FrankYang0529 opened a new pull request, #71869:
URL: https://github.com/apache/airflow/pull/71869
## Why
- `java-sdk/gradle/verification-metadata.xml` is a trust list. Gradle's
strict mode fails on a checksum mismatch and on an artifact with no entry, but
not on an entry nothing resolves any more.
- Regeneration only appends, so every version bump leaves the superseded
checksums behind.
## How
- Add `java-sdk/scripts/ci/regenerate-verification-metadata.sh`. It clears
the component list first, so superseded entries disappear instead of
accumulating. Regenerate metadata based on `-PgitRef=HEAD`. It also puts back
the ASF header Gradle strips, and retries three times because Maven Central and
the Gradle Plugin Portal fail often enough to matter.
- `--check` regenerates into a temporary copy, diffs it against the
committed file, and restores the committed file, so it leaves the working tree
untouched.
- Add a `verification-metadata` job to `java-sdk-dependency-security.yml`
that runs the script with `--check` on java-sdk pull requests, on pushes to
main, and on the existing weekly schedule.
## Verification
1. Bump `com.github.spotbugs:spotbugs-annotations` to `4.10.4`.
2. Run `./scripts/ci/regenerate-verification-metadata.sh`.
3. Check the script can remove `4.10.3` from metadata.
4. Revert the change in `gradle/verification-metadata.xml`.
5. Manually adding following to `gradle/verification-metadata.xml`.
```
<component group="com.github.spotbugs" name="spotbugs-annotations"
version="4.10.4">
<artifact name="spotbugs-annotations-4.10.4.jar">
<sha256
value="28fa4befaddce5d7b79b07c68e7c12fa27c5d9282c4229528717971606661ea3"
origin="Generated by Gradle"/>
</artifact>
<artifact name="spotbugs-annotations-4.10.4.module">
<sha256
value="bdc8ed2f0617e612a9da3c35bb5d375abc96fb2385471f39e810a88cac7d48ed"
origin="Generated by Gradle"/>
</artifact>
</component>
```
6. Run `./scripts/ci/regenerate-verification-metadata.sh --check`.
7. Check it can catch the stale entry.
<!-- SPDX-License-Identifier: Apache-2.0
https://www.apache.org/licenses/LICENSE-2.0 -->
<!--
Thank you for contributing!
Please provide above a brief description of the changes made in this pull
request.
Write a good git commit message following this guide:
https://chris.beams.io/posts/git-commit/
Please make sure that your code changes are covered with tests.
And in case of new features or big changes remember to adjust the
documentation.
For user-facing UI changes, please attach before/after screenshots (or a
short
screen recording) so reviewers can assess the visual impact.
Feel free to ping (in general) for the review if you do not see reaction for
a few days
(72 Hours is the minimum reaction time you can expect from volunteers) - we
sometimes miss notifications.
In case of an existing issue, reference it using one of the following:
* closes: #ISSUE
* related: #ISSUE
-->
---
##### Was generative AI tooling used to co-author this PR?
<!--
If generative AI tooling has been used in the process of authoring this PR,
please
change below checkbox to `[X]` followed by the name of the tool, uncomment
the "Generated-by".
-->
- [X] Yes - Claude Code
<!--
Generated-by: [Tool Name] following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
-->
---
* Read the **[Pull Request
Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)**
for more information. Note: commit author/co-author name and email in commits
become permanently public when merged.
* For fundamental code changes, an Airflow Improvement Proposal
([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals))
is needed.
* When adding dependency, check compliance with the [ASF 3rd Party License
Policy](https://www.apache.org/legal/resolved.html#category-x).
* For significant user-facing changes create newsfragment:
`{pr_number}.significant.rst`, in
[airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments).
You can add this file in a follow-up commit after the PR is created so you
know the PR number.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
