From eda0d18d54caeac0b044dbdab3e0e43b81e67377 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 12 Oct 2026 18:54:03 +0000 Subject: [PATCH 1/2] CI: test Maven 4 on 4.0.0-rc-7 The nightly full tier still tested Maven 4 on 4.0.0-rc-6, which 4.0.0-rc-7 has superseded, so Maven 4 regressions users hit on the current release candidate could go unnoticed. Move both 4.x legs (redirect + vendor builds, and the vendored reactor) to rc-7 and replace the rc-6 SHA512 pin with rc-7's, taken from Apache's published checksum. Same legs, same tier: no change in runner use. Refs #267 Assisted-by: Claude Code:claude-opus-5-5 --- .github/workflows/ci.yml | 4 ++-- docs/design/maven-vendoring.md | 2 +- scripts/maven-sha512.json | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 453634ddc..13b5f25c6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1911,14 +1911,14 @@ jobs: - {os: ubuntu-latest, suite: e2e_vex_build, test_filter: 'pipenv:: --ignored', pipenv: '2022.12.19'} - {os: ubuntu-latest, suite: e2e_redirect_maven_build e2e_vendor_maven_build, jvm_tool: maven, maven: '3.6.3'} - {os: ubuntu-latest, suite: e2e_redirect_maven_build e2e_vendor_maven_build, jvm_tool: maven, maven: '3.8.9'} - - {os: ubuntu-latest, suite: e2e_redirect_maven_build e2e_vendor_maven_build, jvm_tool: maven, maven: '4.0.0-rc-6'} + - {os: ubuntu-latest, suite: e2e_redirect_maven_build e2e_vendor_maven_build, jvm_tool: maven, maven: '4.0.0-rc-7'} - {os: ubuntu-latest, suite: e2e_redirect_maven_build, jvm_tool: maven, maven: '3.9.3'} - {os: ubuntu-latest, suite: e2e_redirect_maven_build, jvm_tool: maven, maven: '3.9.4'} - {os: ubuntu-latest, suite: e2e_vendor_jvm_build, jvm_tool: maven, maven: '3.6.3', test_filter: '--ignored maven_reactor'} - {os: ubuntu-latest, suite: e2e_vendor_jvm_build, jvm_tool: maven, maven: '3.8.9', test_filter: '--ignored maven_reactor'} - {os: ubuntu-latest, suite: e2e_vendor_jvm_build, jvm_tool: maven, maven: '3.9.2', test_filter: '--ignored maven_reactor'} - {os: ubuntu-latest, suite: e2e_vendor_jvm_build, jvm_tool: maven, maven: '3.9.16', test_filter: '--ignored maven_reactor'} - - {os: ubuntu-latest, suite: e2e_vendor_jvm_build, jvm_tool: maven, maven: '4.0.0-rc-6', test_filter: '--ignored maven_reactor'} + - {os: ubuntu-latest, suite: e2e_vendor_jvm_build, jvm_tool: maven, maven: '4.0.0-rc-7', test_filter: '--ignored maven_reactor'} - {os: ubuntu-latest, suite: 'e2e_gradle_discovery_build e2e_gradle_agent_build e2e_redirect_gradle_build', jvm_tool: gradle, gradle: '6.9.4', java: '11', test_filter: '--ignored gradle_agent_ gradle_hosted_3 gradle_hosted_4 gradle_hosted_5'} - {os: ubuntu-latest, suite: e2e_redirect_gradle_build, jvm_tool: gradle, gradle: '6.9.4', java: '11', test_filter: '--ignored gradle_hosted_b gradle_hosted_c gradle_hosted_d gradle_hosted_e gradle_hosted_f gradle_hosted_l gradle_hosted_m gradle_hosted_n gradle_hosted_o gradle_hosted_p'} - {os: ubuntu-latest, suite: e2e_redirect_gradle_build, jvm_tool: gradle, gradle: '6.9.4', java: '11', test_filter: '--ignored gradle_hosted_ --skip gradle_hosted_3 --skip gradle_hosted_4 --skip gradle_hosted_5 --skip gradle_hosted_b --skip gradle_hosted_c --skip gradle_hosted_d --skip gradle_hosted_e --skip gradle_hosted_f --skip gradle_hosted_l --skip gradle_hosted_m --skip gradle_hosted_n --skip gradle_hosted_o --skip gradle_hosted_p'} diff --git a/docs/design/maven-vendoring.md b/docs/design/maven-vendoring.md index 658eed563..e8840b32d 100644 --- a/docs/design/maven-vendoring.md +++ b/docs/design/maven-vendoring.md @@ -249,7 +249,7 @@ checkouts, root and module invocations, Gradle strict locking and repository mode, existing verification metadata, offline builds, tamper detection and byte-exact revert; `e2e_vendor_gradle_build` covers each Gradle rule above against a fake Central, asserting on the jar Gradle actually consumes. The PR -tier pins Maven 3.6.3, 3.8.9, 3.9.2, 3.9.16 and 4.0.0-rc-6 (macOS and Windows on +tier pins Maven 3.6.3, 3.8.9, 3.9.2, 3.9.16 and 4.0.0-rc-7 (macOS and Windows on 3.9.16), and Gradle 6.9.4, 7.6.6, 8.14.3 and 9.8.0 on Linux, plus a Windows 8.14.3 row; `gradle-compatibility.yml` runs every Gradle version on Linux, macOS and Windows nightly. diff --git a/scripts/maven-sha512.json b/scripts/maven-sha512.json index 066ab5605..8ede34e22 100644 --- a/scripts/maven-sha512.json +++ b/scripts/maven-sha512.json @@ -5,5 +5,5 @@ "3.9.3": "400fc5b6d000c158d5ee7937543faa06b6bda8408caa2444a9c947c21472fde0f0b64ac452b8cec8855d528c0335522ed5b6c8f77085811c7e29e1bedbb5daa2", "3.9.4": "deaa39e16b2cf20f8cd7d232a1306344f04020e1f0fb28d35492606f647a60fe729cc40d3cba33e093a17aed41bd161fe1240556d0f1b80e773abd408686217e", "3.9.16": "831a8591fe20c8243b1dbe7d71e3244f31d1665b0804b2e825e38cbbe5ce0cafb8338851f90780735568773e0a6cd07bbec107cda0b896b008b861075358b6f6", - "4.0.0-rc-6": "3fba58e1c345a5aa1dbacfa7aceaf7b1a0fa9626e368eec4814fa7a7ebf0fe74f0e41481faef77f95d8738f9c1365f918c8b8c94d7c28656f067db61a8af7f2e" + "4.0.0-rc-7": "17b886c0ffb7ec225e514afa8179b3143d855d196cfbb4607ece6272a9b4f51501a389438ab6841b393a4b1391a1b714f07f450daba1951f53f732b400338184" } From 8fc25a30014a6741ea52baf79da435e8ad65e7fc Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 12 Oct 2026 19:04:55 +0000 Subject: [PATCH 2/2] Docs: name the tiers that run each Maven pin The Maven vendoring design doc said the PR tier pins five Maven versions, but since lean CI only 3.9.16 runs on PRs and in the merge queue; the rest, plus 3.9.3 and 3.9.4, run in the nightly full tier. Also point two code comments that cite the Maven 4 release they were checked against at rc-7, which the e2e suites now run and pass on. Refs #267 Assisted-by: Claude Code:claude-opus-5-5 --- .../socket-patch-cli/tests/maven_build_common/mod.rs | 2 +- crates/socket-patch-core/src/vex/discover/maven.rs | 2 +- docs/design/maven-vendoring.md | 11 ++++++----- 3 files changed, 8 insertions(+), 7 deletions(-) diff --git a/crates/socket-patch-cli/tests/maven_build_common/mod.rs b/crates/socket-patch-cli/tests/maven_build_common/mod.rs index a49bc96fc..5eca098ce 100644 --- a/crates/socket-patch-cli/tests/maven_build_common/mod.rs +++ b/crates/socket-patch-cli/tests/maven_build_common/mod.rs @@ -34,7 +34,7 @@ pub const MVN_ENV: &str = "SOCKET_PATCH_MAVEN_E2E_MVN"; pub const VERSION_ENV: &str = "SOCKET_PATCH_MAVEN_E2E_VERSION"; pub const REQUIRED_ENV: &str = "SOCKET_PATCH_MAVEN_E2E_REQUIRED"; -/// What Maven 4's `CIDetector`s key on (4.0.0-rc-6 `cisupport`: generic +/// What Maven 4's `CIDetector`s key on (4.0.0-rc-7 `cisupport`: generic /// `CI`, GitHub `GITHUB_ACTIONS`, CircleCI, Jenkins `WORKSPACE`, TeamCity, /// Travis). When one is set, Maven 4 swaps in the `QuietMavenTransferListener` /// even under `-B` — no "Downloading from …" lines and, crucially, no diff --git a/crates/socket-patch-core/src/vex/discover/maven.rs b/crates/socket-patch-core/src/vex/discover/maven.rs index bac874a30..c826edf51 100644 --- a/crates/socket-patch-core/src/vex/discover/maven.rs +++ b/crates/socket-patch-core/src/vex/discover/maven.rs @@ -1547,7 +1547,7 @@ mod tests { /// REGRESSION: the vendored repository is `checksumPolicy=fail`, so the /// jar's `.sha1` sidecar is part of the wiring. With it stale or gone, - /// real Maven (3.6.3 → 4.0.0-rc-6, `e2e_vendor_maven_build`) rejects the + /// real Maven (3.6.3 → 4.0.0-rc-7, `e2e_vendor_maven_build`) rejects the /// file:// copy and silently resolves Central's pristine jar — while the /// committed members still hash-verify, so the ref must not attest a /// build that no longer consumes the patch. diff --git a/docs/design/maven-vendoring.md b/docs/design/maven-vendoring.md index e8840b32d..432789057 100644 --- a/docs/design/maven-vendoring.md +++ b/docs/design/maven-vendoring.md @@ -248,11 +248,12 @@ integration tests. Real-tool capstones exercise a Maven reactor from fresh checkouts, root and module invocations, Gradle strict locking and repository mode, existing verification metadata, offline builds, tamper detection and byte-exact revert; `e2e_vendor_gradle_build` covers each Gradle rule above -against a fake Central, asserting on the jar Gradle actually consumes. The PR -tier pins Maven 3.6.3, 3.8.9, 3.9.2, 3.9.16 and 4.0.0-rc-7 (macOS and Windows on -3.9.16), and Gradle 6.9.4, 7.6.6, 8.14.3 and 9.8.0 on Linux, plus a Windows -8.14.3 row; `gradle-compatibility.yml` runs every Gradle version on Linux, -macOS and Windows nightly. +against a fake Central, asserting on the jar Gradle actually consumes. PR and +merge-queue runs pin Maven 3.9.16; the nightly full tier adds 3.6.3, 3.8.9, +3.9.2, 3.9.3, 3.9.4 and 4.0.0-rc-7 (macOS and Windows on 3.9.16), and Gradle +6.9.4, 7.6.6, 8.14.3 and 9.8.0 on Linux, plus a Windows 8.14.3 row; +`gradle-compatibility.yml` runs every Gradle version on Linux, macOS and +Windows nightly. Pre-v5 single-POM entries are not migrated: revert them and vendor again. Maven 4 implicit subproject discovery, build-time Maven strict pins, creating Gradle verification policy, and online