amaechler opened a new issue, #20732: URL: https://github.com/apache/druid/issues/20732
### Motivation Dependabot opens one PR per artifact every day. Over the 13 weeks to 2026-10-22 that was 381 of 696 commits on master and about 18% of PR runs of the unit-test workflow, and 166 of those PRs needed a manual `licenses.yaml` edit before they could pass. The dev@ discussion is here: https://lists.apache.org/thread/7y1bkvbb6og394mph4lx2x35dktv38nk This issue tracks the individual PRs. Each item can be picked up on its own unless it says otherwise. ### Dependabot configuration - [x] Explicit `build(deps)` / `build(deps-dev)` PR title prefix for Maven and npm (#20691) - [ ] Maven: weekly schedule, one group for all minor and patch updates, major updates stay one PR each. Grouped security updates for every ecosystem (Maven, website, web-console, GitHub Actions). Existing `maven-resolver` group, cooldown and ignore rules stay. ### `licenses.yaml`: check versions at release time instead of on every PR - [ ] Script that refreshes the versions in `licenses.yaml` from the Maven license reports. It has to handle entries that list several libraries under one version (80 today) and the per-module duplicate entries, and should flag rather than guess when the libraries of one entry end up on different versions. Useful on its own: running it on a Dependabot branch fixes the license check locally. - [ ] `check-licenses.py`: a mode that only warns when a version differs, but still fails when a dependency is added or removed or its license changes. PR CI uses this mode; the release build (`-Papache-release`) stays strict. Depends on the script above, so a release manager can bring `licenses.yaml` up to date before the strict check. - [ ] Release guide (`distribution/asf-release-process-guide.md`): run the refresh script and commit the result before cutting the release branch. Can go in the same PR as the `check-licenses.py` change. - Related, merged: #20707 makes the license check cover the modules the release LICENSE actually includes. ### Optional: don't run the test suite on Dependabot pushes that fail the packaging check When Dependabot pushes a bump, the unit and integration tests start in parallel with Static Checks. If `packaging-check` then fails, someone pushes a fix and the tests run again, so the first run is thrown away. The unit tests skip the enforcer (`-P skip-static-checks`), so even a bump that breaks `RequireUpperBoundDeps` runs the whole suite. From 2026-09-08 to 2026-10-24 (Maven Dependabot branches only): - 52 of 120 first Dependabot pushes failed `packaging-check` or `strict-compilation`. Counting later Dependabot rebases too, 57 pushes failed: 26 in `packaging-check` alone (mostly `licenses.yaml`) and 31 in both jobs (the enforcer or a compile error). - The test runs on those pushes used about 18,000 runner-minutes, 18% of all test minutes on Dependabot branches, or about 2,700 a week. - `packaging-check` fails after about 14 minutes and passes after about 20 (medians); one test run takes about 38 minutes of wall-clock time. - [ ] A gate job in `unit-and-integration-tests-unified.yml` that runs only when the push comes from `dependabot[bot]`, checks enforcer and licenses, and that the test jobs wait for. Human pushes are not affected. GitHub Actions cannot make one workflow wait for a job in another, so the gate repeats part of `packaging-check` (about 19 runner-minutes per Dependabot push) and delays Dependabot's test results by about 20 minutes. Worth revisiting only after the items above land: weekly grouping cuts the wasted runs to about one a week, and a version-tolerant license check removes the `licenses.yaml` half of the failures. ### Related CI cleanups Not part of the proposal, but they also reduce CI load or are needed for the ASF GitHub Actions policy. - [x] Cancel superseded Cron Job ITs runs on pull requests (#20692) - [x] Replace `pull_request_target` in the labeler and milestone workflows, required before the ASF turns it off in November 2026 (#20693) - [x] Keep the milestone creation message out of the milestone number (#20694) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
