Don't ask release managers to put plain text passwords in plain text files
- Dominant language
- Java
- Stars
- 2.1k
- Forks
- 522
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 137
Description
### Describe the bug
The release guide currently says that [release managers _have to_ put plain text credentials into plain text files](https://github.com/apache/polaris/blob/b501bfc266147dc80b4e1b3a87b98edbb55fc98c/site/content/release-guide.md?plain=1#L61-L66).
That's not a good practice. Everything that a release manager executes (Gradle builds, Maven builds, tests, browsers) can read that information and the credentials are leaked.
### To Reproduce
_No response_
### Actual Behavior
_No response_
### Expected Behavior
_No response_
### Additional context
_No response_
### System information
_No response_
Contributor guide
Research direction
Start with site/content/release-guide.md, especially the linked lines 61-66, and review how the release process currently handles credentials during Gradle and Maven builds. Update the guide so it no longer instructs release managers to store credentials in plain-text files, then verify the revised instructions are secure and clear.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- documentation, release, security
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100