From 00640bded6e002c2832fc45c87622d406267cf4e Mon Sep 17 00:00:00 2001 From: Jon Bartels Date: Fri, 17 Jul 2026 10:45:05 -0400 Subject: [PATCH 1/5] Add Dependabot config for weekly Gradle updates Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: Jon Bartels --- .github/dependabot.yml | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..e07581508 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: "gradle" + directory: "/" + schedule: + interval: "weekly" From 2431eba50a6bc5e68756d197f707d88833e762a2 Mon Sep 17 00:00:00 2001 From: Jon Bartels Date: Fri, 17 Jul 2026 10:48:16 -0400 Subject: [PATCH 2/5] Run Dependabot Gradle updates monthly instead of weekly Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: Jon Bartels --- .github/dependabot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e07581508..dfa800a18 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,4 +3,4 @@ updates: - package-ecosystem: "gradle" directory: "/" schedule: - interval: "weekly" + interval: "monthly" From c6c59a275a80c4f1282ff8ddf7855afa4298ade2 Mon Sep 17 00:00:00 2001 From: Jon Bartels Date: Fri, 17 Jul 2026 10:59:23 -0400 Subject: [PATCH 3/5] Add Docker updates, cooldown, and grouping to Dependabot config Scan Dockerfile in addition to Gradle, require a 2-day minimum age (cooldown) before opening PRs, and group updates by coherent project family to reduce PR noise. Groups are keyed deep enough to keep unrelated org.apache.* projects (commons, log4j, ...) separate. Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: Jon Bartels --- .github/dependabot.yml | 71 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 71 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index dfa800a18..74f6080ab 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,3 +4,74 @@ updates: directory: "/" schedule: interval: "monthly" + # Wait 2 days after a release before opening a PR, to skip yanked/broken versions. + cooldown: + default-days: 2 + open-pull-requests-limit: 10 + labels: + - "dependencies" + - "java" + commit-message: + prefix: "chore(deps)" + include: "scope" + # Groups are keyed at the coherent-project level. Note e.g. org.apache.* is NOT a + # single project — org.apache.commons, org.apache.logging.log4j, org.apache.pdfbox, + # etc. are unrelated and must not be bundled together, so patterns go three levels deep. + groups: + aws-sdk: + patterns: + - "software.amazon.awssdk:*" + - "software.amazon.eventstream:*" + jetty: + patterns: + - "org.eclipse.jetty*" + jersey: + patterns: + - "org.glassfish.jersey*" + - "org.glassfish.hk2*" + jackson: + patterns: + - "com.fasterxml.jackson*" + netty: + patterns: + - "io.netty*" + - "com.typesafe.netty*" + log4j: + patterns: + - "org.apache.logging.log4j*" + apache-commons: + patterns: + - "org.apache.commons:*" + - "commons-*:*" + test-tooling: + patterns: + - "org.mockito*" + - "net.bytebuddy*" + - "org.objenesis:*" + - "org.hamcrest:*" + - "junit:*" + # Everything else: bundle only minor/patch so major bumps still arrive as + # individual PRs that get reviewed on their own. + all-minor-and-patch: + patterns: + - "*" + update-types: + - "minor" + - "patch" + + - package-ecosystem: "docker" + directory: "/" + schedule: + interval: "monthly" + cooldown: + default-days: 2 + open-pull-requests-limit: 5 + labels: + - "dependencies" + - "docker" + commit-message: + prefix: "chore(docker)" + groups: + docker-base-images: + patterns: + - "*" From 116e5d517b089d3d050246847a88c05ee478eb57 Mon Sep 17 00:00:00 2001 From: Jon Bartels Date: Fri, 17 Jul 2026 12:02:38 -0400 Subject: [PATCH 4/5] Removed cooldown, default is 3 days Signed-off-by: Jon Bartels --- .github/dependabot.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 74f6080ab..616dce695 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,9 +4,6 @@ updates: directory: "/" schedule: interval: "monthly" - # Wait 2 days after a release before opening a PR, to skip yanked/broken versions. - cooldown: - default-days: 2 open-pull-requests-limit: 10 labels: - "dependencies" @@ -63,8 +60,6 @@ updates: directory: "/" schedule: interval: "monthly" - cooldown: - default-days: 2 open-pull-requests-limit: 5 labels: - "dependencies" From 0c771db1d943b5d69c948758c98b42d82e036d67 Mon Sep 17 00:00:00 2001 From: Jon Bartels Date: Mon, 20 Jul 2026 19:26:56 -0400 Subject: [PATCH 5/5] Auto-regenerate Gradle verification metadata on Dependabot PRs Dependabot cannot update gradle/verification-metadata.xml (dependabot-core#1996), so its Gradle bumps fail CI on stale checksums. Add a workflow that, on dependabot/gradle/** branches, regenerates the metadata with a cold cache, validates the build, and commits the refreshed file back to the PR. Also clarify the all-minor-and-patch group comment: majors within a named group are not split into individual PRs. Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: Jon Bartels --- .github/dependabot.yml | 7 ++- .../dependabot-verification-metadata.yaml | 60 +++++++++++++++++++ 2 files changed, 65 insertions(+), 2 deletions(-) create mode 100644 .github/workflows/dependabot-verification-metadata.yaml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 616dce695..ba94cd59d 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -47,8 +47,11 @@ updates: - "org.objenesis:*" - "org.hamcrest:*" - "junit:*" - # Everything else: bundle only minor/patch so major bumps still arrive as - # individual PRs that get reviewed on their own. + # Catch-all for dependencies not matched by a named group above: bundle only + # minor/patch, so a major bump of an *ungrouped* dependency arrives as its own + # PR for individual review. (Majors within a named group are NOT split out — + # those groups have no update-types restriction, so e.g. a Jackson or Jetty + # major rides along in its group PR.) all-minor-and-patch: patterns: - "*" diff --git a/.github/workflows/dependabot-verification-metadata.yaml b/.github/workflows/dependabot-verification-metadata.yaml new file mode 100644 index 000000000..000cce61a --- /dev/null +++ b/.github/workflows/dependabot-verification-metadata.yaml @@ -0,0 +1,60 @@ +name: Dependabot Verification Metadata + +# Dependabot cannot update gradle/verification-metadata.xml (dependabot/dependabot-core#1996), +# so every Gradle bump it pushes would otherwise fail CI on stale checksums. This job +# regenerates the metadata with a cold cache (per CONTRIBUTING.md) on Dependabot's Gradle +# branches, validates the build in the same run, and commits the refreshed file back to the PR. +# +# Triggering on `push` (not `pull_request`) runs in the base-repo context with a writable +# token; Dependabot's pull_request runs get a read-only token and cannot push. + +on: + push: + branches: + - "dependabot/gradle/**" + +permissions: + contents: write + +concurrency: + group: dependabot-metadata-${{ github.ref }} + cancel-in-progress: true + +jobs: + regen: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Set up JDK + uses: actions/setup-java@v4 + with: + java-version: '17' + java-package: 'jdk+fx' + distribution: 'zulu' + + - name: Set up Gradle + uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4.4.3 + with: + validate-wrappers: true + + # Cold cache: a warm cache skips re-resolving already-cached parent POMs so they + # never get recorded, and the build then fails verification only later in CI. + # This step both regenerates the metadata and runs the same build CI runs, so a + # green run here proves the bumped artifacts verify and build. + - name: Regenerate verification metadata (cold cache) + run: | + GRADLE_USER_HOME="$(mktemp -d)" ./gradlew --write-verification-metadata sha256 \ + build dist -PdisableSigning=true -Pcoverage=true + + - name: Commit refreshed metadata + run: | + if git diff --quiet -- gradle/verification-metadata.xml; then + echo "No verification metadata changes to commit." + exit 0 + fi + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git commit -m "Regenerate Gradle dependency verification metadata" \ + -- gradle/verification-metadata.xml + git push origin "HEAD:${GITHUB_REF_NAME}"