## Summary
Java publishing has failed since `v0.42.0-beta.10` because the `lancedb`
Sonatype org hit Maven Central's monthly release-count limit:
```text
Publishing blocked: your organization has reached its monthly release count limit. Grace period ended 2026-11-08. Usage resets 2026-12-01.
```
This sends beta tags to `https://maven.fury.io/lancedb/` instead,
matching how Python publishes betas to `pypi.fury.io/lancedb`. Stable
releases still go to Maven Central.
```text
tag contains "beta" -> setup-java server "fury" -> mvn deploy -P deploy-to-fury
otherwise -> setup-java server "ossrh" -> mvn deploy -P deploy-to-ossrh
```
- `java/pom.xml`: new `deploy-to-fury` profile that points
`distributionManagement` at Fury.
- `java/README.md`: explains how to add the Fury and `maven.lance.org`
repositories to use a beta.
Requires a `FURY_TOKEN` secret with push access to the `lancedb` Fury
account. The token is passed as the Maven username with a placeholder
password. That follows Gemfury's convention but hasn't been tested
against Fury yet.
## Evidence
Running the beta path locally (`deploy -pl lancedb-core -am -P
deploy-to-fury`) against a file repository deployed `lancedb-parent`
(POM) and `lancedb-core` (JAR, POM, sources, javadoc).
`help:effective-pom -P deploy-to-fury` resolves the release repository
to `https://maven.fury.io/lancedb/`.
## Merge Risk
**Door:** Two-way. This only changes where future betas are published;
reverting the workflow restores Central publishing.
**Blast Radius:** `release-ci`. Beta consumers need the extra
repository; stable consumers are unaffected.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Fixes#3299
## Problem
Two security issues exist in `.github/workflows/java-publish.yml`:
1. **`gpg-passphrase` input is misused**: `actions/setup-java`'s
`gpg-passphrase` input expects the **name** of an environment variable
(default: `GPG_PASSPHRASE`), not the secret value itself. The previous
value `${{ secrets.GPG_PASSPHRASE }}` was setting the env var name to
the actual secret, which is incorrect.
2. **Passphrase visible on the command line**: `-Dgpg.passphrase=${{
secrets.GPG_PASSPHRASE }}` passes the GPG passphrase as a Maven system
property argument, making it visible in process listings and potentially
echoed in debug logs — a supply-chain security risk for release
workflows.
## Solution
- Fix `gpg-passphrase: MAVEN_GPG_PASSPHRASE` — use the correct env var
name so `actions/setup-java` generates a proper Maven `settings.xml`
entry that reads from `MAVEN_GPG_PASSPHRASE`.
- Remove `-Dgpg.passphrase=...` from the Maven CLI invocation.
- Add `MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}` to the
`env:` block of the Publish step, so the passphrase is available as an
environment variable rather than a CLI argument.
## Testing
The Java publish workflow only runs on tag pushes, so this cannot be
exercised in a PR build. The logic change is straightforward:
`actions/setup-java` is documented to write a `settings.xml` that reads
`<gpg.passphrase>` from the named env var, and `maven-gpg-plugin` picks
it up from there without any CLI argument.
Co-authored-by: octo-patch <octo-patch@github.com>
Adds `permissions: contents: read` to the 10 workflows that had no
top-level permissions block. Workflows that already declared
permissions, or individual jobs that need elevated permissions (`issues:
write`, `pull-requests: write`, `contents: write`), are left unchanged.
Affected workflows: `dev.yml`, `java-publish.yml`, `java.yml`,
`license-header-check.yml`, `nodejs.yml`, `pypi-publish.yml`,
`python.yml`, `rust.yml`, `update_package_lock_run.yml`,
`update_package_lock_run_nodejs.yml`
After the refactoring on both client and server side, we should have the
ability to fully use lance REST namespace to call into LanceDB cloud and
enterprise. We can avoid having a JNI implementation (which today does
not really do anything except for vending a connection object), and just
use lance-core's RestNamespace.
We will at this moment have a LanceDbRestNamespaceBuilder to allow users
to more easily build the RestNamespace to talk to LanceDB Cloud or
Enterprise endpoint.
In the future, we could extend this further to also support the local
mode through DirectoryNamespace. That will be a separated PR.
## Summary
- Created custom GitHub Action that creates issues when workflow jobs
fail
- Added report-failure jobs to cargo-publish.yml, java-publish.yml,
npm-publish.yml, and pypi-publish.yml
- Issues are created automatically with workflow name, failed job names,
and run URL
## Test plan
- Workflows will only create issues on actual release or
workflow_dispatch events
- Can be tested by triggering workflow_dispatch on a publish workflow
Based on lancedb/lance#4873🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude <noreply@anthropic.com>
Will JonesandClaude Opus 5.5
Raphael Malikian
Octopusandocto-patch
Jack Ye
vinoyang
LuQQiu
Lei XuandLu Qiu