Merge branch 'main' of github.com:googleapis/google-cloud-java into fix_auth_adc_credentials_nullability

Author: lqiu96

.github/workflows/ci.yaml

@@ -23,8 +23,8 @@ on:
   pull_request:
 name: ci
 jobs:
-  # detect whether or note we should run "bulk" (non-handwritten) unit tests
-  bulk-filter:
+  # detect whether or not we should run generated (non-handwritten) unit tests
+  generated-libraries-filter:
     runs-on: ubuntu-latest
     permissions:
       pull-requests: read
@@ -57,68 +57,63 @@ jobs:
           ci:
             - '.github/workflows/ci.yaml'
             - '.kokoro/**'
-  # these unit tests are "bulk" (non-handwritten) libraries
+  # compile all modules across supported Java versions as a fast smoke test
   units:
     runs-on: ubuntu-latest
-    needs: bulk-filter
+    needs: generated-libraries-filter
+    if: ${{ needs.generated-libraries-filter.outputs.runnable == 'true' }}
     strategy:
       fail-fast: false
       matrix:
         java: [11, 17, 21, 25, 26]
     steps:
     - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
       with:
         persist-credentials: false
     - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
-      if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
       with:
         distribution: temurin
         java-version: ${{matrix.java}}
         cache: maven
     - run: java -version
-      if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
     - run: .kokoro/build.sh
-      if: ${{ needs.bulk-filter.outputs.runnable == 'true' && (needs.bulk-filter.outputs.src == 'true' || needs.bulk-filter.outputs.ci == 'true') }}
+      if: ${{ needs.generated-libraries-filter.outputs.src == 'true' || needs.generated-libraries-filter.outputs.ci == 'true' }}
       env:
         JOB_TYPE: test
         JOB_NAME: units-${{matrix.java}}
   units-8-runtime:
     runs-on: ubuntu-latest
-    needs: bulk-filter
+    needs: generated-libraries-filter
+    if: ${{ needs.generated-libraries-filter.outputs.runnable == 'true' }}
     name: "units (8)"
     steps:
     - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
       with:
         persist-credentials: false
     - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
-      if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
       with:
         java-version: 8
         distribution: temurin
     - name: "Set jvm system property environment variable for surefire plugin (unit tests)"
       # Maven surefire plugin (unit tests) allows us to specify JVM to run the tests.
       # https://maven.apache.org/surefire/maven-surefire-plugin/test-mojo.html#jvm
-      if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
       run: echo "SUREFIRE_JVM_OPT=-Djvm=${JAVA_HOME}/bin/java" >> $GITHUB_ENV
       shell: bash    
     - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
-      if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
       with:
         java-version: 11
         distribution: temurin
         cache: maven
     - run: .kokoro/build.sh
-      if: ${{ needs.bulk-filter.outputs.runnable == 'true' && (needs.bulk-filter.outputs.src == 'true' || needs.bulk-filter.outputs.ci == 'true') }}
+      if: ${{ needs.generated-libraries-filter.outputs.src == 'true' || needs.generated-libraries-filter.outputs.ci == 'true' }}
       shell: bash      
       env:
         JOB_TYPE: test
         JOB_NAME: units-8-runtime-${{matrix.java}}
   # detect which libraries have changed
   changes:
-    needs: bulk-filter
-    if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
+    needs: generated-libraries-filter
+    if: ${{ needs.generated-libraries-filter.outputs.runnable == 'true' }}
     runs-on: ubuntu-latest
     permissions:
       pull-requests: read
@@ -349,7 +344,7 @@ jobs:
       env:
         BUILD_SUBDIR: ${{matrix.package}}
   required:
-    needs: [ bulk-filter, changes, split-units, split-clirr, split-dependencies ]
+    needs: [ generated-libraries-filter, changes, split-units, split-clirr, split-dependencies ]
     name: conditional-required-check
     if: ${{ always() }} # Always run even if any "needs" jobs fail
     runs-on: ubuntu-22.04
@@ -360,8 +355,8 @@ jobs:
       - name: Success otherwise
         run: echo "Success!"
   windows:
-    needs: bulk-filter
-    if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
+    needs: generated-libraries-filter
+    if: ${{ needs.generated-libraries-filter.outputs.runnable == 'true' }}
     runs-on: windows-latest
     steps:
     - name: Support longpaths
@@ -380,8 +375,8 @@ jobs:
         JOB_TYPE: test
         JOB_NAME: windows-units
   lint:
-    needs: bulk-filter
-    if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
+    needs: generated-libraries-filter
+    if: ${{ needs.generated-libraries-filter.outputs.runnable == 'true' }}
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
@@ -400,8 +395,26 @@ jobs:
         HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
         BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
   enforcer:
-    needs: bulk-filter
-    if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
+    needs: generated-libraries-filter
+    if: ${{ needs.generated-libraries-filter.outputs.runnable == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
+      with:
+        distribution: temurin
+        java-version: 11
+        cache: maven
+    - run: java -version
+    - run: mvn -B -ntp enforcer:enforce@enforce -T 1C
+  ban-duplicate-classes:
+    needs: generated-libraries-filter
+    if: |
+      needs.generated-libraries-filter.outputs.runnable == 'true' &&
+      github.head_ref == 'release-please--branches--main' &&
+      !endsWith(github.event.pull_request.title, 'SNAPSHOT')
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
@@ -418,10 +431,10 @@ jobs:
       env:
         JOB_TYPE: install
     - run: java -version
-    - run: mvn -B -ntp enforcer:enforce@enforce -T 1C
+    - run: mvn -B -ntp enforcer:enforce@enforce-banned-duplicate-classes -T 1C
   gapic-libraries-bom:
-    needs: bulk-filter
-    if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
+    needs: generated-libraries-filter
+    if: ${{ needs.generated-libraries-filter.outputs.runnable == 'true' }}
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

.github/workflows/java-shared-config-downstream-dependencies.yaml

@@ -82,37 +82,3 @@ jobs:
         mvn install -pl ${TARGET_PATH} -am -DskipTests=true -Dmaven.javadoc.skip=true -Dgcloud.download.skip=true -B -V -q
     - run: .kokoro/client-library-check.sh ${{matrix.repo}} dependencies
 
-  flatten-plugin-check:
-    needs: filter
-    if: ${{ needs.filter.outputs.library == 'true' }}
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      with:
-        persist-credentials: false
-    - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
-      with:
-        distribution: zulu
-        java-version: 11
-        cache: maven
-    - run: java -version
-    - name: Install xmllint
-      timeout-minutes: 5
-      run: |
-        # Retry apt-get update and install up to 3 times with a 15-second per-request timeout.
-        # Retries protect against transient network glitches, mirror timeouts, and apt lock contention on runner startup.
-        for i in {1..3}; do
-          sudo apt-get -o Acquire::http::Timeout="15" -o Acquire::Retries=3 update && \
-          sudo apt-get -o Acquire::http::Timeout="15" -o Acquire::Retries=3 -y install libxml2-utils && \
-          break || sleep 5
-        done
-    - name: Install java-shared-dependencies and common dependencies
-      run: |
-        .kokoro/build.sh
-      env:
-        JOB_TYPE: install
-    - name: Pre-build dependencies
-      run: mvn install -pl java-storage/google-cloud-storage -am -DskipTests=true -Dmaven.javadoc.skip=true -Dgcloud.download.skip=true -B -V -q
-    - run: .kokoro/client-library-check.sh java-storage flatten-plugin
-      env:
-        EXPECTED_DEPENDENCIES_LIST: java-storage-expected-flattened-dependencies.txt

.kokoro/build.sh

@@ -37,27 +37,39 @@ RETURN_CODE=0
 
 case ${JOB_TYPE} in
   test)
+    MAVEN_GOAL="test"
     if [[ -n "${BUILD_SUBDIR}" ]]
     then
+      # Targeted module build (invoked by split-units for handwritten/combo libraries).
+      # Compiles and runs all unit tests for the specific changed library submodule.
       echo "Compiling and building all modules for ${BUILD_SUBDIR}"
       install_modules "${BUILD_SUBDIR}"
       echo "Running in subdir: ${BUILD_SUBDIR}"
       pushd "${BUILD_SUBDIR}"
-      EXTRA_PROFILE_OPTS=()
+      EXCLUDE_PROJECTS_OPTS=()
     else
-      EXTRA_PROFILE_OPTS=("-PbulkTests")
+      # Full monorepo smoke pass across Java runtime matrix versions (units job).
+      # Pure GAPIC-generated modules skip unit tests by default via <skipUnitTests>true</skipUnitTests>
+      # in google-cloud-jar-parent; generator correctness and GAX runtime behaviors are covered by
+      # java-showcase (showcase.yaml). Running a parallel compile pass confirms compatibility
+      # across all supported JDKs in ~2 minutes instead of 40+ minutes.
+      MAVEN_GOAL="compile"
+      # gapic-generator-java is a code generation tool tested in its own dedicated workflow
+      # (sdk-platform-java-ci.yaml). Excluding it from bulk unit test runs saves 2-3 minutes per
+      # Java runtime matrix job and avoids reactor dependency resolution race conditions.
+      EXCLUDE_PROJECTS_OPTS=("--projects" "!sdk-platform-java/gapic-generator-java,!sdk-platform-java/gapic-generator-java-pom-parent")
       install_modules "sdk-platform-java"
     fi
-    echo "SUREFIRE_JVM_OPT: ${SUREFIRE_JVM_OPT}"
+    echo "MAVEN_GOAL: ${MAVEN_GOAL}"
     retry_with_backoff 3 10 \
-      mvn install \
+      mvn ${MAVEN_GOAL} \
         -B -ntp \
         -Pquick-build \
         -Dorg.slf4j.simpleLogger.showDateTime=true \
         -Dorg.slf4j.simpleLogger.dateTimeFormat=HH:mm:ss:SSS \
         -Dmaven.wagon.http.retryHandler.count=5 \
-        --also-make \
-        ${SUREFIRE_JVM_OPT} "${EXTRA_PROFILE_OPTS[@]}"
+        "${EXCLUDE_PROJECTS_OPTS[@]}" \
+        -T 1C
     RETURN_CODE=$?
 
     if [[ -n "${BUILD_SUBDIR}" ]]

.kokoro/client-library-check.sh

@@ -140,26 +140,6 @@ dependencies)
     ../.kokoro/dependencies.sh
     RETURN_CODE=$?
     ;;
-flatten-plugin)
-    # This creates .flattened-pom.xml
-    echo "Before running ../.kokoro/build.sh"
-    ../.kokoro/build.sh
-    echo "After running ../.kokoro/build.sh"
-    pushd ${LIBRARY_NAME}
-    mvn -B -ntp dependency:list -f .flattened-pom.xml -DincludeScope=runtime -Dsort=true \
-        | grep '\[INFO]    .*:.*:.*:.*:.*' |awk '{print $2}' > .actual-flattened-dependencies-list.txt
-    
-    # Strip -SNAPSHOT for comparison to support release PRs where dependencies are bumped to release versions
-    echo "Diff from the expected file (${EXPECTED_DEPENDENCIES_LIST}) (ignoring -SNAPSHOT):"
-    diff <(sed 's/-SNAPSHOT//g' "${scriptDir}/${EXPECTED_DEPENDENCIES_LIST}") <(sed 's/-SNAPSHOT//g' .actual-flattened-dependencies-list.txt)
-    RETURN_CODE=$?
-    if [ "${RETURN_CODE}" == 0 ]; then
-      echo "No diff."
-    else
-      echo "There was a diff."
-    fi
-    popd
-    ;;
 *)
     # For clirr and test, run directly in the subdirectory to avoid building monorepo dependencies (like gax) from source.
     # This is necessary because some monorepo dependencies (like gax) use GraalVM 25+ which cannot be compiled under Java 8.

.kokoro/common.sh

@@ -416,6 +416,8 @@ function install_modules() {
     printf "Installing submodules:\n%s\n" "$all_submodules"
 
     always_install_deps_list=(
+      # Required upstream dependency for java-spanner and java-spanner-jdbc
+      'grpc-gcp-java'
       'java-monitoring/google-cloud-monitoring'
       'java-monitoring/google-cloud-monitoring-bom'
       'java-kms/google-cloud-kms'
@@ -439,6 +441,8 @@ function install_modules() {
       'java-iam/proto-google-iam-v3'
       'java-iam/proto-google-iam-v3beta'
       'gapic-libraries-bom'
+      # Required upstream dependency for gax-java, google-cloud-core, and all client libraries
+      'sdk-platform-java/api-common-java'
       'sdk-platform-java/java-shared-dependencies'
       'sdk-platform-java/java-shared-dependencies/first-party-dependencies'
       'sdk-platform-java/java-shared-dependencies/third-party-dependencies'

.kokoro/dependencies.sh

@@ -56,11 +56,20 @@ then
   pushd "${BUILD_SUBDIR}"
 fi
 
-# this should run maven enforcer
-mvn install -B -V -ntp \
-  -Pquick-build -DskipTests=true -Dmaven.javadoc.skip=true -Denforcer.skip=false
+# We use the 'test-compile' lifecycle phase (with -DskipTests=true) for the following reasons:
+# 1. Why test-compile over compile? 'compile' only builds src/main/java. 'dependency:analyze'
+#    inspects bytecode in both target/classes and target/test-classes. If test classes are not
+#    compiled, test-scoped dependencies (such as test mocks and stubs) will be falsely flagged
+#    as "Unused declared dependencies" by maven-dependency-plugin.
+# 2. Why test-compile over package/install? 'package' and 'install' build and bundle JAR archives
+#    and install them into ~/.m2/repository. Packaging JARs adds significant build time (5-15 mins)
+#    and is unnecessary for static dependency analysis and enforcer verification. 'test-compile'
+#    produces the required bytecode in target/classes and target/test-classes in seconds.
+# 3. Why -DskipTests=true? Ensures test classes are compiled without executing tests during analysis.
+mvn test-compile -B -V -ntp \
+  -Pquick-build -DskipTests=true -Dmaven.javadoc.skip=true -Denforcer.skip=false -T 1C
 
-mvn -B dependency:analyze -Pquick-build -DfailOnWarning=true -Dmdep.analyze.skip=false
+mvn -B dependency:analyze -Pquick-build -DfailOnWarning=true -Dmdep.analyze.skip=false -T 1C
 
 if [[ -n "${BUILD_SUBDIR}" ]]
 then