Bump commons-configuration2 from 2.11.0 to 2.13.0 - #743
Merged
Conversation
Co-authored-by: Isaac
rauchy
approved these changes
Mar 27, 2026
6 tasks
github-merge-queue Bot
pushed a commit
that referenced
this pull request
Apr 8, 2026
## Summary Route Maven dependency resolution through JFrog Artifactory on hardened runners that block direct access to Maven Central. Authenticate via GitHub Actions OIDC (zero stored secrets). Modeled after the CLI ([#4875](databricks/cli#4875)), Go SDK ([#1609](databricks/databricks-sdk-go#1609)), and Python SDK ([#1379](databricks/databricks-sdk-py#1379)). ## What changed - **New composite action** (`.github/actions/setup-build-environment/action.yml`): Sets up JFrog CLI via OIDC, installs the JDK, and generates a `~/.m2/settings.xml` that mirrors all Maven repositories through JFrog (`db-maven`). Skipped on macOS (not hardened). - **`push.yml`**: Added workflow-level `id-token: write` permission for OIDC. Switched `fmt`, `unit-tests` (Linux), and `check-lock` jobs to `databricks-protected-runner-group`. macOS tests remain on public runners. Used matrix `include` to map OS strings to runner configs, preserving the original check names for branch protection compatibility. - **`Makefile`**: Added `fix-lockfile` target. - **`lockfile.json`**: Regenerated to pick up `commons-configuration2` 2.13.0 (was out of date since PR #743 bumped the POM without regenerating the lockfile). ## Why settings.xml is needed Hardened runners terminate SSL handshakes to `repo.maven.apache.org`. Unlike Go (`GOPROXY` env var) or Python (`UV_INDEX_URL`), Maven has no environment variable to redirect repository access. The standard mechanism is a `~/.m2/settings.xml` with a `<mirror>` entry that routes all repository requests through JFrog. ## The lockfile problem Maven's `lockfile.json` stores the full download URL in each dependency's `resolved` field. When Maven resolves through JFrog, these become `https://databricks.jfrog.io/artifactory/db-maven/...` instead of `https://repo.maven.apache.org/maven2/...`. If someone runs `make lock` while Maven is routed through JFrog (CI, VPN), the lockfile would contain proxy URLs that shouldn't be committed. ### make fix-lockfile Replaces JFrog proxy URLs with their public Maven Central equivalents in all `lockfile.json` files. Prevents proxy URLs from being accidentally committed. **When to use it**: Run `make fix-lockfile` before committing if you regenerated the lockfile while Maven was routing through JFrog. **CI enforcement**: The `fmt` job runs `make fix-lockfile` followed by `git diff --exit-code`, so any committed proxy URLs will fail CI. ## Cache ordering The Maven cache (`~/.m2/repository`) must be restored **before** the composite action runs. The composite action generates `~/.m2/settings.xml` with a fresh OIDC token. If the cache step runs after and restores `~/.m2` (including a stale `settings.xml` from a previous run), the expired token causes 401 errors. Caching only `~/.m2/repository` (not all of `~/.m2`) prevents this. ## Out of scope - **release.yml**: Publishes to Maven Central via Sonatype. Needs special publish runners per the migration guide. Separate follow-up with the security team. - **tagging.yml**: Generated from Universe (openapi/genkit/sync/workflows/tagging.yml). JFrog setup needs to be upstreamed to the genkit template. - **conftest.yml**: Only downloads conftest binary from GitHub Releases (not Maven). Can stay on ubuntu-latest. ## Test plan - [x] Verify mvn --errors spotless:check passes (fmt job) - [x] Verify mvn --errors test passes on Linux (Java 8, 11, 17, 20) - [x] Verify mvn --errors test passes on macOS (Java 8, 11, 17, 20) - [x] Verify make check-lock passes (lockfile validation) - [x] Verify conftest passes on the new workflow files - [x] Verify check names match branch protection rules NO_CHANGELOG=true --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
commons-configuration2from 2.11.0 to 2.13.0.commons-lang3dependency from 3.14.0 to 3.20.0.ClassUtils.getClass).NO_CHANGELOG=true
This pull request was AI-assisted by Isaac.