You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@texera.apache.org by gi...@apache.org on 2026/07/05 17:23:24 UTC
(texera) branch main updated (6fdfe19106 -> 6e25ffbb7a)
This is an automated email from the ASF dual-hosted git repository.
github-merge-queue[bot] pushed a change to branch main
in repository https://gitbox.apache.org/repos/asf/texera.git
from 6fdfe19106 chore(deps): Upgrade to Pekko 1.6.0 (#6151)
new 42ea49f8b2 ci: submit sbt dependency graph for Dependabot alerts (#6163)
new 6e25ffbb7a ci: enable weekly Dependabot version updates (#6165)
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.github/dependabot.yml | 115 +++++++++++++++++++++++++++++++++
.github/workflows/dependency-graph.yml | 58 +++++++++++++++++
AGENTS.md | 8 ++-
3 files changed, 179 insertions(+), 2 deletions(-)
create mode 100644 .github/dependabot.yml
create mode 100644 .github/workflows/dependency-graph.yml
(texera) 02/02: ci: enable weekly Dependabot version updates (#6165)
Posted by gi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
github-merge-queue[bot] pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/texera.git
commit 6e25ffbb7ae01497079001bb4c7a1f1e6100fce2
Author: Yicong Huang <17...@users.noreply.github.com>
AuthorDate: Sun Jul 5 10:10:05 2026 -0700
ci: enable weekly Dependabot version updates (#6165)
### What changes were proposed in this PR?
Add `.github/dependabot.yml` to enable weekly Dependabot **version
updates** — the complementary half of #6163 (which feeds security
*alerts*): alerts flag vulnerable dependencies, version updates keep
dependencies current so alerts rarely fire.
| Ecosystem | Directory | Notes |
| --- | --- | --- |
| `sbt` | `/` (root build, all modules) | New Dependabot ecosystem
(beta, 2026-05); first use in the ASF org |
| `npm` | `/frontend`, `/pyright-language-service` | Angular majors
ignored — they need a guided `ng update` migration with framework/CLI
lines moving together (see #6155) |
| `bun` | `/agent-service` | agent-service is a Bun project (`bun.lock`)
|
| `npm` | `/bin/y-websocket-server` | Single-dependency utility, no
lockfile |
| `pip` | `/amber` | Covers `pyproject.toml` and all
`*requirements*.txt` in the directory (`requirements`,
`operator-requirements`, `dev-requirements`) — same detection the
dependency graph already uses for alerts |
| `github-actions` | `/` | Commit prefix `ci` per repo convention |
Noise control: **weekly** schedule, **patch bumps grouped into a single
PR per ecosystem** (bug-fix only, low risk); **minor and major bumps
come as individual PRs** — a failed group PR cannot be bisected by the
bot, so anything that can carry behavior changes passes or fails CI on
its own. ≤5 open PRs per ecosystem bounds the volume. (github-actions
stays fully grouped: SHA/tag bumps, ci-only blast radius.)
Commit/PR-title prefixes are split by dependency semantics (and
AGENTS.md is updated to record the convention): runtime/production bumps
get `fix(deps, <module>)` — they ship to users — while dev/toolchain
bumps get `chore(deps, <module>)` via `prefix-development` (npm
devDependencies, pip `dev-requirements.txt`, bun devDependencies), with
the module as second scope per the repo convention (`pyamber`,
`frontend`, `agent-service`, …; the cross-module sbt entry stays plain
`fix(deps)`); GitHub Actions bumps use `ci`. All types pass the PR title
check. 267 ASF repos already use `dependabot.yml`.
Notes for review:
- Local schema validation passes except the `sbt` enum value —
schemastore still lags the 2026-05 beta; GitHub's changelog ([Dependabot
version updates now support the sbt
ecosystem](https://github.blog/changelog/2026-05-26-dependabot-version-updates-now-support-the-sbt-ecosystem/))
is authoritative for the key. After merge, any config error would
surface under Insights → Dependency graph → Dependabot.
- The sbt ecosystem is beta: it may not follow every `build.sbt` pattern
(e.g. version `val`s), so missed sbt updates are expected at first, not
misconfiguration.
- `.asf.yaml`'s `dependabot_updates` (automatic security-*fix* PRs) is
deliberately left `false` to avoid a burst of bot PRs for the existing
alert backlog while #6152/#6155 are in flight; it can be flipped
separately later.
### Any related issues, documentation, discussions?
Closes #6164. Related: #6162 / #6163 (sbt dependency graph for alerts).
### How was this PR tested?
Config-only change; Dependabot runs server-side after merge, so it
cannot be exercised by PR CI. Validated locally:
- `yaml.safe_load` parses the file.
- `check-jsonschema --builtin-schema vendor.dependabot` passes for all
entries except the not-yet-in-schema `sbt` ecosystem value (see note
above).
### Was this PR authored or co-authored using generative AI tooling?
Generated-by: Claude Code (Claude Fable 5)
---------
Co-authored-by: Claude Fable 5 <no...@anthropic.com>
---
.github/dependabot.yml | 115 +++++++++++++++++++++++++++++++++++++++++++++++++
AGENTS.md | 8 +++-
2 files changed, 121 insertions(+), 2 deletions(-)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000000..d8709f4404
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,115 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Weekly Dependabot version updates. Patch bumps are grouped into one
+# PR per ecosystem (bug-fix only, low risk); minor and major bumps come
+# as individual PRs so each one passes or fails CI on its own. Security alerts are fed separately: npm/pip manifests
+# are parsed natively, sbt via .github/workflows/dependency-graph.yml.
+version: 2
+updates:
+ # Scala backend (root sbt build, all modules). Dependabot sbt support
+ # is in beta (2026-05); it cannot follow every build.sbt pattern yet,
+ # so treat missed updates as expected rather than misconfiguration.
+ - package-ecosystem: "sbt"
+ directory: "/"
+ schedule:
+ interval: "weekly"
+ open-pull-requests-limit: 5
+ commit-message:
+ prefix: "fix(deps)"
+ groups:
+ sbt-patch:
+ update-types:
+ - "patch"
+
+ - package-ecosystem: "npm"
+ directory: "/frontend"
+ schedule:
+ interval: "weekly"
+ open-pull-requests-limit: 5
+ commit-message:
+ prefix: "fix(deps, frontend)"
+ prefix-development: "chore(deps, frontend)"
+ groups:
+ frontend-patch:
+ update-types:
+ - "patch"
+ ignore:
+ # Angular majors need a guided `ng update` migration, and the
+ # framework/CLI lines must move together (see #6155).
+ - dependency-name: "@angular*/*"
+ update-types: ["version-update:semver-major"]
+
+ - package-ecosystem: "npm"
+ directory: "/pyright-language-service"
+ schedule:
+ interval: "weekly"
+ open-pull-requests-limit: 5
+ commit-message:
+ prefix: "fix(deps, pyright-language-service)"
+ prefix-development: "chore(deps, pyright-language-service)"
+ groups:
+ pyright-patch:
+ update-types:
+ - "patch"
+
+ - package-ecosystem: "bun"
+ directory: "/agent-service"
+ schedule:
+ interval: "weekly"
+ open-pull-requests-limit: 5
+ commit-message:
+ prefix: "fix(deps, agent-service)"
+ prefix-development: "chore(deps, agent-service)"
+ groups:
+ agent-service-patch:
+ update-types:
+ - "patch"
+
+ - package-ecosystem: "npm"
+ directory: "/bin/y-websocket-server"
+ schedule:
+ interval: "weekly"
+ open-pull-requests-limit: 5
+ commit-message:
+ prefix: "fix(deps, y-websocket-server)"
+ prefix-development: "chore(deps, y-websocket-server)"
+
+ - package-ecosystem: "pip"
+ directory: "/amber"
+ schedule:
+ interval: "weekly"
+ open-pull-requests-limit: 5
+ commit-message:
+ prefix: "fix(deps, pyamber)"
+ prefix-development: "chore(deps, pyamber)"
+ groups:
+ python-patch:
+ update-types:
+ - "patch"
+
+ - package-ecosystem: "github-actions"
+ directory: "/"
+ schedule:
+ interval: "weekly"
+ open-pull-requests-limit: 5
+ commit-message:
+ prefix: "ci"
+ groups:
+ github-actions:
+ patterns:
+ - "*"
diff --git a/AGENTS.md b/AGENTS.md
index 5927627dd0..a330f9712c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -124,8 +124,12 @@ Short, **Conventional Commits**, same shape for branch and commit subject.
Both ≤ ~60 chars. For code changes, if you use a scope, use the module name
(`amber`, `pyamber`, `frontend`, `agent-service`, `file-service`, …) — not
-`amber-python`. Use `chore(deps): ...` for dependency-only updates, and
-`ci: ...` for CI-only changes. No `Co-authored-by:` trailer for the repo
+`amber-python`. Dependency-only updates split by semantics: `fix(deps): ...` for
+runtime/production dependency bumps (they ship to users),
+`chore(deps): ...` for dev/toolchain-only bumps, and `ci: ...` for
+CI-only changes (including GitHub Actions bumps). Append the module
+as a second scope when the bump is module-specific, e.g.
+`fix(deps, pyamber): ...`; omit it for cross-module bumps (sbt). No `Co-authored-by:` trailer for the repo
owner.
### Issues and PRs
(texera) 01/02: ci: submit sbt dependency graph for Dependabot alerts (#6163)
Posted by gi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
github-merge-queue[bot] pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/texera.git
commit 42ea49f8b234137afaa711a0cc4697344abe76f4
Author: Yicong Huang <17...@users.noreply.github.com>
AuthorDate: Sun Jul 5 10:09:46 2026 -0700
ci: submit sbt dependency graph for Dependabot alerts (#6163)
### What changes were proposed in this PR?
Add `.github/workflows/dependency-graph.yml`: on every push to `main`,
resolve the sbt build and submit the full dependency graph (all modules,
transitive dependencies included) to GitHub via the Dependency
Submission API, using
[scalacenter/sbt-dependency-submission](https://github.com/scalacenter/sbt-dependency-submission).
GitHub cannot parse `build.sbt`, so today Dependabot alerts cover only
the npm/pip manifests and Scala dependencies are invisible — the
jackson-databind CVE batch fixed in #6152 never appeared in the security
tab and was caught by hand. With the graph submitted, Scala dependencies
(Jackson, Pekko, …) get Dependabot alerts like npm/pip. Alerts only — no
automatic PRs (Dependabot security updates do not support sbt).
Notes for review:
- The third-party actions are pinned to full commit SHAs per the [ASF
GitHub Actions
policy](https://infra.apache.org/github-actions-policy.html);
`sbt/setup-sbt` and `coursier/cache-action` reuse the exact pins already
used elsewhere in this repo. The same submission action (same SHA) is
used by apache/pekko and 7 other ASF repos.
- `configs-ignore` drops test/provided/optional/tooling scopes so alerts
reflect what ships.
- The job is guarded with `if: github.repository == 'apache/texera'` and
only triggers on push to `main`, so it never runs on forks or PRs.
### Any related issues, documentation, discussions?
Closes #6162
### How was this PR tested?
The workflow itself only runs post-merge on `apache/texera` `main` (see
guard above), so it cannot be exercised by PR CI. Verified locally by
running the underlying sbt plugin against this build:
```
sbt --addPluginSbtFile=<plugin.sbt> \
'githubGenerateSnapshot {"ignoredConfigs":["provided","optional","test","compile-internal","runtime-internal","scala-tool","scala-doc-tool"]}'
```
completes with `[success]` and writes a snapshot containing 577 resolved
packages across all modules, including
`com.fasterxml.jackson.core:jackson-databind:2.18.8` and
`org.apache.pekko:pekko-actor_2.13:1.6.0`. (It also surfaces a stale
transitive `jackson-databind:2.12.3` in the tree — exactly the kind of
finding this graph will make visible as an alert.)
### Was this PR authored or co-authored using generative AI tooling?
Generated-by: Claude Code (Claude Fable 5)
Co-authored-by: Claude Fable 5 <no...@anthropic.com>
---
.github/workflows/dependency-graph.yml | 58 ++++++++++++++++++++++++++++++++++
1 file changed, 58 insertions(+)
diff --git a/.github/workflows/dependency-graph.yml b/.github/workflows/dependency-graph.yml
new file mode 100644
index 0000000000..899b4ce35a
--- /dev/null
+++ b/.github/workflows/dependency-graph.yml
@@ -0,0 +1,58 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Submits the resolved sbt dependency graph (all modules, transitive
+# dependencies included) to GitHub via the Dependency Submission API so
+# that Dependabot alerts cover Scala dependencies, which GitHub cannot
+# parse from build.sbt on its own.
+name: Update Dependency Graph
+on:
+ push:
+ branches:
+ - main
+
+permissions: {}
+
+jobs:
+ dependency-graph:
+ name: Update Dependency Graph
+ runs-on: ubuntu-latest
+ if: github.repository == 'apache/texera'
+ permissions:
+ # The Dependency Submission API requires write permission
+ # on the repository
+ contents: write
+ steps:
+ - uses: actions/checkout@v5
+ with:
+ persist-credentials: false
+
+ - name: Setup JDK
+ uses: actions/setup-java@v5
+ with:
+ distribution: 'temurin'
+ java-version: 17
+
+ - name: Setup sbt launcher
+ uses: sbt/setup-sbt@508b753e53cb6095967669e0911487d2b9bc9f41 # v1.1.22
+
+ - uses: coursier/cache-action@90c37294538be80a558fd665531fcdc2b467b475 # v8.1.0
+
+ - name: Submit sbt dependency graph
+ uses: scalacenter/sbt-dependency-submission@d84eef4c09e633bcf5f113bcad7fd5e9af1baee9 # v3.1.1
+ with:
+ configs-ignore: provided optional test compile-internal runtime-internal scala-tool scala-doc-tool