Pin testLatestDeps versions for reproducible builds (open-telemetry#16344)

Author: zeitlinger

.github/config/latest-dep-versions.json

@@ -55,29 +55,17 @@ jobs:
     uses: ./.github/workflows/reusable-markdown-lint-check.yml
 
   required-status-check:
-    # test-latest-deps is not included in the required status checks
-    # because any time a new library version is released to maven central
-    # it can fail due to test code incompatibility with the new library version,
-    # or due to slight changes in emitted telemetry
-    # (muzzle can also fail when a new library version is released to maven central
-    # but that happens much less often)
-    #
-    # only the "common" checks are required for release branch PRs in order to avoid any unnecessary
-    # release branch maintenance (especially for patches)
     needs:
       - common
+      - test-latest-deps
       - muzzle
       - markdown-lint-check
     runs-on: ubuntu-latest
     if: always()
     steps:
       - if: |
           needs.common.result != 'success' ||
-          (
-            !startsWith(github.base_ref, 'release/') &&
-            (
-              needs.muzzle.result != 'success' ||
-              needs.markdown-lint-check.result != 'success'
-            )
-          )
+          needs.test-latest-deps.result != 'success' ||
+          needs.muzzle.result != 'success' ||
+          needs.markdown-lint-check.result != 'success'
         run: exit 1 # fail

.github/workflows/build-pull-request.yml

@@ -0,0 +1,91 @@
+name: Update latest dep versions
+
+on:
+  schedule:
+    # daily at 4:12 UTC
+    - cron: "12 4 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  update-latest-dep-versions:
+    permissions:
+      contents: write  # for git push to PR branch
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Free disk space
+        run: .github/scripts/gha-free-disk-space.sh
+
+      - name: Set up JDK for running Gradle
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          distribution: temurin
+          java-version-file: .java-version
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+
+      - name: Resolve latest dep versions
+        run: >
+          ./gradlew resolveLatestDepVersions
+          -PtestLatestDeps=true
+          -PresolveLatestDeps=true
+
+      - name: Check for changes
+        id: check-changes
+        run: |
+          if git diff --quiet .github/config/latest-dep-versions.json; then
+            echo "changed=false" >> $GITHUB_OUTPUT
+          else
+            echo "changed=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Use CLA approved bot
+        if: steps.check-changes.outputs.changed == 'true'
+        run: .github/scripts/use-cla-approved-bot.sh
+
+      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        if: steps.check-changes.outputs.changed == 'true'
+        id: otelbot-token
+        with:
+          app-id: ${{ vars.OTELBOT_APP_ID }}
+          private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+
+      - name: Create pull request
+        if: steps.check-changes.outputs.changed == 'true'
+        env:
+          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
+          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+        run: |
+          message="Update pinned latest dep versions"
+          body="Auto-generated update of pinned latest dependency versions used by \`testLatestDeps\` builds."
+          branch="otelbot/update-latest-dep-versions"
+
+          git checkout -b $branch
+          git add .github/config/latest-dep-versions.json
+          git commit -m "$message"
+
+          # If the remote branch already exists, only force-push when its tip
+          # was authored by otelbot. This preserves any manual commits that
+          # may have pushed on top of an open auto-PR.
+          if git ls-remote --exit-code --heads origin "$branch" >/dev/null; then
+            git fetch origin "$branch"
+            author_email=$(git log -1 --format='%ae' "origin/$branch")
+            if [ "$author_email" != "197425009+otelbot@users.noreply.github.com" ]; then
+              echo "Remote tip of $branch was authored by $author_email (not otelbot); skipping push." >&2
+              exit 0
+            fi
+          fi
+          git push --force-with-lease --set-upstream origin $branch
+
+          # only create a new PR if one doesn't already exist
+          existing_pr=$(gh pr list --head "$branch" --state open --json number --jq '.[0].number')
+          if [ -z "$existing_pr" ]; then
+            gh pr create --title "$message" \
+                         --body "$body" \
+                         --base main
+          fi

.github/workflows/update-latest-dep-versions.yml

@@ -9,6 +9,7 @@ plugins {
 
   id("io.github.gradle-nexus.publish-plugin")
   id("otel.spotless-conventions")
+  id("otel.resolve-latest-dep-versions")
   /* workaround for
   What went wrong:
   Could not determine the dependencies of task ':smoke-tests-otel-starter:spring-boot-3.2:bootJar'.

build.gradle.kts

@@ -1,6 +1,7 @@
 /** Common setup for manual instrumentation of libraries and javaagent instrumentation. */
 
 import io.opentelemetry.instrumentation.gradle.OtelPropsExtension
+import io.opentelemetry.javaagent.muzzle.AcceptableVersions
 
 plugins {
   `java-library`
@@ -26,36 +27,63 @@ val otelProps = the<OtelPropsExtension>()
  *     described above.
  *
  * - latestDepTestLibrary: A dependency on a library for testing when testing of latest dependency
- *   version is enabled. This dependency will be added as-is to testImplementation, but only if
- *   -PtestLatestDeps=true. The version will not be modified but it will be given highest
- *   precedence. Use this to restrict the latest version dependency from the default `+`, for
- *   example to restrict to just a major version by specifying `2.+`.
+ *   version is enabled. This dependency will be added to testImplementation only if
+ *   -PtestLatestDeps=true. Its version overrides the `latest.release` from library/testLibrary
+ *   via resolutionStrategy.eachDependency (which takes highest precedence in Gradle). Use this
+ *   to restrict the latest version to a specific range, e.g. `2.+` to stay on major version 2.
  */
+
+val resolveLatestDeps = gradle.startParameter.projectProperties["resolveLatestDeps"] == "true"
+val pinLatestDeps = otelProps.testLatestDeps && !resolveLatestDeps
+
+fun getPinnedVersions(): Map<String, String> {
+  if (!pinLatestDeps) return emptyMap()
+  val key = "latestDepPinnedVersions"
+  if (!rootProject.extra.has(key)) {
+    val file = rootProject.file(".github/config/latest-dep-versions.json")
+    if (!file.exists()) {
+      throw GradleException("Pinned latest-dep versions file is missing: ${file}.")
+    }
+    @Suppress("UNCHECKED_CAST")
+    rootProject.extra[key] = groovy.json.JsonSlurper().parse(file) as Map<String, String>
+  }
+  @Suppress("UNCHECKED_CAST")
+  return rootProject.extra[key] as Map<String, String>
+}
+
+fun lookupPinnedVersion(group: String?, name: String, version: String?): String? {
+  if (!pinLatestDeps || group == null) return null
+  val pinned = getPinnedVersions()
+  return if (version == "latest.release") {
+    pinned["$group:$name#+"]
+  } else if (version != null && version.contains("+")) {
+    val rangeKey = "$group:$name#$version"
+    val rangeVersion = pinned[rangeKey]
+    if (rangeVersion != null) {
+      rangeVersion
+    } else {
+      // Range-specific key is missing from the pinned versions JSON.
+      // Do NOT fall back to the base key because it could be a different major version
+      // (e.g. base key resolves to 4.x but the range "2.+" expects 2.x).
+      // Run resolveLatestDepVersions to populate the missing key.
+      throw GradleException(
+        "Pinned version missing for range key \"$rangeKey\". " +
+          "Run ./gradlew resolveLatestDepVersions -PtestLatestDeps=true -PresolveLatestDeps=true " +
+          "to regenerate .github/config/latest-dep-versions.json"
+      )
+    }
+  } else {
+    null
+  }
+}
+
 @CacheableRule
 abstract class TestLatestDepsRule : ComponentMetadataRule {
   override fun execute(context: ComponentMetadataContext) {
-    val version = context.details.id.version
-    if (version.contains("-alpha", true)
-      || version.contains("-beta", true)
-      || version.contains("-rc", true)
-      || version.contains(".rc", true)
-      || version.contains("-m", true) // e.g. spring milestones are published to grails repo
-      || version.contains(".m", true) // e.g. lettuce
-      || version.contains(".alpha", true) // e.g. netty
-      || version.contains(".beta", true) // e.g. hibernate
-      || version.contains(".cr", true) // e.g. hibernate
-      || version.endsWith("-nf-execution") // graphql
-      || GIT_SHA_PATTERN.matches(version) // graphql
-      || DATETIME_PATTERN.matches(version) // graphql
-    ) {
+    if (!AcceptableVersions.isStable(context.details.id.version)) {
       context.details.status = "milestone"
     }
   }
-
-  companion object {
-    private val GIT_SHA_PATTERN = Regex("^.*-[0-9a-f]{7,}$")
-    private val DATETIME_PATTERN = Regex("^\\d{4}-\\d{2}-\\d{2}T\\d{2}-\\d{2}-\\d{2}.*$")
-  }
 }
 
 configurations {
@@ -74,14 +102,20 @@ configurations {
 
   val testImplementation by getting
 
+  // Collect latestDepTestLibrary overrides so we can apply them via resolutionStrategy.
+  // This map is populated during configuration and read during resolution.
+  val latestDepTestLibraryOverrides = mutableMapOf<String, String>()
+
   listOf(library, testLibrary).forEach { configuration ->
     // We use whenObjectAdded and copy into the real configurations instead of extension to allow
     // mutating the version for latest dep tests.
     configuration.dependencies.whenObjectAdded {
       val dep = copy()
       if (otelProps.testLatestDeps) {
+        val extDep = this as ExternalDependency
+        val pinnedVersion = lookupPinnedVersion(extDep.group, extDep.name, "latest.release")
         (dep as ExternalDependency).version {
-          require("latest.release")
+          require(pinnedVersion ?: "latest.release")
         }
       }
       testImplementation.dependencies.add(dep)
@@ -94,12 +128,31 @@ configurations {
       }
     }
 
+    // latestDepTestLibrary lets modules restrict the latest version to a specific range
+    // (e.g. "3.+" to stay on major version 3). These constraints must beat the
+    // require("latest.release") from library/testLibrary above.
+    //
+    // We can't use strictly() on the dependency itself because it conflicts with require()
+    // from library/testLibrary (Gradle rejects conflicting strict/require constraints).
+    // We can't use prefer() on library/testLibrary either because prefer() is too weak and
+    // loses against the original library() version from compileOnly.
+    //
+    // Instead, we collect latestDepTestLibrary versions here and apply them via
+    // resolutionStrategy.eachDependency below, which overrides all other constraints.
     latestDepTestLibrary.dependencies.whenObjectAdded {
       val dep = copy()
       val declaredVersion = dep.version
       if (declaredVersion != null) {
+        val extDep = this as ExternalDependency
+        val pinnedVersion = lookupPinnedVersion(extDep.group, extDep.name, declaredVersion)
+        val resolvedVersion = pinnedVersion ?: declaredVersion
+        // Record the override; the actual version forcing happens in eachDependency below.
+        // We use require() here (not strictly()) because strictly() would conflict with
+        // the require() from library/testLibrary for the same artifact. The eachDependency
+        // callback enforces the final version regardless.
+        latestDepTestLibraryOverrides["${extDep.group}:${extDep.name}"] = resolvedVersion
         (dep as ExternalDependency).version {
-          strictly(declaredVersion)
+          require(resolvedVersion)
         }
       }
       testImplementation.dependencies.add(dep)
@@ -108,6 +161,37 @@ configurations {
   named("compileOnly") {
     extendsFrom(library)
   }
+
+  // Apply version overrides via resolutionStrategy which takes highest precedence.
+  // This handles two cases:
+  // 1. latestDepTestLibraryOverrides: modules that restrict latest deps to a version range
+  //    (e.g. spring-boot-starter-test:3.+ while latest is 4.x). These must override
+  //    the require("latest.release") from library/testLibrary.
+  // 2. pinLatestDeps pinned versions: when pinning is enabled, any dependency still using
+  //    "latest.release" or "+" versions (e.g. transitive deps) gets pinned to a concrete
+  //    version from the JSON file.
+  if (otelProps.testLatestDeps) {
+    // Only apply to test-related configurations, not build tool configurations like Zinc
+    // (the Scala compiler). Overriding scala-library in Zinc's configuration breaks compilation.
+    configureEach {
+      if (isCanBeResolved && (name.startsWith("test") || name.startsWith("latestDepTest"))) {
+        resolutionStrategy.eachDependency {
+          // latestDepTestLibrary overrides take priority over pinned versions
+          val override = latestDepTestLibraryOverrides["${requested.group}:${requested.name}"]
+          if (override != null) {
+            useVersion(override)
+            return@eachDependency
+          }
+          if (pinLatestDeps) {
+            val pinnedVersion = lookupPinnedVersion(requested.group, requested.name, requested.version)
+            if (pinnedVersion != null) {
+              useVersion(pinnedVersion)
+            }
+          }
+        }
+      }
+    }
+  }
 }
 
 if (otelProps.testLatestDeps) {