Strengthening the Release Process for Quarkiverse and SmallRye

[giscus[bot]]

Strengthening the Release Process for Quarkiverse and SmallRye

Quarkus: Supersonic Subatomic Java

https://quarkus.io/blog/quarkiverse-and-smallrye-new-release-process/

[emmanuelbernard]

Nice, do you have pointers to the attestation of the artifacts downloaded. This point made me curious :)

[cescoffier]

@emmanuelbernard Sorry for the delay.

• Github documentation about attestation: https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds
• An example (SmallRye Stork release) - https://github.com/smallrye/smallrye-stork/actions/runs/11663551461
• The verification (in the smallrye release repository) - https://github.com/smallrye/smallrye-release/actions/runs/11663574533/job/32472279261 (expand the attestation verification step)