chore: Add renovate custom manager to update upper-bound files #3894

lqiu96 · 2025-08-29T19:45:29Z

Dependencies CI Test: https://github.com/googleapis/sdk-platform-java/actions/runs/18327368470/job/52195017520

Changes

In order to keep the current Maven pom.xml files the same, we create a new format in the dependencies.txt file:
{GroupID}:{ArtifactID},{MavenPropertyID}={Version}. The GroupID, ArtifactID, and Version values are by renovate bot to determine there should be a dependency bump. The MavenPropertyID and Version values are used to build the maven test command.

The format may not look intuitive and can be changed in the future. Values/ Separators were chosen so that it doesn't have any weird edge cases/ impact in shell scripts (avoiding ';', '*', '|' characters)

Local Renovate Bot Invocation

Local invocation of renovate shows that it is able to match the versions:

{
     "depName": "com.fasterxml.jackson:jackson-bom",
     "currentValue": "2.19.2",
     "datasource": "maven",
     "replaceString": "com.fasterxml.jackson:jackson-bom=2.19.2\n",
     "updates": [
       {
         "bucket": "non-major",
         "newVersion": "2.20.0",
         "newValue": "2.20.0",
         "releaseTimestamp": "2025-08-28T22:48:03.000Z",
         "newVersionAgeInDays": 0,
         "newMajor": 2,
         "newMinor": 20,
         "newPatch": 0,
         "updateType": "minor",
         "isBreaking": false,
         "branchName": "renovate/com.fasterxml.jackson-jackson-bom-2.x"
       }
     ],
     ...
 ],
   "matchStrings": ["(?<depName>.*)=(?<currentValue>.*)\\n"],
   "datasourceTemplate": "maven",
   "packageFile": "dependencies.txt"
 }

java-shared-dependencies/third-party-dependencies/pom.xml

gapic-generator-java-pom-parent/pom.xml

sonarqubecloud · 2025-08-29T20:11:03Z

Quality Gate passed for 'gapic-generator-java-root'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarqubecloud · 2025-08-29T20:15:13Z

Quality Gate passed for 'java_showcase_integration_tests'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

renovate.json

blakeli0 · 2025-10-10T20:52:37Z

gapic-generator-java-pom-parent/pom.xml

  <properties>
    <skipUnitTests>false</skipUnitTests>
    <checkstyle.header.file>java.header</checkstyle.header.file>
+    <maven.compiler.release>8</maven.compiler.release>


I think changes in this file is unintentional? If yes, can we revert it?

Moved the non-dependency property up (I think above is moreso a section for maven plugins.

…erties

lqiu96 · 2025-10-10T21:26:29Z

dependencies.txt

+javax.annotation:javax.annotation-api,javax.annotation-api=1.3.2
+io.grpc:grpc-bom,grpc=1.74.0
+com.google.auth:google-auth-library-bom,google.auth=1.37.1
+com.google.http-client:google-http-client,google.http-client=1.47.1
+com.google.code.gson:gson,gson=2.13.1


These may have some old versions that weren't merged properly. I think we should see renovate-bot raise a PR for these once this is merged in.

Where are the old versions pulled from? Can we keep the latest versions?

These are just old versions from this stale PR. Hopefully renovate bot can group the deps in these files in one deps PR.

SG. As long as we upgrade them before releasing sdk-platform-java, we should be good.

SG. As long as we upgrade them before releasing sdk-platform-java, we should be good.

I will merge this in and test this. Hopefully this should all come in as one big PR!

sonarqubecloud · 2025-10-10T21:34:57Z

Quality Gate passed for 'gapic-generator-java-root'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarqubecloud · 2025-10-10T21:38:49Z

Quality Gate passed for 'java_showcase_integration_tests'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

product-auto-label bot added the size: m Pull request size is medium. label Aug 29, 2025

lqiu96 commented Aug 29, 2025

View reviewed changes

java-shared-dependencies/third-party-dependencies/pom.xml Outdated Show resolved Hide resolved

lqiu96 commented Aug 29, 2025

View reviewed changes

gapic-generator-java-pom-parent/pom.xml Outdated Show resolved Hide resolved

product-auto-label bot added size: l Pull request size is large. and removed size: m Pull request size is medium. labels Oct 7, 2025

lqiu96 added 11 commits October 7, 2025 12:14

chore: Update renovate config to support dependencies.txt customMamager

18e2626

chore: Update the properties value to match dependencies.txt

b6d840a

chore: Update test dependency script

56cb44a

chore: Revert back to original renovate.json

fe4915d

chore: Fix 1P Google deps

a42349b

chore: Add a pomProperty matcher in the dependencies.txt file

6682d84

chore: Reset pom properties names to original value

74e2a15

chore: update dependencies.txt file to a new format

4e8bcf1

chore: Simplify script

b3693a6

chore: Update description of new format

5bcc0fc

chore: Fix pom format issues

ba9bb67

lqiu96 force-pushed the renovate-bot-upper-bound-file branch from 5e8d7b3 to ba9bb67 Compare October 7, 2025 16:19

product-auto-label bot added size: m Pull request size is medium. and removed size: l Pull request size is large. labels Oct 7, 2025

lqiu96 added 5 commits October 7, 2025 13:29

chore: Update the scripts

713523b

chore: Update to new dependencies.txt file

f27e301

chore: Fix deps format

f6f51bd

chore: Update format

40d3ffe

chore: Fix old format text

64e5ccf

lqiu96 marked this pull request as ready for review October 7, 2025 22:05

lqiu96 requested a review from blakeli0 October 7, 2025 22:05

blakeli0 reviewed Oct 10, 2025

View reviewed changes

chore: Restore customerManager matcher for gax-java/dependencies.prop…

23042f8

…erties

lqiu96 commented Oct 10, 2025

View reviewed changes

lqiu96 requested a review from blakeli0 October 10, 2025 21:27

blakeli0 approved these changes Oct 14, 2025

View reviewed changes

lqiu96 merged commit 4223a86 into main Oct 14, 2025
60 of 63 checks passed

lqiu96 deleted the renovate-bot-upper-bound-file branch October 14, 2025 21:32

chore: Add renovate custom manager to update upper-bound files #3894

chore: Add renovate custom manager to update upper-bound files #3894

Uh oh!

Conversation

lqiu96 commented Aug 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Local Renovate Bot Invocation

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud bot commented Aug 29, 2025

Quality Gate passed for 'gapic-generator-java-root'

Uh oh!

sonarqubecloud bot commented Aug 29, 2025

Quality Gate passed for 'java_showcase_integration_tests'

Uh oh!

Uh oh!

blakeli0 Oct 10, 2025

Choose a reason for hiding this comment

Uh oh!

lqiu96 Oct 10, 2025

Choose a reason for hiding this comment

Uh oh!

lqiu96 Oct 10, 2025

Choose a reason for hiding this comment

Uh oh!

blakeli0 Oct 13, 2025

Choose a reason for hiding this comment

Uh oh!

lqiu96 Oct 13, 2025

Choose a reason for hiding this comment

Uh oh!

blakeli0 Oct 14, 2025

Choose a reason for hiding this comment

Uh oh!

lqiu96 Oct 14, 2025

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Oct 10, 2025

Quality Gate passed for 'gapic-generator-java-root'

Uh oh!

sonarqubecloud bot commented Oct 10, 2025

Quality Gate passed for 'java_showcase_integration_tests'

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

lqiu96 commented Aug 29, 2025 •

edited

Loading