spring-ai-dependency-updates.yml

name: Dependency Updates

on:
  schedule:
    - cron: '0 7 * * 1'  # 07:00 UTC every Monday
  workflow_dispatch:

jobs:
  dependency-updates:
    name: List dependency updates
    runs-on: ubuntu-latest
    if: ${{ github.repository_owner == 'spring-projects' }}
    steps:
      - name: Checkout source code
        uses: actions/checkout@v6

      - name: Set up JDK
        uses: actions/setup-java@v5
        with:
          java-version: '17'
          distribution: 'liberica'
          cache: 'maven'

      - name: Check for dependency updates
        run: |
          ./mvnw --batch-mode -ntp \
            versions:display-dependency-updates \
            -DprocessDependencyManagementTransitive=false \
            -DallowSnapshots=false \
            -Dversions.outputFile=$(pwd)/dependency-updates.txt \
            -Dversions.logOutput=false

      - name: Publish job summary
        run: |
          # Parse the versions-maven-plugin output into artifact|current|latest rows.
          # Lines come in two formats:
          #   single-line:  "  groupId:artifact ..... current -> latest"
          #   wrapped:      "  groupId:artifact ..."   (artifact too long)
          #                 "                   current -> latest"
          awk '
            /->/ {
              split($0, parts, " -> ")
              latest = parts[2]
              gsub(/^[ \t]+|[ \t\r\n]+$/, "", latest)
              n = split(parts[1], words, " ")
              current = words[n]
              if (pending != "") {
                print pending "|" current "|" latest
                pending = ""
              } else {
                artifact = words[1]
                if (index(artifact, ":") > 0) print artifact "|" current "|" latest
              }
              next
            }
            /^\s+[a-z].*:.*\.\.\.$/ {
              split($0, words, " ")
              pending = words[1]
              next
            }
            { pending = "" }
          ' dependency-updates.txt \
            | grep -v '^org\.springframework\.ai:' \
            | grep -v '|\${project\.version}|' \
            | grep -v '|\${.*}|' \
            | grep -v '^ch\.qos\.logback:' \
            | grep -v '^co\.elastic\.clients:' \
            | grep -v '^com\.couchbase\.client:' \
            | grep -v '^com\.fasterxml\.jackson\.' \
            | grep -v '^com\.google\.code\.gson:' \
            | grep -v '^com\.microsoft\.onnxruntime:' \
            | grep -v '^com\.zaxxer:HikariCP' \
            | grep -v '^io\.grpc:' \
            | grep -v '^io\.rest-assured:json-path' \
            | grep -v '^io\.rest-assured:rest-assured\b' \
            | grep -v '^jakarta\.servlet:' \
            | grep -v '^jakarta\.validation:' \
            | grep -v '^net\.bytebuddy:' \
            | grep -v '^org\.apache\.httpcomponents\.client5:httpclient5' \
            | grep -v '^org\.apache\.tomcat\.embed:' \
            | grep -v '^org\.assertj:' \
            | grep -v '^org\.hsqldb:' \
            | grep -v '^org\.jetbrains\.kotlin:' \
            | grep -v '^org\.junit\.jupiter:' \
            | grep -v '^org\.mariadb\.jdbc:' \
            | grep -v '^org\.neo4j\.driver:neo4j-java-driver' \
            | grep -v '^org\.postgresql:' \
            | grep -v '^org\.skyscreamer:' \
            | grep -v '^redis\.clients:' \
            | grep -v '^tools\.jackson\.' \
            | sort -u \
            > filtered-updates.txt

          echo "## Dependency Updates Available" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "> Versions already managed by imported BOMs (Spring Boot, DJL, MCP, REST Assured) are excluded from the report." >> $GITHUB_STEP_SUMMARY
          echo "> All updates require manual verification and integration testing before adoption." >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          if [ ! -s filtered-updates.txt ]; then
            echo "All dependencies are up to date." >> $GITHUB_STEP_SUMMARY
          else
            echo "| Dependency | Current | Latest |" >> $GITHUB_STEP_SUMMARY
            echo "|-----------|---------|--------|" >> $GITHUB_STEP_SUMMARY
            while IFS='|' read -r artifact current latest; do
              echo "| \`$artifact\` | $current | **$latest** |" >> $GITHUB_STEP_SUMMARY
            done < filtered-updates.txt
          fi

      - name: Upload full dependency update report
        if: always()
        uses: actions/upload-artifact@v6
        with:
          name: dependency-updates-report
          path: dependency-updates.txt
          retention-days: 1