[rrama]

Description

Milestone 3 (part 2 of 2) of migrating snyk-eclipse-plugin's S3 publishing off static AWS keys onto CircleCI OIDC (IDE-2483). Stacked on #463 (the stable-release workflow scaffold).

Replaces #464, which was merged by mistake (mis-click, unrelated to this PR's content — see #463's comment thread) and whose head branch GitHub auto-deleted on merge, so it can't be reopened. Same content, same commits.

What this adds

• New publish-stable job: assumes the snyk-assets-eclipse-writer IAM role via CircleCI OIDC, creates the GitHub release (tagging the commit as a side effect, with the update-site ZIP asset), and uploads the signed p2 repository to s3://snyk-assets/eclipse/stable/. Safe to retry (skips if the release already exists), so a partial failure can just be re-run on the same commit. gh release create --target "$CIRCLE_SHA1" pins the tag to the commit CircleCI actually built — the legacy workflow's git tag (no argument, so it only lists tags) plus gh release create without --target meant a hotfix release run from hotfix/* got tagged against main's HEAD instead of the commit it signed.
• Wires publish-stable into the stable-release workflow ci: add stable-release workflow scaffold on CircleCI OIDC [IDE-2483] #463 added, requiring only build-sign-stable — no separate approval gate (the manual pipeline trigger itself is the deliberate act).
• DRY refactor: extracts the duplicated "Verify OIDC identity" step (previously copy-pasted in both publish-preview and publish-stable) into a shared commands: verify-oidc-identity: block.
• Renames .github/workflows/release.yml → release-legacy.yml, kept fully functional as a manual fallback (still using the static AWS keys) until milestone 4 deletes it, once CircleCI's stable-release path has cut a real release successfully.
• Rewrites RELEASE.md's trigger step to describe the CircleCI UI flow (deliberately UI-only, never the API — a documented discipline choice, not a technical restriction, so a stable release is always a deliberate human action).
• Adds docs/release.md documenting why the two pipelines (CICD and stable-release) are fully independent — no shared jobs, requires-chain, or workspace.

Context status

publish-stable's context: snyk-eclipse-plugin-github-release now exists (ProdSec created it directly) and has a real GITHUB_TOKEN set. circleci-infra PR #66 formally defines it in Terraform.

Merge gate — resolved

#463 merged the stable-release scaffold and ran once for real, but that run predated the security-scans-stable context rename (endpoint-experience → developer-agentic-experience_endpoint-experience). A manual run_stable_release=true trigger on main has now re-verified the scaffold end-to-end with the renamed context — pipeline #2114, all jobs (test-linux/macos/windows-stable, security-scans-stable, secrets scan, build-sign-stable) green. Ready to merge.

Final PR in the stack

#465 (draft, stacked on this one) deletes the GitHub Actions fallback and moves the shared upload script once this PR's path is proven working with a real stable release — see that PR for the full decommissioning runbook.

Checklist

• Read and understood the Code of Conduct and Contributing Guidelines.
• Tests added and all succeed — N/A, CI-config-only change; real verification done via pipeline #2114 on main, all jobs green
• Linted
• CHANGELOG.md updated
• README.md updated, if user-facing

Screenshots / GIFs

N/A — CI config change.

PR Stack — Merge Order

flowchart LR
    main(["main"])
    PR1["#460 build-sign\nCircleCI signing"]
    PR2["#462 publish-preview\nCircleCI OIDC publish"]
    PR3["#463 stable-release scaffold\nworkflow + build-sign-stable"]
    PR4["publish-stable ← YOU ARE HERE\nreplaces #464, scaffold re-verified on main, ready to merge"]
    PR5["#465 remove legacy workflow\nholding for a real stable release via this PR's path"]
    main --> PR1 --> PR2 --> PR3 --> PR4 --> PR5
    style PR4 fill:#ffd700,color:#000

Loading

Depends on: #463

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes the stable release path (GitHub tagging/releases and S3 publish) and AWS OIDC assumptions; mistakes could ship the wrong commit or channel, though manual trigger and identity checks reduce exposure.

Overview
Adds a publish-stable CircleCI job to the manual stable-release workflow: after OIDC into snyk-assets-eclipse-writer, it creates a GitHub release (timestamp tag via gh, --target $CIRCLE_SHA1, update-site ZIP, idempotent skip on retry) and runs .github/upload-to-s3.sh stable. build-sign now persists update-site/target/*.zip for that asset; shared verify-oidc-identity replaces duplicated checks in preview publish.

Release docs shift from GitHub Actions to CircleCI “Trigger Pipeline” with run_stable_release=true, with release-legacy.yml kept as fallback. New docs/release.md explains preview vs stable pipelines and safeguards.

^{Reviewed by Cursor Bugbot for commit 28e36b0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[rrama]

• ci: delete release-legacy.yml, move upload-to-s3.sh into .circleci/ [IDE-2483] #465
• ci: add publish-stable job with CircleCI OIDC, rename release.yml to legacy fallback [IDE-2483] #468 👈 (View in Graphite)
• ci: add stable-release workflow scaffold on CircleCI OIDC [IDE-2483] #463
• ci: move publish-preview job to CircleCI [IDE-2483] #462
• ci: add build-sign job to CircleCI CICD workflow [IDE-2483] #460
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[nick-y-snyk]

Looks good. Creating the release before the S3 upload, deriving the tag from the commit date, and skipping when the release exists make reruns safe. gh release create with an asset also creates a draft, uploads, then publishes, and it deletes the draft if the upload fails. So a retry won't leave a release without its ZIP.

The description could mention that --target "$CIRCLE_SHA1" fixes a bug in the legacy workflow. Its git tag had no arguments, so it only listed tags, and gh release create without --target tagged the default branch. A hotfix release run from hotfix/* got its tag on main HEAD.

Nits:

• docs/release.md says to trigger from the UI only, never the API. The run_stable_release description in config.yml says "UI or API". Worth making them match.
• The legacy workflow's name points at docs/release.md, which never mentions it. Either add a line there or point the name at RELEASE.md, which has the fallback note.
• The title is missing [IDE-2483].

[rrama]

[AI reply] False positive. CircleCI's persist_to_workspace paths does support glob patterns — it uses Go's Glob/filepath.Match (confirmed by a CircleCI staff reply: https://discuss.circleci.com/t/glob-patterns-document-persist-to-workspace-paths/17442), and the official config reference's own example shows a single-level glob (build/*). update-site/target/*.zip is exactly that pattern — one wildcard segment, no recursive ** (which is the one thing CircleCI's glob implementation doesn't support). No change needed.

[rrama]

The description could mention that --target "$CIRCLE_SHA1" fixes a bug in the legacy workflow. Its git tag had no arguments, so it only listed tags, and gh release create without --target tagged the default branch. A hotfix release run from hotfix/* got its tag on main HEAD.

Description updated.

docs/release.md says to trigger from the UI only, never the API. The run_stable_release description in config.yml says "UI or API". Worth making them match.

It could be triggered from either, but we only want people using the UI. (I don't want AI's running our release pipelines)

The legacy workflow's name points at docs/release.md, which never mentions it. Either add a line there or point the name at RELEASE.md, which has the fallback note.

Updated it.

The title is missing IDE-2483.

🙈 Added.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 6 relevant code sections from 6 files (average relevance: 0.60) CHANGELOG.md (lines 1-4) CONTRIBUTING.md (lines 1-95) README.md (lines 1-42) pom.xml (lines 101-175) docs/release.md (lines 1-52) RELEASE.md (lines 1-86)

🤖 Repository instructions applied (from AGENTS.md)