[xsalefter]

1. Make kpm.yml repository URL configurable for tagged images
   • tagged/kpm.yml.template gets a nexus block (url: __NEXUSURL__, ssl_verify: true).
   • docker/dockerTemplate.sh substitutes __NEXUSURL__ from NEXUS_URL, and fails if the template needs it and
     NEXUS_URL is unset.
   • docker_ci.yml sets NEXUS_URL=https://repo1.maven.org/maven2 . This is OK because for testing only.
2. Add cloudsmith Dockerfile template for Kill Bill 0.25+ (docker/templates/killbill/cloudsmith/Dockerfile.template)
   • Self-contained multi-stage build: builder-base, builder-tomcat, base, shell, final (one final image).
   • JDK 21 and Tomcat 11, FROM ubuntu:24.04.
   • The Cloudsmith URL (which contains the token) is passed as the BuildKit secret nexus_url. It is only used inside
     one RUN, against a temporary copy of kpm.yml, and removed by a trap. It is never stored in a layer.
   • The secret is mounted with mode=0444 because that stage runs as the non-root tomcat user. The default
     root-only mode fails with Permission denied.
   • .gitignore ignores the generated cloudsmith/Dockerfile.
3. Deprecate release.yml and kb_beta_release.yml
   • Both are now no-ops (still workflow_dispatch only, so nothing else calls them).
   • maint-for-0-24-x has its own copies of both and is not affected.
4. Add optional artifacts_hook build secret (same Dockerfile)
   • If the BuildKit secret artifacts_hook is given, it runs with bash -euo pipefail after Kill Bill and the
     default bundles are installed, as the tomcat user. A non-zero exit fails the build.
   • Meant for callers that need to add things this template knows nothing about, for example extra plugin jars,
     registered offline with kpm install_java_plugin <key> --from_source_file=<jar> --version=<v> --destination=$KILLBILL_BUNDLES_DIR.
   • It is a secret mount, so neither the script nor credentials inside it end up in a layer.
   • Without the secret the step does nothing, so existing builds are unchanged.
   • KILLBILL_BUNDLES_DIR is exported for the hook.

[Copilot]

🟡 Changes recommended

The repository URL is interpolated into a sed replacement without escaping special characters, which can corrupt valid URLs and cause artifact downloads to fail.

1 open issue

• Escape repository URL before inserting it into sed replacement · New

What changed in this PR

Adds Docker image support for Kill Bill 0.25+ using private Cloudsmith artifacts, alongside configurable repository settings for tagged builds.

Changes:

• Adds a self-contained Java 21 image template with BuildKit secrets and an optional artifact-installation hook.
• Makes tagged builds’ repository URL configurable and supplies Maven Central in CI.
• Replaces the release and beta-release workflows with deprecation notices.

File	Description
docker/​templates/​killbill/​tagged/​kpm.yml.template	Adds repository URL and TLS verification settings.
docker/​templates/​killbill/​cloudsmith/​Dockerfile.template	Adds the multi-stage image build and secret-based installation hooks.
docker/​dockerTemplate.sh	Requires and substitutes the configured repository URL.
.gitignore	Ignores the generated Cloudsmith Dockerfile.
.github/​workflows/​release.yml	Replaces publishing with a deprecation notice.
.github/​workflows/​kb_beta_release.yml	Replaces beta publishing with a deprecation notice.
.github/​workflows/​docker_ci.yml	Sets Maven Central as the repository for CI builds.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The artifacts-hook stage lacks cache invalidation when the optional secret is enabled or changed, allowing BuildKit to silently omit requested plugins or retain stale artifacts.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Secret hook changes can reuse stale cached artifacts

docker/​templates/​killbill/​cloudsmith/​Dockerfile.template:216

BuildKit does not include secret contents (or whether an optional secret was supplied) in the cache key. After a cached build without artifacts_hook, building the same inputs with the hook supplied can reuse this no-op layer and silently omit the requested plugins; changing an existing hook can likewise retain old artifacts. Add a non-secret hook revision build argument that callers update when enabling/changing the hook, or require callers to disable caching for this stage.

1 resolved since last review

• Escape repository URL before inserting it into sed replacement

_{Review effort: Balanced}