Re: [MENTORS] Potential issue with GitHub releases

On Sat, 2 May 2026 at 16:35, PJ Fanning <[email protected]> wrote:
>
> I've come across rare exceptions where PMCs have non source GitHub
> release artifacts and I believe that they've got Legal approval. Don't
> ask me which PMCs do this. I am not aware of any Incubator podlings
> that have non source GitHub release artifacts.
> Maybe there is a GitHub API approach to find what apache/* projects in
> GitHub have non source release artifacts.
> Unfortunately, GitHub automatically produces source zips and tar.gzs
> for every git tag - and GitHub releases are based around git tags.

However, these tag artifacts are not automatically flagged as releases.

For example:
https://github.com/apache/commons-lang
has 113 tags with source bundles, but no releases.

> On Sat, 2 May 2026 at 16:18, Dave Fisher <[email protected]> wrote:
> >
> > IIRC GitHub releases are never, ever official ASF releases and should not be made at all. (Releases prior to incubation are ok.)
> >
> > One reason is that until recently they could not be immutable. Repositories may contain binaries and files that are not suitable for inclusion in official ASF source releases
> >
> > If this has changed please provided a reference where LEGAL has approved. If not then perhaps a LEGAL jira should be created asking about conditions around convenience GitHub “Releases”.
> >
> > Best,
> > Dave
> >
> > > On May 2, 2026, at 4:24 AM, Justin Mclean <[email protected]> wrote:
> > >
> > > Hi,
> > >
> > >> The thing about GitHub is it generates zip and tar.gz source archives
> > >> and allows access to them for every git tag and by extension every
> > >> GitHub release (which appears to be primarily just a way to attach
> > >> release notes to a git tag).
> > >
> > > You can also mark a release as a pre-release.
> > >
> > >> Burr doesn't yet have an ASF release so the most recent release was
> > >> added to the GitHub project before the project was migrated to the
> > >> apache group in GitHub.
> > >
> > > They should be tagged as pre-ASF to avoid user confusion.
> > >
> > >> Thee most recent Hamilton release on GitHub is an RC0 and that appears
> > >> to have the LICENSE, NOTICE and DISCLAIMER that I would expect.
> > >
> > > It still needs the incubator disclaimer on the page and be marked as a pre-release.
> > >
> > > Kind Regards,
> > > Justin
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: [email protected]
> > > For additional commands, e-mail: [email protected]
> > >
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: [email protected]
> > For additional commands, e-mail: [email protected]
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
>