From fc467552a1782986faf0e832b064cf0675327af6 Mon Sep 17 00:00:00 2001 From: Peter Zhu Date: Wed, 9 Sep 2026 18:15:52 -0400 Subject: [PATCH 1/3] Guard eclipse() to spotless tasks and keep P2 mirror on pinned version (common-utils) Signed-off-by: Peter Zhu --- .github/workflows/ci.yml | 1 - build.gradle | 26 ++++++++++++++++++++++++-- 2 files changed, 24 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e4a96dbd..27ba9c61 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -61,7 +61,6 @@ jobs: - 11 - 17 - 21 - - 23 name: Build and Test runs-on: windows-latest diff --git a/build.gradle b/build.gradle index f14b711a..6d8fc34a 100644 --- a/build.gradle +++ b/build.gradle @@ -25,13 +25,18 @@ buildscript { classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:${kotlin_version}" classpath "org.jetbrains.kotlin:kotlin-allopen:${kotlin_version}" // classpath "io.gitlab.arturbosch.detekt:detekt-gradle-plugin:1.20.0-RC1" + // Spotless 8.10.x requires a Java 17+ runtime to resolve its plugin. Only put it on the + // buildscript classpath on Java 17+ so the Java 11 CI matrix doesn't fail resolving it. + // The plugin is applied (also gated to Java 17+) further below only when available. + if (JavaVersion.current().isCompatibleWith(JavaVersion.VERSION_17)) { + classpath "com.diffplug.spotless:spotless-plugin-gradle:8.10.1" + } } } plugins { id 'java-library' id 'maven-publish' - id 'com.diffplug.spotless' version '6.22.0' } repositories { @@ -110,15 +115,32 @@ test { } } +// Spotless 8.10.x (the pinned Eclipse-JDT toolchain) requires a Java 17+ runtime to even +// resolve/apply its Gradle plugin. Skip it on older JDKs (e.g. the Java 11 CI matrix) so +// non-spotless builds don't fail at configuration time. Formatting still runs on Java 17+. +if (JavaVersion.current().isCompatibleWith(JavaVersion.VERSION_17)) { +apply plugin: 'com.diffplug.spotless' + +// Only wire the Eclipse JDT step when a spotless task is actually being run, so non-spotless +// Gradle invocations don't provision the formatter at configuration time. +def runningSpotlessTask = gradle.startParameter.taskNames.any { it.toLowerCase(Locale.ROOT).contains('spotless') } + spotless { java { removeUnusedImports() importOrder 'java', 'javax', 'org', 'com' licenseHeaderFile 'spotless.license.java' - eclipse().withP2Mirrors(Map.of("https://download.eclipse.org/", "https://ci.opensearch.org/")).configFile rootProject.file('.eclipseformat.xml') + // Pin 4.27 explicitly: spotless 8.10.0+ ships an embedded lockfile for it, so the + // formatter resolves from Maven Central through the mirror below instead of querying a + // P2 update site at configuration time. 4.27 keeps the formatting identical to the + // eclipse() default of the previous spotless 6.22.0 this branch used. + if (runningSpotlessTask) { + eclipse('4.27').withP2Mirrors(Map.of("https://download.eclipse.org/", "https://ci.opensearch.org/")).configFile rootProject.file('.eclipseformat.xml') + } } } +} // TODO: enable detekt only when snakeyaml vulnerability is fixed /*detekt { From fc6710dcdfdce53bd28f3f9afa01d204e45b56c4 Mon Sep 17 00:00:00 2001 From: Peter Zhu Date: Thu, 10 Sep 2026 18:11:07 -0400 Subject: [PATCH 2/3] Bump actions to latest pinned SHAs, add distribution, drop backport workflows (common-utils) Signed-off-by: Peter Zhu --- .github/workflows/auto-release.yml | 8 ++--- .github/workflows/backport.yml | 31 -------------------- .github/workflows/ci.yml | 13 ++++---- .github/workflows/delete_backport_branch.yml | 15 ---------- .github/workflows/maven-publish.yml | 8 ++--- 5 files changed, 15 insertions(+), 60 deletions(-) delete mode 100644 .github/workflows/backport.yml delete mode 100644 .github/workflows/delete_backport_branch.yml diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml index 4453d652..5dd91e05 100644 --- a/.github/workflows/auto-release.yml +++ b/.github/workflows/auto-release.yml @@ -14,16 +14,16 @@ jobs: steps: - name: GitHub App token id: github_app_token - uses: tibdex/github-app-token@v1.5.0 + uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0 with: app_id: ${{ secrets.APP_ID }} private_key: ${{ secrets.APP_PRIVATE_KEY }} installation_id: 22958780 - name: Get tag id: tag - uses: dawidd6/action-get-tag@v1 - - uses: actions/checkout@v2 - - uses: ncipollo/release-action@v1 + uses: dawidd6/action-get-tag@727a6f0a561be04e09013531e73a3983a65e3479 # v1.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0 with: github_token: ${{ steps.github_app_token.outputs.token }} bodyFile: release-notes/opensearch-common-utils.release-notes-${{steps.tag.outputs.tag}}.md \ No newline at end of file diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml deleted file mode 100644 index 56fef507..00000000 --- a/.github/workflows/backport.yml +++ /dev/null @@ -1,31 +0,0 @@ - -name: Backport -on: - pull_request_target: - types: - - closed - - labeled - -jobs: - backport: - runs-on: ubuntu-latest - permissions: - contents: write - pull-requests: write - name: Backport - steps: - - name: GitHub App token - id: github_app_token - uses: tibdex/github-app-token@v1.5.0 - with: - app_id: ${{ secrets.APP_ID }} - private_key: ${{ secrets.APP_PRIVATE_KEY }} - installation_id: 22958780 - - - name: Backport - uses: VachaShah/backport@v2.2.0 - with: - github_token: ${{ steps.github_app_token.outputs.token }} - branch_name: backport/backport-${{ github.event.number }} - labels_template: "<%= JSON.stringify([...labels, 'autocut']) %>" - failure_labels: "failed backport" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 27ba9c61..5e84aef2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -35,13 +35,13 @@ jobs: run: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-start-command }} - name: Setup Java ${{ matrix.java }} - uses: actions/setup-java@v4 + uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 with: distribution: 'temurin' java-version: ${{ matrix.java }} - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Build and Test run: | @@ -50,7 +50,7 @@ jobs: ./gradlew publishToMavenLocal" - name: Upload Coverage Report - uses: codecov/codecov-action@v1 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 with: token: ${{ secrets.CODECOV_TOKEN }} @@ -66,11 +66,12 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Java ${{ matrix.java }} - uses: actions/setup-java@v1 + uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 with: + distribution: temurin java-version: ${{ matrix.java }} - name: Build and Test @@ -82,7 +83,7 @@ jobs: ./gradlew publishToMavenLocal - name: Upload Coverage Report - uses: codecov/codecov-action@v1 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 with: token: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/delete_backport_branch.yml b/.github/workflows/delete_backport_branch.yml deleted file mode 100644 index f24f022b..00000000 --- a/.github/workflows/delete_backport_branch.yml +++ /dev/null @@ -1,15 +0,0 @@ -name: Delete merged branch of the backport PRs -on: - pull_request: - types: - - closed - -jobs: - delete-branch: - runs-on: ubuntu-latest - if: startsWith(github.event.pull_request.head.ref,'backport/') - steps: - - name: Delete merged branch - uses: SvanBoxel/delete-merged-branch@main - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/maven-publish.yml b/.github/workflows/maven-publish.yml index 4d97f581..86df42e9 100644 --- a/.github/workflows/maven-publish.yml +++ b/.github/workflows/maven-publish.yml @@ -19,11 +19,11 @@ jobs: contents: write steps: - - uses: actions/setup-java@v3 + - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 with: - distribution: temurin # Temurin is a distribution of adoptium + distribution: temurin java-version: 17 - - uses: actions/checkout@v3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Load secret uses: 1password/load-secrets-action@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5.0.1 @@ -36,7 +36,7 @@ jobs: MAVEN_SNAPSHOTS_S3_ROLE: op://opensearch-infra-secrets/maven-snapshots-s3/role - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v5 + uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4 with: role-to-assume: ${{ env.MAVEN_SNAPSHOTS_S3_ROLE }} aws-region: us-east-1 From 479d839d3466e55dc39169470e542b0b09d2eeca Mon Sep 17 00:00:00 2001 From: Peter Zhu Date: Thu, 10 Sep 2026 18:11:31 -0400 Subject: [PATCH 3/3] Remove auto-release workflow (common-utils) Signed-off-by: Peter Zhu --- .github/workflows/auto-release.yml | 29 ----------------------------- 1 file changed, 29 deletions(-) delete mode 100644 .github/workflows/auto-release.yml diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml deleted file mode 100644 index 5dd91e05..00000000 --- a/.github/workflows/auto-release.yml +++ /dev/null @@ -1,29 +0,0 @@ -name: Releases - -on: - push: - tags: - - '*' - -jobs: - - build: - runs-on: ubuntu-latest - permissions: - contents: write - steps: - - name: GitHub App token - id: github_app_token - uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0 - with: - app_id: ${{ secrets.APP_ID }} - private_key: ${{ secrets.APP_PRIVATE_KEY }} - installation_id: 22958780 - - name: Get tag - id: tag - uses: dawidd6/action-get-tag@727a6f0a561be04e09013531e73a3983a65e3479 # v1.1.0 - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0 - with: - github_token: ${{ steps.github_app_token.outputs.token }} - bodyFile: release-notes/opensearch-common-utils.release-notes-${{steps.tag.outputs.tag}}.md \ No newline at end of file