From c979cdae853300357be6e75773bf7ed9fb93fcd8 Mon Sep 17 00:00:00 2001 From: Tony Germano Date: Tue, 3 Nov 2026 23:03:26 -0500 Subject: [PATCH] Let version catalog refs decide Renovate grouping Renovate's Gradle manager records each catalog entry's version.ref and uses it as the group name when no rule sets one, so every ref already updates as one branch. Two things worked against that: - config:recommended includes group:monorepos, which puts Jetty, Jackson, Netty, Log4j2, Jersey, Mockito, jaxb-ri and slf4j into " monorepo" groups. - Vulnerability-alert updates reset groupName to null and fall back to the ref name. So a family whose normal updates get a group name other than the ref name is split: a jar with an OSV advisory lands on renovate/, the rest on renovate/, and both branches rewrite the same catalog line. The explicit jetty, jackson, netty and log4j groups only avoided this because their names happen to equal the refs, and that does not work for refs with a dash, which become dotted branch names (jaxb-ri -> renovate/jaxb.ri). jaxb-ri, slf4j and the refs inside the multi-ref groups (awssdk in aws-sdk, mockito and byte-buddy in test-tooling, hk2 in jersey, jaxws-ri in sun-xml) were exposed. The pdfbox group's *pdfbox* pattern also pulled openhtmltopdf-pdfbox away from the rest of the openhtmltopdf ref. Ignore group:monorepos and remove every groupName rule, leaving the refs as the only grouping. A local Renovate 44.199.0 run with OSV alerts on (--platform=local, gradle manager) confirms that each ref then goes to exactly one branch, plus its major-update branch, that no branch updates more than one ref, and that jetty-http's advisory update lands on renovate/jetty with the other Jetty jars. Dockerfile and Gradle wrapper branches are unchanged. Artifacts on literal versions, such as the Apache Commons and Metro jars that the apache-commons and sun-xml groups bundled, now get one PR each. In the same run, PR-producing branches went from 59 to 82 and major-only branches, which wait for dashboard approval, from 31 to 40; prConcurrentLimit and the monthly schedule still pace them. Grouping never kept those jars compatible anyway, since each update in a group moves to its own latest version. Document the rule in CONTRIBUTING.md and point to it from the catalog. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Tony Germano --- CONTRIBUTING.md | 2 + gradle/libs.versions.toml | 1 + renovate.json | 77 ++------------------------------------- 3 files changed, 6 insertions(+), 74 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index d139d181f..f6edbe5f5 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -44,6 +44,8 @@ GRADLE_USER_HOME=$(mktemp -d) ./gradlew --write-verification-metadata sha256 bui ``` The cold cache matters: a warm cache skips re-resolving already-cached parent POMs, so they never get recorded, and the build then fails verification only in CI (this bit us once during the migration). The run downloads everything once and takes a few minutes. Only when adding a **new** artifact that ships in the distribution does `gradle/vendored-layout.json` need a one-line placement entry, and the build fails with a message telling you so. +Artifacts that are released together under one version number share a `[versions]` entry (a ref) in `gradle/libs.versions.toml`. [Renovate](https://docs.renovatebot.com/) proposes each ref's update as one PR, on a branch named after the ref, and puts a security fix for any artifact on that ref on the same branch. To keep it that way, `renovate.json` defines no groups and ignores Renovate's built-in `group:monorepos` preset, so the refs alone decide what is updated together. Don't add a `groupName` rule: a security-fix update never joins a named group, so the family would be split across two branches that edit the same line. To have several artifacts updated together, put them on one ref, which is only correct if they share a version. Artifacts on literal versions get one PR each. + ### Changing build logic The build's correctness is guarded by output comparison, not by unit diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index bb6dc1f29..f8e1f014b 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -11,6 +11,7 @@ [versions] # Shared by artifacts released together; bump the whole family at once. +# Renovate updates each ref in one PR (see CONTRIBUTING.md). asm = "9.6" awssdk = "2.55.12" bouncycastle = "1.78.1" diff --git a/renovate.json b/renovate.json index 9b71c32a3..51ffca599 100644 --- a/renovate.json +++ b/renovate.json @@ -5,6 +5,9 @@ "schedule:monthly", "helpers:pinGitHubActionDigests" ], + "ignorePresets": [ + "group:monorepos" + ], "timezone": "America/New_York", "minimumReleaseAge": "14 days", "prConcurrentLimit": 10, @@ -45,80 +48,6 @@ "addLabels": [ "github actions" ] - }, - { - "groupName": "aws-sdk", - "matchPackageNames": [ - "software.amazon.awssdk:*", - "software.amazon.eventstream:*" - ] - }, - { - "groupName": "jetty", - "matchPackageNames": [ - "org.eclipse.jetty*" - ] - }, - { - "groupName": "bouncycastle", - "matchPackageNames": [ - "org.bouncycastle*" - ] - }, - { - "groupName": "jersey", - "matchPackageNames": [ - "org.glassfish.jersey*", - "org.glassfish.hk2*" - ] - }, - { - "groupName": "pdfbox", - "matchPackageNames": [ - "*pdfbox*" - ] - }, - { - "groupName": "sun-xml", - "matchPackageNames": [ - "com.sun.xml*" - ] - }, - { - "groupName": "jackson", - "matchPackageNames": [ - "com.fasterxml.jackson*" - ] - }, - { - "groupName": "netty", - "matchPackageNames": [ - "io.netty*", - "com.typesafe.netty*" - ] - }, - { - "groupName": "log4j", - "matchPackageNames": [ - "org.apache.logging.log4j*" - ] - }, - { - "groupName": "apache-commons", - "matchPackageNames": [ - "org.apache.commons:*", - "commons-*" - ] - }, - { - "groupName": "test-tooling", - "matchPackageNames": [ - "org.mockito*", - "net.bytebuddy*", - "org.objenesis:*", - "org.hamcrest:*", - "junit:*" - ] } ] }