You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@logging.apache.org by "vy (via GitHub)" <gi...@apache.org> on 2026/04/14 13:52:51 UTC
[PR] Document that GHA workflows are moved to `gha/v0` [logging-parent]
vy opened a new pull request, #455:
URL: https://github.com/apache/logging-parent/pull/455
Document that GHA workflows are moved to `gha/v0`, remove mention of automated dependabot PR merge, and dust off some other basic infrastructure.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document that GHA workflows are moved to `gha/v0` [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #455:
URL: https://github.com/apache/logging-parent/pull/455#discussion_r3092234616
##########
pom.xml:
##########
@@ -630,6 +630,8 @@
<!-- License headers in GitHub templates pollute the prompt displayed to the user: -->
<exclude>.github/ISSUE_TEMPLATE/*.md</exclude>
<exclude>.github/pull_request_template.md</exclude>
+ <!-- `.logging-parent-bom-activator` activates the `bom` Maven profile: -->
+ <exclude>.logging-parent-bom-activator</exclude>
Review Comment:
CycloneDX also uses SPDX license expressions: https://cyclonedx.org/docs/1.7/json/#metadata_tools_oneOf_i0_components_items_licenses
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document that GHA workflows are moved to `gha/v0` [logging-parent]
Posted by "vy (via GitHub)" <gi...@apache.org>.
vy commented on code in PR #455:
URL: https://github.com/apache/logging-parent/pull/455#discussion_r3091813941
##########
package-lock.json:
##########
@@ -703,20 +703,6 @@
"node": ">= 0.4"
}
},
- "node_modules/dunder-proto": {
- "version": "1.0.1",
- "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
- "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
- "license": "MIT",
- "dependencies": {
- "call-bind-apply-helpers": "^1.0.1",
- "es-errors": "^1.3.0",
- "gopd": "^1.2.0"
- },
- "engines": {
- "node": ">= 0.4"
- }
- },
Review Comment:
Fixed in c527f5b.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document that GHA workflows are moved to `gha/v0` [logging-parent]
Posted by "vy (via GitHub)" <gi...@apache.org>.
vy commented on code in PR #455:
URL: https://github.com/apache/logging-parent/pull/455#discussion_r3091799093
##########
pom.xml:
##########
@@ -630,6 +630,8 @@
<!-- License headers in GitHub templates pollute the prompt displayed to the user: -->
<exclude>.github/ISSUE_TEMPLATE/*.md</exclude>
<exclude>.github/pull_request_template.md</exclude>
+ <!-- `.logging-parent-bom-activator` activates the `bom` Maven profile: -->
+ <exclude>.logging-parent-bom-activator</exclude>
Review Comment:
Last time I've checked we're a CDX company. 😉
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document that GHA workflows are moved to `gha/v0` [logging-parent]
Posted by "vy (via GitHub)" <gi...@apache.org>.
vy merged PR #455:
URL: https://github.com/apache/logging-parent/pull/455
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document that GHA workflows are moved to `gha/v0` [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #455:
URL: https://github.com/apache/logging-parent/pull/455#discussion_r3081095152
##########
pom.xml:
##########
@@ -630,6 +630,8 @@
<!-- License headers in GitHub templates pollute the prompt displayed to the user: -->
<exclude>.github/ISSUE_TEMPLATE/*.md</exclude>
<exclude>.github/pull_request_template.md</exclude>
+ <!-- `.logging-parent-bom-activator` activates the `bom` Maven profile: -->
+ <exclude>.logging-parent-bom-activator</exclude>
Review Comment:
_Nit_: alternatively we can use the shortest possible license declaration:
```
SPDX-License-Identifier: Apache-2.0
```
##########
.github/dependabot.yaml:
##########
@@ -17,33 +17,50 @@
version: 2
-# Add Maven Central explicitly to work around:
-# https://github.com/dependabot/dependabot-core/issues/8329
-registries:
- maven-central:
- type: maven-repository
- url: https://repo.maven.apache.org/maven2
-
updates:
+ # region `main` updates
+
- package-ecosystem: maven
directory: "/"
schedule:
- interval: daily
- open-pull-requests-limit: 10
+ interval: monthly
+ groups:
+ dependencies:
+ patterns: [ "*" ]
+ target-branch: "main"
registries:
- maven-central
- package-ecosystem: github-actions
directory: "/"
schedule:
- interval: daily
+ interval: monthly
Review Comment:
GitHub Actions might need to be updated more often than monthly, but I would apply the recommended `cooldown` period. In our case, the cooldown period allows the INFRA team to review and allow the new version of the action.
```suggestion
interval: weekly
cooldown:
default-days: 7
```
##########
.github/dependabot.yaml:
##########
@@ -17,33 +17,50 @@
version: 2
-# Add Maven Central explicitly to work around:
-# https://github.com/dependabot/dependabot-core/issues/8329
-registries:
- maven-central:
- type: maven-repository
- url: https://repo.maven.apache.org/maven2
-
updates:
+ # region `main` updates
+
- package-ecosystem: maven
directory: "/"
schedule:
- interval: daily
- open-pull-requests-limit: 10
+ interval: monthly
+ groups:
+ dependencies:
+ patterns: [ "*" ]
+ target-branch: "main"
registries:
- maven-central
- package-ecosystem: github-actions
directory: "/"
schedule:
- interval: daily
+ interval: monthly
+ groups:
+ dependencies:
+ patterns: [ "*" ]
+ target-branch: "main"
- package-ecosystem: npm
directory: "/"
schedule:
interval: monthly
groups:
- all:
- patterns:
- - "*"
+ dependencies:
+ patterns: [ "*" ]
+ target-branch: "main"
+
+ # endregion
+
+ # region `gha/v0` updates
+
+ - package-ecosystem: github-actions
+ directory: "/"
+ schedule:
+ interval: monthly
Review Comment:
Same as above: weekly, but with a cooldown.
```suggestion
schedule:
interval: weekly
cooldown:
default-days: 7
```
##########
.github/workflows/codeql-analysis.yaml:
##########
@@ -34,21 +38,9 @@ permissions: { }
jobs:
analyze:
- name: Analyze
- runs-on: ubuntu-latest
+ uses: apache/logging-parent/.github/workflows/codeql-analysis-reusable.yaml@gha/v0
Review Comment:
The `logging-parent` repo does not have any Java code, this is why `codeql-analysis` was copy-pasted and slightly adapted, instead of using the `codeql-analysis-reusable`.
##########
package-lock.json:
##########
@@ -703,20 +703,6 @@
"node": ">= 0.4"
}
},
- "node_modules/dunder-proto": {
- "version": "1.0.1",
- "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
- "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
- "license": "MIT",
- "dependencies": {
- "call-bind-apply-helpers": "^1.0.1",
- "es-errors": "^1.3.0",
- "gopd": "^1.2.0"
- },
- "engines": {
- "node": ">= 0.4"
- }
- },
Review Comment:
I am not sure, why this PR updates the lock file.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document that GHA workflows are moved to `gha/v0` [logging-parent]
Posted by "vy (via GitHub)" <gi...@apache.org>.
vy commented on code in PR #455:
URL: https://github.com/apache/logging-parent/pull/455#discussion_r3091789510
##########
.github/workflows/codeql-analysis.yaml:
##########
@@ -34,21 +38,9 @@ permissions: { }
jobs:
analyze:
- name: Analyze
- runs-on: ubuntu-latest
+ uses: apache/logging-parent/.github/workflows/codeql-analysis-reusable.yaml@gha/v0
Review Comment:
Unless there is a big performance gain I'm not able to see, I'd like to keep things simple for maintainers and others trying to reason about the code.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document that GHA workflows are moved to `gha/v0` [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #455:
URL: https://github.com/apache/logging-parent/pull/455#discussion_r3092121880
##########
.github/workflows/codeql-analysis.yaml:
##########
@@ -34,21 +38,9 @@ permissions: { }
jobs:
analyze:
- name: Analyze
- runs-on: ubuntu-latest
+ uses: apache/logging-parent/.github/workflows/codeql-analysis-reusable.yaml@gha/v0
Review Comment:
Isn't this the reason CodeQL is failing?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Document that GHA workflows are moved to `gha/v0` [logging-parent]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #455:
URL: https://github.com/apache/logging-parent/pull/455#discussion_r3092207668
##########
.github/workflows/codeql-analysis.yaml:
##########
@@ -34,21 +38,9 @@ permissions: { }
jobs:
analyze:
- name: Analyze
- runs-on: ubuntu-latest
+ uses: apache/logging-parent/.github/workflows/codeql-analysis-reusable.yaml@gha/v0
Review Comment:
See the error in https://github.com/apache/logging-parent/actions/runs/24502703900/job/71613300989
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org