spark-runtime: publish sources and javadoc-Jar with contents of its subprojects

.github/trivyignore/kafka-connect-runtime.trivyignore

@@ -0,0 +1,29 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+# Trivy ignore file for the Kafka Connect runtime distribution.
+#
+# The Kafka Connect runtime's own jackson-databind is already aligned to the
+# project version (2.22.x). The remaining finding comes from parquet-jackson,
+# which ships its own shaded copy of jackson-databind (relocated under
+# shaded.parquet.*). That copy cannot be upgraded independently of Apache
+# Parquet, and 1.17.1 still bundles a vulnerable version.
+#
+# jackson-databind CVEs shaded into parquet-jackson, only fixed in jackson
+# >= 2.21.4 / 2.18.8.
+CVE-2026-54512
+CVE-2026-54513

.github/trivyignore/spark-runtime-3.5.trivyignore

@@ -0,0 +1,27 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+# Trivy ignore file for the Spark 3.5 runtime bundle.
+#
+# The Spark 3.5 runtime bundles the Jackson version provided by Spark 3.5
+# (jackson 2.15.x), which cannot be safely upgraded without breaking
+# compatibility with Spark 3.5. Newer Spark lines (4.0, 4.1) align Jackson to a
+# fixed version instead of ignoring the finding.
+#
+# jackson-databind CVEs that are only fixed in jackson >= 2.18.8.
+CVE-2026-54512
+CVE-2026-54513

.github/workflows/api-binary-compatibility.yml

@@ -46,7 +46,7 @@ jobs:
   revapi:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # fetch-depth of zero ensures that the tags are pulled in and we're not in a detached HEAD state
           # revapi depends on the tags, specifically the tag from git describe, to find the relevant override
@@ -55,11 +55,11 @@ jobs:
           # See https://github.com/actions/checkout/issues/124
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
           distribution: zulu
           java-version: 17
-      - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+      - uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           # Read-only: small job; restore opportunistically from other jobs' caches but never write.
           cache-read-only: true

.github/workflows/asf-allowlist-check.yml

@@ -25,13 +25,9 @@ name: "ASF Allowlist Check"
 
 on:
   pull_request:
-    paths:
-      - ".github/**"
   push:
     branches:
       - main
-    paths:
-      - ".github/**"
 
 permissions:
   contents: read
@@ -40,7 +36,7 @@ jobs:
   asf-allowlist-check:
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         persist-credentials: false
     - uses: apache/infrastructure-actions/allowlist-check@4e9c961f587f72b170874b6f5cd4ac15f7f26eb8  # main

.github/workflows/codeql.yml

@@ -41,7 +41,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         persist-credentials: false
 

.github/workflows/cve-scan.yml

@@ -31,6 +31,7 @@ on:
     - '**'
     - '!.github/**'
     - '.github/workflows/cve-scan.yml'
+    - '.github/trivyignore/**'
     - '!.baseline/**'
     - '!.palantir/**'
     - '!.gitignore'
@@ -54,6 +55,7 @@ on:
     - '**'
     - '!.github/**'
     - '.github/workflows/cve-scan.yml'
+    - '.github/trivyignore/**'
     - '!.baseline/**'
     - '!.palantir/**'
     - '!.gitignore'
@@ -86,12 +88,13 @@ jobs:
   # Trivy CVE scan — scans bundled jars for known vulnerabilities.
   #
   # Behaviour:
-  #   - On PRs: the scan blocks CI if CVEs are found (exit-code 1).
-  #     SARIF upload is skipped because GitHub's Security tab only
-  #     accepts results from default/protected branches.
-  #   - On push to main/release branches: the scan is informational
-  #     (exit-code 0) and results are uploaded as SARIF to the GitHub
-  #     Security tab for ongoing tracking.
+  #   - Trivy always writes SARIF with exit-code 0. The reporting step owns
+  #     finding-based failures so GitHub opens the step with actionable details.
+  #   - On PRs: the reporting step blocks CI if HIGH/CRITICAL CVEs are found.
+  #   - On push to main/release branches and release tags: findings are
+  #     informational, then SARIF is uploaded to the GitHub Security tab.
+  #   - Missing or unparseable SARIF is still a failure on every event because
+  #     it means the scan did not produce usable results.
   # ------------------------------------------------------------------
   cve-scan:
     runs-on: ubuntu-24.04
@@ -113,6 +116,7 @@ jobs:
             :iceberg-kafka-connect:iceberg-kafka-connect-runtime:distZip
           scan-path: kafka-connect/kafka-connect-runtime/build/distributions
           unpack: true
+          trivyignores: .github/trivyignore/kafka-connect-runtime.trivyignore
         - distribution: aws-bundle
           build-task: :iceberg-aws-bundle:shadowJar
           scan-path: aws-bundle/build/libs
@@ -131,6 +135,7 @@ jobs:
             :iceberg-spark:iceberg-spark-runtime-3.5_2.12:shadowJar
           scan-path: spark/v3.5/spark-runtime/build/libs
           unpack: false
+          trivyignores: .github/trivyignore/spark-runtime-3.5.trivyignore
         - distribution: spark-runtime-4.0_2.13
           build-task: >-
             -DsparkVersions=4.0
@@ -167,14 +172,14 @@ jobs:
           unpack: false
     name: ${{ matrix.distribution }}
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
       with:
         distribution: zulu
         java-version: 21
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+    - uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
       with:
         # Read-only: small job; restore opportunistically from other jobs' caches but never write.
         cache-read-only: true
@@ -214,20 +219,109 @@ jobs:
         scan-ref: '/tmp/cve-scan'
         scanners: 'vuln'
         severity: 'HIGH,CRITICAL'
+        trivyignores: ${{ matrix.trivyignores }}
         limit-severities-for-sarif: true
-        # Block PRs on CVE findings; on main/release branches report without failing
-        exit-code: ${{ github.event_name == 'pull_request' && '1' || '0' }}
+        # Let Trivy generate SARIF without failing on findings. GitHub opens the
+        # failed step by default, so PRs fail later in the reporting step that
+        # prints the actionable CVE details.
+        exit-code: '0'
         format: 'sarif'
         output: 'trivy-results.sarif'
         trivy-image: ${{ env.TRIVY_IMAGE }}
-    - name: Print Trivy scan results
+    - name: Report Trivy scan results
       if: always()
+      env:
+        # PRs block on findings; push runs report findings without failing so
+        # SARIF can be uploaded to GitHub Security for tracking.
+        FAIL_ON_FINDINGS: ${{ github.event_name == 'pull_request' && 'true' || 'false' }}
       run: |
-        if [ -f trivy-results.sarif ]; then
-          echo "## Trivy CVE Scan Results — ${{ matrix.distribution }}"
-          jq -r '.runs[].results[] | "- \(.ruleId): \(.message.text)"' trivy-results.sarif 2>/dev/null || echo "No findings or unable to parse SARIF."
-        else
-          echo "No SARIF file found — scan may have failed to install."
+        results_file="trivy-results.sarif"
+        summary="${GITHUB_STEP_SUMMARY:-/dev/null}"
+
+        log() {
+          printf '%s\n' "$*" | tee -a "${summary}"
+        }
+
+        markdown_escape() {
+          value="$1"
+          value="${value//|/\\|}"
+          printf '%s' "${value}"
+        }
+
+        escape_annotation() {
+          value="$1"
+          value="${value//'%'/%25}"
+          value="${value//$'\r'/%0D}"
+          value="${value//$'\n'/%0A}"
+          printf '%s' "${value}"
+        }
+
+        extract_findings() {
+          jq -r '
+            def field($prefix):
+              (.message.text | split("\n") | map(select(startswith($prefix))) | first // "")
+              | ltrimstr($prefix);
+
+            .runs[].results[]?
+            | [
+                .ruleId,
+                field("Severity: "),
+                field("Package: "),
+                field("Installed Version: "),
+                field("Fixed Version: "),
+                field("Link: ")
+              ]
+            | @tsv
+          ' "${results_file}"
+        }
+
+        report_findings() {
+          log "Found ${finding_count} HIGH/CRITICAL vulnerabilities."
+          log ""
+          log "| CVE | Severity | Package | Installed | Fixed | Link |"
+          log "| --- | --- | --- | --- | --- | --- |"
+
+          while IFS=$'\t' read -r cve severity package installed fixed link; do
+            cve="$(markdown_escape "${cve}")"
+            severity="$(markdown_escape "${severity}")"
+            package="$(markdown_escape "${package}")"
+            installed="$(markdown_escape "${installed}")"
+            fixed="$(markdown_escape "${fixed}")"
+            link="$(markdown_escape "${link}")"
+            log "| ${cve} | ${severity} | \`${package}\` | \`${installed}\` | ${fixed} | ${link} |"
+          done <<< "${findings}"
+        }
+
+        if [ ! -f "${results_file}" ]; then
+          log "No SARIF file found — scan may have failed to run."
+          exit 1
+        fi
+
+        if ! findings="$(extract_findings)"; then
+          log "Unable to parse Trivy SARIF results."
+          exit 1
+        fi
+
+        log "## Trivy CVE Scan Results — ${{ matrix.distribution }}"
+
+        if [ -z "${findings}" ]; then
+          log "No HIGH or CRITICAL vulnerabilities found."
+          exit 0
+        fi
+
+        finding_count="$(printf '%s\n' "${findings}" | awk 'END { print NR }')"
+        finding_ids="$(printf '%s\n' "${findings}" | cut -f1 | awk 'BEGIN { sep="" } { printf "%s%s", sep, $0; sep=", " } END { print "" }')"
+
+        report_findings
+
+        if [ "${FAIL_ON_FINDINGS}" = "true" ]; then
+          # Surface findings in the PR checks UI, not just in the workflow logs.
+          annotation_message="Trivy found ${finding_count} HIGH/CRITICAL vulnerabilities in ${{ matrix.distribution }}: ${finding_ids}. See the 'Report Trivy scan results' step for details."
+          annotation="$(escape_annotation "${annotation_message}")"
+          echo "::error title=Trivy CVE scan failed::${annotation}"
+          log ""
+          log "Failing because ${finding_count} HIGH/CRITICAL vulnerabilities were found."
+          exit 1
         fi
     - name: Upload Trivy results to GitHub Security tab
       if: always() && github.event_name == 'push'

.github/workflows/delta-conversion-ci.yml

@@ -82,14 +82,14 @@ jobs:
     env:
       SPARK_LOCAL_IP: localhost
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
           distribution: zulu
           java-version: ${{ matrix.jvm }}
-      - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+      - uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           # Read-only: java-ci's build-checks (17) is the global canonical writer.
           cache-read-only: true
@@ -111,14 +111,14 @@ jobs:
     env:
       SPARK_LOCAL_IP: localhost
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
         with:
           distribution: zulu
           java-version: ${{ matrix.jvm }}
-      - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+      - uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           # Read-only: java-ci's build-checks (17) is the global canonical writer.
           cache-read-only: true

.github/workflows/docs-ci.yml

@@ -36,7 +36,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest]
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0

.github/workflows/flink-ci.yml

@@ -86,14 +86,14 @@ jobs:
     env:
       SPARK_LOCAL_IP: localhost
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
       with:
         distribution: zulu
         java-version: ${{ matrix.jvm }}
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+    - uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
       with:
         # Read-only: java-ci's build-checks (17) is the global canonical writer.
         cache-read-only: true

.github/workflows/hive-ci.yml

@@ -83,14 +83,14 @@ jobs:
     env:
       SPARK_LOCAL_IP: localhost
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
       with:
         distribution: zulu
         java-version: ${{ matrix.jvm }}
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+    - uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
       with:
         # Read-only: java-ci's build-checks (17) is the global canonical writer.
         cache-read-only: true