googleapis / googleapis/google-cloud-java

[sdk-platform-java] [Hermetic Build] Libraries BOM version rendered in README.md may not be up to date

Open
#12,374 0 comments 0 reactions 0 assignees View on GitHub
priority: p3 type: feature request
Dominant language
Java
Stars
2.1k
Forks
1.2k
Avg merge
1d 23h
Merged PRs (30d)
154

Description

We found out that java-storage had only one of the versions updated in https://github.com/googleapis/java-storage/pull/3267, where the BOM setup section was missing the version update.
This was also found in https://github.com/googleapis/java-bigquerystorage/pull/3070.

The root cause is in owl-bot relying on sample snippets instead of the BOM version of the config yaml. From internal investigation:

## "
Turns out that the value of libraries bom doesn't come from a template, but from a snippet in java-storage ([link](https://github.com/googleapis/java-storage/blob/e3d2d379db2e59b3fd0ab1c1a95bba32eb52d48d/samples/snippets/pom.xml#L28-L50)). The template readme [will render this if present](https://github.com/googleapis/sdk-platform-java/blob/f18318660c05d0d8466e3ead7127f0747fac2e2e/hermetic_build/library_generation/owlbot/templates/java_library/README.md?plain=1#L31-L36), which is the case in java-storage.

This seems to be an ambiguous case where hermetic build tries to manage the bom version when rendering templates, but the legacy synthtool under the hood would first try to fetch existing code which may or may not be updated beforehand ([renovate-bot takes care of this](https://github.com/googleapis/java-storage/commits/main/samples/snippets/pom.xml)).

On one hand, we have documentation pointing to libraries bom (this case) and other places, such as root pom.xml files, where the version is used in production code.

What if we simply use [the other case for installing it with BOM](https://github.com/googleapis/sdk-platform-java/blob/f18318660c05d0d8466e3ead7127f0747fac2e2e/hermetic_build/library_generation/owlbot/templates/java_library/README.md?plain=1#L39-L48) by default? We can do a survey and find out whether there are any repos using a special version of "install_with_bom" that is not covered by that default template.
## "

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.