slachiewicz commented on issue #247: URL: https://github.com/apache/maven-gh-actions-shared/issues/247#issuecomment-5233572606
Status check on this, since the "Bump apache/maven-gh-actions-shared" queue you linked in July is now **empty** — no open bump PRs anywhere in `org:apache`. The upgrade itself is done: `v5` runs `[email protected]`, `v4` is still on `v6.4.0`. What is left is the tail of repositories that never moved from `v4` to `v5`. ## Why the tail stalled Not migration difficulty — **nothing was proposing the bump**. Four repositories had a `dependabot.yml` that declared only `package-ecosystem: maven`, so Dependabot never looked at their workflows: - apache/maven-checkstyle-plugin#686 - apache/maven-doxia-converter#141 - apache/maven-reporting-api#78 - apache/maven-shared-jar#159 All four are merged now, so org-wide coverage is **85 of 85** repositories that have workflows at all. (The remaining seven with no `dependabot.yml` — maven-integration-testing, maven-jenkins-env, maven-jenkins-lib, maven-sources, maven-stage-plugin, maven-studies, maven-verifier-plugin — have no `.github/workflows` directory, so there is nothing for Dependabot to update.) Dependabot should now open the bumps for those four on its next run. ## Still on v4 after that Walking every default and maintenance branch in the org, rather than using code search: **Maintenance branches (11)** — these need an explicit `target-branch` entry in `dependabot.yml` before Dependabot will ever propose anything for them: ``` maven-resolver-1.9.x maven-help-plugin-3.4.x wagon-3.x jxr-3.4.x maven-dependency-plugin-3.7.x maven-plugin-tools-3.14.x maven-invoker-plugin-3.7.x maven-pmd-plugin-3.24.x maven-javadoc-plugin-3.8.x maven-project-info-reports-plugin-3.6.x surefire-3.4.x ``` **Default branches (5)** — the four above plus `maven-plugin-testing`, which does declare the ecosystem, so that one is worth a look separately. One caveat on any list like this: GitHub code search returns **zero** hits for `maven-verify.yml@v4` across `org:apache`. That is wrong twice over — it does not index non-default branches, and it also missed the five default branches above. The list came from walking branches directly. ## Related Those same 11 maintenance branches are the ones still hitting #284, where a `pull_request` from a non-fork branch fails the whole run with `fromJSON: empty input`. #305 backports the `v5` guard to `v4` so they are not broken while they wait to be migrated. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
