merge: #10616 #10640 #10647 #10654

10616: ci: merge deploy and auto-merge workflows into unified CI workflow r=oleschoenburg a=oleschoenburg This merges the deploy, auto-merge and test workflows into one CI workflow. This fixes #10503 because codeql will run within the same workflow on main and in PRs, getting the CodeQL workflow to pass again. Additionally, some conditions and job dependencies are a bit simpler now. 10640: fix(raft): do not handle response if role is already closed r=deepthidevaki a=deepthidevaki ## Description The response to a request send when the node was in leader in a specific term, was processed even if the response was received in a later term. This resulted in following behavior: 1. Leader sends an AppendRequest to follower, before sending it updates `RaftMemberContext#inFlightAppendCount` to 1. 3. Leader steps down and becomes leader again 5. Leader resets the member context of follower. So `inFlightAppendCount` is reset to 0 6. Leader sends a new append request to the follower,` inFlightAppendCount` is set to 1 7. The first request times out. On handling the response it decrements the inFlightAppendCount to 0. 8. The second request times out. On handling the response it decrements the inFlightAppendCount to -1. 9. Next time, when the leader attempts to send an append request `RaftMemberContext#canAppend` returns false because inFlightAppendCount != 0. As a result leader will never sent a heartbeat or new append request to the follower. To fix this, the check for if the role is open is done before processing the response. As a precaution, other requests where the response is handled without checking for open is also updated. ## Related issues closes #10545 10647: deps(maven): bump spotbugs-maven-plugin from 4.7.2.0 to 4.7.2.1 r=oleschoenburg a=dependabot[bot] Bumps [spotbugs-maven-plugin](https://github.com/spotbugs/spotbugs-maven-plugin) from 4.7.2.0 to 4.7.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/spotbugs/spotbugs-maven-plugin/releases">spotbugs-maven-plugin's releases</a>.</em></p> <blockquote> <h2>Spotbugs Maven Plugin 4.7.2.1</h2> <ul> <li>Bumps groovy to 4.0.5</li> <li>Bumps asm to 9.4</li> </ul> <p>Build Related</p> <ul> <li>For reproducible builds, timestamp is now more accurate to the release.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/spotbugs/spotbugs-maven-plugin/commit/21e2e70c938a290fd4a43fc87decb7fcf89d8021"><code>21e2e70</code></a> [maven-release-plugin] prepare release spotbugs-maven-plugin-4.7.2.1</li> <li><a href="https://github.com/spotbugs/spotbugs-maven-plugin/commit/719192f31e57324629c755926682756bb995c197"><code>719192f</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/spotbugs/spotbugs-maven-plugin/issues/496">#496</a> from spotbugs/renovate/asm.version</li> <li><a href="https://github.com/spotbugs/spotbugs-maven-plugin/commit/f57b664aad1e5d86480585d640e8e0341e9dea1b"><code>f57b664</code></a> Update dependency org.ow2.asm:asm-bom to v9.4</li> <li><a href="https://github.com/spotbugs/spotbugs-maven-plugin/commit/e2921d8fcaf49cb64d460f0d54cbb12fb7d4c75b"><code>e2921d8</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/spotbugs/spotbugs-maven-plugin/issues/495">#495</a> from hazendaz/spotbugs</li> <li><a href="https://github.com/spotbugs/spotbugs-maven-plugin/commit/6bf634ded9d4864decf6d069b7105207d1c6def2"><code>6bf634d</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/spotbugs/spotbugs-maven-plugin/issues/494">#494</a> from spotbugs/renovate/slf4jversion</li> <li><a href="https://github.com/spotbugs/spotbugs-maven-plugin/commit/f1b84ab96307977971ee600295459d42fa00dbcb"><code>f1b84ab</code></a> Update slf4jVersion to v2.0.3</li> <li><a href="https://github.com/spotbugs/spotbugs-maven-plugin/commit/f9dc957930d8db654d4c125d948f2786998059d8"><code>f9dc957</code></a> [pom] Bump junit to 5.9.1</li> <li><a href="https://github.com/spotbugs/spotbugs-maven-plugin/commit/683ecb84c65bf847bbd72ddae0c657da6a914ca1"><code>683ecb8</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/spotbugs/spotbugs-maven-plugin/issues/493">#493</a> from spotbugs/renovate/slf4jversion</li> <li><a href="https://github.com/spotbugs/spotbugs-maven-plugin/commit/6cb063c1e8f1ed2ff757246770de9db3e987f36c"><code>6cb063c</code></a> Update dependency org.slf4j:slf4j-api to v2.0.2</li> <li><a href="https://github.com/spotbugs/spotbugs-maven-plugin/commit/62c90efff3efc0b0a4579c3639d36bb50cf75a5d"><code>62c90ef</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/spotbugs/spotbugs-maven-plugin/issues/492">#492</a> from spotbugs/renovate/groovy-monorepo</li> <li>Additional commits viewable in <a href="https://github.com/spotbugs/spotbugs-maven-plugin/compare/spotbugs-maven-plugin-4.7.2.0...spotbugs-maven-plugin-4.7.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.github.spotbugs:spotbugs-maven-plugin&package-manager=maven&previous-version=4.7.2.0&new-version=4.7.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting ``@dependabot` rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - ``@dependabot` rebase` will rebase this PR - ``@dependabot` recreate` will recreate this PR, overwriting any edits that have been made to it - ``@dependabot` merge` will merge this PR after your CI passes on it - ``@dependabot` squash and merge` will squash and merge this PR after your CI passes on it - ``@dependabot` cancel merge` will cancel a previously requested merge and block automerging - ``@dependabot` reopen` will reopen this PR if it is closed - ``@dependabot` close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - ``@dependabot` ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - ``@dependabot` ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - ``@dependabot` ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> 10654: deps(maven): bump software.amazon.awssdk:bom from 2.17.289 to 2.17.290 r=github-actions[bot] a=dependabot[bot] Bumps [software.amazon.awssdk:bom](https://github.com/aws/aws-sdk-java-v2) from 2.17.289 to 2.17.290. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/aws/aws-sdk-java-v2/blob/master/CHANGELOG.md">software.amazon.awssdk:bom's changelog</a>.</em></p> <blockquote> <h1><strong>2.17.290</strong> <strong>2022-10-07</strong></h1> <h2><strong>AWS IoT Greengrass V2</strong></h2> <ul> <li> <h3>Features</h3> <ul> <li>This release adds error status details for deployments and components that failed on a device and adds features to improve visibility into component installation.</li> </ul> </li> </ul> <h2><strong>AWS SDK for Java v2</strong></h2> <ul> <li> <h3>Features</h3> <ul> <li>Add the ability to configure connection timeout, and enabling keep-alive with interval/timeout settings on the AwsCrtAsyncHttpClient to support long-running connections <ul> <li>Contributed by: <a href="https://github.com/nikp"><code>`@nikp</code></a></li>` </ul> </li> <li>Updated service endpoint metadata.</li> </ul> </li> </ul> <h2><strong>Amazon CodeGuru Reviewer</strong></h2> <ul> <li> <h3>Features</h3> <ul> <li>Documentation update to replace broken link.</li> </ul> </li> </ul> <h2><strong>Amazon QuickSight</strong></h2> <ul> <li> <h3>Features</h3> <ul> <li>Amazon QuickSight now supports SecretsManager Secret ARN in place of CredentialPair for DataSource creation and update. This release also has some minor documentation updates and removes CountryCode as a required parameter in GeoSpatialColumnGroup</li> </ul> </li> </ul> <h2><strong>Elastic Load Balancing</strong></h2> <ul> <li> <h3>Features</h3> <ul> <li>Gateway Load Balancer adds a new feature (target_failover) for customers to rebalance existing flows to a healthy target after marked unhealthy or deregistered. This allows graceful patching/upgrades of target appliances during maintenance windows, and helps reduce unhealthy target failover time.</li> </ul> </li> </ul> <h2><strong>Contributors</strong></h2> <p>Special thanks to the following contributors to this release:</p> <p><a href="https://github.com/nikp"><code>`@nikp</code></a></p>` </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aws/aws-sdk-java-v2/commit/5b309eaea361c9409201e58ab539e79236346709"><code>5b309ea</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/aws/aws-sdk-java-v2/issues/2184">#2184</a> from aws/staging/8f1fe0e1-e346-4e98-a994-5763db72f55c</li> <li><a href="https://github.com/aws/aws-sdk-java-v2/commit/aefbeea552d595b01ae4093127ed09ba066ae09b"><code>aefbeea</code></a> Release 2.17.290. Updated CHANGELOG.md, README.md and all pom.xml.</li> <li><a href="https://github.com/aws/aws-sdk-java-v2/commit/6ff65a35ccb9b4a119abe52fe519563eb375209b"><code>6ff65a3</code></a> Updated endpoints.json.</li> <li><a href="https://github.com/aws/aws-sdk-java-v2/commit/240d4151918a8874a79bbb1b833d49d7081ccf68"><code>240d415</code></a> Elastic Load Balancing Update: Gateway Load Balancer adds a new feature (targ...</li> <li><a href="https://github.com/aws/aws-sdk-java-v2/commit/a7778a5c8705bd4e0bedb8b44944ee40e53f59ef"><code>a7778a5</code></a> AWS IoT Greengrass V2 Update: This release adds error status details for depl...</li> <li><a href="https://github.com/aws/aws-sdk-java-v2/commit/e46c8c6cb34f0f5978ef61aa192a7b2cd9465ef3"><code>e46c8c6</code></a> Amazon CodeGuru Reviewer Update: Documentation update to replace broken link.</li> <li><a href="https://github.com/aws/aws-sdk-java-v2/commit/2ff64790167edf69220af1e5385bdc253d15aa98"><code>2ff6479</code></a> Amazon QuickSight Update: Amazon QuickSight now supports SecretsManager Secre...</li> <li><a href="https://github.com/aws/aws-sdk-java-v2/commit/92e48e4e62ad723f2e94b6fcbcce0238c35a731c"><code>92e48e4</code></a> Update APIReference.md (<a href="https://github-redirect.dependabot.com/aws/aws-sdk-java-v2/issues/3467">#3467</a>)</li> <li><a href="https://github.com/aws/aws-sdk-java-v2/commit/8cd6f5b428adc183ba276b7c210b11601eb30fb9"><code>8cd6f5b</code></a> Add the ability to configure connection timeout, keep-alive settings, and adv...</li> <li><a href="https://github.com/aws/aws-sdk-java-v2/commit/8e6958a08ea7579b894f671ff70cb37b98ed445a"><code>8e6958a</code></a> Update to next snapshot version: 2.17.290-SNAPSHOT</li> <li>See full diff in <a href="https://github.com/aws/aws-sdk-java-v2/compare/2.17.289...2.17.290">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=software.amazon.awssdk:bom&package-manager=maven&previous-version=2.17.289&new-version=2.17.290)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting ``@dependabot` rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - ``@dependabot` rebase` will rebase this PR - ``@dependabot` recreate` will recreate this PR, overwriting any edits that have been made to it - ``@dependabot` merge` will merge this PR after your CI passes on it - ``@dependabot` squash and merge` will squash and merge this PR after your CI passes on it - ``@dependabot` cancel merge` will cancel a previously requested merge and block automerging - ``@dependabot` reopen` will reopen this PR if it is closed - ``@dependabot` close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - ``@dependabot` ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - ``@dependabot` ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - ``@dependabot` ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Co-authored-by: Ole Schönburg <ole.schoenburg@gmail.com> Co-authored-by: Deepthi Devaki Akkoorath <deepthidevaki@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
camunda · Oct 10, 2022 · ce68a1d · ce68a1d
5 parents bd3008e + db3f85a + 11a58e4 + 72dcc9f + fcbd52e
commit ce68a1d
Show file tree

Hide file tree

Showing 7 changed files with 169 additions and 206 deletions.
diff --git a/.github/workflows/auto-merge-deps.yml b/.github/workflows/auto-merge-deps.yml
diff --git a/.github/workflows/test.yml → .github/workflows/ci.yml b/.github/workflows/test.yml → .github/workflows/ci.yml
@@ -1,8 +1,9 @@
-name: Tests
+name: CI
 
 on:
   push:
     branches:
+      - main
       - stable/*
       - release-*
       - trying
@@ -402,10 +403,10 @@ jobs:
           REVISION: ${{ github.sha }}
           VERSION: ${{ steps.build-docker.outputs.version }}
         run: ${PWD}/docker/test/verify.sh '${{ steps.build-docker.outputs.image }}'
-  # Used by bors to check all tests, including the unit test matrix.
-  # New test jobs must be added to the `needs` lists!
-  # This name is hard-referenced from bors.toml; remember to update that if this name changes
   test-summary:
+    # Used by bors to check all tests, including the unit test matrix.
+    # New test jobs must be added to the `needs` lists!
+    # This name is hard-referenced from bors.toml; remember to update that if this name changes
     name: Test summary
     runs-on: ubuntu-latest
     needs:
@@ -422,11 +423,10 @@ jobs:
       - docker-checks
     steps:
       - run: exit 0
-
-  # We need to upload the event file as an artifact in order to support
-  # publishing the results of forked repositories
-  # https://github.com/EnricoMi/publish-unit-test-result-action#support-fork-repositories-and-dependabot-branches
   event_file:
+    # We need to upload the event file as an artifact in order to support
+    # publishing the results of forked repositories
+    # https://github.com/EnricoMi/publish-unit-test-result-action#support-fork-repositories-and-dependabot-branches
     name: "Event File"
     runs-on: ubuntu-latest
     needs:
@@ -445,3 +445,140 @@ jobs:
           name: Event File
           path: ${{ github.event_path }}
           retention-days: 1
+  deploy-snapshots:
+    name: Deploy snapshot artifacts
+    needs: [ test-summary ]
+    runs-on: ubuntu-latest
+    if: github.repository == 'camunda/zeebe' && github.ref == 'refs/heads/main'
+    concurrency:
+      group: deploy-maven-snapshot
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@v3
+      - name: Import Secrets
+        id: secrets
+        uses: hashicorp/vault-action@v2.4.2
+        with:
+          url: ${{ secrets.VAULT_ADDR }}
+          method: approle
+          roleId: ${{ secrets.VAULT_ROLE_ID }}
+          secretId: ${{ secrets.VAULT_SECRET_ID }}
+          secrets: |
+            secret/data/products/zeebe/ci/zeebe ARTIFACTS_USR;
+            secret/data/products/zeebe/ci/zeebe ARTIFACTS_PSW;
+      - uses: actions/setup-java@v3.5.1
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+          server-id: camunda-nexus
+          server-username: MAVEN_USERNAME
+          server-password: MAVEN_PASSWORD
+      # compile and generate-sources to ensure that the Javadoc can be properly generated; compile is
+      # necessary when using annotation preprocessors for code generation, as otherwise the symbols are
+      # not resolve-able by the Javadoc generator
+      - run: mvn -B -D skipTests -D skipChecks compile generate-sources source:jar javadoc:jar deploy
+        env:
+          MAVEN_USERNAME: ${{ steps.secrets.outputs.ARTIFACTS_USR }}
+          MAVEN_PASSWORD: ${{ steps.secrets.outputs.ARTIFACTS_PSW }}
+  deploy-docker-snapshot:
+    name: Deploy snapshot Docker image
+    needs: [ test-summary ]
+    runs-on: ubuntu-latest
+    if: github.repository == 'camunda/zeebe' && github.ref == 'refs/heads/main'
+    concurrency:
+      group: deploy-docker-snapshot
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@v3
+      - name: Import Secrets
+        id: secrets
+        uses: hashicorp/vault-action@v2.4.2
+        with:
+          url: ${{ secrets.VAULT_ADDR }}
+          method: approle
+          roleId: ${{ secrets.VAULT_ROLE_ID }}
+          secretId: ${{ secrets.VAULT_SECRET_ID }}
+          secrets: |
+            secret/data/products/zeebe/ci/zeebe REGISTRY_HUB_DOCKER_COM_USR;
+            secret/data/products/zeebe/ci/zeebe REGISTRY_HUB_DOCKER_COM_PSW;
+      - name: Login to DockerHub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ steps.secrets.outputs.REGISTRY_HUB_DOCKER_COM_USR }}
+          password: ${{ steps.secrets.outputs.REGISTRY_HUB_DOCKER_COM_PSW }}
+      - uses: ./.github/actions/setup-zeebe
+      - uses: ./.github/actions/build-zeebe
+        id: build-zeebe
+      - uses: ./.github/actions/build-docker
+        id: build-docker
+        with:
+          repository: camunda/zeebe
+          version: SNAPSHOT
+          push: true
+          distball: ${{ steps.build-zeebe.outputs.distball }}
+  notify-if-failed:
+    name: Send slack notification on build failure
+    runs-on: ubuntu-latest
+    needs: [ test-summary, deploy-snapshots, deploy-docker-snapshot ]
+    if: failure() && github.repository == 'camunda/zeebe' && github.ref == 'refs/heads/main'
+    steps:
+      - id: slack-notify
+        name: Send slack notification
+        uses: slackapi/slack-github-action@v1.22.0
+        with:
+          # For posting a rich message using Block Kit
+          payload: |
+            {
+              "text": ":alarm: Build on `main` failed! :alarm:\n${{ github.event.head_commit.url }}",
+             	"blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": ":alarm: Build on `main` failed! :alarm:"
+                  }
+                },
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "Please check the related commit: ${{ github.event.head_commit.url }}\n \\cc @zeebe-medic"
+                  }
+                }
+              ]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
+  auto-merge:
+    # This workflow will auto merge a PR authored by dependabot[bot]. It runs only on open PRs ready for
+    # review.
+    #
+    # It will merge the PR only if: it is authored by dependabot[bot], is a patch semantic update, and
+    # all CI checks are successful (ignoring the soon-to-be-removed Jenkins check).
+    #
+    # The workflow is divided into multiple sequential jobs to allow giving only minimal permissions to
+    # the GitHub token passed around.
+    #
+    # Once we're using the merge queue feature, I think we can simplify this workflow a lot by relying
+    # on dependabot merging PRs via its commands, as it will always wait for checks to be green before
+    # merging.
+    name: Auto-merge dependabot PRs
+    runs-on: ubuntu-latest
+    needs: [ test-summary ]
+    if: github.repository == 'camunda/zeebe' && github.actor == 'dependabot[bot]'
+    permissions:
+      checks: read
+      pull-requests: write
+    steps:
+      - id: metadata
+        name: Fetch dependency metadata
+        uses: dependabot/fetch-metadata@v1.3.4
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+      - id: approve-and-merge
+        name: Approve and merge PR
+        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'
+        run: gh pr review ${{ github.event.pull_request.number }} --approve -b "bors merge"
+        env:
+          GITHUB_TOKEN: "${{secrets.GITHUB_TOKEN}}"
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml