[rrama]

Description

Milestone 3 (part 2 of 2) of migrating snyk-eclipse-plugin's S3 publishing off static AWS keys onto CircleCI OIDC (IDE-2483). Stacked on #463 (the stable-release workflow scaffold).

⚠️ DO NOT MERGE yet

This must wait until #463 is merged to main. build-sign-stable has already been proven to succeed under a real manual pipeline trigger with no approval gate (verified directly, not just tested on a throwaway branch — see #463's description), so the only remaining gate here is #463 actually merging.

What this adds

• New publish-stable job: assumes the snyk-assets-eclipse-writer IAM role via CircleCI OIDC, creates the GitHub release (tagging the commit as a side effect, with the update-site ZIP asset), and uploads the signed p2 repository to s3://snyk-assets/eclipse/stable/. Safe to retry (skips if the release already exists), so a partial failure can just be re-run on the same commit.
• Wires publish-stable into the stable-release workflow ci: add stable-release workflow scaffold on CircleCI OIDC [IDE-2483] #463 added, requiring only build-sign-stable — no separate approval gate (the manual pipeline trigger itself is the deliberate act).
• DRY refactor: extracts the duplicated "Verify OIDC identity" step (previously copy-pasted in both publish-preview and publish-stable) into a shared commands: verify-oidc-identity: block.
• Renames .github/workflows/release.yml → release-legacy.yml, kept fully functional as a manual fallback (still using the static AWS keys) until milestone 4 deletes it, once CircleCI's stable-release path has cut a real release successfully.
• Rewrites RELEASE.md's trigger step to describe the CircleCI UI flow (deliberately UI-only, never the API — a documented discipline choice, not a technical restriction, so a stable release is always a deliberate human action).
• Adds docs/release.md documenting why the two pipelines (CICD and stable-release) are fully independent — no shared jobs, requires-chain, or workspace.

Context status

publish-stable's context: snyk-eclipse-plugin-github-release now exists (ProdSec created it directly) and has a real GITHUB_TOKEN set. circleci-infra PR #66 formally defines it in Terraform, still blocked on an unrelated state-drift fix in circleci-infra PR #67 — but that's now approved and doesn't block this PR's own testing, since the context already exists on the CircleCI side regardless of Terraform catching up.

Final PR in the stack

#465 (draft, stacked on this one) deletes the GitHub Actions fallback and moves the shared upload script once this PR's path is proven working — see that PR for the full decommissioning runbook.

Checklist

• Read and understood the Code of Conduct and Contributing Guidelines.
• Tests added and all succeed — N/A, CI-config-only change; real verification is blocked on ci: add stable-release workflow scaffold on CircleCI OIDC [IDE-2483] #463 merging + the github-release context, tracked above
• Linted
• CHANGELOG.md updated
• README.md updated, if user-facing

Screenshots / GIFs

N/A — CI config change.

🤖 Generated with Claude Code

PR Stack — Merge Order

flowchart LR
    main(["main"])
    PR1["#460 build-sign\nCircleCI signing"]
    PR2["#462 publish-preview\nCircleCI OIDC publish"]
    PR3["#463 stable-release scaffold\nworkflow + build-sign-stable"]
    PR4["#464 publish-stable ← YOU ARE HERE\nOIDC publish, DO NOT MERGE yet"]
    PR5["#465 remove legacy workflow\nDO NOT MERGE yet"]
    main --> PR1 --> PR2 --> PR3 --> PR4 --> PR5
    style PR4 fill:#ffd700,color:#000

Loading

Depends on: #463

---

Note

Medium Risk
Changes production release mechanics (GitHub tagging, S3 stable channel, OIDC role assumption); mitigated by manual trigger gate and idempotent release step, but not yet proven in a real release.

Overview
Adds a manual stable-release path on CircleCI (OIDC to snyk-assets-eclipse-writer): new publish-stable job creates a timestamped GitHub release/tag with the update-site ZIP, uploads the p2 repo to S3 stable, and is wired into the stable-release workflow after build-sign-stable with the snyk-eclipse-plugin-github-release context.

CI hygiene: shared verify-oidc-identity command replaces duplicated OIDC checks in preview publish; build-sign now persists update-site/target/*.zip for release assets; GitHub CLI orb supports gh release create with idempotent skip on retry.

Docs / fallback: RELEASE.md points releases at CircleCI (run_stable_release=true) instead of GHA; new docs/release.md explains preview vs stable pipelines; .github/workflows/release.yml is renamed to Release (Legacy) as a manual fallback until CircleCI is proven.

^{Reviewed by Cursor Bugbot for commit ffec5ab. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d4a9b89. Configure here.}

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 6 relevant code sections from 6 files (average relevance: 0.59) pom.xml (lines 1-175) CHANGELOG.md (lines 1-4) CONTRIBUTING.md (lines 1-95) README.md (lines 1-42) docs/release.md (lines 1-52) RELEASE.md (lines 1-92)

🤖 Repository instructions applied (from AGENTS.md)