Skip to content

Let version catalog refs decide Renovate grouping #553

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tonygermano wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Let version catalog refs decide Renovate grouping #553

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,8 @@ GRADLE_USER_HOME=$(mktemp -d) ./gradlew --write-verification-metadata sha256 bui
```
The cold cache matters: a warm cache skips re-resolving already-cached parent POMs, so they never get recorded, and the build then fails verification only in CI (this bit us once during the migration). The run downloads everything once and takes a few minutes. Only when adding a **new** artifact that ships in the distribution does `gradle/vendored-layout.json` need a one-line placement entry, and the build fails with a message telling you so.

Artifacts that are released together under one version number share a `[versions]` entry (a ref) in `gradle/libs.versions.toml`. [Renovate](https://docs.renovatebot.com/) proposes each ref's update as one PR, on a branch named after the ref, and puts a security fix for any artifact on that ref on the same branch. To keep it that way, `renovate.json` defines no groups and ignores Renovate's built-in `group:monorepos` preset, so the refs alone decide what is updated together. Don't add a `groupName` rule: a security-fix update never joins a named group, so the family would be split across two branches that edit the same line. To have several artifacts updated together, put them on one ref, which is only correct if they share a version. Artifacts on literal versions get one PR each.

### Changing build logic

The build's correctness is guarded by output comparison, not by unit
Expand Down
1 change: 1 addition & 0 deletions gradle/libs.versions.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@

[versions]
# Shared by artifacts released together; bump the whole family at once.
# Renovate updates each ref in one PR (see CONTRIBUTING.md).
asm = "9.6"
awssdk = "2.55.12"
bouncycastle = "1.78.1"
Expand Down
77 changes: 3 additions & 74 deletions renovate.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,9 @@
"schedule:monthly",
"helpers:pinGitHubActionDigests"
],
"ignorePresets": [
"group:monorepos"
],
"timezone": "America/New_York",
"minimumReleaseAge": "14 days",
"prConcurrentLimit": 10,
Expand Down Expand Up @@ -45,80 +48,6 @@
"addLabels": [
"github actions"
]
},
{
"groupName": "aws-sdk",
"matchPackageNames": [
"software.amazon.awssdk:*",
"software.amazon.eventstream:*"
]
},
{
"groupName": "jetty",
"matchPackageNames": [
"org.eclipse.jetty*"
]
},
{
"groupName": "bouncycastle",
"matchPackageNames": [
"org.bouncycastle*"
]
},
{
"groupName": "jersey",
"matchPackageNames": [
"org.glassfish.jersey*",
"org.glassfish.hk2*"
]
},
{
"groupName": "pdfbox",
"matchPackageNames": [
"*pdfbox*"
]
},
{
"groupName": "sun-xml",
"matchPackageNames": [
"com.sun.xml*"
]
},
{
"groupName": "jackson",
"matchPackageNames": [
"com.fasterxml.jackson*"
]
},
{
"groupName": "netty",
"matchPackageNames": [
"io.netty*",
"com.typesafe.netty*"
]
},
{
"groupName": "log4j",
"matchPackageNames": [
"org.apache.logging.log4j*"
]
},
{
"groupName": "apache-commons",
"matchPackageNames": [
"org.apache.commons:*",
"commons-*"
]
},
{
"groupName": "test-tooling",
"matchPackageNames": [
"org.mockito*",
"net.bytebuddy*",
"org.objenesis:*",
"org.hamcrest:*",
"junit:*"
]
}
]
}
Loading