Update docs site for ATR Beta

.asf.yaml

@@ -1,5 +1,5 @@
 staging:
-  profile:
+  profile: ~
   autostage: preview/*
 
 pelican:

.github/workflows/build-pelican.yml

@@ -16,7 +16,7 @@ jobs:
     permissions:
       contents: write   # because we push to asf-site
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: true
           ref: ${{ github.ref || 'main' }}

.github/workflows/pre-commit.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3  # v6.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Install
@@ -21,7 +21,7 @@ jobs:
           pip install pre-commit
       - name: Set PY
         run: echo "PY=$(python -VV | sha256sum | cut -d' ' -f1)" >> "$GITHUB_ENV"
-      - uses: actions/cache@v4
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.0.1
         with:
           path: ~/.cache/pre-commit
           key: pre-commit|${{ env.PY }}|${{ hashFiles('.pre-commit-config.yaml') }}

content/pages/atr-design-doc.md

@@ -0,0 +1,86 @@
+Title: Apache Trusted Releases design
+license: https://www.apache.org/licenses/LICENSE-2.0
+
+The main project is the Apache Trusted Releases platform. This is the initial design document.
+
+Repositories:
+
+- https://github.com/apache/tooling-trusted-releases
+- https://github.com/apache/tooling-releases-client
+
+## 1. Automate the Release Process
+
+   - Minimize human interaction.
+   - Community participation on **Release Votes** remains via email.
+   - Record all of the key events and metrics for tracking operations and performance.
+   - PMCs can quickly benefit.
+   - Infra costs and management complexity are decreased.
+
+## 2. Community
+
+   - Work with a selection of **Apache** PMCs, **Incubator PPMCs(podlings)**, and **Infra** for **User Acceptance Testing (UAT)**.
+   - Co-ordinate with **Infra** on migration and operation.
+   - Contribute to Infra's **asfquart** and **asfpy** frameworks.
+   - Provide openings for volunteers to help so long as the contributions are adequate and timely.
+   - Assure that the **ATR platform** follows industry best practices especially regarding **SBOMs**,
+     **Certificate Management**, and **Digital Signatures**.
+   - Help lead the industry to better practices.
+   - Work within the **ASF** on **Release Policy** improvements.
+
+## 3. Apache Trusted Release Platform (ATR)
+
+   - Incorporate all PMC Releases.
+     - Download page.
+     - Release Candidate page.
+     - Archived download page.
+   - Every PMC has a management interface.
+     - Current manual release practice is viewable.
+     - Automated release status.
+     - **KEYS** file management including revoking keys.
+     - Trigger release phases.
+     - Tracking performance.
+   - Platform includes a RESTful API.
+   - Serve release artifacts efficiently.
+   - Make switching from current manual release process to a minimal ATR process very simple.
+   - System Admins (Infra) have a management interface.
+   - Provide operational status to help Infra monitor ATR operations through the Infra Reporting Dashboard (IRD).
+   - Develop the platform with consideration about reusability outside of the ASF ecosystem, where feasible with regards to development costs.
+
+   See [Platform Services](platform.html) for detailed requirements for the **ATR**.
+
+## 4. Automate Release Process around Compliance
+
+   - Meet Release Policy
+     - Legal Policy
+     - Infra Policy
+     - Security Policy
+   - SBOMs and Attestations
+     - Include dependency and license compliance.
+     - Provide clear attribution and information about Release Votes.
+   - Certificate and Credential Management
+     - Manage the signing keys needed for automation.
+   - Download Page including available SBOM and verification instructions.
+   - Announcement Email.
+
+## 5. Release Lifecycle Phases
+
+   Here is a flow chart showing the [Release Lifecycle Phases](https://github.com/apache/tooling-docs/blob/main/apache-trusted-releases/lifecycle.md).
+
+## 6. Infrastructure Requirements
+
+   - Run book for releases.apache.org
+   - Progress on the retirement path for `svn:dist`. See [Legacy Releases from SVN Dist](svn-dist.html)
+     for possible transitional states. For the beta test _transition 1B_ is preferred.
+   - Legacy urls for dist.apache.org, downloads.apache.org, dlcdn.apache.org, and archive.apache.org remain supported.
+   - Path schemes for downloads.apache.org, dlcdn.apache.org, and archive.apache.org remain.
+
+## 7. Future Requirements
+
+   - Integrate with the [Security Advisory Process](https://github.com/apache/tooling-docs/blob/main/apache-trusted-releases/advisory-process.md) to make it easy to track applicable advisories on download pages.
+   - Expand support for [Evaluating Build Claims](https://github.com/apache/tooling-docs/blob/main/apache-trusted-releases/evaluate.md) to additional build tools.
+   - Expand automated support for additional [Distribution Channels](https://github.com/apache/tooling-docs/blob/main/apache-trusted-releases/distributions.md).
+   - Include a [Signing Candidates](https://github.com/apache/tooling-docs/blob/main/apache-trusted-releases/digital-signatures.md) phase during ATR processing.
+
+     > There are policy implications to the automation of digital signatures.
+     > For now, creating digital signatures on certain artifact types must be done prior to GPG signing and
+     > prior to submission of the release candidate.

content/pages/index.md

@@ -22,25 +22,19 @@ developed by ASF Infrastructure.
 2. Automate the Release Process for the benefit of PMCs while also reducing infrastructure
    costs and management complexity.
 
-### Contribute to the Discussion
-
-- Repository: https://github.com/apache/tooling-docs
-- ASF Slack Channels: [#tooling-discuss](https://the-asf.slack.com/archives/C086X8CKEMB) – [#apache-trusted-releases](https://the-asf.slack.com/archives/C049WADAAQG)
-- Mailing List: dev@tooling.apache.org – [archives](https://lists.apache.org/list.html?dev@tooling.apache.org)
-- Subscribe to Mailing List: dev-subscribe@tooling.apache.org
-
 ### Apache Trusted Releases (ATR) platform
 
-All ASF Projects may participate in our second Alpha testing the new automation framework.
+All ASF PMCs and Incubating podlings may participate in Beta testing of our new [Trusted Releases](/trusted-releases.html) platform.
 
 #### ATR Website
 
 Login to the ATR using your ASF credentials and you will have access to your PMC's projects.
 Incubating projects are welcome to join.
 
-1. ATR: https://release-test.apache.org/
-2. Open API:  https://release-test.apache.org/api/docs
-3. Comparison:  https://release-test.apache.org/about
+1. ATR: https://releases.apache.org
+2. Docs:  https://releases.apache.org/docs
+3. Open API:  https://releases.apache.org/api/docs
+4. Catalog:  https://release-catalog.apache.org
 
 #### Source code
 
@@ -49,8 +43,16 @@ Here are the source code repositories. Please view the README.md files for instr
 1. Website: https://github.com/apache/tooling-trusted-releases
 2. Python Client: https://github.com/apache/tooling-releases-client
 3. GitHub Actions: https://github.com/apache/tooling-actions
-4. Example Workflows: https://github.com/apache/tooling-asf-example/
+4. Maven plugin: https://github.com/apache/tooling-atr-maven-plugin
+5. Example Workflows: https://github.com/apache/tooling-asf-example
 
 ### Security Issues
 
 To report a new vulnerability you have discovered please follow the [ASF vulnerability reporting process](https://apache.org/security/#reporting-a-vulnerability).
+
+### Contribute to the Discussion
+
+- Repository: https://github.com/apache/tooling-docs
+- ASF Slack Channels: [#tooling-discuss](https://the-asf.slack.com/archives/C086X8CKEMB) – [#apache-trusted-releases](https://the-asf.slack.com/archives/C049WADAAQG)
+- Mailing List: dev@tooling.apache.org – [archives](https://lists.apache.org/list.html?dev@tooling.apache.org)
+- Subscribe to Mailing List: dev-subscribe@tooling.apache.org

content/pages/team.md

@@ -1,9 +1,9 @@
 Title: About the Apache Tooling Team
 license: https://www.apache.org/licenses/LICENSE-2.0
 
-# ASF Tooling
+# ASF Tooling Initiative
 
-The ASF Tooling team, known as **Tooling**, provides tooling development for select ASF Initiatives.
+The ASF Tooling Initiative, known as **Tooling**, provides tooling development for select ASF Initiatives. We consist of both paid staff and volunteers.
 
 ## About us