Add CI, publish, and upstream-tracking workflows + README#1
Conversation
Stand up the operational shape that PR eXist-db/exist#6364 needs in order to resolve this artifact from CI: - README.md: what/versioning/transform/release/local-creds/license - ci.yml: smoke-test on PR/push — mvn verify + a JUnit 5 + Mockito test class that constructs WebdavRequestImpl against a jakarta.servlet stub, asserts the constructor's parameter types are jakarta.servlet.*, and scans WebdavRequestImpl.class bytes to confirm no javax/servlet references survived the OpenRewrite transform - publish.yml: v* tag + workflow_dispatch trigger; mvn deploy to maven.pkg.github.com/eXist-db/jackrabbit-webdav-jakarta using GITHUB_TOKEN with packages:write - check-upstream.yml: weekly cron + manual dispatch; queries apache/jackrabbit tags, re-vendors sources.jar from Maven Central, re-extracts into src/main/java, runs mvn rewrite:run to re-apply the Jakarta EE 10 transform, bumps pom.xml version, and opens a PR labelled upstream-bump - pom.xml: add distributionManagement pointing at GitHub Packages, plus JUnit Jupiter + Mockito + surefire-plugin so the smoke test runs Smoke test verified locally on JDK 21: 3 tests pass. Note on the transform mechanism: src/main/java/ already contains the jakarta-transformed sources (committed once, OpenRewrite was run manually). The rewrite-maven-plugin in pom.xml has no executions binding, so day-to-day builds are plain `mvn compile`. The bump workflow is the trigger that re-runs `mvn rewrite:run`.
There was a problem hiding this comment.
this looks a bit like rewriting dependabot, can we use dependabot for alerts for new releases?
There was a problem hiding this comment.
[This response was co-authored with Claude Code. -Joe]
Both fair calls, thanks @duncdrum — implemented in 315aada and 1dcf2f7 (also addresses your second comment below about action versions).
On "rewriting Dependabot" — you're right. check-upstream.yml is deleted. The new design:
pom.xmldeclaresorg.apache.jackrabbit:jackrabbit-webdavin a tracker-only<dependencyManagement>block (no corresponding<dependencies>entry, so it stays off the classpath — wouldn't want the un-transformed upstream colliding with our vendored sources). Dependabot's Maven manifest scan sees the coordinate and opens a PR on each upstream release..github/dependabot.ymlgets a Maven ecosystem block, weekly, labelledupstream-bump..github/workflows/bump-on-dependabot.ymltriggers on Dependabot's PR, runs a checked-in script that re-vendorssources.jarfrom Maven Central and re-applies OpenRewrite, commits back to the Dependabot branch. CI smoke test gates merge.
Net: ~100 lines of polling YAML gone, replaced with ~10 lines of pom + ~7 lines of dependabot config + the irreducible bump mechanics. Polling is Dependabot's job; only sources-jar vendoring and OpenRewrite re-application remain custom, because nothing in Dependabot's model can do those.
On stale actions — bumped checkout@v4→v6, setup-java@v4→v5, create-pull-request@v7→v8, and added a github-actions ecosystem to dependabot.yml so they don't drift again. Same weekly schedule as the Maven one.
|
|
||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
most action versions are out of date. dependabot to the rescue part 2
Addresses @duncdrum's review comment on PR #1: action versions in the initial workflows were behind, and Dependabot should keep them current going forward. - actions/checkout@v4 → v6 - actions/setup-java@v4 → v5 - peter-evans/create-pull-request@v7 → v8 - .github/dependabot.yml: weekly github-actions ecosystem updates The Maven side of @duncdrum's "use Dependabot instead of polling" point is still being designed and will land in a follow-up commit.
Addresses @duncdrum's "this looks a bit like rewriting Dependabot" review comment on PR #1. Dependabot now does the polling; the workflow does only the work Dependabot fundamentally can't (re-vendoring sources.jar and re-applying the OpenRewrite Jakarta EE 10 transform). - pom.xml: add upstream.jackrabbit.version property + tracker-only <dependencyManagement> entry for org.apache.jackrabbit:jackrabbit-webdav. No corresponding <dependencies> entry — Dependabot sees it in the manifest but Maven doesn't put it on the compile classpath. - .github/dependabot.yml: add maven ecosystem, weekly, labelled upstream-bump. - .github/workflows/bump-on-dependabot.yml: triggered on pull_request_target from Dependabot-opened, upstream-bump-labelled, same-repo PRs. Guards (per Joe): bot author + label + head.repo == github.repository. Runs the checked-in bump script (never reads logic from the PR's pom), then commits the re-vendored sources back to the Dependabot branch so ci.yml's smoke test re-runs and gates merge. - .github/scripts/bump-upstream.sh: idempotent — reads upstream.jackrabbit.version, downloads matching sources.jar from Maven Central, re-extracts into src/main/{java,resources}, runs `mvn rewrite:run`, and sets project version via `mvn versions:set`. Verified locally: with property and project.version already in sync, exits 0 without modifying any files. - check-upstream.yml: removed (cron-driven polling, superseded). - README.md: updated "How upstream tracking works" section to reflect the new Dependabot-driven flow.
|
[This response was co-authored with Claude Code. -Joe] Both fair calls, thanks @duncdrum — implemented in 315aada and 1dcf2f7. On "rewriting Dependabot" — you're right.
Net: ~100 lines of polling YAML gone, replaced with ~10 lines of pom + ~7 lines of dependabot config + the irreducible bump mechanics. Polling is Dependabot's job; only sources-jar vendoring and OpenRewrite re-application remain custom, because nothing in Dependabot's model can do those. On stale actions — bumped |
2 participants
Summary
Stands up the operational shape this repo needs so eXist-db/exist#6364 can resolve
org.exist-db.thirdparty.org.apache.jackrabbit:jackrabbit-webdav:2.22.3-jakarta-ee10from CI. Five of the six deliverables from the tasking are bundled here; the remaining two (eXist consumer pom wiring + tracking issue) come after the first publish.What lands
README.md— what this is, versioning scheme, how the transform works, how upstream tracking works, how to cut a release, how to add the GitHub Packages credential locally, license/attribution..github/workflows/ci.yml— every PR + push tomain. Runsmvn verifyon JDK 21 and three smoke assertions:WebdavRequestImpl's public constructors acceptjakarta.servlet.*types and nojavax.servlet.*types.WebdavRequestImplconstructs cleanly against a Mockito-stubbedjakarta.servlet.http.HttpServletRequest.WebdavRequestImpl.classbytecode containsjakarta/servletand does not containjavax/servlet..github/workflows/publish.yml—v*tag push +workflow_dispatch. Usessecrets.GITHUB_TOKENwithpackages: write(same-org publish, no PAT). Deploys tomaven.pkg.github.com/eXist-db/jackrabbit-webdav-jakarta..github/workflows/check-upstream.yml— Mondays 09:00 UTC + manual dispatch. Queriesapache/jackrabbittags, downloads the new*-sources.jarfrom Maven Central, re-extracts intosrc/main/java+src/main/resources, runsmvn rewrite:runto re-apply the Jakarta EE 10 transform, bumpspom.xmlversion, opens a PR labelledupstream-bump. Idempotent: skips if the bump branch already exists.pom.xml— adds<distributionManagement>for GitHub Packages, plus JUnit Jupiter 5.11.4, Mockito 5.14.2, andmaven-surefire-plugin3.5.2 so the smoke test runs.Discrepancy with the tasking, worth flagging
The tasking describes the transform as happening "inline at build time" via the rewrite-maven-plugin. In reality the plugin in
pom.xmlhas no<executions>binding, andsrc/main/java/is already committed as the post-transform output. Day-to-day builds are plainmvn compileagainst already-jakarta source. The transform actually re-runs in the upstream-bump workflow viamvn rewrite:run. The README, smoke test, and bump workflow all reflect this corrected mental model.Verified locally
mvn teston JDK 21 (Zulu 21.38.21): 3 tests pass.Remaining tasking items
v2.22.3-jakarta-ee10after this merges → verify artifact resolvesexist-parent/pom.xml<repository>block in PR #6364Test plan
v2.22.3-jakarta-ee10, confirm publish workflow goes green and artifact appears in GitHub Packagescheck-upstream.ymlwithtarget_version: 2.22.3and confirm it correctly detects "no bump needed"<repository>block inexist-parent/pom.xml🤖 Generated with Claude Code