Merge branch 'main' into cert-bound-oauth-iam-pinning

Author: macastelaz

.github/CODEOWNERS

@@ -3,22 +3,22 @@
 # For syntax help see:
 # https://help.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners#codeowners-syntax
 
-*   @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
+*   @googleapis/cloud-sdk-java-team
 
 # java-vertexai has maintainers
-/java-vertexai/   @googleapis/vertexai-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
-/java-bigquerystorage/ @googleapis/bigquery-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
-/java-bigquery/ @googleapis/bigquery-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
-/java-bigquery-jdbc/ @googleapis/bigquery-developer-tools-team @googleapis/bigquery-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
-/grpc-gcp-java/ @googleapis/spanner-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
-/java-spanner/ @googleapis/spanner-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
-/java-spanner-jdbc/ @googleapis/spanner-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
-/google-auth-library-java/ @googleapis/cloud-sdk-auth-team @googleapis/cloud-sdk-java-team @googleapis/aion-team @googleapis/cloud-sdk-librarian-team
-/java-storage/ @googleapis/gcs-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
-/java-storage-nio/ @googleapis/gcs-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
-/java-pubsub/ @googleapis/pubsub-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
-/java-bigtable/ @googleapis/bigtable-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
-/java-firestore/ @googleapis/firestore-team @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
+/java-vertexai/   @googleapis/vertexai-team @googleapis/cloud-sdk-java-team
+/java-bigquerystorage/ @googleapis/bigquery-team @googleapis/cloud-sdk-java-team
+/java-bigquery/ @googleapis/bigquery-team @googleapis/cloud-sdk-java-team
+/java-bigquery-jdbc/ @googleapis/bigquery-developer-tools-team @googleapis/bigquery-team @googleapis/cloud-sdk-java-team
+/grpc-gcp-java/ @googleapis/spanner-team @googleapis/cloud-sdk-java-team
+/java-spanner/ @googleapis/spanner-team @googleapis/cloud-sdk-java-team
+/java-spanner-jdbc/ @googleapis/spanner-team @googleapis/cloud-sdk-java-team
+/google-auth-library-java/ @googleapis/cloud-sdk-auth-team @googleapis/cloud-sdk-java-team @googleapis/aion-team
+/java-storage/ @googleapis/gcs-team @googleapis/cloud-sdk-java-team
+/java-storage-nio/ @googleapis/gcs-team @googleapis/cloud-sdk-java-team
+/java-pubsub/ @googleapis/pubsub-team @googleapis/cloud-sdk-java-team
+/java-bigtable/ @googleapis/bigtable-team @googleapis/cloud-sdk-java-team
+/java-firestore/ @googleapis/firestore-team @googleapis/cloud-sdk-java-team
 /librarian.yaml @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
 /java-cloud-bom/ @googleapis/cloud-sdk-java-team
-/java-shared-config/ @googleapis/cloud-sdk-java-team @googleapis/cloud-sdk-librarian-team
+/java-shared-config/ @googleapis/cloud-sdk-java-team

.github/requirements.txt

@@ -108,7 +108,7 @@ requests==2.33.0 \
     --hash=sha256:3324635456fa185245e24865e810cecec7b4caf933d7eb133dcde67d48cee69b \
     --hash=sha256:c7ebc5e8b0f21837386ad0e1c8fe8b829fa5f544d8df3b2253bff14ef29d7652
     # via -r requirements.in
-urllib3==2.6.3 \
-    --hash=sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed \
-    --hash=sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4
+urllib3==2.8.0 \
+    --hash=sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3 \
+    --hash=sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63
     # via requests

.github/workflows/ci.yaml

@@ -21,6 +21,11 @@ on:
     branches:
     - main
   pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 name: ci
 jobs:
   # detect whether or not we should run generated (non-handwritten) unit tests
@@ -51,8 +56,8 @@ jobs:
           workflows:
             - '.github/workflows/**'
           src:
-            - '!(google-auth-library-java|grpc-gcp-java|java-bigquery|java-bigquery-jdbc|java-bigquerystorage|java-bigtable|java-cloud-bom|java-datastore|java-firestore|java-logging|java-logging-logback|java-pubsub|java-shared-config|java-showcase|java-spanner|java-storage)/**/*.java'
-            - '!(google-auth-library-java|grpc-gcp-java|java-bigquery|java-bigquery-jdbc|java-bigquerystorage|java-bigtable|java-cloud-bom|java-datastore|java-firestore|java-logging|java-logging-logback|java-pubsub|java-shared-config|java-showcase|java-spanner|java-storage)/**/pom.xml'
+            - '!(google-auth-library-java|grpc-gcp-java|java-bigquery|java-bigquery-jdbc|java-bigquerystorage|java-bigtable|java-cloud-bom|java-datastore|java-firestore|java-logging|java-logging-logback|java-pubsub|java-showcase|java-spanner|java-storage)/**/*.java'
+            - '!(google-auth-library-java|grpc-gcp-java|java-bigquery|java-bigquery-jdbc|java-bigquerystorage|java-bigtable|java-cloud-bom|java-datastore|java-firestore|java-logging|java-logging-logback|java-pubsub|java-showcase|java-spanner|java-storage)/**/pom.xml'
             - 'pom.xml'
           ci:
             - '.github/workflows/ci.yaml'
@@ -133,6 +138,7 @@ jobs:
             - 'google-auth-library-java/**'
           grpc-gcp-java:
             - 'grpc-gcp-java/**'
+            - 'java-shared-config/**/pom.xml'
           java-bigquery:
             - 'java-bigquery/**'
             - 'google-auth-library-java/**/*.java'
@@ -142,6 +148,7 @@ jobs:
             - 'sdk-platform-java/gapic-generator-java-pom-parent/pom.xml'
             - 'google-cloud-jar-parent/pom.xml'
             - 'google-cloud-pom-parent/pom.xml'
+            - 'java-shared-config/**/pom.xml'
             - 'pom.xml'
           java-bigquerystorage:
             - 'java-bigquerystorage/**'
@@ -152,6 +159,7 @@ jobs:
             - 'sdk-platform-java/gapic-generator-java-pom-parent/pom.xml'
             - 'google-cloud-jar-parent/pom.xml'
             - 'google-cloud-pom-parent/pom.xml'
+            - 'java-shared-config/**/pom.xml'
             - 'pom.xml'
           java-datastore:
             - 'java-datastore/**'
@@ -162,6 +170,7 @@ jobs:
             - 'sdk-platform-java/gapic-generator-java-pom-parent/pom.xml'
             - 'google-cloud-jar-parent/pom.xml'
             - 'google-cloud-pom-parent/pom.xml'
+            - 'java-shared-config/**/pom.xml'
             - 'pom.xml'
           java-logging-logback:
             - 'java-logging-logback/**'
@@ -172,6 +181,7 @@ jobs:
             - 'sdk-platform-java/gapic-generator-java-pom-parent/pom.xml'
             - 'google-cloud-jar-parent/pom.xml'
             - 'google-cloud-pom-parent/pom.xml'
+            - 'java-shared-config/**/pom.xml'
             - 'pom.xml'
           java-logging:
             - 'java-logging/**'
@@ -182,6 +192,7 @@ jobs:
             - 'sdk-platform-java/gapic-generator-java-pom-parent/pom.xml'
             - 'google-cloud-jar-parent/pom.xml'
             - 'google-cloud-pom-parent/pom.xml'
+            - 'java-shared-config/**/pom.xml'
             - 'pom.xml'
           java-spanner:
             - 'java-spanner/**'
@@ -193,6 +204,7 @@ jobs:
             - 'sdk-platform-java/gapic-generator-java-pom-parent/pom.xml'
             - 'google-cloud-jar-parent/pom.xml'
             - 'google-cloud-pom-parent/pom.xml'
+            - 'java-shared-config/**/pom.xml'
             - 'pom.xml'
           java-storage:
             - 'java-storage/**'
@@ -203,6 +215,7 @@ jobs:
             - 'sdk-platform-java/gapic-generator-java-pom-parent/pom.xml'
             - 'google-cloud-jar-parent/pom.xml'
             - 'google-cloud-pom-parent/pom.xml'
+            - 'java-shared-config/**/pom.xml'
             - 'pom.xml'
           java-pubsub:
             - 'java-pubsub/**'
@@ -213,6 +226,7 @@ jobs:
             - 'sdk-platform-java/gapic-generator-java-pom-parent/pom.xml'
             - 'google-cloud-jar-parent/pom.xml'
             - 'google-cloud-pom-parent/pom.xml'
+            - 'java-shared-config/**/pom.xml'
             - 'pom.xml'
           java-bigtable:
             - 'java-bigtable/**'
@@ -223,6 +237,7 @@ jobs:
             - 'sdk-platform-java/gapic-generator-java-pom-parent/pom.xml'
             - 'google-cloud-jar-parent/pom.xml'
             - 'google-cloud-pom-parent/pom.xml'
+            - 'java-shared-config/**/pom.xml'
             - 'pom.xml'
           java-firestore:
             - 'java-firestore/**'
@@ -233,6 +248,7 @@ jobs:
             - 'sdk-platform-java/gapic-generator-java-pom-parent/pom.xml'
             - 'google-cloud-jar-parent/pom.xml'
             - 'google-cloud-pom-parent/pom.xml'
+            - 'java-shared-config/**/pom.xml'
             - 'pom.xml'
           java-shared-config:
             - 'java-shared-config/**'
@@ -292,6 +308,7 @@ jobs:
       run: |
         mvn test \
           -B -ntp \
+          -U \
           -Pquick-build \
           -Dorg.slf4j.simpleLogger.showDateTime=true \
           -Dorg.slf4j.simpleLogger.dateTimeFormat=HH:mm:ss:SSS \

.github/workflows/java-bigquery-jdbc-ci.yaml

@@ -47,6 +47,7 @@ jobs:
             - 'sdk-platform-java/**/*.java'
             - 'sdk-platform-java/java-shared-dependencies/**/pom.xml'
             - 'sdk-platform-java/gapic-generator-java-pom-parent/pom.xml'
+            - 'java-shared-config/**/pom.xml'
   units:
     needs: filter
     if: ${{ needs.filter.outputs.library == 'true' }}

.github/workflows/java-cloud-bom-ci.yaml

@@ -42,6 +42,7 @@ jobs:
             - 'java-cloud-bom/**'
             - 'sdk-platform-java/**'
             - 'google-auth-library-java/**'
+            - 'java-shared-config/**'
   dependencies:
     needs: filter
     if: ${{ needs.filter.outputs.library == 'true' }}

.github/workflows/java-spanner-jdbc-ci.yaml

@@ -45,6 +45,7 @@ jobs:
             - 'sdk-platform-java/**/*.java'
             - 'sdk-platform-java/java-shared-dependencies/**/pom.xml'
             - 'sdk-platform-java/gapic-generator-java-pom-parent/pom.xml'
+            - 'java-shared-config/**/pom.xml'
   units:
     needs: filter
     if: ${{ needs.filter.outputs.library == 'true' }}

.github/workflows/java-storage-nio-ci.yaml

@@ -45,6 +45,7 @@ jobs:
             - 'sdk-platform-java/**/*.java'
             - 'sdk-platform-java/java-shared-dependencies/**/pom.xml'
             - 'sdk-platform-java/gapic-generator-java-pom-parent/pom.xml'
+            - 'java-shared-config/**/pom.xml'
   units:
     needs: filter
     if: ${{ needs.filter.outputs.library == 'true' }}

.github/workflows/sdk-platform-java-ci.yaml

@@ -23,6 +23,7 @@ jobs:
           library:
             - 'sdk-platform-java/**'
             - 'google-auth-library-java/**'
+            - 'java-shared-config/**'
             - '.github/workflows/sdk-platform-java-ci.yaml'
   units:
     needs: filter
@@ -280,7 +281,6 @@ jobs:
         with:
           java-version: 8
           distribution: temurin
-          cache: maven
       - run: java -version
       - name: Run tests in Java 8 with the source compiled in Java 11 for gapic-generator-java
         shell: bash

.github/workflows/sdk-platform-java-downstream.yaml

@@ -28,43 +28,7 @@ jobs:
           library:
             - 'sdk-platform-java/**'
             - 'google-auth-library-java/**'
-            - .kokoro/downstream-compatibility.sh
             - .github/workflows/sdk-platform-java-downstream.yaml
-  downstream-compatibility:
-    needs: filter
-    if: ${{ needs.filter.outputs.library == 'true' }}
-    runs-on: ubuntu-22.04
-    strategy:
-      fail-fast: false
-      matrix:
-        repo:
-          - java-bigtable
-          - java-firestore
-          - java-pubsub
-    steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
-        with:
-          persist-credentials: false
-      - uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3.14.1
-        with:
-          java-version: 17
-          distribution: temurin
-          cache: maven
-      - run: mvn -version
-      - name: Install xmllint
-        timeout-minutes: 5
-        run: |
-          # Retry apt-get update and install up to 3 times with a 15-second per-request timeout.
-          # Retries protect against transient network glitches, mirror timeouts, and apt lock contention on runner startup.
-          for i in {1..3}; do
-            sudo apt-get -o Acquire::http::Timeout="15" -o Acquire::Retries=3 update && \
-            sudo apt-get -o Acquire::http::Timeout="15" -o Acquire::Retries=3 -y install libxml2-utils && \
-            break || sleep 5
-          done
-      - name: Test helper scripts
-        run: .kokoro/common_test.sh
-      - name: Perform downstream compatibility testing
-        run: REPOS_UNDER_TEST="${{ matrix.repo }}" .kokoro/downstream-compatibility.sh
   downstream-compatibility-spring-generator:
     needs: filter
     if: ${{ needs.filter.outputs.library == 'true' }}
@@ -92,10 +56,12 @@ jobs:
             sudo apt-get -o Acquire::http::Timeout="15" -o Acquire::Retries=3 -y install libxml2-utils && \
             break || sleep 5
           done
+      - name: Test helper scripts
+        run: .kokoro/common_test.sh
       - name: Perform downstream compatibility testing
         run: .kokoro/downstream-compatibility-spring.sh
   required:
-    needs: [ downstream-compatibility, downstream-compatibility-spring-generator ]
+    needs: [ downstream-compatibility-spring-generator ]
     name: conditional-required-check
     if: ${{ always() }} # Always run even if any "needs" jobs fail
     runs-on: ubuntu-22.04

.github/workflows/showcase.yaml

@@ -23,6 +23,7 @@ jobs:
           library:
             - 'sdk-platform-java/**'
             - 'google-auth-library-java/**'
+            - 'java-shared-config/**'
             - 'java-showcase/**'
             - '.github/workflows/showcase.yaml'
 
@@ -50,7 +51,6 @@ jobs:
         with:
           java-version: 8
           distribution: temurin
-          cache: maven
       - run: java -version
       - name: Parse showcase version
         working-directory: java-showcase/gapic-showcase
@@ -155,7 +155,6 @@ jobs:
         with:
           java-version: 17
           distribution: temurin
-          cache: maven
       - name: Showcase golden tests
         working-directory: java-showcase
         run: |
@@ -168,7 +167,6 @@ jobs:
         with:
           java-version: ${{ matrix.java }}
           distribution: temurin
-          cache: maven
       - name: Parse showcase version
         working-directory: java-showcase/gapic-showcase
         run: echo "SHOWCASE_VERSION=$(mvn help:evaluate -Dexpression=gapic-showcase.version -q -DforceStdout)" >> "$GITHUB_ENV"