TODO: : release-build configuration

July 30, 2026 · View on GitHub

This file is a placeholder ahead of the release-management skill family landing. None of the release-* skills exist yet, see docs/release-management/README.md. The values below are what release-rc-cut and release-verify-rc will read.

Per-project build invocation, expected artefact set, digest selection, and license-verification configuration. Adopters copy this file into their own <project-config>/release-build.md and fill every TODO with their project's equivalents.

Build invocation

TODO: name the canonical build command that produces the source artefact (and any convenience binary artefacts the project publishes). For Maven projects this is typically mvn -Papache-release clean install; for Python projects a combination of python -m build and twine; for Cargo projects cargo package --list; etc.

Example shape:

# From the release branch tip, at the release tag:
mvn -Papache-release clean install

Expected artefact list

TODO: list the artefacts the build invocation produces and the release ships. Each entry: filename pattern, content type, whether it is the canonical source artefact or a convenience binary.

Example shape:

  • apache-<project>-<version>-source-release.zip, canonical source artefact (required, signed, checksummed).
  • apache-<project>-<version>-bin.tar.gz, convenience binary (optional, signed, checksummed).

The canonical source artefact is the one the [VOTE] thread votes on. Convenience binaries do not vote, but ship under the same signature regime.

Digest set

TODO: list which digests the project publishes alongside each artefact. ASF baseline is sha512; many projects also publish sha256 for older downstream tools. md5 is no longer accepted per ASF infrastructure guidance.

Example shape:

  • sha512, required.
  • sha256, published for downstream-tool compatibility.

Binary-exclude list

TODO: configure release-verify-rc Step 6's prohibited-binary check.

The skill always scans a fixed baseline: .class, .jar, .so, .dylib, .dll, .exe, .pyc, and __pycache__ directories. List here:

  1. Additional prohibited globs the source artefact must also not contain (appended to the Step 6 find beyond the baseline).
  2. Known-accepted exceptions — specific paths that match a prohibited pattern but must ship; Step 6 classifies those as EXPECTED-BINARY rather than PROHIBITED-BINARY.

Example shape:

  • assets/vendor/**/*.min.js — additional prohibited glob (vendored minified JS; flagged on every source-release verification).
  • third-party/some-native.so — known-accepted exception (ships with a documented source counterpart).

Apache RAT configuration

TODO: point at the project's Apache RAT configuration. RAT checks every source file carries the required license header.

Example shape:

  • RAT plugin config: pom.xml § rat-maven-plugin.
  • RAT excludes file: rat-excludes.txt.

release-verify-rc runs RAT against the unpacked source artefact and reports any file with a missing or wrong header. Project- specific excludes belong in the RAT-excludes file, not in this configuration; this file documents where the excludes live so the agent can resolve them.