diff --git a/.github/workflows/build-test-publish.yml b/.github/workflows/build-test-publish.yml index 0d7ba85..767afbf 100755 --- a/.github/workflows/build-test-publish.yml +++ b/.github/workflows/build-test-publish.yml @@ -204,7 +204,7 @@ on: type: number java_version: description: "Java version to use" - default: "21" + default: "25" required: false type: string go_version: diff --git a/.github/workflows/publish-maven-central.yml b/.github/workflows/publish-maven-central.yml index 5285094..c713b6b 100644 --- a/.github/workflows/publish-maven-central.yml +++ b/.github/workflows/publish-maven-central.yml @@ -30,7 +30,7 @@ on: type: string java_version: description: "Java version to use" - default: "21" + default: "25" required: false type: string publish_task: diff --git a/.github/workflows/test-and-build.yml b/.github/workflows/test-and-build.yml index 28471cd..12b0ebd 100644 --- a/.github/workflows/test-and-build.yml +++ b/.github/workflows/test-and-build.yml @@ -70,7 +70,7 @@ on: type: string java_version: description: "Java version to use" - default: "21" + default: "25" required: false type: string go_version: diff --git a/CLAUDE.md b/CLAUDE.md index b306c7b..d406335 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -44,7 +44,7 @@ The main orchestrator that: ### Test and Build (`test-and-build.yml`) Core workflow that: -- Sets up language-specific environments (Node.js v24.21.0, Python via pyproject.toml, Java via the `java_version` input, default 21; Go from `go.mod` or `go_version`) +- Sets up language-specific environments (Node.js v24.21.0, Python via pyproject.toml, Java via the `java_version` input, default 25; Go from `go.mod` or `go_version`) - Implements comprehensive caching for dependencies across all tools (tool-specific cache keys) - Supports Nx monorepos with SHA optimization - Handles Playwright E2E testing automatically (supports .ts, .js, and .mjs config variants) @@ -430,8 +430,8 @@ Publishing only occurs on: The workflows dynamically adapt based on `tool` parameter: - **npm/yarn**: Node.js v24.21.0, package-lock.json/yarn.lock caching - **uv**: Python setup from pyproject.toml, uv.lock caching -- **./gradlew**: JDK 21 Temurin, Gradle caching -- **mvn**: JDK 21 Temurin, Maven repository caching +- **./gradlew**: JDK 25 Temurin by default (`java_version`), Gradle caching — JDK 25 needs Gradle 9.1+ +- **mvn**: JDK 25 Temurin by default (`java_version`), Maven repository caching - **bash**: Shell script execution with basic environment setup ### Artifact Management @@ -474,10 +474,18 @@ Renovate's custom managers track: - **npm CLI** — the `npm install -g npm@` pin; minor/patch updates are disabled since the pin only expresses a major. - **Java** — the `java-version:` pin in `release-android-apk.yml` and the - `java_version` input default in `test-and-build.yml` / `build-test-publish.yml`. - The pins differ on purpose (21 generic, 24 android) and a caller may ask for - another major through `java_version`, so major updates are disabled; changing - a default major is a deliberate, tested change. + `java_version` input default in `test-and-build.yml` / `build-test-publish.yml` / + `publish-maven-central.yml`. + The pins differ on purpose (25 generic, 24 android) and a caller may ask for + another major through `java_version`, so a major update is never opened on + its own: it waits as a checkbox in the Dependency Dashboard + (`dependencyDashboardApproval`) until someone asks for the PR. Changing a + default major is a deliberate, tested change — the android pin stays on 24 + until every `app_root` caller runs Gradle 9.1+, the first Gradle that runs on + JDK 25. The pins express a major + only, so `extractVersionTemplate` cuts the datasource's full versions + (`21.0.12+101.0.LTS`) down to the major — without it Renovate tries to write + the full version into the pin and the branch fails with "update failure". **When adding a new pinned tool version to a workflow, add a matching custom manager** — otherwise the pin is invisible to both bots and will go stale. diff --git a/README.md b/README.md index 8c1af38..f346ed2 100644 --- a/README.md +++ b/README.md @@ -105,7 +105,7 @@ _Python, Rust, Firefox, Android, GitHub releases_ | Input | Default | Description | |---|---|---| | `publish_python_libraries` | `false` | Validate build + tag for PyPI release (requires `tool: uv`; upload is parked, see §5) | -| `java_version` | `21` | JDK major version for `tool: ./gradlew` or `mvn` (Temurin) | +| `java_version` | `25` | JDK major version for `tool: ./gradlew` or `mvn` (Temurin). JDK 25 needs Gradle 9.1+; with an older wrapper pass `java_version: "21"` | | `go_version` | `""` | Go version for `tool: go`; empty reads it from `go.mod` | | `rust_version` | `stable` | Rust toolchain version | | `enable_clippy` | `true` | Run Clippy | diff --git a/renovate.json b/renovate.json index f83247b..e90f168 100644 --- a/renovate.json +++ b/renovate.json @@ -90,7 +90,8 @@ "java_version:\\n\\s+description: \"Java version to use\"\\n\\s+default: \"(?\\d+)\"" ], "depNameTemplate": "java", - "datasourceTemplate": "java-version" + "datasourceTemplate": "java-version", + "extractVersionTemplate": "^(?\\d+)" } ], "packageRules": [ @@ -134,14 +135,14 @@ "groupName": "python security tools" }, { - "description": "Java pins are chosen per job (21 generic default, 24 android) and callers override via java_version; majors are a deliberate, tested change", + "description": "Java pins are chosen per job (25 generic default, 24 android) and callers override via java_version; majors are a deliberate, tested change, so they wait for approval in the Dependency Dashboard", "matchDepNames": [ "java" ], "matchUpdateTypes": [ "major" ], - "enabled": false + "dependencyDashboardApproval": true } ] }