apache
diff --git a/‎.asf.yaml‎
Lines changed: 6 additions & 0 deletions b/‎.asf.yaml‎
Lines changed: 6 additions & 0 deletions
diff --git a/‎.github/REVIEWERS.yml‎
Lines changed: 2 additions & 7 deletions b/‎.github/REVIEWERS.yml‎
Lines changed: 2 additions & 7 deletions
diff --git a/‎.github/actions/dind-up-action/action.yml‎
Lines changed: 17 additions & 7 deletions b/‎.github/actions/dind-up-action/action.yml‎
Lines changed: 17 additions & 7 deletions
diff --git a/‎.github/actions/gradle-command-self-hosted-action/action.yml‎
Lines changed: 1 addition & 1 deletion b/‎.github/actions/gradle-command-self-hosted-action/action.yml‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎.github/actions/setup-default-test-properties/test-properties.json‎
Lines changed: 13 additions & 13 deletions b/‎.github/actions/setup-default-test-properties/test-properties.json‎
Lines changed: 13 additions & 13 deletions
diff --git a/‎.github/actions/setup-environment-action/action.yml‎
Lines changed: 8 additions & 7 deletions b/‎.github/actions/setup-environment-action/action.yml‎
Lines changed: 8 additions & 7 deletions
diff --git a/‎.github/build.gradle‎
Lines changed: 2 additions & 2 deletions b/‎.github/build.gradle‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎.github/gh-actions-self-hosted-runners/arc/README.md‎
Lines changed: 20 additions & 1 deletion b/‎.github/gh-actions-self-hosted-runners/arc/README.md‎
Lines changed: 20 additions & 1 deletion
diff --git a/‎.github/gh-actions-self-hosted-runners/arc/environments/beam.env‎
Lines changed: 5 additions & 5 deletions b/‎.github/gh-actions-self-hosted-runners/arc/environments/beam.env‎
Lines changed: 5 additions & 5 deletions
diff --git a/‎.github/gh-actions-self-hosted-runners/arc/helm.tf‎
Lines changed: 12 additions & 11 deletions b/‎.github/gh-actions-self-hosted-runners/arc/helm.tf‎
Lines changed: 12 additions & 11 deletions
@@ -51,6 +51,12 @@ github:
 
   protected_branches:
     master: {}
+    release-2.71.0-postrelease: {}
+    release-2.71: {}
+    release-2.70.0-postrelease: {}
+    release-2.70: {}
+    release-2.69.0-postrelease: {}
+    release-2.69: {}
     release-2.68.0-postrelease: {}
     release-2.68: {}
     release-2.67.0-postrelease: {}
 
@@ -23,25 +23,21 @@ labels:
       - jrmccluskey
       - lostluck
       - shunping
-      - liferoad
     exclusionList: []
   - name: Python
     reviewers:
       - claudevdm
       - damccorm
       - jrmccluskey
       - tvalentyn
-      - liferoad
       - shunping
     exclusionList: []
   - name: Java
     reviewers:
       - Abacn
       - ahmedabu98
       - chamikaramj
-      - m-trieu
       - kennknowles
-      - robertwb
     exclusionList: []
   - name: spanner
     reviewers:
@@ -65,17 +61,16 @@ labels:
     exclusionList: []
   - name: website
     reviewers:
+      - Abacn
       - damccorm
-      - liferoad
       - kennknowles
+      - shunping
     exclusionList: []
 fallbackReviewers:
   - Abacn
   - chamikaramj
   - damccorm
   - jrmccluskey
   - kennknowles
-  - liferoad
-  - robertwb
   - shunping
   - tvalentyn
@@ -43,7 +43,7 @@ inputs:
   storage-driver:
     default: overlay2
   additional-dockerd-args:
-    default: ""
+    default: "--tls=false"
   use-host-network:
     description: "Run DinD with --network host instead of publishing a TCP port."
     default: "false"
@@ -57,6 +57,9 @@ inputs:
     default: 10s
   wait-timeout:
     default: "180"
+  dind-image:
+    description: "DinD image. Use a fixed version tag to avoid issues."
+    default: "docker:27-dind"
 
   # --- NEW: Optional Setup & Verification Steps ---
   cleanup-dind-on-start:
@@ -129,7 +132,11 @@ runs:
 
         docker volume create --name "${STORAGE_VOL}" --label "com.github.dind=1" --label "com.github.repo=${GITHUB_REPOSITORY}" >/dev/null
         docker volume create --name "${EXECROOT_VOL}" --label "com.github.dind=1" --label "com.github.repo=${GITHUB_REPOSITORY}" >/dev/null
+
+        # Clean up any existing DinD containers
+        docker ps -a -q --filter "label=com.github.dind=1" | xargs -r docker rm -f -v 2>/dev/null || true
         docker rm -f -v "$NAME" 2>/dev/null || true
+        sleep 2
 
         NET_ARGS=""
         PUBLISH_ARGS="-p ${BIND}:${PORT}:${PORT}"
@@ -138,6 +145,8 @@ runs:
           PUBLISH_ARGS=""
         fi
 
+        IMAGE="${{ inputs.dind-image || 'docker:27-dind' }}"
+
         docker run -d --privileged --name "$NAME" \
           --cgroupns=host \
           -e DOCKER_TLS_CERTDIR= \
@@ -152,10 +161,11 @@ runs:
           --health-interval=${HI} \
           --health-retries=${HR} \
           --health-start-period=${HSP} \
-          docker:dind \
+          "${IMAGE}" \
             --host=tcp://0.0.0.0:${PORT} \
             --host=unix:///var/run/docker.sock \
             --storage-driver=${SD} \
+            --iptables=false \
             --exec-root=/execroot ${EXTRA}
 
         {
@@ -206,20 +216,20 @@ runs:
       run: |
         set -euo pipefail
         NAME="${{ inputs.container-name || 'dind-daemon' }}"
-        
+
         # Use host daemon to inspect the DinD container
         nm=$(docker inspect -f '{{.HostConfig.NetworkMode}}' "$NAME")
         echo "DinD NetworkMode=${nm}"
 
         # Try to find the bridge network IP
         ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$NAME" || true)
-        
+
         # If still empty, likely host networking -> use loopback
         if [[ -z "${ip}" || "${nm}" == "host" ]]; then
           echo "No bridge IP found or using host network. Falling back to 127.0.0.1."
           ip="127.0.0.1"
         fi
-        
+
         echo "Discovered DinD IP: ${ip}"
         echo "dind-ip=${ip}" >> "$GITHUB_OUTPUT"
 
@@ -237,7 +247,7 @@ runs:
         hostport=$(docker port redis-smoke 6379/tcp | sed 's/.*://')
         echo "Redis container started, mapped to host port ${hostport}"
         echo "Probing connection to ${DIND_IP}:${hostport} ..."
-        
+
         timeout 5 bash -c 'exec 3<>/dev/tcp/$DIND_IP/'"$hostport"
         if [[ $? -eq 0 ]]; then
           echo "TCP connection successful. Port mapping is working."
@@ -272,4 +282,4 @@ runs:
       shell: bash
       run: |
         echo "DOCKER_HOST=${{ steps.set-output.outputs.docker-host }}" >> "$GITHUB_ENV"
-        echo "DIND_IP=${{ steps.discover-ip.outputs.dind-ip }}" >> "$GITHUB_ENV"
+        echo "DIND_IP=${{ steps.discover-ip.outputs.dind-ip }}" >> "$GITHUB_ENV"
@@ -41,6 +41,6 @@ runs:
         if [ -f ~/.m2/settings.xml ]; then
           rm ~/.m2/settings.xml
         fi
-        ./gradlew ${{ inputs.gradle-command }} --max-workers=${{ inputs.max-workers }} --continue \
+        ./gradlew ${{ inputs.gradle-command }} --max-workers=${{ inputs.max-workers }} --continue --no-daemon \
          -Dorg.gradle.jvmargs=-Xms2g -Dorg.gradle.jvmargs=-Xmx6g -Dorg.gradle.vfs.watch=false -Pdocker-pull-licenses \
         ${{ inputs.arguments }}
@@ -1,23 +1,23 @@
 {
   "PythonTestProperties": {
-    "ALL_SUPPORTED_VERSIONS": ["3.9", "3.10", "3.11", "3.12"],
-    "LOWEST_SUPPORTED": ["3.9"],
-    "HIGHEST_SUPPORTED": ["3.12"],
-    "ESSENTIAL_VERSIONS": ["3.9", "3.12"],
-    "CROSS_LANGUAGE_VALIDATES_RUNNER_PYTHON_VERSIONS": ["3.9", "3.12"],
+    "ALL_SUPPORTED_VERSIONS": ["3.10", "3.11", "3.12", "3.13"],
+    "LOWEST_SUPPORTED": ["3.10"],
+    "HIGHEST_SUPPORTED": ["3.13"],
+    "ESSENTIAL_VERSIONS": ["3.10", "3.13"],
+    "CROSS_LANGUAGE_VALIDATES_RUNNER_PYTHON_VERSIONS": ["3.10", "3.12", "3.13"],
     "CROSS_LANGUAGE_VALIDATES_RUNNER_DATAFLOW_USING_SQL_PYTHON_VERSIONS": ["3.11"],
-    "VALIDATES_CONTAINER_DATAFLOW_PYTHON_VERSIONS": ["3.9", "3.10", "3.11", "3.12"],
-    "LOAD_TEST_PYTHON_VERSION": "3.9",
-    "CHICAGO_TAXI_EXAMPLE_FLINK_PYTHON_VERSION": "3.9",
-    "DEFAULT_INTERPRETER": "python3.9",
+    "VALIDATES_CONTAINER_DATAFLOW_PYTHON_VERSIONS": ["3.10", "3.11", "3.12", "3.13"],
+    "LOAD_TEST_PYTHON_VERSION": "3.10",
+    "CHICAGO_TAXI_EXAMPLE_FLINK_PYTHON_VERSION": "3.10",
+    "DEFAULT_INTERPRETER": "python3.10",
     "TOX_ENV": ["Cloud", "Cython"]
   },
   "JavaTestProperties": {
-    "SUPPORTED_VERSIONS": ["8", "11", "17", "21"],
-    "FLINK_VERSIONS": ["1.17", "1.18", "1.19"],
-    "SPARK_VERSIONS": ["2", "3"]
+    "SUPPORTED_VERSIONS": ["8", "11", "17", "21", "25"],
+    "FLINK_VERSIONS": ["1.17", "1.18", "1.19", "1.20"],
+    "SPARK_VERSIONS": ["3"]
   },
   "GoTestProperties": {
-    "SUPPORTED_VERSIONS": ["1.23"]
+    "SUPPORTED_VERSIONS": ["1.25"]
   }
 }
@@ -50,7 +50,7 @@ runs:
       if: ${{ inputs.python-version != '' }}
       uses: actions/setup-python@v5
       with:
-        python-version: ${{ inputs.python-version == 'default' && '3.9' || inputs.python-version }}
+        python-version: ${{ inputs.python-version == 'default' && '3.10' || inputs.python-version }}
         cache: ${{ inputs.python-cache && 'pip' || 'none' }}
         cache-dependency-path: |
           sdks/python/setup.py
@@ -64,10 +64,10 @@ runs:
           sdks/python/target/.tox
           !sdks/python/target/.tox/**/log
           !sdks/python/target/.tox/.package_cache
-        key: tox-${{ runner.os }}-py${{ inputs.python-version == 'default' && '39' || inputs.python-version }}-${{ hashFiles('sdks/python/tox.ini') }}-${{ hashFiles('sdks/python/setup.py') }}
+        key: tox-${{ runner.os }}-py${{ inputs.python-version == 'default' && '310' || inputs.python-version }}-${{ hashFiles('sdks/python/tox.ini') }}-${{ hashFiles('sdks/python/setup.py') }}
         restore-keys: |
-          tox-${{ runner.os }}-py${{ inputs.python-version == 'default' && '39' || inputs.python-version }}-${{ hashFiles('sdks/python/tox.ini') }}-
-          tox-${{ runner.os }}-py${{ inputs.python-version == 'default' && '39' || inputs.python-version }}-
+          tox-${{ runner.os }}-py${{ inputs.python-version == 'default' && '310' || inputs.python-version }}-${{ hashFiles('sdks/python/tox.ini') }}-
+          tox-${{ runner.os }}-py${{ inputs.python-version == 'default' && '310' || inputs.python-version }}-
 
     - name: Install Java
       if: ${{ inputs.java-version != '' }}
@@ -76,12 +76,13 @@ runs:
         distribution: 'temurin'
         java-version: ${{ inputs.java-version == 'default' && '11' || inputs.java-version }}
     - name: Setup Gradle
-      uses: gradle/gradle-build-action@v2
+      uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
       with:
         cache-disabled: ${{ inputs.disable-cache }}
+        validate-wrappers: false
     - name: Install Go
       if: ${{ inputs.go-version != '' }}
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v6
       with:
-        go-version: ${{ inputs.go-version == 'default' && '1.24' || inputs.go-version }} # never set patch, to get latest patch releases.
+        go-version: ${{ inputs.go-version == 'default' && '1.25' || inputs.go-version }} # never set patch, to get latest patch releases.
         cache-dependency-path: $${{ inputs.disable-cache && '' || 'sdks/go.sum' }}
@@ -48,15 +48,15 @@ task check {
           return
         }
 
-        // precommit and postcommit should triggered by this specific file
+        // precommit and postcommit should be triggered by this specific file
         // this is to ensure not missing test during release branch verification
         if (paths != null && !paths.contains('release/trigger_all_tests.json') && !fname.toLowerCase().contains('sickbay') && !workflow.name.toLowerCase().contains('disabled')) {
           errors.add("Error validating ${fname}: " +
                   "Please add 'release/trigger_all_tests.json' to the trigger path")
           return
         }
 
-        // postcommit should triggered by a specific file so that there is a way to exercise post for open PR
+        // postcommit should be triggered by a specific file so that there is a way to exercise post for open PR
         // TODO(https://github.com/apache/beam/issues/28909)
         //  remove file match trigger once a better trigger (e.g. comment trigger) is implemented
         if (fname.startsWith("beam_PostCommit")) {
 
@@ -96,7 +96,26 @@ terraform init -backend-config="bucket=bucket_name"
 terraform apply -var-file=environments/environment_name.env
 ```
 
+# Updating
+If you need to update the configuration (e.g. upgrading the github runner image, changing resource settings, etc), follow the steps below:
+
+1. From this directory, login to your gcloud account that you created the bucket with and init terraform. Replace bucket_name with the bucket for storing terraform state, e.g. `beam-arc-state`.
+```
+gcloud auth login
+gcloud auth application-default login
+terraform init -backend-config="bucket=bucket_name"
+```
+
+2. Terraform plan. Replace environment_name.env with the file under environments, e.g. `beam.env`. Fix config problems if any.
+```
+terraform plan -var-file=environments/environment_name.env
+```
+
+3. Terraform apply. Replace environment_name.env with the file under environments, e.g. `beam.env`.
+```
+terraform apply -var-file=environments/environment_name.env
+```
+
 # Maintanance
 
 - To access the ARC k8s cluster call the `get_kubeconfig_command` terraform output and run the command
-
 
@@ -21,7 +21,7 @@ project_id = "apache-beam-testing"
 region = "us-central1"
 zone = "us-central1-b"
 environment = "beam-prod"
-ingress_domain = "action.beam.apache.org" 
+ingress_domain = "action.beam.apache.org"
 organization = "apache"
 repository = "beam"
 github_app_id_secret_name = "gh-app_id"
@@ -35,7 +35,7 @@ service_account_id = "beam-github-actions@apache-beam-testing.iam.gserviceaccoun
 runner_group = "beam"
 main_runner = {
     name = "main-runner"
-    runner_image = "us-central1-docker.pkg.dev/apache-beam-testing/beam-github-actions/beam-arc-runner:3063b55757509dad1c14751c9f2aa5905826d9a0"
+    runner_image = "us-central1-docker.pkg.dev/apache-beam-testing/beam-github-actions/beam-arc-runner:d7cd81a1649bc665581951d2330c4b8acd19ed72"
     machine_type = "e2-standard-16"
     min_node_count = "1"
     max_node_count = "30"
@@ -51,7 +51,7 @@ main_runner = {
 additional_runner_pools = [{
     name = "small-runner"
     machine_type = "e2-standard-2"
-    runner_image = "us-central1-docker.pkg.dev/apache-beam-testing/beam-github-actions/beam-arc-runner:3063b55757509dad1c14751c9f2aa5905826d9a0"
+    runner_image = "us-central1-docker.pkg.dev/apache-beam-testing/beam-github-actions/beam-arc-runner:d7cd81a1649bc665581951d2330c4b8acd19ed72"
     min_node_count = "1"
     max_node_count = "15"
     min_replicas = "1"
@@ -68,7 +68,7 @@ additional_runner_pools = [{
 {
     name = "highmem-runner"
     machine_type = "c3-highmem-8"
-    runner_image = "us-central1-docker.pkg.dev/apache-beam-testing/beam-github-actions/beam-arc-runner:3063b55757509dad1c14751c9f2aa5905826d9a0"
+    runner_image = "us-central1-docker.pkg.dev/apache-beam-testing/beam-github-actions/beam-arc-runner:d7cd81a1649bc665581951d2330c4b8acd19ed72"
     min_node_count = "1"
     max_node_count = "15"
     min_replicas = "1"
@@ -85,7 +85,7 @@ additional_runner_pools = [{
 {
     name = "highmem-runner-22"
     machine_type = "c3-highmem-22"
-    runner_image = "us-central1-docker.pkg.dev/apache-beam-testing/beam-github-actions/beam-arc-runner:3063b55757509dad1c14751c9f2aa5905826d9a0"
+    runner_image = "us-central1-docker.pkg.dev/apache-beam-testing/beam-github-actions/beam-arc-runner:d7cd81a1649bc665581951d2330c4b8acd19ed72"
     min_node_count = "0"
     max_node_count = "8"
     min_replicas = "0"
 
@@ -22,14 +22,16 @@ resource "helm_release" "cert-manager" {
   create_namespace = true
   repository = "https://charts.jetstack.io"
   chart      = "cert-manager"
-  
+
   atomic = "true"
   timeout = 100
 
-  set {
-    name  = "installCRDs"
-    value = "true"
-  }
+  set = [
+    {
+      name  = "installCRDs"
+      value = "true"
+    }
+  ]
   depends_on = [ google_container_node_pool.main-actions-runner-pool ]
 }
 
@@ -43,12 +45,11 @@ resource "helm_release" "arc" {
   atomic = "true"
   timeout = 120
 
-  dynamic "set" {
-    for_each = local.arc_values
-    content {
-      name = set.key
-      value = set.value
+  set = [
+    for k, v in local.arc_values : {
+      name  = k
+      value = v
     }
-  }
+  ]
   depends_on = [ helm_release.cert-manager ]
 }