Merge branch 'main' into fix-resource-leak-token

Author: lsirac

.agents/skills/api-lifecycle/SKILL.md

@@ -0,0 +1,99 @@
+---
+name: api-lifecycle
+description: Guidelines and playbooks for managing the API lifecycle (BetaApi, GA, ObsoleteApi, Deprecated, and Removal) in the Google Cloud Java SDK. Use this skill when modifying, deprecating, or introducing new public API surfaces.
+---
+
+# API Lifecycle & Stability Guide
+
+This guide defines the lifecycle phases and stability annotations of public APIs inside the Google Cloud Java SDK. Use this to ensure all public methods, classes, and fields correctly adhere to Semantic Versioning (Semver) and safely transition through deprecation phases.
+
+> [!IMPORTANT]
+> **Scope & Visibility Rule**
+> This guideline applies **ONLY to public API surfaces** (e.g., `public` classes, interfaces, methods, and fields) that are exposed to external/downstream consumers. It does **NOT** apply to private, package-private, or internal implementation details.
+
+---
+
+## Design Principle: Minimize Public API Surface
+
+To reduce maintenance overhead and ensure long-term flexibility, developers should actively avoid creating public APIs unless absolutely necessary.
+
+*   **Default to Restrictive Visibility**: Always default to the most restrictive access modifier (`private`, `package-private`, or `@InternalApi`) for new classes, methods, and fields. Only expose an API as `public` if there is a clear, justified requirement for external consumers.
+*   **Exposing Public APIs Commits Us**: Every public class, method, or field represents a strict compatibility contract under Semantic Versioning. Once public, modifying or removing it requires a long, multi-phase deprecation cycle.
+*   Prefer Internal Utilities: If functionality is only needed within the same package or module, keep it private or package-private. Do not make it public "just in case".
+
+---
+
+## The API Lifecycle Flow
+
+An API does **not** have to start with `@BetaApi`. Stable, well-designed features can be introduced directly as General Availability (GA). The `@BetaApi` annotation is reserved for experimental, preview, or unstable APIs.
+
+Below is the transition flow for public APIs:
+
+**Standard Lifecycle (Direct to GA):**
+`General Availability (GA) ──> @ObsoleteApi (Staged Deprecation) ──> @Deprecated (Official) ──> Removed`
+
+**Experimental Lifecycle (Beta first):**
+`@BetaApi (Experimental) ──> General Availability (GA) ──> @ObsoleteApi (Staged Deprecation) ──> @Deprecated (Official) ──> Removed`
+
+---
+
+## API Lifecycle Stages
+
+### 1. `@BetaApi` (Experimental Phase)
+*   **Purpose**: Used for experimental, preview, or unstable API surfaces.
+*   **Semver Policy**: Treated as a **"0.x" feature inside a "1.x" library**. Subject to incompatible changes or removal between minor and patch releases at any time.
+*   **Graduation Policy**: Not all APIs start here. Many APIs go directly to GA. If an API does start as `@BetaApi`, it is intended to eventually graduate to a GA feature by removing the `@BetaApi` annotation.
+*   **Usage Rule**: Do **NOT** depend on `@BetaApi` features inside a public library `B` that has downstream consumers, *unless* the consuming components of library `B` are also marked with `@BetaApi`.
+*   **Exception**: `google-cloud-java` is allowed to depend on `@BetaApi` features in `gax-java` without declaring the consuming code `@BetaApi`, as they move in lockstep.
+
+### 2. General Availability (GA)
+*   **Purpose**: Stable API surfaces intended for production use.
+*   Policy: Deprecation or breaking changes to GA APIs are considered breaking changes and should generally not be performed under a minor version release using standard @Deprecated.
+
+### 3. `@ObsoleteApi` (Staged Deprecation)
+*   **Purpose**: Signals to users that an API will be deprecated in a future version, allowing them to transition to alternative methods before official deprecation.
+*   **Policy**: Used during minor version releases.
+*   **Usage Guidelines**:
+    *   **Annotation**: Apply `@ObsoleteApi("Reason or alternative instructions")`. A descriptive reason is required.
+    *   **Javadoc**: Detail the replacement or migration path, referencing alternative methods via `{@link}`.
+    *   **IDE Impact**: Does not trigger IDE compilation/strike-through warnings, keeping downstream builds warning-free.
+
+### 4. `@Deprecated` (Official Deprecation)
+*   **Purpose**: Officially deprecates the API in the editor/IDE, producing compiler warnings and strike-throughs.
+*   **Policy**: Strongly recommended to be applied during **Major Version Releases** (e.g., `v2.0.0`), or in rare emergency cases to fix critical security vulnerabilities. However, it can be acceptable in minor version releases if the library owners explicitly review and determine that the deprecation is low-risk for downstream consumers.
+*   **Usage Guidelines**:
+    *   **Annotation**: Apply Java's standard `@Deprecated` annotation to the code element.
+    *   **Javadoc**: Add the standard `@deprecated` Javadoc tag describing alternative APIs or transition steps.
+
+### 5. Removal
+*   **Purpose**: Complete removal of the API from the codebase.
+*   **Policy**: Performed in a subsequent major version release following official deprecation.
+*   **Usage Guidelines**:
+    *   **Action**: Completely delete the class, interface, method, or field, along with its Javadoc and annotations.
+    *   **Validation**: Verify that all internal usages, references, and tests within the monorepo are fully cleaned up or migrated.
+
+---
+
+## API Stability & Visibility Annotations
+
+While the standard **API Lifecycle Stages** section above defines how public APIs transition over time, the SDK also utilizes specialized stability annotations. These annotations serve as "exceptions" or "special contracts" that dictate how Semantic Versioning applies to public elements:
+
+### 1. `@InternalApi`
+*   **Definition**: Technically `public` because of Java's access modifier limitations, but intended **only** for internal use.
+*   **Semver Policy**: For the purposes of semver, these are considered **private**. They can be modified or deleted in any minor or patch release without breaking compatibility.
+
+### 2. `@InternalExtensionOnly`
+*   **Definition**: A `public` interface that is only intended to be implemented by internal SDK classes, though it can be consumed publicly.
+*   **Semver Policy**: We reserve the right to add new methods to these interfaces without providing default implementations in minor/patch releases. Downstream consumers should **not** write custom implementations of these interfaces.
+
+*(Note: For experimental public APIs, see the `@BetaApi` stage in the Lifecycle Stages section above.)*
+
+---
+
+## Checklist for API Modifiers & Code Reviewers
+
+- [ ] **Is the API GA?** If so, do **NOT** apply `@Deprecated` directly in a minor release. Apply `@ObsoleteApi` first.
+- [ ] **Is it intended only for internal use?** If so, mark it `@InternalApi` so downstream users don't rely on it.
+- [ ] **Is it an interface meant only for internal implementation?** Mark it `@InternalExtensionOnly` to protect future extensions.
+- [ ] **Does `@ObsoleteApi` or `@Deprecated` have a `value` parameter?** The string must explain *why* and *what* the user should do instead.
+- [ ] **Does the Javadoc link to alternatives?** Use `{@link #alternativeMethod()}` so the user can easily navigate in their IDE.

.agents/skills/java-development/SKILL.md

@@ -3,14 +3,20 @@
 # For syntax help see:
 # https://help.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners#codeowners-syntax
 
-*   @googleapis/cloud-sdk-java-team
+*   @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
 
 # java-vertexai has maintainers
-/java-vertexai/   @googleapis/vertexai-team @googleapis/cloud-sdk-java-team
-/java-bigquerystorage/ @googleapis/bigquery-team @googleapis/cloud-sdk-java-team
-/java-bigquery/ @googleapis/bigquery-team @googleapis/cloud-sdk-java-team
-/java-spanner/ @googleapis/spanner-team @googleapis/cloud-sdk-java-team
-/java-spanner-jdbc/ @googleapis/spanner-team @googleapis/cloud-sdk-java-team
-/google-auth-library-java/ @googleapis/cloud-sdk-auth-team @googleapis/cloud-sdk-java-team @googleapis/aion-team
-/java-storage/ @googleapis/gcs-team @googleapis/cloud-sdk-java-team
-/java-storage-nio/ @googleapis/gcs-team @googleapis/cloud-sdk-java-team
+/java-vertexai/   @googleapis/vertexai-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
+/java-bigquerystorage/ @googleapis/bigquery-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
+/java-bigquery/ @googleapis/bigquery-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
+/java-bigquery-jdbc/ @googleapis/bigquery-developer-tools-team @googleapis/bigquery-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
+/grpc-gcp-java/ @googleapis/spanner-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
+/java-spanner/ @googleapis/spanner-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
+/java-spanner-jdbc/ @googleapis/spanner-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
+/google-auth-library-java/ @googleapis/cloud-sdk-auth-team @googleapis/cloud-sdk-java-team @googleapis/aion-team @googleapis/cloud-sdk-librarian-team
+/java-storage/ @googleapis/gcs-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
+/java-storage-nio/ @googleapis/gcs-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
+/java-pubsub/ @googleapis/pubsub-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
+/java-bigtable/ @googleapis/bigtable-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
+/java-firestore/ @googleapis/firestore-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
+/librarian.yaml @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team

.github/CODEOWNERS

@@ -6,46 +6,119 @@ about: Create a report to help us improve
 
 Thanks for stopping by to let us know something could be better!
 
-**PLEASE READ**: If you have a support contract with Google, please create an issue in the [support console](https://cloud.google.com/support/) instead of filing on GitHub. This will ensure a timely response.
+**PLEASE READ**: If you have a support contract with Google, please create an issue in the [support console](https://cloud.google.com/support/) instead of filing on GitHub. This will ensure a timely response. We try to review GitHub issues on a regular basis, however we cannot guarantee an SLO.
 
-Please run down the following list and make sure you've tried the usual "quick fixes":
+Before creating this issue, please run down the following list and make sure you've tried the usual "quick fixes":
 
   - Search the issues already opened: https://github.com/googleapis/google-cloud-java/issues
   - Check for answers on StackOverflow: http://stackoverflow.com/questions/tagged/google-cloud-platform
+  - Refer to the [Google Cloud Java Getting Started guides](https://docs.cloud.google.com/java/getting-started) for common usage patterns and troubleshooting.
+  - Verify you are using the latest versions of the Java SDK. If not, is it possible to upgrade? We recommend using the [Libraries-Bom](https://cloud.google.com/java/docs/bom) to manage dependency versions.
 
-If you are still having issues, please include as much information as possible:
+To help expedite the resolution of the issue, please fill out as much information as possible. If unable to provide information, please note down why the information is unable to be provided.
 
-#### Environment details
+## Issue Details
 
-1. Specify the API at the beginning of the title. For example, "[vision]: ...").
-   General, Core, and Other are also allowed as types
-2. OS type and version:
-3. Java version:
-4. Version(s):
+Required: Provide a detailed description of the issue. Any additional information helps with figuring out the issue.
 
-#### Steps to reproduce
+### Example
+I am seeing {ISSUE} when running X, Y... after doing Z. This behavior started after the X library upgrade a few weeks ago ...
 
-  1. ?
-  2. ?
+## Environment
 
-#### Code example
+Required: Provide details about your environment. If relevant, please also provide details about your GCP environment. The environment details MUST be filled out.
 
-```java
-// example
+Provide the relevant details about your environment:
+
+  - OS Type and Version:
+  - Java Version and JDK Vendor:
+  - (If using GraalVM) GraalVM Version:
+
+(Optional) If deployed on GCP, provide the relevant details about your GCP deployment environment:
+
+  - Project ID:
+  - Cloud Services:
+  - Deployment Environment (Compute, GKE, Run, etc):
+
+## Dependencies
+
+Required: Provide a list of the dependencies that are being used. If unable to provide the list, please list the relevant libraries shown below. One of the two sections below MUST be filled out.
+
+1. List your application’s dependency versions. Please provide the output of `mvn dependency:tree`, `gradle dependencies`, or your build system.
+
+### Example `mvn dependency:tree` output
 ```
+maven-dependency-plugin:tree
+
+- com.google.cloud:{X}:{Y}
+
+- com.google.auth:{X}:{Y}
+
+...
+```
+
+2. Provide the versions of the relevant libraries:
+    - Libraries-Bom ([com.google.cloud:libraries-bom](https://central.sonatype.com/artifact/com.google.cloud/libraries-bom)):
+      - (If not using Libraries-Bom) Client Libraries:
+    - Gax (gax / gax-grpc / gax-httpjson):
+    - Auth (google-auth-library-oauth2-http / google-auth-library-credentials):
+    - Any other relevant Java SDK dependencies:
+      - Google-Http-Java-Client ([com.google.http-client:google-http-client](https://central.sonatype.com/artifact/com.google.http-client/google-http-client)):
+
+## Reproducer
+
+Required: Provide a reproducer and the steps needed to reproduce this issue locally. If unable to provide a reproducer, please provide code snippets to help reproduce the issue. One of the two sections below MUST be filled out.
 
-#### Stack trace
+1. A reproducer is the quickest method to resolve this issue. It could be a test case or a sample application. It is easier for us to troubleshoot the problem and to verify the solution.
+
+Steps to reproduce:
+
+### Example
+1. Enable Speech API
+2. Upload a .mp4 file to GCS
+3. ...
+4. See {ERROR}
+
+If unable to provide a reproducer, please provide a reason: ...
+
+2. Provide as many code snippets as possible:
+
+### Example
+```java
+try (InstancesClient instancesClient = InstancesClient.create()) {
+  ...
+}
 ```
-Any relevant stacktrace here.
+
+## Logs and Stack Trace
+
+Required: Provide logs that showcase the error. This will help show the flow of the application and help narrow down the cause. Additionally, provide a stack trace of the error if possible.
+
+The Java SDK has a troubleshooting [guide](https://github.com/googleapis/google-cloud-java/blob/main/TROUBLESHOOTING.md) for enabling logs. This contains information regarding client-server communication, request and response details, and logging in dependency libraries. If using this guide, please obfuscate any private information (bearer tokens, request and response params, etc).
+
+Additionally, please provide a stack trace of the error seen:
+
+### Example
 ```
+TransportContext.java:347|Fatal (CERTIFICATE_UNKNOWN): PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target (
+
+"throwable" : {
 
-#### External references such as API reference guides
+sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
 
-- ?
+	at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:456)
+
+	at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:323)
+
+...
+```
 
-#### Any additional information below
+## Behavior
 
+Optional: Any additional information about the behavior of the error is helpful to debug.
 
-Following these steps guarantees the quickest resolution possible.
+Behavioral Questions:
 
-Thanks!
+  - When did the issue begin? Is this behavior related to any dependency version upgrade?
+  - Is this behavior flaky? Or is this consistently seen in production?
+  - Is this behavior related to the volume of data?

.github/ISSUE_TEMPLATE/bug_report.md

@@ -46,3 +46,8 @@ branches:
       onDemand: true
       local: true
       localCloneDepth: 200
+    - branch: datastore-2.x
+      releaseType: java-backport
+      onDemand: true
+      local: true
+      localCloneDepth: 200