Build: Strict runtime-deps check and auto-regeneration for dependabot PRs

.github/workflows/autoupdate-runtime-deps.yml

@@ -0,0 +1,55 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+name: "Autoupdate Runtime Deps"
+on:
+  pull_request:
+    paths:
+      - 'gradle/libs.versions.toml'
+
+permissions:
+  contents: write
+
+jobs:
+  regenerate:
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    runs-on: ubuntu-24.04
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        ref: ${{ github.head_ref }}
+        persist-credentials: true
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      with:
+        distribution: zulu
+        java-version: 17
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+    - run: ./gradlew generateRuntimeDeps -DallModules=true --rerun-tasks
+    - name: Commit updated baselines
+      run: |
+        # 41898282 is the GitHub user ID for github-actions[bot]
+        git config user.name "github-actions[bot]"
+        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+        git add '**/runtime-deps.txt'
+        if git diff --cached --quiet; then
+          echo "No runtime-deps changes"
+        else
+          git commit -m "Build: Regenerate runtime-deps.txt"
+          git push
+        fi

flink/v1.20/flink-runtime/runtime-deps.txt

@@ -9,7 +9,7 @@ io.airlift:aircompressor:2.0.3
 org.apache.avro:avro:1.12.1
 org.apache.datasketches:datasketches-java:6.2.0
 org.apache.datasketches:datasketches-memory:3.0.2
-org.apache.httpcomponents.client5:httpclient5:5.6
+org.apache.httpcomponents.client5:httpclient5:5.6.1
 org.apache.httpcomponents.core5:httpcore5-h2:5.4
 org.apache.httpcomponents.core5:httpcore5:5.4
 org.apache.orc:orc-core:1.9.8
@@ -25,7 +25,7 @@ org.apache.parquet:parquet-variant:1.17.0
 org.checkerframework:checker-qual:3.19.0
 org.eclipse.microprofile.openapi:microprofile-openapi-api:4.1.1
 org.locationtech.jts:jts-core:1.20.0
-org.projectnessie.nessie:nessie-client:0.107.4
-org.projectnessie.nessie:nessie-model:0.107.4
+org.projectnessie.nessie:nessie-client:0.107.5
+org.projectnessie.nessie:nessie-model:0.107.5
 org.roaringbitmap:RoaringBitmap:1.6.14
 org.threeten:threeten-extra:1.7.1

flink/v2.0/flink-runtime/runtime-deps.txt

@@ -9,7 +9,7 @@ io.airlift:aircompressor:2.0.3
 org.apache.avro:avro:1.12.1
 org.apache.datasketches:datasketches-java:6.2.0
 org.apache.datasketches:datasketches-memory:3.0.2
-org.apache.httpcomponents.client5:httpclient5:5.6
+org.apache.httpcomponents.client5:httpclient5:5.6.1
 org.apache.httpcomponents.core5:httpcore5-h2:5.4
 org.apache.httpcomponents.core5:httpcore5:5.4
 org.apache.orc:orc-core:1.9.8
@@ -25,7 +25,7 @@ org.apache.parquet:parquet-variant:1.17.0
 org.checkerframework:checker-qual:3.19.0
 org.eclipse.microprofile.openapi:microprofile-openapi-api:4.1.1
 org.locationtech.jts:jts-core:1.20.0
-org.projectnessie.nessie:nessie-client:0.107.4
-org.projectnessie.nessie:nessie-model:0.107.4
+org.projectnessie.nessie:nessie-client:0.107.5
+org.projectnessie.nessie:nessie-model:0.107.5
 org.roaringbitmap:RoaringBitmap:1.6.14
 org.threeten:threeten-extra:1.7.1

flink/v2.1/flink-runtime/runtime-deps.txt

@@ -9,7 +9,7 @@ io.airlift:aircompressor:2.0.3
 org.apache.avro:avro:1.12.1
 org.apache.datasketches:datasketches-java:6.2.0
 org.apache.datasketches:datasketches-memory:3.0.2
-org.apache.httpcomponents.client5:httpclient5:5.6
+org.apache.httpcomponents.client5:httpclient5:5.6.1
 org.apache.httpcomponents.core5:httpcore5-h2:5.4
 org.apache.httpcomponents.core5:httpcore5:5.4
 org.apache.orc:orc-core:1.9.8
@@ -25,7 +25,7 @@ org.apache.parquet:parquet-variant:1.17.0
 org.checkerframework:checker-qual:3.19.0
 org.eclipse.microprofile.openapi:microprofile-openapi-api:4.1.1
 org.locationtech.jts:jts-core:1.20.0
-org.projectnessie.nessie:nessie-client:0.107.4
-org.projectnessie.nessie:nessie-model:0.107.4
+org.projectnessie.nessie:nessie-client:0.107.5
+org.projectnessie.nessie:nessie-model:0.107.5
 org.roaringbitmap:RoaringBitmap:1.6.14
 org.threeten:threeten-extra:1.7.1

kafka-connect/kafka-connect-runtime/runtime-deps.txt

@@ -159,7 +159,7 @@ org.apache.hadoop.thirdparty:hadoop-shaded-guava:1.5.0
 org.apache.hadoop.thirdparty:hadoop-shaded-protobuf_3_25:1.5.0
 org.apache.hadoop:hadoop-annotations:3.4.3
 org.apache.hadoop:hadoop-common:3.4.3
-org.apache.httpcomponents.client5:httpclient5:5.6
+org.apache.httpcomponents.client5:httpclient5:5.6.1
 org.apache.httpcomponents.core5:httpcore5-h2:5.4
 org.apache.httpcomponents.core5:httpcore5:5.4
 org.apache.httpcomponents:httpclient:4.5.14

runtime-deps.gradle

@@ -36,9 +36,7 @@
 //
 //   checkRuntimeDeps     - compares the resolved dependencies against the
 //                          checked-in baseline and fails with a diff if
-//                          they don't match. Patch-level version changes are
-//                          ignored so that routine Dependabot bumps don't
-//                          require a baseline update. Wired into the 'check'
+//                          they don't match. Wired into the 'check'
 //                          lifecycle.
 //
 // Workflow:
@@ -86,11 +84,6 @@ tasks.register('checkRuntimeDeps') {
     def expected = depsFile.readLines().findAll { it.trim() }.toSorted()
 
     def groupArtifact = { coord -> coord.substring(0, coord.lastIndexOf(':')) }
-    def majorMinor = { coord ->
-      def ver = coord.substring(coord.lastIndexOf(':') + 1)
-      def parts = ver.split('\\.')
-      parts.length >= 2 ? "${parts[0]}.${parts[1]}" : ver
-    }
 
     def actualByModule = actual.collectEntries { [(groupArtifact(it)): it] }
     def expectedByModule = expected.collectEntries { [(groupArtifact(it)): it] }
@@ -99,7 +92,7 @@ tasks.register('checkRuntimeDeps') {
     def removed = expectedByModule.keySet() - actualByModule.keySet()
     def shared = actualByModule.keySet().intersect(expectedByModule.keySet())
     def versionChanged = shared.findAll {
-      majorMinor(actualByModule[it]) != majorMinor(expectedByModule[it])
+      actualByModule[it] != expectedByModule[it]
     }
 
     if (added || removed || versionChanged) {

spark/v3.4/spark-runtime/runtime-deps.txt

@@ -16,7 +16,7 @@ org.apache.arrow:arrow-vector:15.0.2
 org.apache.avro:avro:1.12.1
 org.apache.datasketches:datasketches-java:6.2.0
 org.apache.datasketches:datasketches-memory:3.0.2
-org.apache.httpcomponents.client5:httpclient5:5.6
+org.apache.httpcomponents.client5:httpclient5:5.6.1
 org.apache.httpcomponents.core5:httpcore5-h2:5.4
 org.apache.httpcomponents.core5:httpcore5:5.4
 org.apache.orc:orc-core:1.9.8
@@ -34,7 +34,7 @@ org.eclipse.collections:eclipse-collections-api:11.1.0
 org.eclipse.collections:eclipse-collections:11.1.0
 org.eclipse.microprofile.openapi:microprofile-openapi-api:4.1.1
 org.locationtech.jts:jts-core:1.20.0
-org.projectnessie.nessie:nessie-client:0.107.4
-org.projectnessie.nessie:nessie-model:0.107.4
+org.projectnessie.nessie:nessie-client:0.107.5
+org.projectnessie.nessie:nessie-model:0.107.5
 org.roaringbitmap:RoaringBitmap:1.6.14
 org.threeten:threeten-extra:1.7.1

spark/v3.5/spark-runtime/runtime-deps.txt

@@ -16,7 +16,7 @@ org.apache.arrow:arrow-vector:15.0.2
 org.apache.avro:avro:1.12.1
 org.apache.datasketches:datasketches-java:6.2.0
 org.apache.datasketches:datasketches-memory:3.0.2
-org.apache.httpcomponents.client5:httpclient5:5.6
+org.apache.httpcomponents.client5:httpclient5:5.6.1
 org.apache.httpcomponents.core5:httpcore5-h2:5.4
 org.apache.httpcomponents.core5:httpcore5:5.4
 org.apache.orc:orc-core:1.9.8
@@ -34,7 +34,7 @@ org.eclipse.collections:eclipse-collections-api:11.1.0
 org.eclipse.collections:eclipse-collections:11.1.0
 org.eclipse.microprofile.openapi:microprofile-openapi-api:4.1.1
 org.locationtech.jts:jts-core:1.20.0
-org.projectnessie.nessie:nessie-client:0.107.4
-org.projectnessie.nessie:nessie-model:0.107.4
+org.projectnessie.nessie:nessie-client:0.107.5
+org.projectnessie.nessie:nessie-model:0.107.5
 org.roaringbitmap:RoaringBitmap:1.6.14
 org.threeten:threeten-extra:1.7.1

spark/v4.0/spark-runtime/runtime-deps.txt

@@ -16,7 +16,7 @@ org.apache.arrow:arrow-vector:15.0.2
 org.apache.avro:avro:1.12.1
 org.apache.datasketches:datasketches-java:6.2.0
 org.apache.datasketches:datasketches-memory:3.0.2
-org.apache.httpcomponents.client5:httpclient5:5.6
+org.apache.httpcomponents.client5:httpclient5:5.6.1
 org.apache.httpcomponents.core5:httpcore5-h2:5.4
 org.apache.httpcomponents.core5:httpcore5:5.4
 org.apache.orc:orc-core:1.9.8
@@ -34,7 +34,7 @@ org.eclipse.collections:eclipse-collections-api:11.1.0
 org.eclipse.collections:eclipse-collections:11.1.0
 org.eclipse.microprofile.openapi:microprofile-openapi-api:4.1.1
 org.locationtech.jts:jts-core:1.20.0
-org.projectnessie.nessie:nessie-client:0.107.4
-org.projectnessie.nessie:nessie-model:0.107.4
+org.projectnessie.nessie:nessie-client:0.107.5
+org.projectnessie.nessie:nessie-model:0.107.5
 org.roaringbitmap:RoaringBitmap:1.6.14
 org.threeten:threeten-extra:1.7.1

spark/v4.1/spark-runtime/runtime-deps.txt

@@ -16,7 +16,7 @@ org.apache.arrow:arrow-vector:15.0.2
 org.apache.avro:avro:1.12.1
 org.apache.datasketches:datasketches-java:6.2.0
 org.apache.datasketches:datasketches-memory:3.0.2
-org.apache.httpcomponents.client5:httpclient5:5.6
+org.apache.httpcomponents.client5:httpclient5:5.6.1
 org.apache.httpcomponents.core5:httpcore5-h2:5.4
 org.apache.httpcomponents.core5:httpcore5:5.4
 org.apache.orc:orc-core:1.9.8
@@ -34,7 +34,7 @@ org.eclipse.collections:eclipse-collections-api:11.1.0
 org.eclipse.collections:eclipse-collections:11.1.0
 org.eclipse.microprofile.openapi:microprofile-openapi-api:4.1.1
 org.locationtech.jts:jts-core:1.20.0
-org.projectnessie.nessie:nessie-client:0.107.4
-org.projectnessie.nessie:nessie-model:0.107.4
+org.projectnessie.nessie:nessie-client:0.107.5
+org.projectnessie.nessie:nessie-model:0.107.5
 org.roaringbitmap:RoaringBitmap:1.6.14
 org.threeten:threeten-extra:1.7.1