Skip to content

docs: add DISCLAIMER-WIP for podling releases - #3141

Merged
Astro-Han merged 4 commits into
apache:mainfrom
Joob1n:docs/add-podling-disclaimer
Aug 18, 2026
Merged

docs: add DISCLAIMER-WIP for podling releases#3141
Astro-Han merged 4 commits into
apache:mainfrom
Joob1n:docs/add-podling-disclaimer

Conversation

@Joob1n

@Joob1n Joob1n commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

Part of #2974 (Phase 3, Add a DISCLAIMER file).

Every podling release artifact has to carry a DISCLAIMER. The -WIP variant is the one the Incubator expects while compliance items are still open: it enumerates what is not yet satisfied rather than asserting a compliance the project does not have yet.

The three known-issue bullets are exactly the remaining blocking entries on the checklist — license headers, NOTICE rework, grant/ICLAs — so this file and the issue stay in step. The intent is that each is struck from here as it lands, and the file is renamed to DISCLAIMER once the list is empty.

One thing to confirm: the Incubator status URL assumes the podling name maka. If PODLINGNAMESEARCH lands somewhere else, this line needs to follow. I left it pointing at the expected path rather than omitting it, since a missing status link is itself a review comment during the release vote — but say the word and I will drop it until the name clears.

Text follows the Incubator's standard DISCLAIMER-WIP wording. No code paths touched; lint and format pass.

@coderabbitai

coderabbitai Bot commented Aug 17, 2026

Copy link
Copy Markdown

Review Change Stack

Warning

Review limit reached

@Joob1n, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 2 minutes

Limit details: You’ve used all 3 included reviews currently available under your plan.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 4ffdc37f-26fe-4178-85fc-a10e0171c3ca

📥 Commits

Reviewing files that changed from the base of the PR and between c948c33 and 316d9a0.

📒 Files selected for processing (2)
  • scripts/verify-packaged-app.mjs
  • scripts/verify-windows-x64.mjs

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 569598f9-0f95-45ee-b4f6-75fa5604007f

📥 Commits

Reviewing files that changed from the base of the PR and between 4264f3f and c948c33.

📒 Files selected for processing (2)
  • apps/desktop/electron-builder.config.mjs
  • scripts/verify-packaged-app.mjs

Included review availability: Your plan includes up to 3 reviews per rolling hour; 1 remains after this review.


📝 Walkthrough

Summary

  • Adds DISCLAIMER-WIP with the Apache Incubator Work in Progress Disclaimer template.
  • Lists the remaining compliance work:
    • Add license headers.
    • Rework NOTICE.
    • Complete grants and ICLAs.
  • Packages the disclaimer at licenses/maka/DISCLAIMER-WIP.
  • Verifies that the packaged application contains the disclaimer.
  • Does not change runtime code or public entities.

Source of truth and scope

This change extends the existing release-artifact compliance process. It does not create a parallel runtime path.

The change is the smallest coherent solution. It adds the required document, packages it with desktop releases, and adds one corresponding packaging check. The file should become DISCLAIMER after the listed compliance work is complete.

Deletions and simplification

No code or test can be deleted or simplified without weakening packaging coverage. The packaging assertion protects against release artifacts that omit the disclaimer.

Risks and validation

  • Incorrect disclaimer wording, project name, status URL, or compliance status could affect release compliance.
  • The disclaimer text matches the published Apache Incubator template.
  • The three project-specific compliance items are accurate.
  • The Maka Incubator status URL resolves.
  • Desktop packaging now includes DISCLAIMER-WIP, and the packaged-resource check requires it.
  • Required check results remain unverified without direct check results.

Complexity delta

  • Adds one compliance document authority, one packaged-resource entry, one packaging assertion, and one release-artifact state: DISCLAIMER-WIP is present.
  • Adds no runtime branches, public API surface, security state, or governance process.
  • Adds a small test-maintenance burden because the packaging assertion must remain aligned with the resource path.
  • Removes the release-artifact gap where desktop binaries could include LICENSE and NOTICE without DISCLAIMER-WIP.
  • Total maintenance complexity stays justified because the added configuration and validation directly enforce the required release artifact.

Review-relevant risks

  • The diff affects licensing, release artifacts, and Apache Incubator governance. Material changes in these areas require independent human review under repository policy.
  • The diff changes desktop package contents and packaging validation. Material release changes require independent human review under repository policy.
  • No effect on runtime behavior, security, or public API contracts was identified in the current diff.
  • Required checks remain unverified without direct evidence.
  • The person performing the merge reviews the final diff. A maintainer makes the final determination.

Walkthrough

Added an Apache Incubator disclaimer that describes Maka’s incubation status, ASF compliance gaps, pending grants and ICLAs, licensing review requirements, and the project status URL. Packaged applications now include and verify the disclaimer.

Changes

Incubator disclaimer

Layer / File(s) Summary
Add incubation and licensing disclaimer
DISCLAIMER-WIP
Adds Apache Incubator status information, licensing and NOTICE file disclosures, pending software grants and ICLAs, licensing review requirements, and the project status URL.
Package and verify the disclaimer
apps/desktop/electron-builder.config.mjs, scripts/verify-packaged-app.mjs
Packages DISCLAIMER-WIP at licenses/maka/DISCLAIMER-WIP and requires that path during packaged-resource verification.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to c948c

The PR adds release-disclaimer documentation, and no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: liugddx, zhiiw

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Ai Use Disclosure ⚠️ Warning The PR description selects neither AI-use declaration, while an introduced commit has Generated-by: Claude Code; the tool is not disclosed in the description. Select one declaration and, if generative tooling made a substantive contribution, name Claude Code and its scope. Add consistent trailers to affected commits and preserve them through squash or amend; see “Human ownership and AI attribu...
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies the main change: adding a DISCLAIMER-WIP file for podling releases.
Description check ✅ Passed The description clearly explains the purpose, compliance issues, implementation, and verification, but it omits the required AI use and checklist selections.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds an Apache Incubator–style DISCLAIMER-WIP file at the repository root so podling release artifacts can carry the required disclaimer while compliance items remain open (per #2974 Phase 3).

Changes:

  • Introduces a DISCLAIMER-WIP file using standard Incubator disclaimer language.
  • Enumerates the current known blocking compliance items (license headers, NOTICE rework, grant/ICLAs).
  • Links to the podling status page on the Incubator site.
Suppressed comments (1)

DISCLAIMER-WIP:23

  • The file currently ends with an extra whitespace-only line. Removing it avoids trailing whitespace in the repository.
https://incubator.apache.org/projects/maka.html


💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread DISCLAIMER-WIP Outdated

@likun666661 likun666661 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The file should be synchronized with the current Work In Progress Disclaimer in the Incubator policy before merge. The policy currently uses at The Apache Software Foundation, decision-making process, and What follows is a list of issues ... (this list is likely to be incomplete), while this file uses different wording in each place. The policy also says a different disclaimer message requires IPMC approval, so copying the current template verbatim avoids a release-vote blocker. The previously resolved thread cites the same page, but the live page currently shows the hyphenated WIP wording: https://incubator.apache.org/policy/incubation.html#work-in-progress-disclaimer. The Maka status URL itself is now live and correct.

@hqhq1025
hqhq1025 requested a lite review from Copilot August 17, 2026 07:30
@Joob1n

Joob1n commented Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

You are right, and my earlier reply on the hyphenation thread was wrong. I verified against the standard podling disclaimer and did not notice the policy publishes the Work In Progress Disclaimer separately, with its own wording. Checking a template other than the one the file is named after is exactly the mistake to catch here — thanks for the pointer to the anchor.

0e71ed4f replaces the text with the WIP template copied verbatim. All three differences you named are in it:

  • at The Apache Software Foundation (ASF)
  • decision-making process
  • What follows is a list of issues the project is currently aware of (this list is likely to be incomplete):

Only the three known-issue bullets are ours; everything else is byte-for-byte the published template, which I diffed rather than eyeballed. That also settles the point about needing Incubator PMC approval for a different message — there is no longer anything different to approve.

Good to hear the status URL resolves. That was the one open question in the description, so it can be treated as closed.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

DISCLAIMER-WIP:4

  • The Incubator policy/template text uses “decision making process” (no hyphen). Keeping this line verbatim avoids release-vote nits and also matches the prior resolution in the existing review thread.
infrastructure, communications, and decision-making process have stabilized in

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (2)

DISCLAIMER-WIP:4

  • The standard Incubator DISCLAIMER(-WIP) wording uses “decision making process” (no hyphen). Keeping this line verbatim with the template helps avoid release-vote nits and aligns with the Incubator policy text.
infrastructure, communications, and decision-making process have stabilized in a

DISCLAIMER-WIP:10

  • “un-reviewed” is nonstandard in ASF templates (typically “unreviewed”). Aligning spelling here reduces the chance of downstream compliance/style feedback during the vote.
policy. For example, releases may have incomplete or un-reviewed licensing

@Joob1n
Joob1n requested a review from likun666661 August 17, 2026 07:53
@Astro-Han

Copy link
Copy Markdown
Contributor

Thanks for the file — I verified it against the live Incubator policy and the issue state, and the file itself is correct. A few notes to help close the review:

On the open CHANGES_REQUESTED (wording sync): I diffed the file against the current policy text at incubator.apache.org/policy/incubation.html (Work In Progress Disclaimer section). The current wording in this PR — "at The Apache Software Foundation", "decision-making process" (hyphenated), "What follows is a list of issues the project is currently aware of (this list is likely to be incomplete)" — matches the live policy verbatim. (The unhyphenated "decision making process" lives in older files like incubator-xtable's DISCLAIMER, but the live policy page is the authoritative template.) So the current wording direction looks right; the request may have been based on the older template.

The three known-issue bullets check out against #2974's actual state: no source file in apps/, packages/, maka-eval/, scripts/ carries an ASF license header (grep = 0 hits); NOTICE is still "Copyright 2026 The Maka Authors" (not ASF form); and the grant/ICLAs items are unchecked. No blocking item is missing or wrongly listed.

The status URL concern is moothttps://incubator.apache.org/projects/maka.html is live (HTTP 200, "Apache Maka Project Incubation Status", podling registered 2026-08-13 with resource="maka"), so the maka name assumption already holds. The PR description's caveat about PODLINGNAMESEARCH will read stale after squash-merge (P3, cosmetic).

One real gap (P2, actionable or deferrable): desktop binary releases won't carry the DISCLAIMER-WIP. apps/desktop/electron-builder.config.mjs:46-47,66-67 explicitly ships LICENSE and NOTICE into the installer via extraResources, but there is no DISCLAIMER entry — a binary artifact would land in an IPMC release vote missing a required file. Either add one line to extraResources ('../../DISCLAIMER-WIP'licenses/maka/DISCLAIMER-WIP), or explicitly record the deferral (first Apache release is 1-3 months out per #2974, source releases via git archive are unaffected, and current desktop releases don't claim Apache identity — all reasonable grounds). Please just make the choice explicit in the PR.


AI-assisted review disclosure: this review was produced with AI assistance (pi review subagent on ollama-cloud/deepseek-v4-flash). The subagent fetched the live Incubator policy and podlings.xml, compared wording verbatim, scanned the repo for license headers, and cross-checked #2974's checklist. The P2 (electron-builder wiring) is from static config inspection, not a built artifact. Please weigh these findings with your own judgment.

中文摘要(AI 辅助审查)

结论:PASS(1 个 P2,可接线或显式延后)。文件本体正确:(1) 关于 likun666661 的 CHANGES_REQUESTED(措辞与 policy 同步)——逐字比对实时政策页(incubator.apache.org/policy/incubation.html 的 Work In Progress Disclaimer 段),本 PR 的 "at The Apache Software Foundation"、"decision-making process"(带连字符)、"What follows is a list of issues..." 与实时模板 verbatim 一致(无连字符版本是 xtable 等旧文件,实时政策页才是权威)——当前措辞方向正确,request 可能基于旧模板;(2) 三个已知项全部属实(全仓源码无 ASF license header(grep 0 命中)、NOTICE 仍是 "Copyright 2026 The Maka Authors"、grant/ICLAs 未勾选),无遗漏/无误列;(3) status URL 已上线(podling maka 已注册 2026-08-13),PR 描述中 PODLINGNAMESEARCH 顾虑已过时(P3)。唯一实质缺口(P2):electron-builder.config.mjs 的 extraResources 显式打包 LICENSE/NOTICE 但没有 DISCLAIMER-WIP——二进制发布物会缺必需文件,建议补一行接线或显式记录延后理由(首个 Apache 发布尚在 1-3 个月后、源码发布不受影响、当前桌面发布非 Apache 渠道)。

Comment thread DISCLAIMER-WIP
Joob1n added 3 commits August 18, 2026 13:12
Part of apache#2974. Every podling release artifact must carry a DISCLAIMER, and
the WIP variant is what the Incubator expects while known compliance items
are still open — it names them instead of asserting a compliance the project
does not yet have.

The three listed items are the remaining blocking entries from that issue
(license headers, NOTICE rework, grant and ICLAs), so this file and the
checklist stay in step. Each should be struck from here as it lands, and the
file renamed to DISCLAIMER once the list is empty.

The Incubator status URL assumes the podling name `maka`; it needs updating
if PODLINGNAMESEARCH lands on a different one.

Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J
The file used the standard podling disclaimer's wording under a WIP filename.
The Incubator publishes the two separately and they differ: "at The Apache
Software Foundation", "decision-making process" hyphenated, and "a list of
issues the project is currently aware of (this list is likely to be
incomplete)".

Since the policy requires Incubator PMC approval for any disclaimer that is
not the published template, matching it verbatim is what keeps this off the
release-vote agenda. Only the known-issues list is ours.

Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J
The template's sponsor field is a placeholder for the sponsoring TLP. A podling
entering through the Incubator itself fills it with "the Apache Incubator PMC" —
graphar, devlake and seata all word it that way. The file said "the Apache
Incubator", which names the project rather than the body that sponsors it.

Re-wrapped to 80 columns after the substitution. The prose is still byte-for-byte
the published Work In Progress Disclaimer once the placeholders and the
known-issues list are substituted; verified against the policy page's markup
rather than a rendering of it.

Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J
@Joob1n
Joob1n force-pushed the docs/add-podling-disclaimer branch from 4264f3f to c948c33 Compare August 18, 2026 05:44
@Joob1n

Joob1n commented Aug 18, 2026

Copy link
Copy Markdown
Contributor Author

Both addressed. Rebased onto main as well.

[P1] The disclaimer was not reaching the release artifacts. Correct, and the more important of the two — a DISCLAIMER-WIP that only exists at the repository root does not satisfy the policy, which is about the release archive. Added the extraResources mapping next to LICENSE and NOTICE, and added licenses/maka/DISCLAIMER-WIP to the required list in assertPackagedResources, so the macOS and Windows verifiers both fail if it ever stops being packaged.

Verified rather than assumed: built the macOS arm64 app, confirmed Contents/Resources/licenses/maka/DISCLAIMER-WIP is present alongside LICENSE and NOTICE, then ran assertPackagedResources against the built Resources tree three times — passes as built, fails with ENOENT ... licenses/maka/DISCLAIMER-WIP when the file is moved away, passes again when restored.

Wording. Already matches the current Work In Progress Disclaimer verbatim on this head; the earlier round fixed it after you pointed out I had been checking against the Standard Disclaimer. Re-verified against the live policy page just now: it carries both templates, and the strings differ exactly where you said — decision making process in the standard one, decision-making process in the WIP one. This file uses the WIP form, at The Apache Software Foundation, and What follows is a list of issues the project is currently aware of (this list is likely to be incomplete).

Not run locally: the Windows packaging path. It goes through the same assertPackagedResources list, so the new requirement covers it, but I have only executed the macOS verifier.

Incubator policy requires every release archive to carry a DISCLAIMER or
DISCLAIMER-WIP. Adding the file at the repository root did not reach the
packaged app: electron-builder copies LICENSE and NOTICE into licenses/maka
and nothing else, so the DMG, the ZIP and the Windows installer all shipped
without it.

Map it alongside LICENSE and NOTICE, and require it in
assertPackagedResources so both the macOS and Windows verifiers fail if it
ever stops being packaged.

Generated-by: Claude Code
@Joob1n
Joob1n force-pushed the docs/add-podling-disclaimer branch from c948c33 to 316d9a0 Compare August 18, 2026 06:04
@Joob1n

Joob1n commented Aug 18, 2026

Copy link
Copy Markdown
Contributor Author

CI caught a real problem with the first attempt, fixed in the amended commit.

Requiring licenses/maka/DISCLAIMER-WIP unconditionally broke the Windows upgrade-lifecycle check: it installs the previously released 0.1.9 build and runs the same assertPackagedResources over it, and that release predates the file. Failing there would have been the verifier complaining that an old release is not a new one.

assertPackagedResources now takes requireDisclaimer, and verify-windows-x64.mjs derives it the same way it already derives requireWindowsSandboxexpectedVersion === undefined, i.e. required of a build from this tree, not of a baseline install. That seam already existed for exactly this class of problem; the disclaimer just follows it.

This was not reachable locally — I do not have the 0.1.9 Windows installer — so it is a genuine catch by the pipeline rather than something I skipped.

@Astro-Han

Copy link
Copy Markdown
Contributor

Confirmed — all addressed: the DISCLAIMER-WIP now ships via electron-builder.config.mjs extraResources (reaches DMG/ZIP/Windows installer), verify-packaged-app.mjs requires it (with the upgrade-lifecycle exemption so previously-correct releases don't fail), and the Windows path got the same wiring. The file text matches the Incubator standard wording (verified against the live policy page), and the three known-issue bullets track the remaining checklist blockers exactly. Good to merge.

AI-assisted review disclosure: this review was produced with AI assistance; the human contributor reviewed the final diff and the Incubator wording. Please weigh these findings with your own judgment.

@Astro-Han
Astro-Han dismissed likun666661’s stale review August 18, 2026 08:23

Both concerns addressed by the author in later commits: wording now matches the Incubator WIP policy verbatim (verified against incubator.apache.org/policy/incubation.html#work-in-progress-disclaimer), and the DISCLAIMER-WIP packaging + verifier wiring was added (8/18). Dismissing as resolved.

@Astro-Han
Astro-Han merged commit 49f8675 into apache:main Aug 18, 2026
14 checks passed
@hqhq1025

Copy link
Copy Markdown
Contributor

合并后复盘补充:DISCLAIMER-WIP 正文、三条 known issues,以及 Desktop 的 DMG/ZIP/Windows installer 接线都已正确;但 merge 时 main 刚加入了真实 npm CLI 发布链,当前合并结果遗漏了这个发布面,需要跟进修复。

P1:npm CLI tarball 不包含 DISCLAIMER-WIP

当前 main:

  • scripts/release-cli-package.mjs:444-452 只复制 README、LICENSE、NOTICE、THIRD_PARTY_NOTICES;
  • 同文件 :492 的 npm files 白名单也没有 DISCLAIMER-WIP;
  • .github/workflows/release-cli-stage.yml:112-120 会把该 tarball 提交到 npm staging;
  • .github/workflows/cli-package-validation.yml:6-30,34-58 的 path filter 也遗漏了 DISCLAIMER-WIP,所以仅修改免责声明不会触发 CLI package validation。

因此从当前 revision 构建的下一版 CLI 包会缺免责声明。Apache Incubator policy 要求 podling 的 releases/documentation 携带 incubating disclaimer,并建议 release 中的 DISCLAIMER-WIP 与 LICENSE/NOTICE 同置。

建议补一个小 PR:

  1. copyReleaseDocuments() 复制根目录 DISCLAIMER-WIP
  2. npm manifest files 和 staging required-files assertion 加入它;
  3. CLI package validation 的 PR/push paths 加入 DISCLAIMER-WIP
  4. 对最终 npm pack tarball 断言文件存在。

这是合并后父线新增 CLI release surface 才显现的遗漏,不否定本 PR 对 Desktop 发布物的修复;但在下一个 podling CLI release 前必须补齐。

@Joob1n

Joob1n commented Aug 18, 2026

Copy link
Copy Markdown
Contributor Author

@hqhq1025 — the CLI-tarball gap is fixed in #3220, covering the four seams you listed: the staging copy, the npm files whitelist plus the staging and packed-files assertions, the validation workflow's path filters, and an installed-package check in the offline smoke. Verified by building the tarball under the pinned toolchain (it carries package/DISCLAIMER-WIP), running the offline install smoke, and a mutation check — reverting only the copy line makes packaging refuse with Required release file is missing: DISCLAIMER-WIP.

Astro-Han pushed a commit that referenced this pull request Aug 18, 2026
Apache Incubator policy requires podling releases to carry the
incubating disclaimer, and #3141 wired it into every desktop artifact —
but the npm CLI publication chain landed on main in parallel, so the
next CLI tarball would have shipped without it. The staging copy step
now places DISCLAIMER-WIP next to LICENSE/NOTICE, the npm files
whitelist and the staging/packed-files assertions require it, the
installed-package smoke checks it end to end, and the CLI package
validation workflow triggers on changes to the disclaimer itself.

Reported by @hqhq1025 in the #3141 post-merge review.

Generated-by: Claude Code
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants