shahar1 opened a new pull request, #76666: URL: https://github.com/apache/airflow/pull/76666
### Why Dependabot cannot regenerate `java-sdk/gradle/verification-metadata.xml`. Each Gradle bump fails CI until a committer dispatches `java-sdk-dependabot-verification-metadata.yml`. On #76616 that was not enough. The workflow ran `./gradlew --write-verification-metadata sha256 build`, which only appends. The `regenerate-java-sdk-verification-metadata` prek hook rebuilds the file from an empty list, with a wider task list. The hook therefore removed 56 superseded components (and added none), and [Static checks failed](https://github.com/apache/airflow/actions/runs/42324586844/job/128264198277). The dispatch job also took 13m13s on `ubuntu-slim`, whose job limit is 15 minutes, and it ran Gradle in the same job as a `contents: write` token. During regeneration, verification is off and dependency code runs. ### How - **One generator:** the workflow runs the script the hook runs. - **Automatic:** it also runs on Dependabot PRs that change `java-sdk/`, except the two example builds. Manual dispatch stays. - **Three jobs:** | Job | Token | Work | |---|---|---| | `resolve` | read | Finds the PR head and refuses a head in another repository | | `regenerate` | read | Runs Gradle and uploads only the file. No cache access (`cache-mode: none`) | | `publish` | write | Validates the file, then commits only that path. A non-force push means a moved branch is rejected | - **Validation:** `publish` treats the artifact as untrusted, because a job running dependency code produced it. The new `--validate` mode rejects: - a DOCTYPE - any change before `<components>`, which covers `verify-metadata` and `trusted-artifacts` - any element or attribute Gradle does not write for a plain checksum entry - duplicate entries - a changed hash for an artifact that stays The script and the baseline come from the PR's base. A PR head may hold an older script, which would ignore `--validate` and run Gradle with the token present. The merge commit is not used as the baseline, because an entry removed by one bot commit could return with a different hash as a new entry. A rejected file needs a human to run the hook and find out why. - **Rebase:** the commit message has `[skip dependabot]`. Without it, Dependabot stops rebasing the PR once other commits exist. A rebase drops the commit and the workflow runs again. ### What this does not do **New entries still need human review.** The validator cannot judge a hash for a new coordinate. CI for the bot's commit waits for a maintainer's approval, because `GITHUB_TOKEN` pushed it. This approval is not a review of the entries, and green CI checks against the same file. `java-sdk/DEVELOPMENT.md` says this. I did not add auto-approval, for this reason. The file is regenerated on the PR head, but CI checks the merge commit. If `main` changes Java SDK dependencies later, Static checks can fail again until `@dependabot rebase`. ### Verification | Check | Result | |---|---| | `scripts/tests/` | 1983 passed, 1 skipped | | Validator on the file the hook produced for #76616 | Accepted (482 to 426 components). Tampered copies rejected | | `prek`, pre-commit and manual stages | Passed, except as below | | Dispatch on my fork with the #76616 bump, head with the new script | Passed: [run](https://github.com/shahar1/airflow/actions/runs/42343399700). This ran an earlier revision of the workflow, before the separate validator checkout | | Dispatch on my fork with the #76616 bump, head with the old script | Passed on the final workflow: [run](https://github.com/shahar1/airflow/actions/runs/42349537912) | | Bot's file against the hook's file from #76616 CI | Byte-identical in both runs | `lychee-docker` did not start, because the local Docker proxy refused a writable bind mount. The change adds no links to Markdown files. I skipped `regenerate-java-sdk-verification-metadata` locally because it needs Gradle; this PR's CI runs it, as the script changed. **Not tested:** the `pull_request` trigger from a real Dependabot PR, which can only run after merge. That covers two things: `contents: write` through the `permissions` key, which [GitHub documents](https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain/troubleshoot-dependency-security/troubleshooting-dependabot-on-github-actions), and the `base.sha` baseline, as dispatch uses `github.sha`. If the push fails, manual dispatch still works. After merge, #76616 can be fixed with `@dependabot rebase`, or by dispatching this workflow with its PR number. related: #76616 --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 5.5) Generated-by: Claude Code (Opus 5.5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01BVx6g77DD1Qpsu2hvLEZxk -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
