From 3c59412ad64926852d763a027926f22d8bf1eef5 Mon Sep 17 00:00:00 2001
From: Mike Eltsufin <meltsufin@google.com>
Date: Fri, 17 Apr 2026 21:54:26 -0400
Subject: [PATCH 01/17] build: fall back to previous image version on release
 PRs

The library generation pipeline fails on release PRs because it attempts to pull a Docker image version that has not yet been built or pushed to the registry.

This PR adds a fallback mechanism in hermetic_library_generation.sh to use the previous version of the image from the main branch if the requested version fails to pull on a release PR.

To verify this in CI, this branch is named with the prefix 'release-please--' to simulate a release PR.

Fixes #12825
---
 .../scripts/hermetic_library_generation.sh        | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/sdk-platform-java/.github/scripts/hermetic_library_generation.sh b/sdk-platform-java/.github/scripts/hermetic_library_generation.sh
index fc991aa3e94d..439c03c17155 100755
--- a/sdk-platform-java/.github/scripts/hermetic_library_generation.sh
+++ b/sdk-platform-java/.github/scripts/hermetic_library_generation.sh
@@ -123,6 +123,21 @@ changed_libraries="$(cat "${changed_libraries_file}")"
 echo "Changed libraries are: ${changed_libraries:-"No changed library"}."
 
 # run hermetic code generation docker image.
+# Attempt to pull the image to see if it exists on release PRs.
+if [[ "$current_branch" =~ ^release-please-- ]]; then
+  echo "Detected release PR branch: $current_branch"
+  if ! docker pull gcr.io/cloud-devrel-public-resources/java-library-generation:"${image_tag}"; then
+    echo "Image not found for version ${image_tag}. Falling back to previous version from ${target_branch}."
+    previous_tag=$(git show "${target_branch}":.github/workflows/hermetic_library_generation.yaml | grep "image_tag:" | cut -d ':' -f 2 | cut -d '#' -f 1 | xargs)
+    if [ -n "$previous_tag" ]; then
+      echo "Using previous image version: $previous_tag"
+      image_tag="$previous_tag"
+    else
+      echo "Failed to extract previous version from ${target_branch}. Proceeding with original tag."
+    fi
+  fi
+fi
+
 docker run \
   --rm \
   -u "$(id -u):$(id -g)" \

From 5fa7830dd283820ac3b9cc5fd4b4ba834e6a57fa Mon Sep 17 00:00:00 2001
From: Mike Eltsufin <meltsufin@google.com>
Date: Fri, 17 Apr 2026 22:07:04 -0400
Subject: [PATCH 02/17] build: extract image name to variable in hermetic
 script

---
 .../.github/scripts/hermetic_library_generation.sh           | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/sdk-platform-java/.github/scripts/hermetic_library_generation.sh b/sdk-platform-java/.github/scripts/hermetic_library_generation.sh
index 439c03c17155..06e0f9cb7f46 100755
--- a/sdk-platform-java/.github/scripts/hermetic_library_generation.sh
+++ b/sdk-platform-java/.github/scripts/hermetic_library_generation.sh
@@ -27,6 +27,7 @@ set -exo pipefail
 # the default value is generation_config.yaml in the repository root.
 # 5. [optional] showcase_mode, true if we wish to download the showcase api
 # definitions, which are necessary for generating the showcase library.
+IMAGE_NAME="gcr.io/cloud-devrel-public-resources/java-library-generation"
 while [[ $# -gt 0 ]]; do
 key="$1"
 case "${key}" in
@@ -126,7 +127,7 @@ echo "Changed libraries are: ${changed_libraries:-"No changed library"}."
 # Attempt to pull the image to see if it exists on release PRs.
 if [[ "$current_branch" =~ ^release-please-- ]]; then
   echo "Detected release PR branch: $current_branch"
-  if ! docker pull gcr.io/cloud-devrel-public-resources/java-library-generation:"${image_tag}"; then
+  if ! docker pull "${IMAGE_NAME}:${image_tag}"; then
     echo "Image not found for version ${image_tag}. Falling back to previous version from ${target_branch}."
     previous_tag=$(git show "${target_branch}":.github/workflows/hermetic_library_generation.yaml | grep "image_tag:" | cut -d ':' -f 2 | cut -d '#' -f 1 | xargs)
     if [ -n "$previous_tag" ]; then
@@ -144,7 +145,7 @@ docker run \
   -v "$(pwd):${workspace_name}" \
   -v "${api_def_dir}:${workspace_name}/googleapis" \
   -e GENERATOR_VERSION="${image_tag}" \
-  gcr.io/cloud-devrel-public-resources/java-library-generation:"${image_tag}" \
+  "${IMAGE_NAME}:${image_tag}" \
   --generation-config-path="${workspace_name}/${generation_config}" \
   --library-names="${changed_libraries}" \
   --api-definitions-path="${workspace_name}/googleapis"

From 823b98cc5348341ab37b22c556e4042137bd75b0 Mon Sep 17 00:00:00 2001
From: Mike Eltsufin <meltsufin@google.com>
Date: Fri, 17 Apr 2026 22:10:12 -0400
Subject: [PATCH 03/17] build: improve robustness of fallback version
 extraction

---
 .../.github/scripts/hermetic_library_generation.sh              | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk-platform-java/.github/scripts/hermetic_library_generation.sh b/sdk-platform-java/.github/scripts/hermetic_library_generation.sh
index 06e0f9cb7f46..879c7e2bb056 100755
--- a/sdk-platform-java/.github/scripts/hermetic_library_generation.sh
+++ b/sdk-platform-java/.github/scripts/hermetic_library_generation.sh
@@ -129,7 +129,7 @@ if [[ "$current_branch" =~ ^release-please-- ]]; then
   echo "Detected release PR branch: $current_branch"
   if ! docker pull "${IMAGE_NAME}:${image_tag}"; then
     echo "Image not found for version ${image_tag}. Falling back to previous version from ${target_branch}."
-    previous_tag=$(git show "${target_branch}":.github/workflows/hermetic_library_generation.yaml | grep "image_tag:" | cut -d ':' -f 2 | cut -d '#' -f 1 | xargs)
+    previous_tag=$(git show "${target_branch}":.github/workflows/hermetic_library_generation.yaml | grep -m 1 "^[[:space:]]*image_tag:" | cut -d ':' -f 2- | cut -d '#' -f 1 | xargs)
     if [ -n "$previous_tag" ]; then
       echo "Using previous image version: $previous_tag"
       image_tag="$previous_tag"

From 832af4cbb319b45f20f68cf68d89ff134034b1c1 Mon Sep 17 00:00:00 2001
From: Mike Eltsufin <meltsufin@google.com>
Date: Fri, 17 Apr 2026 22:37:28 -0400
Subject: [PATCH 04/17] build: force fallback by using non-existent image
 version

This commit updates the image_tag to a non-existent version (9.99.9) in hermetic_library_generation.yaml to force the pull failure and verify the fallback logic works in CI.

DO NOT MERGE THIS PR
---
 .github/workflows/hermetic_library_generation.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/hermetic_library_generation.yaml b/.github/workflows/hermetic_library_generation.yaml
index 74fec93e13d8..ed12e433ffb5 100644
--- a/.github/workflows/hermetic_library_generation.yaml
+++ b/.github/workflows/hermetic_library_generation.yaml
@@ -44,4 +44,4 @@ jobs:
         head_ref: ${{ github.head_ref }}
         token: ${{ secrets.CLOUD_JAVA_BOT_GITHUB_TOKEN }}
         force_regenerate_all: ${{ github.event.pull_request.head.ref == 'generate-libraries-main' }}
-        image_tag: 2.71.0  # {x-version-update:gapic-generator-java:current}
+        image_tag: 9.99.9

From c1395d2cc9685fd8c00b770e8ac4ead613c004eb Mon Sep 17 00:00:00 2001
From: Mike Eltsufin <meltsufin@google.com>
Date: Fri, 17 Apr 2026 22:42:33 -0400
Subject: [PATCH 05/17] build: prevent script termination on empty fallback
 match

---
 .../.github/scripts/hermetic_library_generation.sh              | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk-platform-java/.github/scripts/hermetic_library_generation.sh b/sdk-platform-java/.github/scripts/hermetic_library_generation.sh
index 879c7e2bb056..a17e7d6fcafc 100755
--- a/sdk-platform-java/.github/scripts/hermetic_library_generation.sh
+++ b/sdk-platform-java/.github/scripts/hermetic_library_generation.sh
@@ -129,7 +129,7 @@ if [[ "$current_branch" =~ ^release-please-- ]]; then
   echo "Detected release PR branch: $current_branch"
   if ! docker pull "${IMAGE_NAME}:${image_tag}"; then
     echo "Image not found for version ${image_tag}. Falling back to previous version from ${target_branch}."
-    previous_tag=$(git show "${target_branch}":.github/workflows/hermetic_library_generation.yaml | grep -m 1 "^[[:space:]]*image_tag:" | cut -d ':' -f 2- | cut -d '#' -f 1 | xargs)
+    previous_tag=$(git show "${target_branch}":.github/workflows/hermetic_library_generation.yaml | grep -m 1 "^[[:space:]]*image_tag:" | cut -d ':' -f 2- | cut -d '#' -f 1 | xargs || true)
     if [ -n "$previous_tag" ]; then
       echo "Using previous image version: $previous_tag"
       image_tag="$previous_tag"

From 5abc6a20c397ca699d5cb959a9fd7d347c212ef7 Mon Sep 17 00:00:00 2001
From: Mike Eltsufin <meltsufin@google.com>
Date: Mon, 20 Apr 2026 11:19:35 -0400
Subject: [PATCH 06/17] build: fetch target branch in Kokoro to resolve diff
 error

---
 .kokoro/common.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.kokoro/common.sh b/.kokoro/common.sh
index bfcef516e43e..0160ce7a6d9d 100644
--- a/.kokoro/common.sh
+++ b/.kokoro/common.sh
@@ -236,6 +236,7 @@ function generate_modified_modules_list() {
   # grep returns 1 (error code) and exits the pipeline if there is no match
   # If there is no match, it will return true so the rest of the commands can run
   git config --global --add safe.directory $(realpath .)
+  git fetch origin "${KOKORO_GITHUB_PULL_REQUEST_TARGET_BRANCH}" || true
   modified_files=$(git diff --name-only "${KOKORO_GITHUB_PULL_REQUEST_TARGET_BRANCH}...${KOKORO_GITHUB_PULL_REQUEST_COMMIT}")
   printf "Modified files:\n%s\n" "${modified_files}"
 

From 59659b466277b9f5173b7412e975e2ec0e7e8a88 Mon Sep 17 00:00:00 2001
From: Mike Eltsufin <meltsufin@google.com>
Date: Mon, 20 Apr 2026 21:15:29 -0400
Subject: [PATCH 07/17] chore: update *all* instances of gapic-generator-java
 markers to 9.99.9 for simulation

---
 .github/workflows/generated_files_sync.yaml                 | 2 +-
 .github/workflows/hermetic_library_generation.yaml          | 2 +-
 WORKSPACE                                                   | 2 +-
 sdk-platform-java/api-common-java/pom.xml                   | 2 +-
 sdk-platform-java/gapic-generator-java-bom/pom.xml          | 6 +++---
 sdk-platform-java/gapic-generator-java-pom-parent/pom.xml   | 2 +-
 sdk-platform-java/gapic-generator-java/pom.xml              | 6 +++---
 sdk-platform-java/gax-java/pom.xml                          | 2 +-
 .../common/tests/resources/misc/TESTWORKSPACE               | 2 +-
 sdk-platform-java/java-common-protos/pom.xml                | 2 +-
 sdk-platform-java/java-core/google-cloud-core-bom/pom.xml   | 2 +-
 sdk-platform-java/java-core/pom.xml                         | 2 +-
 sdk-platform-java/java-iam/pom.xml                          | 2 +-
 .../first-party-dependencies/pom.xml                        | 2 +-
 sdk-platform-java/java-shared-dependencies/pom.xml          | 2 +-
 .../third-party-dependencies/pom.xml                        | 2 +-
 16 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/generated_files_sync.yaml b/.github/workflows/generated_files_sync.yaml
index 3143a317c9e3..a4c088057576 100644
--- a/.github/workflows/generated_files_sync.yaml
+++ b/.github/workflows/generated_files_sync.yaml
@@ -17,7 +17,7 @@ on:
   pull_request:
 name: generation diff
 env:
-  library_generation_image_tag: 2.71.0  # {x-version-update:gapic-generator-java:current}
+  library_generation_image_tag: 9.99.9  # {x-version-update:gapic-generator-java:current}
 jobs:
   root-pom:
     # root pom.xml does not have diff from generated one
diff --git a/.github/workflows/hermetic_library_generation.yaml b/.github/workflows/hermetic_library_generation.yaml
index ed12e433ffb5..fc16fb3ca990 100644
--- a/.github/workflows/hermetic_library_generation.yaml
+++ b/.github/workflows/hermetic_library_generation.yaml
@@ -44,4 +44,4 @@ jobs:
         head_ref: ${{ github.head_ref }}
         token: ${{ secrets.CLOUD_JAVA_BOT_GITHUB_TOKEN }}
         force_regenerate_all: ${{ github.event.pull_request.head.ref == 'generate-libraries-main' }}
-        image_tag: 9.99.9
+        image_tag: 9.99.9  # {x-version-update:gapic-generator-java:current}
diff --git a/WORKSPACE b/WORKSPACE
index 91d2cb646fa0..475aadca8742 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -67,7 +67,7 @@ load("@rules_jvm_external//:defs.bzl", "maven_install")
 load("@io_grpc_grpc_java//:repositories.bzl", "IO_GRPC_GRPC_JAVA_ARTIFACTS")
 load("@io_grpc_grpc_java//:repositories.bzl", "IO_GRPC_GRPC_JAVA_OVERRIDE_TARGETS")
 
-_gapic_generator_java_version = "2.71.0"  # {x-version-update:gapic-generator-java:current}
+_gapic_generator_java_version = "9.99.9"  # {x-version-update:gapic-generator-java:current}
 
 maven_install(
     artifacts = [
diff --git a/sdk-platform-java/api-common-java/pom.xml b/sdk-platform-java/api-common-java/pom.xml
index 881eac206666..ce9b9c96c6e7 100644
--- a/sdk-platform-java/api-common-java/pom.xml
+++ b/sdk-platform-java/api-common-java/pom.xml
@@ -12,7 +12,7 @@
     <parent>
         <groupId>com.google.api</groupId>
         <artifactId>gapic-generator-java-pom-parent</artifactId>
-        <version>2.71.0</version><!-- {x-version-update:gapic-generator-java:current} -->
+        <version>9.99.9</version><!-- {x-version-update:gapic-generator-java:current} -->
         <relativePath>../gapic-generator-java-pom-parent</relativePath>
     </parent>
 
diff --git a/sdk-platform-java/gapic-generator-java-bom/pom.xml b/sdk-platform-java/gapic-generator-java-bom/pom.xml
index f9ef334121d8..edd5042280e7 100644
--- a/sdk-platform-java/gapic-generator-java-bom/pom.xml
+++ b/sdk-platform-java/gapic-generator-java-bom/pom.xml
@@ -4,7 +4,7 @@
   <groupId>com.google.api</groupId>
   <artifactId>gapic-generator-java-bom</artifactId>
   <packaging>pom</packaging>
-  <version>2.71.0</version><!-- {x-version-update:gapic-generator-java:current} -->
+  <version>9.99.9</version><!-- {x-version-update:gapic-generator-java:current} -->
   <name>GAPIC Generator Java BOM</name>
   <description>
     BOM for the libraries in gapic-generator-java repository. Users should not
@@ -15,7 +15,7 @@
   <parent>
     <groupId>com.google.api</groupId>
     <artifactId>gapic-generator-java-pom-parent</artifactId>
-    <version>2.71.0</version><!-- {x-version-update:gapic-generator-java:current} -->
+    <version>9.99.9</version><!-- {x-version-update:gapic-generator-java:current} -->
     <relativePath>../gapic-generator-java-pom-parent</relativePath>
   </parent>
 
@@ -100,7 +100,7 @@
       <dependency>
         <groupId>com.google.api</groupId>
         <artifactId>gapic-generator-java</artifactId>
-        <version>2.71.0</version><!-- {x-version-update:gapic-generator-java:current} -->
+        <version>9.99.9</version><!-- {x-version-update:gapic-generator-java:current} -->
       </dependency>
       <dependency>
         <groupId>com.google.api.grpc</groupId>
diff --git a/sdk-platform-java/gapic-generator-java-pom-parent/pom.xml b/sdk-platform-java/gapic-generator-java-pom-parent/pom.xml
index 3b7f133acc76..f8ff47b18361 100644
--- a/sdk-platform-java/gapic-generator-java-pom-parent/pom.xml
+++ b/sdk-platform-java/gapic-generator-java-pom-parent/pom.xml
@@ -5,7 +5,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.google.api</groupId>
   <artifactId>gapic-generator-java-pom-parent</artifactId>
-  <version>2.71.0</version><!-- {x-version-update:gapic-generator-java:current} -->
+  <version>9.99.9</version><!-- {x-version-update:gapic-generator-java:current} -->
   <packaging>pom</packaging>
   <name>GAPIC Generator Java POM Parent</name>
   <url>https://github.com/googleapis/sdk-platform-java</url>
diff --git a/sdk-platform-java/gapic-generator-java/pom.xml b/sdk-platform-java/gapic-generator-java/pom.xml
index da49819c86bb..f3785c09b42d 100644
--- a/sdk-platform-java/gapic-generator-java/pom.xml
+++ b/sdk-platform-java/gapic-generator-java/pom.xml
@@ -4,7 +4,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>com.google.api</groupId>
   <artifactId>gapic-generator-java</artifactId>
-  <version>2.71.0</version><!-- {x-version-update:gapic-generator-java:current} -->
+  <version>9.99.9</version><!-- {x-version-update:gapic-generator-java:current} -->
   <name>GAPIC Generator Java</name>
   <description>GAPIC generator Java</description>
 
@@ -23,7 +23,7 @@
   <parent>
     <groupId>com.google.api</groupId>
     <artifactId>gapic-generator-java-pom-parent</artifactId>
-    <version>2.71.0</version><!-- {x-version-update:gapic-generator-java:current} -->
+    <version>9.99.9</version><!-- {x-version-update:gapic-generator-java:current} -->
     <relativePath>../gapic-generator-java-pom-parent</relativePath>
   </parent>
 
@@ -32,7 +32,7 @@
       <dependency>
         <groupId>com.google.api</groupId>
         <artifactId>gapic-generator-java-bom</artifactId>
-        <version>2.71.0</version><!-- {x-version-update:gapic-generator-java:current} -->
+        <version>9.99.9</version><!-- {x-version-update:gapic-generator-java:current} -->
         <type>pom</type>
         <scope>import</scope>
       </dependency>
diff --git a/sdk-platform-java/gax-java/pom.xml b/sdk-platform-java/gax-java/pom.xml
index 558194b4f78d..3836613bad36 100644
--- a/sdk-platform-java/gax-java/pom.xml
+++ b/sdk-platform-java/gax-java/pom.xml
@@ -11,7 +11,7 @@
   <parent>
     <groupId>com.google.api</groupId>
     <artifactId>gapic-generator-java-pom-parent</artifactId>
-    <version>2.71.0</version><!-- {x-version-update:gapic-generator-java:current} -->
+    <version>9.99.9</version><!-- {x-version-update:gapic-generator-java:current} -->
     <relativePath>../gapic-generator-java-pom-parent</relativePath>
   </parent>
 
diff --git a/sdk-platform-java/hermetic_build/common/tests/resources/misc/TESTWORKSPACE b/sdk-platform-java/hermetic_build/common/tests/resources/misc/TESTWORKSPACE
index 60b3036d9daf..96c71225aced 100644
--- a/sdk-platform-java/hermetic_build/common/tests/resources/misc/TESTWORKSPACE
+++ b/sdk-platform-java/hermetic_build/common/tests/resources/misc/TESTWORKSPACE
@@ -62,7 +62,7 @@ maven_install(
     repositories = ["https://repo.maven.apache.org/maven2/"],
 )
 
-_gapic_generator_java_version = "2.25.1-SNAPSHOT"  # {x-version-update:gapic-generator-java:current}
+_gapic_generator_java_version = "9.99.9"  # {x-version-update:gapic-generator-java:current}
 
 maven_install(
     artifacts = [
diff --git a/sdk-platform-java/java-common-protos/pom.xml b/sdk-platform-java/java-common-protos/pom.xml
index 9dca49783ba9..4bdf4ccdc658 100644
--- a/sdk-platform-java/java-common-protos/pom.xml
+++ b/sdk-platform-java/java-common-protos/pom.xml
@@ -13,7 +13,7 @@
   <parent>
     <groupId>com.google.api</groupId>
     <artifactId>gapic-generator-java-pom-parent</artifactId>
-    <version>2.71.0</version><!-- {x-version-update:gapic-generator-java:current} -->
+    <version>9.99.9</version><!-- {x-version-update:gapic-generator-java:current} -->
     <relativePath>../gapic-generator-java-pom-parent</relativePath>
   </parent>
 
diff --git a/sdk-platform-java/java-core/google-cloud-core-bom/pom.xml b/sdk-platform-java/java-core/google-cloud-core-bom/pom.xml
index 4857efd40145..2483c1c240e9 100644
--- a/sdk-platform-java/java-core/google-cloud-core-bom/pom.xml
+++ b/sdk-platform-java/java-core/google-cloud-core-bom/pom.xml
@@ -9,7 +9,7 @@
   <parent>
     <groupId>com.google.api</groupId>
     <artifactId>gapic-generator-java-pom-parent</artifactId>
-    <version>2.71.0</version><!-- {x-version-update:gapic-generator-java:current} -->
+    <version>9.99.9</version><!-- {x-version-update:gapic-generator-java:current} -->
     <relativePath>../../gapic-generator-java-pom-parent</relativePath>
   </parent>
 
diff --git a/sdk-platform-java/java-core/pom.xml b/sdk-platform-java/java-core/pom.xml
index 254b6d2c10c3..2cc105cb321c 100644
--- a/sdk-platform-java/java-core/pom.xml
+++ b/sdk-platform-java/java-core/pom.xml
@@ -13,7 +13,7 @@
   <parent>
     <groupId>com.google.api</groupId>
     <artifactId>gapic-generator-java-pom-parent</artifactId>
-    <version>2.71.0</version><!-- {x-version-update:gapic-generator-java:current} -->
+    <version>9.99.9</version><!-- {x-version-update:gapic-generator-java:current} -->
     <relativePath>../gapic-generator-java-pom-parent</relativePath>
   </parent>
 
diff --git a/sdk-platform-java/java-iam/pom.xml b/sdk-platform-java/java-iam/pom.xml
index 339a16102230..99080cd98216 100644
--- a/sdk-platform-java/java-iam/pom.xml
+++ b/sdk-platform-java/java-iam/pom.xml
@@ -13,7 +13,7 @@
   <parent>
     <groupId>com.google.api</groupId>
     <artifactId>gapic-generator-java-pom-parent</artifactId>
-    <version>2.71.0</version><!-- {x-version-update:gapic-generator-java:current} -->
+    <version>9.99.9</version><!-- {x-version-update:gapic-generator-java:current} -->
     <relativePath>../gapic-generator-java-pom-parent</relativePath>
   </parent>
 
diff --git a/sdk-platform-java/java-shared-dependencies/first-party-dependencies/pom.xml b/sdk-platform-java/java-shared-dependencies/first-party-dependencies/pom.xml
index 3283683e9886..652f7c922ddd 100644
--- a/sdk-platform-java/java-shared-dependencies/first-party-dependencies/pom.xml
+++ b/sdk-platform-java/java-shared-dependencies/first-party-dependencies/pom.xml
@@ -32,7 +32,7 @@
         <!-- This BOM declares the versions gRPC, Protobuf, Guava, etc. -->
         <groupId>com.google.api</groupId>
         <artifactId>gapic-generator-java-bom</artifactId>
-        <version>2.71.0</version><!-- {x-version-update:gapic-generator-java:current} -->
+        <version>9.99.9</version><!-- {x-version-update:gapic-generator-java:current} -->
         <type>pom</type>
         <scope>import</scope>
       </dependency>
diff --git a/sdk-platform-java/java-shared-dependencies/pom.xml b/sdk-platform-java/java-shared-dependencies/pom.xml
index 6eea01d40b57..4b2123efc7c8 100644
--- a/sdk-platform-java/java-shared-dependencies/pom.xml
+++ b/sdk-platform-java/java-shared-dependencies/pom.xml
@@ -17,7 +17,7 @@
   <parent>
     <groupId>com.google.api</groupId>
     <artifactId>gapic-generator-java-pom-parent</artifactId>
-    <version>2.71.0</version><!-- {x-version-update:gapic-generator-java:current} -->
+    <version>9.99.9</version><!-- {x-version-update:gapic-generator-java:current} -->
     <relativePath>../gapic-generator-java-pom-parent</relativePath>
   </parent>
 
diff --git a/sdk-platform-java/java-shared-dependencies/third-party-dependencies/pom.xml b/sdk-platform-java/java-shared-dependencies/third-party-dependencies/pom.xml
index b372ed8aa93d..dd443f9dab29 100644
--- a/sdk-platform-java/java-shared-dependencies/third-party-dependencies/pom.xml
+++ b/sdk-platform-java/java-shared-dependencies/third-party-dependencies/pom.xml
@@ -15,7 +15,7 @@
   <parent>
     <groupId>com.google.api</groupId>
     <artifactId>gapic-generator-java-pom-parent</artifactId>
-    <version>2.71.0</version><!-- {x-version-update:gapic-generator-java:current} -->
+    <version>9.99.9</version><!-- {x-version-update:gapic-generator-java:current} -->
     <relativePath>../../gapic-generator-java-pom-parent</relativePath>
   </parent>
 

From 53d67a1c20f5d7fe2e4add897e597d107ce973f9 Mon Sep 17 00:00:00 2001
From: Mike Eltsufin <meltsufin@google.com>
Date: Mon, 20 Apr 2026 21:38:21 -0400
Subject: [PATCH 08/17] refactor: centralize generator docker execution and
 fallback logic

---
 .github/workflows/ci.yaml                     |  5 +-
 .github/workflows/generated_files_sync.yaml   | 10 ++-
 generation/run_generator_docker.sh            | 61 +++++++++++++++++++
 .../scripts/hermetic_library_generation.sh    | 20 +-----
 4 files changed, 69 insertions(+), 27 deletions(-)
 create mode 100755 generation/run_generator_docker.sh

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index c164c3c4fa39..28b38631028f 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -321,13 +321,12 @@ jobs:
     - name: validate generation configuration
       shell: bash
       run: |
-        docker run \
-          --rm \
+        bash generation/run_generator_docker.sh "${library_generation_image_tag}" "${{ github.base_ref || 'main' }}" \
           --quiet \
           -u "$(id -u):$(id -g)" \
           -v "$(pwd):${workspace_name}" \
           --entrypoint python \
-          gcr.io/cloud-devrel-public-resources/java-library-generation:"${library_generation_image_tag}" \
+          -- \
           /src/library_generation/cli/entry_point.py validate-generation-config
       env:
         library_generation_image_tag: 2.68.0
diff --git a/.github/workflows/generated_files_sync.yaml b/.github/workflows/generated_files_sync.yaml
index 3143a317c9e3..75bc9a306850 100644
--- a/.github/workflows/generated_files_sync.yaml
+++ b/.github/workflows/generated_files_sync.yaml
@@ -27,13 +27,12 @@ jobs:
     - name: Generate root pom.xml file
       shell: bash
       run: |
-        docker run \
-          --rm \
+        bash generation/run_generator_docker.sh "${library_generation_image_tag}" "${{ github.base_ref }}" \
           --quiet \
           -u "$(id -u):$(id -g)" \
           -v "$(pwd):/workspace" \
           --entrypoint python \
-          gcr.io/cloud-devrel-public-resources/java-library-generation:"${library_generation_image_tag}" \
+          -- \
           /src/library_generation/cli/generate_monorepo_root_pom.py \
           generate \
           --repository-path=/workspace
@@ -48,13 +47,12 @@ jobs:
     - name: Generate gapic-libraries-bom/pom.xml
       shell: bash
       run: |
-        docker run \
-          --rm \
+        bash generation/run_generator_docker.sh "${library_generation_image_tag}" "${{ github.base_ref }}" \
           --quiet \
           -u "$(id -u):$(id -g)" \
           -v "$(pwd):/workspace" \
           --entrypoint python \
-          gcr.io/cloud-devrel-public-resources/java-library-generation:"${library_generation_image_tag}" \
+          -- \
           /src/library_generation/cli/generate_monorepo_gapic_bom.py \
           generate \
           --repository-path=/workspace \
diff --git a/generation/run_generator_docker.sh b/generation/run_generator_docker.sh
new file mode 100755
index 000000000000..6034c7a65172
--- /dev/null
+++ b/generation/run_generator_docker.sh
@@ -0,0 +1,61 @@
+#!/bin/bash
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -exo pipefail
+
+REQUESTED_TAG="$1"
+TARGET_BRANCH="$2"
+shift 2
+
+# Parse arguments using '--' as delimiter
+DOCKER_OPTS=()
+CONTAINER_CMD=()
+found_delimiter=false
+
+for arg in "$@"; do
+  if [ "$arg" == "--" ]; then
+    found_delimiter=true
+    continue
+  fi
+  if $found_delimiter; then
+    CONTAINER_CMD+=("$arg")
+  else
+    DOCKER_OPTS+=("$arg")
+  fi
+done
+
+IMAGE_NAME="gcr.io/cloud-devrel-public-resources/java-library-generation"
+# Support both local git and GitHub Actions environment variables
+CURRENT_BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME:-$(git branch --show-current)}}"
+IMAGE_TAG="$REQUESTED_TAG"
+
+# Fallback logic on Release PR branches
+if [[ "$CURRENT_BRANCH" =~ ^release-please-- ]]; then
+  echo "Detected release PR branch: $CURRENT_BRANCH"
+  if ! docker pull "${IMAGE_NAME}:${IMAGE_TAG}"; then
+    echo "Image not found for version ${IMAGE_TAG}. Falling back to previous version from ${TARGET_BRANCH}."
+    # Extract tag from target branch's workflow file
+    PREVIOUS_TAG=$(git show "${TARGET_BRANCH}":.github/workflows/hermetic_library_generation.yaml | grep -m 1 "^[[:space:]]*image_tag:" | cut -d ':' -f 2- | cut -d '#' -f 1 | xargs || true)
+    if [ -n "$PREVIOUS_TAG" ]; then
+      echo "Using previous image version: $PREVIOUS_TAG"
+      IMAGE_TAG="$PREVIOUS_TAG"
+    else
+      echo "Failed to extract fallback tag. Proceeding with requested tag."
+    fi
+  fi
+fi
+
+# Execute Docker run with proper ordering
+docker run --rm "${DOCKER_OPTS[@]}" "${IMAGE_NAME}:${IMAGE_TAG}" "${CONTAINER_CMD[@]}"
diff --git a/sdk-platform-java/.github/scripts/hermetic_library_generation.sh b/sdk-platform-java/.github/scripts/hermetic_library_generation.sh
index a17e7d6fcafc..c254aae64b3a 100755
--- a/sdk-platform-java/.github/scripts/hermetic_library_generation.sh
+++ b/sdk-platform-java/.github/scripts/hermetic_library_generation.sh
@@ -124,28 +124,12 @@ changed_libraries="$(cat "${changed_libraries_file}")"
 echo "Changed libraries are: ${changed_libraries:-"No changed library"}."
 
 # run hermetic code generation docker image.
-# Attempt to pull the image to see if it exists on release PRs.
-if [[ "$current_branch" =~ ^release-please-- ]]; then
-  echo "Detected release PR branch: $current_branch"
-  if ! docker pull "${IMAGE_NAME}:${image_tag}"; then
-    echo "Image not found for version ${image_tag}. Falling back to previous version from ${target_branch}."
-    previous_tag=$(git show "${target_branch}":.github/workflows/hermetic_library_generation.yaml | grep -m 1 "^[[:space:]]*image_tag:" | cut -d ':' -f 2- | cut -d '#' -f 1 | xargs || true)
-    if [ -n "$previous_tag" ]; then
-      echo "Using previous image version: $previous_tag"
-      image_tag="$previous_tag"
-    else
-      echo "Failed to extract previous version from ${target_branch}. Proceeding with original tag."
-    fi
-  fi
-fi
-
-docker run \
-  --rm \
+bash generation/run_generator_docker.sh "${image_tag}" "${target_branch}" \
   -u "$(id -u):$(id -g)" \
   -v "$(pwd):${workspace_name}" \
   -v "${api_def_dir}:${workspace_name}/googleapis" \
   -e GENERATOR_VERSION="${image_tag}" \
-  "${IMAGE_NAME}:${image_tag}" \
+  -- \
   --generation-config-path="${workspace_name}/${generation_config}" \
   --library-names="${changed_libraries}" \
   --api-definitions-path="${workspace_name}/googleapis"

From 16cfa1bc712828286d626da323a73629fcc40ffa Mon Sep 17 00:00:00 2001
From: Mike Eltsufin <meltsufin@google.com>
Date: Mon, 20 Apr 2026 21:42:09 -0400
Subject: [PATCH 09/17] refactor: extract fallback tag from versions.txt
 instead of workflow yaml

---
 generation/run_generator_docker.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/generation/run_generator_docker.sh b/generation/run_generator_docker.sh
index 6034c7a65172..9c4fcafae30d 100755
--- a/generation/run_generator_docker.sh
+++ b/generation/run_generator_docker.sh
@@ -46,8 +46,8 @@ if [[ "$CURRENT_BRANCH" =~ ^release-please-- ]]; then
   echo "Detected release PR branch: $CURRENT_BRANCH"
   if ! docker pull "${IMAGE_NAME}:${IMAGE_TAG}"; then
     echo "Image not found for version ${IMAGE_TAG}. Falling back to previous version from ${TARGET_BRANCH}."
-    # Extract tag from target branch's workflow file
-    PREVIOUS_TAG=$(git show "${TARGET_BRANCH}":.github/workflows/hermetic_library_generation.yaml | grep -m 1 "^[[:space:]]*image_tag:" | cut -d ':' -f 2- | cut -d '#' -f 1 | xargs || true)
+    # Extract tag from target branch's versions.txt
+    PREVIOUS_TAG=$(git show "${TARGET_BRANCH}":versions.txt | grep "^gapic-generator-java:" | cut -d ':' -f 2 || true)
     if [ -n "$PREVIOUS_TAG" ]; then
       echo "Using previous image version: $PREVIOUS_TAG"
       IMAGE_TAG="$PREVIOUS_TAG"

From ef926091ea7c21074d8aeb12d62b3a5db92ecb0c Mon Sep 17 00:00:00 2001
From: Mike Eltsufin <meltsufin@google.com>
Date: Mon, 20 Apr 2026 22:00:09 -0400
Subject: [PATCH 10/17] refactor: remove unused gapic_generator_version from
 generation_config.yaml

---
 generation_config.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/generation_config.yaml b/generation_config.yaml
index d10cf1c50168..add660b31a8b 100644
--- a/generation_config.yaml
+++ b/generation_config.yaml
@@ -1,4 +1,3 @@
-gapic_generator_version: 2.70.0
 googleapis_commitish: 62e4ecb2f4390728990514fea14aad0431881a52
 libraries_bom_version: 26.79.0
 libraries:

From 54269dcf16a1b8eb69a6d763a3f0775c470b7b5d Mon Sep 17 00:00:00 2001
From: Mike Eltsufin <meltsufin@google.com>
Date: Mon, 20 Apr 2026 22:09:14 -0400
Subject: [PATCH 11/17] fix: use remote ref origin/ for fallback tag extraction
 in CI

---
 generation/run_generator_docker.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/generation/run_generator_docker.sh b/generation/run_generator_docker.sh
index 9c4fcafae30d..77bf15bbb8d9 100755
--- a/generation/run_generator_docker.sh
+++ b/generation/run_generator_docker.sh
@@ -47,7 +47,7 @@ if [[ "$CURRENT_BRANCH" =~ ^release-please-- ]]; then
   if ! docker pull "${IMAGE_NAME}:${IMAGE_TAG}"; then
     echo "Image not found for version ${IMAGE_TAG}. Falling back to previous version from ${TARGET_BRANCH}."
     # Extract tag from target branch's versions.txt
-    PREVIOUS_TAG=$(git show "${TARGET_BRANCH}":versions.txt | grep "^gapic-generator-java:" | cut -d ':' -f 2 || true)
+    PREVIOUS_TAG=$(git show origin/"${TARGET_BRANCH}":versions.txt | grep "^gapic-generator-java:" | cut -d ':' -f 2 || true)
     if [ -n "$PREVIOUS_TAG" ]; then
       echo "Using previous image version: $PREVIOUS_TAG"
       IMAGE_TAG="$PREVIOUS_TAG"

From 1ae26ccea22d54fd40a64da410b0e8396457b5ab Mon Sep 17 00:00:00 2001
From: Mike Eltsufin <meltsufin@google.com>
Date: Mon, 20 Apr 2026 23:18:43 -0400
Subject: [PATCH 12/17] fix: fetch target branch to get fallback tag in CI

---
 generation/run_generator_docker.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/generation/run_generator_docker.sh b/generation/run_generator_docker.sh
index 77bf15bbb8d9..4255747319da 100755
--- a/generation/run_generator_docker.sh
+++ b/generation/run_generator_docker.sh
@@ -46,8 +46,9 @@ if [[ "$CURRENT_BRANCH" =~ ^release-please-- ]]; then
   echo "Detected release PR branch: $CURRENT_BRANCH"
   if ! docker pull "${IMAGE_NAME}:${IMAGE_TAG}"; then
     echo "Image not found for version ${IMAGE_TAG}. Falling back to previous version from ${TARGET_BRANCH}."
-    # Extract tag from target branch's versions.txt
-    PREVIOUS_TAG=$(git show origin/"${TARGET_BRANCH}":versions.txt | grep "^gapic-generator-java:" | cut -d ':' -f 2 || true)
+    # Extract tag from target branch's versions.txt using explicit fetch
+    git fetch origin "${TARGET_BRANCH}" --depth=1 || true
+    PREVIOUS_TAG=$(git show FETCH_HEAD:versions.txt | grep "^gapic-generator-java:" | cut -d ':' -f 2 || true)
     if [ -n "$PREVIOUS_TAG" ]; then
       echo "Using previous image version: $PREVIOUS_TAG"
       IMAGE_TAG="$PREVIOUS_TAG"

From 43835e211f811b6a553925f4f56c1ab975312c9f Mon Sep 17 00:00:00 2001
From: Mike Eltsufin <meltsufin@google.com>
Date: Mon, 20 Apr 2026 23:34:01 -0400
Subject: [PATCH 13/17] impl: add GENERATOR_VERSION to final stage of
 Dockerfile

---
 .../library_generation/library_generation.Dockerfile          | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sdk-platform-java/.cloudbuild/library_generation/library_generation.Dockerfile b/sdk-platform-java/.cloudbuild/library_generation/library_generation.Dockerfile
index dd805ecfc362..0712b8798c5d 100644
--- a/sdk-platform-java/.cloudbuild/library_generation/library_generation.Dockerfile
+++ b/sdk-platform-java/.cloudbuild/library_generation/library_generation.Dockerfile
@@ -43,6 +43,10 @@ ARG GRPC_VERSION=1.80.0
 ENV HOME=/home
 ENV OS_ARCHITECTURE="linux-x86_64"
 
+# {x-version-update-start:gapic-generator-java:current}
+ENV GENERATOR_VERSION="2.71.0"
+# {x-version-update-end}
+
 # install OS tools
 RUN apt update && apt install -y curl unzip rsync jq nodejs npm git openjdk-17-jdk
 

From 3137fc8c17c73e185cece71c68df45edb748c1c2 Mon Sep 17 00:00:00 2001
From: Mike Eltsufin <meltsufin@google.com>
Date: Mon, 20 Apr 2026 23:37:34 -0400
Subject: [PATCH 14/17] test: simulate version update to 9.99.9

---
 .../library_generation/library_generation.Dockerfile            | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk-platform-java/.cloudbuild/library_generation/library_generation.Dockerfile b/sdk-platform-java/.cloudbuild/library_generation/library_generation.Dockerfile
index dd805ecfc362..e5d02fe8fe0e 100644
--- a/sdk-platform-java/.cloudbuild/library_generation/library_generation.Dockerfile
+++ b/sdk-platform-java/.cloudbuild/library_generation/library_generation.Dockerfile
@@ -22,7 +22,7 @@ WORKDIR /google-cloud-java
 
 COPY . .
 # {x-version-update-start:gapic-generator-java:current}
-ENV DOCKER_GAPIC_GENERATOR_VERSION="2.71.0"
+ENV DOCKER_GAPIC_GENERATOR_VERSION="9.99.9"
 # {x-version-update-end}
 
 # Download the java formatter

From e9fd28029058deec6eaa2e59153a76efb1daaa02 Mon Sep 17 00:00:00 2001
From: Mike Eltsufin <meltsufin@google.com>
Date: Mon, 20 Apr 2026 23:39:33 -0400
Subject: [PATCH 15/17] test: simulate update of GENERATOR_VERSION to 9.99.9

---
 .../library_generation/library_generation.Dockerfile            | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk-platform-java/.cloudbuild/library_generation/library_generation.Dockerfile b/sdk-platform-java/.cloudbuild/library_generation/library_generation.Dockerfile
index 1c823deb0ae6..72a15ec555d9 100644
--- a/sdk-platform-java/.cloudbuild/library_generation/library_generation.Dockerfile
+++ b/sdk-platform-java/.cloudbuild/library_generation/library_generation.Dockerfile
@@ -44,7 +44,7 @@ ENV HOME=/home
 ENV OS_ARCHITECTURE="linux-x86_64"
 
 # {x-version-update-start:gapic-generator-java:current}
-ENV GENERATOR_VERSION="2.71.0"
+ENV GENERATOR_VERSION="9.99.9"
 # {x-version-update-end}
 
 # install OS tools

From 68519fb34588bcb294210597826190ded1116652 Mon Sep 17 00:00:00 2001
From: Mike Eltsufin <meltsufin@google.com>
Date: Mon, 20 Apr 2026 23:55:42 -0400
Subject: [PATCH 16/17] chore: pass GENERATOR_VERSION to validation container
 in CI

---
 .github/workflows/ci.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 696578380543..862add9f8a30 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -322,6 +322,7 @@ jobs:
       shell: bash
       run: |
         bash generation/run_generator_docker.sh "${library_generation_image_tag}" "${{ github.base_ref || 'main' }}" \
+          -e GENERATOR_VERSION="${library_generation_image_tag}" \
           --quiet \
           -u "$(id -u):$(id -g)" \
           -v "$(pwd):${workspace_name}" \

From 2cbaa3c684aa27bebd99cad54331aa5d6f46bcc5 Mon Sep 17 00:00:00 2001
From: Mike Eltsufin <meltsufin@google.com>
Date: Tue, 21 Apr 2026 07:15:42 -0400
Subject: [PATCH 17/17] chore: pass GENERATOR_VERSION to
 hermetic_library_generation workflow

---
 .github/workflows/hermetic_library_generation.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/hermetic_library_generation.yaml b/.github/workflows/hermetic_library_generation.yaml
index 74fec93e13d8..42dcd405eeb4 100644
--- a/.github/workflows/hermetic_library_generation.yaml
+++ b/.github/workflows/hermetic_library_generation.yaml
@@ -20,6 +20,9 @@ on:
 env:
   REPO_FULL_NAME: ${{ github.event.pull_request.head.repo.full_name }}
   GITHUB_REPOSITORY: ${{ github.repository }}
+  # {x-version-update-start:gapic-generator-java:current}
+  GENERATOR_VERSION: 2.71.0
+  # {x-version-update-end}
 jobs:
   library_generation:
     runs-on: ubuntu-latest
@@ -44,4 +47,4 @@ jobs:
         head_ref: ${{ github.head_ref }}
         token: ${{ secrets.CLOUD_JAVA_BOT_GITHUB_TOKEN }}
         force_regenerate_all: ${{ github.event.pull_request.head.ref == 'generate-libraries-main' }}
-        image_tag: 2.71.0  # {x-version-update:gapic-generator-java:current}
+        image_tag: ${{ env.GENERATOR_VERSION }}