Update CI for better separation of concerns

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: ctrueden

.github/melt.sh

@@ -12,8 +12,8 @@ datestamp="$(TZ=UTC date +'%Y-%m-%d %H:%M:%S UTC')"
 message="$1 ($datestamp)"
 shift
 
-git config --global user.name github-actions
-git config --global user.email github-actions@github.com
+git config --global user.name "SciJava CI"
+git config --global user.email ci@scijava.org
 
 dest_dir=site-publish
 
@@ -36,5 +36,13 @@ then
 else
   echo "== Committing changes =="
   git commit -m "$message"
-  git push
+  # Retry against concurrent publishers (the build and status workflows both
+  # push here), rebasing onto whatever landed in between.
+  n=0
+  until git push
+  do
+    n=$((n + 1))
+    test "$n" -lt 5 || { echo "push failed after $n attempts" >&2; exit 1; }
+    git pull --rebase
+  done
 fi

.github/publish.sh

@@ -1,23 +1,27 @@
 #!/bin/sh
-uv tool install "git+https://github.com/scijava/pombast.git"
+# CI orchestrator for the status dashboard: fetch the most recently published
+# smelt.json, regenerate the status/badges/team reports from it, and publish
+# them to status.scijava.org. The report generation itself lives in
+# bin/report.sh so it can be run outside CI too.
+set -e
 
 # Pull the most recently published smelt results so that `pombast status` can
 # classify each available version bump by its bytecode-floor blast radius
 # (flat / local / cascading / excluded). Read straight from the gh-pages branch
 # rather than https://status.scijava.org/, so we pick up a freshly committed
 # smelt.json immediately instead of waiting on the asynchronous Pages deploy.
 #
-# Best-effort: if smelt.json is not published yet (or the fetch fails), status
-# still runs -- just without the bytecode classification overlay.
-smelt_arg=""
+# Best-effort: if smelt.json is not published yet (or the fetch fails),
+# bin/report.sh still generates the reports -- just without the classification.
 smelt_url=https://raw.githubusercontent.com/scijava/status.scijava.org/gh-pages/smelt.json
-if curl -fsSLO "$smelt_url"; then
-  smelt_arg="--smelt smelt.json"
-else
+mkdir -p target/pombast
+curl -fsSL -o target/pombast/smelt.json "$smelt_url" ||
   echo "== smelt.json unavailable; running status without classification =="
-fi
 
-pombast status $smelt_arg .
-pombast badges -o badges.json .
-pombast team .
-.github/publish.sh "Update status reports" index.html badges.json team.html
+bin/report.sh
+
+.github/publish.sh "Update status reports" \
+  target/pombast/index.html \
+  target/pombast/badges.json \
+  target/pombast/team.html \
+  target/pombast/team.json

.github/status.sh

@@ -11,6 +11,11 @@ on:
     # Run weekly on Sunday to keep the Maven cache alive.
     - cron: '4 5 * * 0'
 
+# Queue runs of the same ref; cancel superseded PR builds (they never publish).
+concurrency:
+  group: build-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -63,8 +68,8 @@ jobs:
             ~/.cache/jgo
           key: ${{ runner.os }}-pombast-build
 
-      - name: Run pombast melt+smelt commands
-        run: .github/melt.sh
+      - name: Run pombast checks (melt + smelt)
+        run: bin/check.sh
         shell: bash
 
       - name: Delete old pombast cache
@@ -86,5 +91,5 @@ jobs:
 
       - name: Publish smelt results
         if: always() && github.ref == 'refs/heads/master' && github.event_name == 'push'
-        run: .github/publish.sh "Update smelt results" smelt.json
+        run: .github/publish.sh "Update smelt results" target/pombast/smelt.json
         shell: bash

.github/workflows/build.yml

@@ -12,6 +12,12 @@ on:
     workflows: [build]
     types: [completed]
 
+# Serialize status runs (daily cron + each build completion) so two never push
+# to the status.scijava.org gh-pages branch at the same time.
+concurrency:
+  group: status-publish
+  cancel-in-progress: false
+
 jobs:
   status:
     runs-on: ubuntu-latest

.github/workflows/status.yml

@@ -0,0 +1,22 @@
+#!/bin/sh
+# Validate a Maven BOM's managed components against each other:
+#
+#   melt  -- mega-melt classpath check (duplicate classes, SNAPSHOTs, enforcer)
+#   smelt -- per-component build + test against the BOM-pinned dependency set
+#
+# Both phases always run, so a failure in one (e.g. duplicate classes in melt)
+# never hides real incompatibilities surfaced by the other. The script exits
+# non-zero if either phase found a problem.
+#
+# Run from a BOM checkout (e.g. a pom-scijava working copy):
+#
+#   bin/check.sh
+#
+# Outputs land under target/pombast/ (see pombast.toml).
+command -v pombast >/dev/null 2>&1 ||
+  uv tool install "git+https://github.com/scijava/pombast.git"
+
+rc=0
+pombast melt  || rc=$?
+pombast smelt || rc=$?
+exit $rc

bin/check.sh

@@ -0,0 +1,24 @@
+#!/bin/sh
+# Generate the status, badges, and team reports for a Maven BOM, writing them
+# under target/pombast/ (see pombast.toml).
+#
+# Run from a BOM checkout (e.g. a pom-scijava working copy):
+#
+#   bin/report.sh
+#
+# The status report overlays binary/source compatibility info from
+# target/pombast/smelt.json when present. Run bin/check.sh first, or drop a
+# published smelt.json into target/pombast/, to populate it; without it, the
+# reports are still generated, just without the bytecode classification.
+command -v pombast >/dev/null 2>&1 ||
+  uv tool install "git+https://github.com/scijava/pombast.git"
+
+smelt=target/pombast/smelt.json
+if [ -f "$smelt" ]; then
+  pombast status --smelt "$smelt"
+else
+  echo "== $smelt not found; generating status without bytecode classification =="
+  pombast status
+fi
+pombast badges
+pombast team

bin/report.sh

@@ -3,8 +3,7 @@ default-java-version = 8
 repositories = ["scijava.public=https://maven.scijava.org/content/groups/public"]
 
 [status]
-output = "../status.scijava.org/index.html"
-smelt = "../status.scijava.org/smelt.json"
+output = "target/pombast/index.html"
 rules = "rules.xml"
 header = "pombast/header-status.html"
 footer = "pombast/footer-status.html"
@@ -26,7 +25,7 @@ cuttable = [
 ]
 
 [team]
-output = "../status.scijava.org/team.html"
+output = "target/pombast/team.html"
 header = "pombast/header-team.html"
 footer = "pombast/footer-team.html"
 includes = [
@@ -46,7 +45,7 @@ includes = [
 ]
 
 [badges]
-output = "../status.scijava.org/badges.json"
+output = "target/pombast/badges.json"
 includes = [
   "de.nanoimaging:*",
   "fr.inra.ijpb:*",
@@ -115,7 +114,7 @@ excludes = [
 ]
 
 [smelt]
-output = "../status.scijava.org/smelt.json"
+output = "target/pombast/smelt.json"
 includes = [
   "de.nanoimaging:*",
   "fr.inra.ijpb:*",