You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by ja...@apache.org on 2026/10/22 16:48:34 UTC
(ofbiz-framework) branch trunk updated (eb01ea135a -> 905e4cf03d)
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a change to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
from eb01ea135a Bump com.fasterxml.jackson.core:jackson-databind from 2.22.3 to 2.22.4
new aa8624c262 Group Dependabot updates and check for them weekly
new 1177219b57 Run the CodeQL analysis only when it is useful
new 38e2bc6d21 Build the Docker images only when they can be pushed and are needed
new 905e4cf03d Refactor Gradle build steps to separate Javadoc preparation, and perform data loading and integration tests
The 4 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.github/README-CI-CD.md | 8 +++--
.github/dependabot.yml | 66 ++++++++++++++++++++++++++---------
.github/workflows/codeql-analysis.yml | 42 ++++++++++++++++++++++
.github/workflows/docker-image.yml | 34 ++++++++++++++++--
.github/workflows/gradle.yml | 14 +++++---
5 files changed, 136 insertions(+), 28 deletions(-)
(ofbiz-framework) 04/04: Refactor Gradle build steps to separate Javadoc preparation, and perform data loading and integration tests
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 905e4cf03dfd801fde708aa5a49e360875063f20
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Thu Oct 22 11:10:56 2026 +0200
Refactor Gradle build steps to separate Javadoc preparation, and perform data loading and integration tests
---
.github/workflows/gradle.yml | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
index 3cea0c907b..33420504d9 100644
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -105,9 +105,13 @@ jobs:
run: ./pullAllPluginsSource.sh
- name: Build with Gradle
- run: ./gradlew check javadoc
+ run: ./gradlew check
-# Below does not work, see see https://lists.apache.org/thread/80wzf4kclfk5nh2fss56jd6otf7y4n2f
-# BuildBot does it anyway
-# - name: Builds with Gradle, checks style and run integration tests (just to know if they pass)
-# run: ./gradlew pullAllPluginsSource check javadoc loadAll testIntegration
+ - name: Prepare Javadocs with Gradle
+ run: ./gradlew javadoc
+
+ - name: Load demo and test data with Gradle
+ run: ./gradlew loadAll
+
+ - name: Run integration tests with Gradle
+ run: ./gradlew testIntegration
(ofbiz-framework) 03/04: Build the Docker images only when they can be pushed and are needed
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 38e2bc6d21c02dcb44df8298e6105e1748c0154b
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Thu Oct 22 10:53:05 2026 +0200
Build the Docker images only when they can be pushed and are needed
The Docker workflow builds three images, compiling OFBiz each time, on
an ubuntu-latest runner, a limited resource shared by all the ASF
projects:
- run the job only when the DO_DOCKER_PUSH variable is 'true': forks
built the images without being able to push them. To run the
workflow with act, pass --var DO_DOCKER_PUSH=true; the images are
still not pushed under act
- cancel the running or queued build of a branch when a new commit is
pushed to it, since only the images of the latest push replace the
-snapshot images; tag builds are never cancelled
- don't trigger the build for changes that cannot affect the images
(Markdown files, Windows scripts, IDE/devcontainer setup, other
workflows). The docs are copied into the images, so they still
trigger it. Paths filters are not evaluated for tag pushes, so
tags always build the images
Document the new condition and the cancellation in README-CI-CD.md.
Co-Authored-By: Claude Opus 5.5 <no...@anthropic.com>
---
.github/README-CI-CD.md | 4 ++--
.github/workflows/docker-image.yml | 34 +++++++++++++++++++++++++++++++---
2 files changed, 33 insertions(+), 5 deletions(-)
diff --git a/.github/README-CI-CD.md b/.github/README-CI-CD.md
index d4251946fc..be130e6dc2 100644
--- a/.github/README-CI-CD.md
+++ b/.github/README-CI-CD.md
@@ -11,8 +11,8 @@
→ Trigger: push / PR (except Dependabot PRs) + weekly on `trunk` and `release*`, skipped when only documentation or setup files change
- `docker-image.yml`
- Build and push images to `ghcr.io/apache/ofbiz`
- → Trigger: push on `trunk` / `release*` + tags
+ Build and push images to `ghcr.io/apache/ofbiz`, only if the `DO_DOCKER_PUSH` variable is `true`
+ → Trigger: push on `trunk` / `release*` + tags; a new push cancels the running build of the same branch
- `dependency-review.yml`
Vulnerability scanning for dependencies in PRs
diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index 793edf527b..672f695ce7 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -27,12 +27,13 @@
# Some actions, such as docker/metadata-action, require a GITHUB_TOKEN. To meet this
# requirement when using act you will need to create a Personal Access Token on GitHub.
# You can then run act using a command similar to:
-# act --job docker_build --secret GITHUB_TOKEN
+# act --job docker_build --secret GITHUB_TOKEN --var DO_DOCKER_PUSH=true
# Act will then prompt you to enter your token.
#############################################################################
-# Docker push will only occur if configuration variable DO_DOCKER_PUSH is set to 'true'.
-# This ensures that repository forks do not attempt push to the ghcr.io/apache/ofbiz container registry.
+# The images are only built and pushed if configuration variable DO_DOCKER_PUSH is set to 'true'.
+# This ensures that repository forks do not build images that they cannot push to the
+# ghcr.io/apache/ofbiz container registry.
# See https://docs.github.com/en/actions/learn-github-actions/variables#defining-configuration-variables-for-multiple-workflows
# for more information on configuring variables for a repository.
@@ -43,6 +44,32 @@ on:
branches: [ trunk, release* ]
tags:
- '**'
+ # Changes that cannot affect the images (Markdown files, IDE/devcontainer setup,
+ # Windows-only scripts, other workflows...) don't trigger the build: the ubuntu-latest
+ # runners are a limited resource shared by all the ASF projects.
+ # These patterns are not evaluated for the push of a tag, which always builds the images.
+ # GitHub evaluates these patterns in order, so a later pattern can re-include a path that an
+ # earlier "!" pattern excluded.
+ paths:
+ - '**'
+ - '!**.md'
+ - '!**.bat'
+ - '!.asf.yaml'
+ - '!.devcontainer/**'
+ - '!.gitattributes'
+ - '!.gitignore'
+ - '!.hgignore'
+ - '!.idea/**'
+ - '!.pre-commit-config.yaml'
+ - '!.github/**'
+ - '.github/workflows/docker-image.yml'
+
+# Only the images of the latest push to a branch matter, as they replace the -snapshot images
+# of the previous pushes, so a new push cancels the still running or queued build of the branch.
+# The builds of tags are never cancelled.
+concurrency:
+ group: ${{ github.workflow }}-${{ github.ref }}
+ cancel-in-progress: ${{ github.ref_type == 'branch' }}
permissions:
contents: read
@@ -50,6 +77,7 @@ permissions:
jobs:
docker_build:
name: Build and push OFBiz docker container images
+ if: vars.DO_DOCKER_PUSH == 'true'
runs-on: ubuntu-latest
permissions:
contents: read
(ofbiz-framework) 01/04: Group Dependabot updates and check for them weekly
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit aa8624c262d340f79ba4bd7460933d4c3c86d56b
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Thu Oct 22 10:53:05 2026 +0200
Group Dependabot updates and check for them weekly
Each Dependabot pull request runs the CI workflows on ubuntu-latest
runners, a limited resource shared by all the ASF projects: when it is
opened, again each time it is rebased after another pull request is
merged, and once more when it is merged. With daily checks and one pull
request per dependency, this added up to many builds for routine
updates.
Check for updates weekly instead of daily, and group the minor and
patch updates of each gradle, npm and github-actions entry in a single
pull request. Major updates, which need a closer review, still get
their own pull request. The codeql-action group stays first, so it
still collects the init and analyze actions, major updates included.
The docker entries have a single base image and need no group.
Document the schedule and the grouping in README-CI-CD.md.
Co-Authored-By: Claude Opus 5.5 <no...@anthropic.com>
---
.github/README-CI-CD.md | 2 ++
.github/dependabot.yml | 66 ++++++++++++++++++++++++++++++++++++-------------
2 files changed, 51 insertions(+), 17 deletions(-)
diff --git a/.github/README-CI-CD.md b/.github/README-CI-CD.md
index b811037ac9..3297a0c315 100644
--- a/.github/README-CI-CD.md
+++ b/.github/README-CI-CD.md
@@ -57,6 +57,8 @@ To label the PRs merged before `pr-type-label.yml` existed, run it manually from
Read **only from `trunk`**.
+Updates are checked weekly. The minor and patch updates of each ecosystem and branch are grouped in a single PR; major updates get their own PR.
+
Updates:
- GitHub Actions
- Docker base images
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index eacd5b87b8..f4d2412140 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -18,17 +18,25 @@
# Please see the documentation for all configuration options:
# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+# Each update runs the CI workflows on its pull request, again on each rebase
+# after another pull request is merged, and once more when it is merged.
+# To keep the number of jobs low, the updates are checked weekly and the minor
+# and patch updates of each entry are grouped in a single pull request, while
+# major updates, which need a closer review, still get their own pull request.
+# A dependency is put in the first group it matches.
+
version: 2
updates:
- package-ecosystem: "gradle"
directory: "/"
schedule:
- interval: "daily"
+ interval: "weekly"
open-pull-requests-limit: 40
- #groups:
- # all-dependencies:
- # patterns:
- # - "*"
+ groups:
+ minor-and-patch:
+ update-types:
+ - "minor"
+ - "patch"
ignore:
- dependency-name: "*"
update-types:
@@ -42,12 +50,13 @@ updates:
- "java"
- "release_branch"
schedule:
- interval: "daily"
+ interval: "weekly"
open-pull-requests-limit: 40
- #groups:
- # all-dependencies:
- # patterns:
- # - "*"
+ groups:
+ minor-and-patch:
+ update-types:
+ - "minor"
+ - "patch"
ignore:
- dependency-name: "*"
update-types:
@@ -66,14 +75,24 @@ updates:
- package-ecosystem: "npm"
directory: "themes/common-theme/webapp/common-theme/js"
schedule:
- interval: "daily"
+ interval: "weekly"
open-pull-requests-limit: 20
+ groups:
+ minor-and-patch:
+ update-types:
+ - "minor"
+ - "patch"
- package-ecosystem: "npm"
directory: "framework/rest-api"
schedule:
- interval: "daily"
+ interval: "weekly"
open-pull-requests-limit: 20
+ groups:
+ minor-and-patch:
+ update-types:
+ - "minor"
+ - "patch"
- package-ecosystem: "npm"
directory: "themes/common-theme/webapp/common-theme/js"
@@ -83,18 +102,27 @@ updates:
- "javascript"
- "release_branch"
schedule:
- interval: "daily"
+ interval: "weekly"
open-pull-requests-limit: 20
+ groups:
+ minor-and-patch:
+ update-types:
+ - "minor"
+ - "patch"
- package-ecosystem: github-actions
directory: /
schedule:
- interval: daily
+ interval: weekly
groups:
codeql-action:
patterns:
- "github/codeql-action/init"
- "github/codeql-action/analyze"
+ minor-and-patch:
+ update-types:
+ - "minor"
+ - "patch"
- package-ecosystem: github-actions
directory: /
@@ -104,17 +132,21 @@ updates:
- "github_actions"
- "release_branch"
schedule:
- interval: daily
+ interval: weekly
groups:
codeql-action:
patterns:
- "github/codeql-action/init"
- "github/codeql-action/analyze"
+ minor-and-patch:
+ update-types:
+ - "minor"
+ - "patch"
- package-ecosystem: docker
directory: /
schedule:
- interval: daily
+ interval: weekly
- package-ecosystem: docker
directory: /
@@ -124,4 +156,4 @@ updates:
- "docker"
- "release_branch"
schedule:
- interval: daily
+ interval: weekly
(ofbiz-framework) 02/04: Run the CodeQL analysis only when it is useful
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jacopoc pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 1177219b576f2e67a5f6886516fc5aff36016075
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Thu Oct 22 10:53:05 2026 +0200
Run the CodeQL analysis only when it is useful
The ubuntu-latest runners are a limited resource shared by all the ASF
projects, so avoid using them when the analysis cannot be affected:
- trigger the workflow only for changes that can affect the analyzed
sources, with the same paths filter as the Java CI workflow:
changes to documentation, Windows scripts, legal/info files,
Docker/IDE/devcontainer setup and other workflows no longer start
an analysis; the weekly scheduled analysis runs anyway
- cancel the analysis of a pull request that is still running or
queued when a new commit is pushed to it; analyses of pushes to
trunk and release* branches are never cancelled, and each of them
gets its own concurrency group
- skip the analysis of Dependabot pull requests, which only change
dependency versions; the push of their merge is analyzed as any
other push
Document the new triggers in README-CI-CD.md.
Co-Authored-By: Claude Opus 5.5 <no...@anthropic.com>
---
.github/README-CI-CD.md | 2 +-
.github/workflows/codeql-analysis.yml | 42 +++++++++++++++++++++++++++++++++++
2 files changed, 43 insertions(+), 1 deletion(-)
diff --git a/.github/README-CI-CD.md b/.github/README-CI-CD.md
index 3297a0c315..d4251946fc 100644
--- a/.github/README-CI-CD.md
+++ b/.github/README-CI-CD.md
@@ -8,7 +8,7 @@
- `codeql-analysis.yml`
Security analysis (Java + JavaScript)
- → Trigger: push / PR + weekly on `trunk` and `release*`
+ → Trigger: push / PR (except Dependabot PRs) + weekly on `trunk` and `release*`, skipped when only documentation or setup files change
- `docker-image.yml`
Build and push images to `ghcr.io/apache/ofbiz`
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index dc1f85d67f..aa003cb6e0 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -20,18 +20,60 @@ name: "CodeQL"
on:
push:
branches: [ trunk, release* ]
+ # Changes that cannot affect the analyzed sources (documentation, Docker/IDE/devcontainer
+ # setup, Windows-only scripts, other workflows...) don't trigger the analysis: the
+ # ubuntu-latest runners are a limited resource shared by all the ASF projects.
+ # The weekly scheduled analysis runs anyway.
+ # GitHub evaluates these patterns in order, so a later pattern can re-include a path that an
+ # earlier "!" pattern excluded.
+ paths: &analysis-paths
+ - '**'
+ - '!**.md'
+ - '!**.adoc'
+ - '!**/src/docs/**'
+ - '!docs/**'
+ - '!**.bat'
+ - '!APACHE2_HEADER'
+ - '!INSTALL'
+ - '!LICENSE'
+ - '!NOTICE'
+ - '!OPTIONAL_LIBRARIES'
+ - '!VERSION'
+ - '!.asf.yaml'
+ - '!.devcontainer/**'
+ - '!.dockerignore'
+ - '!.gitattributes'
+ - '!.gitignore'
+ - '!.hgignore'
+ - '!.idea/**'
+ - '!.pre-commit-config.yaml'
+ - '!Dockerfile'
+ - '!docker/**'
+ - '!.github/**'
+ - '.github/workflows/codeql-analysis.yml'
pull_request:
# The branches below must be a subset of the branches above
branches: [ trunk, release* ]
+ paths: *analysis-paths
schedule:
- cron: '27 15 * * 1'
+# A new push to a pull request makes its previous, still running or queued analysis useless.
+# Pushes to trunk and release* are never cancelled so that every commit gets its own result.
+# Each of them gets its own group (run_id): in a shared group a newer run would replace a pending one.
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+ cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
permissions:
contents: read
jobs:
analyze:
name: Analyze
+ # A Dependabot pull request only changes dependency versions, not the analyzed sources.
+ # The push of its merge is analyzed as any other push.
+ if: github.event.pull_request.user.login != 'dependabot[bot]'
runs-on: ubuntu-latest
permissions:
actions: read