build: enable Spark SQL tests for released Spark 4.2.0

.github/workflows/README.md

@@ -38,8 +38,8 @@ is a `workflow_call` reusable invoked from the umbrella.
   (PR+push)    (PR+push)    (PR+push)
                                                        |           |           |
                                                        v           v           v
-                                            spark_3_4 / spark_4_1   iceberg_1_8 / 1_9
-                                            (push or PR + label)    (push only)
+                                     spark_3_4 / spark_4_1 / spark_4_2  iceberg_1_8 / 1_9
+                                            (push or PR + label)        (push only)
 
   reusable workflows invoked via `uses:`:
     pr_build_linux.yml         spark_sql_test_reusable.yml
@@ -62,6 +62,7 @@ is a `workflow_call` reusable invoked from the umbrella.
 | `spark_4_0`          | PR or push, paths matched                        | Spark 4.0 sources                   |
 | `spark_3_4`          | push, **or** PR with `run-spark-3.4-tests` label | Spark 3.4 sources                   |
 | `spark_4_1`          | push, **or** PR with `run-spark-4.1-tests` label | Spark 4.1 sources                   |
+| `spark_4_2`          | push, **or** PR with `run-spark-4.2-tests` label | Spark 4.2 sources                   |
 | `iceberg_1_10`       | PR or push, paths matched                        | Iceberg sources                     |
 | `iceberg_1_8`        | push only                                        | Iceberg sources                     |
 | `iceberg_1_9`        | push only                                        | Iceberg sources                     |
@@ -86,14 +87,14 @@ umbrella doesn't watch, or operate independently of the rest of CI:
 
 ## Reusable workflows (called by `ci.yml`)
 
-| File                              | Called from `ci.yml` job(s)                        |
-| --------------------------------- | -------------------------------------------------- |
-| `pr_build_linux.yml`              | `pr_build_linux`                                   |
-| `pr_build_macos.yml`              | `pr_build_macos`                                   |
-| `pr_benchmark_check.yml`          | `pr_benchmark_check`                               |
-| `docs.yaml`                       | `docs`                                             |
-| `spark_sql_test_reusable.yml`     | `spark_3_4`, `spark_3_5`, `spark_4_0`, `spark_4_1` |
-| `iceberg_spark_test_reusable.yml` | `iceberg_1_8`, `iceberg_1_9`, `iceberg_1_10`       |
+| File                              | Called from `ci.yml` job(s)                                     |
+| --------------------------------- | --------------------------------------------------------------- |
+| `pr_build_linux.yml`              | `pr_build_linux`                                                |
+| `pr_build_macos.yml`              | `pr_build_macos`                                                |
+| `pr_benchmark_check.yml`          | `pr_benchmark_check`                                            |
+| `docs.yaml`                       | `docs`                                                          |
+| `spark_sql_test_reusable.yml`     | `spark_3_4`, `spark_3_5`, `spark_4_0`, `spark_4_1`, `spark_4_2` |
+| `iceberg_spark_test_reusable.yml` | `iceberg_1_8`, `iceberg_1_9`, `iceberg_1_10`                    |
 
 ## Modifying path filters
 

.github/workflows/ci.yml

@@ -38,6 +38,14 @@ on:
       - main
   workflow_dispatch:
 
+# Least-privilege default for the whole pipeline: every job here builds and tests,
+# and nothing needs to write back to the repository. Jobs that call reusable
+# workflows inherit this, and a callee can only narrow it further -- so the one
+# job that does need to write (docs, which pushes the built site to asf-site)
+# raises it to `contents: write` on itself.
+permissions:
+  contents: read
+
 jobs:
   # ---------------------------------------------------------------------------
   # preflight: cheap checks that gate everything else. Failure short-circuits
@@ -58,6 +66,7 @@ jobs:
       github.event.label.name == 'run-spark-3.4-tests' ||
       github.event.label.name == 'run-spark-4.0-tests' ||
       github.event.label.name == 'run-spark-4.1-tests' ||
+      github.event.label.name == 'run-spark-4.2-tests' ||
       github.event.label.name == 'run-iceberg-tests'
     steps:
       - uses: actions/checkout@v7
@@ -114,6 +123,7 @@ jobs:
       spark_3_5:    ${{ steps.compute.outputs.spark_3_5 }}
       spark_4_0:    ${{ steps.compute.outputs.spark_4_0 }}
       spark_4_1:    ${{ steps.compute.outputs.spark_4_1 }}
+      spark_4_2:    ${{ steps.compute.outputs.spark_4_2 }}
       iceberg_1_8:  ${{ steps.compute.outputs.iceberg_1_8 }}
       iceberg_1_9:  ${{ steps.compute.outputs.iceberg_1_9 }}
       iceberg_1_10: ${{ steps.compute.outputs.iceberg_1_10 }}
@@ -199,6 +209,10 @@ jobs:
     if: |
       needs.changes.outputs.docs == 'true' &&
       (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    # docs.yaml commits and pushes the generated site to the asf-site branch, so
+    # this job needs write access on top of the read-only default above.
+    permissions:
+      contents: write
     uses: ./.github/workflows/docs.yaml
 
   spark_3_4:
@@ -263,6 +277,23 @@ jobs:
       spark-full: '4.1.3'
       java: 17
 
+  spark_4_2:
+    name: Spark SQL Tests (Spark 4.2)
+    needs: changes
+    # Main-only by default; PRs need the `run-spark-4.2-tests` label. Spark 4.2
+    # support is still experimental, so keep it off the default PR path.
+    if: |
+      needs.changes.outputs.spark_4_2 == 'true' &&
+      (github.event_name == 'push' ||
+       github.event_name == 'workflow_dispatch' ||
+       (github.event_name == 'pull_request' &&
+        contains(github.event.pull_request.labels.*.name, 'run-spark-4.2-tests')))
+    uses: ./.github/workflows/spark_sql_test_reusable.yml
+    with:
+      spark-short: '4.2'
+      spark-full: '4.2.0'
+      java: 17
+
   iceberg_1_8:
     name: Iceberg Spark SQL Tests (Iceberg 1.8)
     needs: changes

dev/ci/compute-changes.py

@@ -177,6 +177,28 @@
         ".github/actions/setup-builder/**",
         ".github/actions/setup-spark-builder/**",
     ],
+    "spark_4_2": [
+        "native/**/src/**",
+        "native/**/Cargo.toml",
+        "native/Cargo.lock",
+        "common/src/main/**",
+        "common/pom.xml",
+        "spark/src/main/**",
+        "!spark/src/main/spark-3.4/**",
+        "!spark/src/main/spark-3.5/**",
+        "!spark/src/main/spark-3.x/**",
+        "!spark/src/main/spark-4.0/**",
+        "!spark/src/main/spark-4.1/**",
+        "!spark/src/main/scala/org/apache/comet/GenerateDocs.scala",
+        "spark/pom.xml",
+        "dev/diffs/4.2.0.diff",
+        "pom.xml",
+        "rust-toolchain.toml",
+        ".github/workflows/ci.yml",
+        ".github/workflows/spark_sql_test_reusable.yml",
+        ".github/actions/setup-builder/**",
+        ".github/actions/setup-spark-builder/**",
+    ],
     "iceberg_1_8": [
         "native/**/src/**",
         "native/**/Cargo.toml",