refactor: centralize generator docker execution and fallback logic

Author: meltsufin

.github/workflows/ci.yaml

@@ -321,13 +321,12 @@ jobs:
     - name: validate generation configuration
       shell: bash
       run: |
-        docker run \
-          --rm \
+        bash generation/run_generator_docker.sh "${library_generation_image_tag}" "${{ github.base_ref || 'main' }}" \
           --quiet \
           -u "$(id -u):$(id -g)" \
           -v "$(pwd):${workspace_name}" \
           --entrypoint python \
-          gcr.io/cloud-devrel-public-resources/java-library-generation:"${library_generation_image_tag}" \
+          -- \
           /src/library_generation/cli/entry_point.py validate-generation-config
       env:
         library_generation_image_tag: 2.68.0

.github/workflows/generated_files_sync.yaml

@@ -27,13 +27,12 @@ jobs:
     - name: Generate root pom.xml file
       shell: bash
       run: |
-        docker run \
-          --rm \
+        bash generation/run_generator_docker.sh "${library_generation_image_tag}" "${{ github.base_ref }}" \
           --quiet \
           -u "$(id -u):$(id -g)" \
           -v "$(pwd):/workspace" \
           --entrypoint python \
-          gcr.io/cloud-devrel-public-resources/java-library-generation:"${library_generation_image_tag}" \
+          -- \
           /src/library_generation/cli/generate_monorepo_root_pom.py \
           generate \
           --repository-path=/workspace
@@ -48,13 +47,12 @@ jobs:
     - name: Generate gapic-libraries-bom/pom.xml
       shell: bash
       run: |
-        docker run \
-          --rm \
+        bash generation/run_generator_docker.sh "${library_generation_image_tag}" "${{ github.base_ref }}" \
           --quiet \
           -u "$(id -u):$(id -g)" \
           -v "$(pwd):/workspace" \
           --entrypoint python \
-          gcr.io/cloud-devrel-public-resources/java-library-generation:"${library_generation_image_tag}" \
+          -- \
           /src/library_generation/cli/generate_monorepo_gapic_bom.py \
           generate \
           --repository-path=/workspace \

generation/run_generator_docker.sh

@@ -0,0 +1,61 @@
+#!/bin/bash
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -exo pipefail
+
+REQUESTED_TAG="$1"
+TARGET_BRANCH="$2"
+shift 2
+
+# Parse arguments using '--' as delimiter
+DOCKER_OPTS=()
+CONTAINER_CMD=()
+found_delimiter=false
+
+for arg in "$@"; do
+  if [ "$arg" == "--" ]; then
+    found_delimiter=true
+    continue
+  fi
+  if $found_delimiter; then
+    CONTAINER_CMD+=("$arg")
+  else
+    DOCKER_OPTS+=("$arg")
+  fi
+done
+
+IMAGE_NAME="gcr.io/cloud-devrel-public-resources/java-library-generation"
+# Support both local git and GitHub Actions environment variables
+CURRENT_BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME:-$(git branch --show-current)}}"
+IMAGE_TAG="$REQUESTED_TAG"
+
+# Fallback logic on Release PR branches
+if [[ "$CURRENT_BRANCH" =~ ^release-please-- ]]; then
+  echo "Detected release PR branch: $CURRENT_BRANCH"
+  if ! docker pull "${IMAGE_NAME}:${IMAGE_TAG}"; then
+    echo "Image not found for version ${IMAGE_TAG}. Falling back to previous version from ${TARGET_BRANCH}."
+    # Extract tag from target branch's workflow file
+    PREVIOUS_TAG=$(git show "${TARGET_BRANCH}":.github/workflows/hermetic_library_generation.yaml | grep -m 1 "^[[:space:]]*image_tag:" | cut -d ':' -f 2- | cut -d '#' -f 1 | xargs || true)
+    if [ -n "$PREVIOUS_TAG" ]; then
+      echo "Using previous image version: $PREVIOUS_TAG"
+      IMAGE_TAG="$PREVIOUS_TAG"
+    else
+      echo "Failed to extract fallback tag. Proceeding with requested tag."
+    fi
+  fi
+fi
+
+# Execute Docker run with proper ordering
+docker run --rm "${DOCKER_OPTS[@]}" "${IMAGE_NAME}:${IMAGE_TAG}" "${CONTAINER_CMD[@]}"

sdk-platform-java/.github/scripts/hermetic_library_generation.sh

@@ -124,28 +124,12 @@ changed_libraries="$(cat "${changed_libraries_file}")"
 echo "Changed libraries are: ${changed_libraries:-"No changed library"}."
 
 # run hermetic code generation docker image.
-# Attempt to pull the image to see if it exists on release PRs.
-if [[ "$current_branch" =~ ^release-please-- ]]; then
-  echo "Detected release PR branch: $current_branch"
-  if ! docker pull "${IMAGE_NAME}:${image_tag}"; then
-    echo "Image not found for version ${image_tag}. Falling back to previous version from ${target_branch}."
-    previous_tag=$(git show "${target_branch}":.github/workflows/hermetic_library_generation.yaml | grep -m 1 "^[[:space:]]*image_tag:" | cut -d ':' -f 2- | cut -d '#' -f 1 | xargs || true)
-    if [ -n "$previous_tag" ]; then
-      echo "Using previous image version: $previous_tag"
-      image_tag="$previous_tag"
-    else
-      echo "Failed to extract previous version from ${target_branch}. Proceeding with original tag."
-    fi
-  fi
-fi
-
-docker run \
-  --rm \
+bash generation/run_generator_docker.sh "${image_tag}" "${target_branch}" \
   -u "$(id -u):$(id -g)" \
   -v "$(pwd):${workspace_name}" \
   -v "${api_def_dir}:${workspace_name}/googleapis" \
   -e GENERATOR_VERSION="${image_tag}" \
-  "${IMAGE_NAME}:${image_tag}" \
+  -- \
   --generation-config-path="${workspace_name}/${generation_config}" \
   --library-names="${changed_libraries}" \
   --api-definitions-path="${workspace_name}/googleapis"