Skip to content

build(deps): bump project.version from 0.6.0-SNAPSHOT to 0.6.0 in /performance-test - #336

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/performance-test/project.version-0.6.0
Closed

build(deps): bump project.version from 0.6.0-SNAPSHOT to 0.6.0 in /performance-test#336
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/performance-test/project.version-0.6.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 11, 2026

Copy link
Copy Markdown
Contributor

Bumps project.version from 0.6.0-SNAPSHOT to 0.6.0.
Updates io.github.java-helpers:simple-builders-core from 0.6.0-SNAPSHOT to 0.6.0

Release notes

Sourced from io.github.java-helpers:simple-builders-core's releases.

Release 0.6.0

What's Changed

✨ New Features

🐛 Bug Fixes

⚡ Performance

... (truncated)

Changelog

Sourced from io.github.java-helpers:simple-builders-core's changelog.

Release Process

This document describes how to release artifacts to Maven Central.

Prerequisites

Configure these GitHub secrets in Settings → Secrets and variables → Actions:

  1. CENTRAL_TOKEN_USERNAME - Maven Central token username
  2. CENTRAL_TOKEN_PASSWORD - Maven Central token password
  3. GPG_SIGNING_KEY - GPG private key (full armored block)
  4. GPG_SIGNING_KEY_PASSWORD - GPG key passphrase

How to Release

Actions → Release to Maven Central → Run workflow

No version input is required. The workflow derives the release version from the current POM by stripping the -SNAPSHOT suffix (e.g., 0.5.0-SNAPSHOT → release 0.5.0). The main branch must always be on a -SNAPSHOT version.

What the Workflow Does

  1. Derives the release version from the current POM snapshot version (strips -SNAPSHOT)
  2. Updates POM versions to the release version in all modules (core, processor, example, example-custom-generator)
  3. Commits the version bump on a dedicated release/vX.Y.Z branch and creates tag vX.Y.Z
  4. Builds and verifies the project with -Prelease (reproducible builds via project.build.outputTimestamp)
  5. Signs artifacts with GPG
  6. Generates a CycloneDX SBOM (JSON + XML) for each published module
  7. Runs tests and stages the deployment to the Sonatype Central portal (does not auto-publish)
  8. Creates a build-provenance attestation for the published jars
  9. Bumps all module versions to the next snapshot (e.g., 0.6.0-SNAPSHOT after releasing 0.5.0) and commits it as a second commit on the release branch
  10. Pushes the release branch and tag (never pushes directly to main)
  11. Opens a pull request against main containing both the release version commit and the next-snapshot bump
  12. Creates draft GitHub release (jars, sources, javadoc and SBOMs attached; requires manual publish)

After Release

  1. Publish to Maven Central: Go to the Sonatype Central portal, review the staged deployment, and manually publish it. Nothing is released to consumers until this step is performed.
  2. Publish GitHub Release: Go to Releases → Edit draft → Publish release
  3. Verify Maven Central: Artifacts appear at https://central.sonatype.com/ (15-30 min delay)
    • Search for: io.github.java-helpers:simple-builders-core or simple-builders-processor
  4. Test the release: 
    <dependency>
  <groupId>io.github.java-helpers</groupId>
  <artifactId>simple-builders-core</artifactId>
  <version>0.5.0</version>
</dependency>
  5. Merge the version-bump pull request: Review and merge the PR opened by the workflow. This updates main with both the release version commit (tagged vX.Y.Z) and the next-snapshot bump (e.g., 0.6.0-SNAPSHOT), so development can continue.

... (truncated)

Commits

Updates io.github.java-helpers:simple-builders-processor from 0.6.0-SNAPSHOT to 0.6.0

Release notes

Sourced from io.github.java-helpers:simple-builders-processor's releases.

Release 0.6.0

What's Changed

✨ New Features

🐛 Bug Fixes

⚡ Performance

... (truncated)

Changelog

Sourced from io.github.java-helpers:simple-builders-processor's changelog.

Release Process

This document describes how to release artifacts to Maven Central.

Prerequisites

Configure these GitHub secrets in Settings → Secrets and variables → Actions:

  1. CENTRAL_TOKEN_USERNAME - Maven Central token username
  2. CENTRAL_TOKEN_PASSWORD - Maven Central token password
  3. GPG_SIGNING_KEY - GPG private key (full armored block)
  4. GPG_SIGNING_KEY_PASSWORD - GPG key passphrase

How to Release

Actions → Release to Maven Central → Run workflow

No version input is required. The workflow derives the release version from the current POM by stripping the -SNAPSHOT suffix (e.g., 0.5.0-SNAPSHOT → release 0.5.0). The main branch must always be on a -SNAPSHOT version.

What the Workflow Does

  1. Derives the release version from the current POM snapshot version (strips -SNAPSHOT)
  2. Updates POM versions to the release version in all modules (core, processor, example, example-custom-generator)
  3. Commits the version bump on a dedicated release/vX.Y.Z branch and creates tag vX.Y.Z
  4. Builds and verifies the project with -Prelease (reproducible builds via project.build.outputTimestamp)
  5. Signs artifacts with GPG
  6. Generates a CycloneDX SBOM (JSON + XML) for each published module
  7. Runs tests and stages the deployment to the Sonatype Central portal (does not auto-publish)
  8. Creates a build-provenance attestation for the published jars
  9. Bumps all module versions to the next snapshot (e.g., 0.6.0-SNAPSHOT after releasing 0.5.0) and commits it as a second commit on the release branch
  10. Pushes the release branch and tag (never pushes directly to main)
  11. Opens a pull request against main containing both the release version commit and the next-snapshot bump
  12. Creates draft GitHub release (jars, sources, javadoc and SBOMs attached; requires manual publish)

After Release

  1. Publish to Maven Central: Go to the Sonatype Central portal, review the staged deployment, and manually publish it. Nothing is released to consumers until this step is performed.
  2. Publish GitHub Release: Go to Releases → Edit draft → Publish release
  3. Verify Maven Central: Artifacts appear at https://central.sonatype.com/ (15-30 min delay)
    • Search for: io.github.java-helpers:simple-builders-core or simple-builders-processor
  4. Test the release: 
    <dependency>
  <groupId>io.github.java-helpers</groupId>
  <artifactId>simple-builders-core</artifactId>
  <version>0.5.0</version>
</dependency>
  5. Merge the version-bump pull request: Review and merge the PR opened by the workflow. This updates main with both the release version commit (tagged vX.Y.Z) and the next-snapshot bump (e.g., 0.6.0-SNAPSHOT), so development can continue.

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): bump project.version in /performance-test
d6b126d 
Bumps `project.version` from 0.6.0-SNAPSHOT to 0.6.0.

Updates `io.github.java-helpers:simple-builders-core` from 0.6.0-SNAPSHOT to 0.6.0
- [Release notes](https://github.com/java-helpers/simple-builders/releases)
- [Changelog](https://github.com/java-helpers/simple-builders/blob/main/RELEASE.md)
- [Commits](https://github.com/java-helpers/simple-builders/commits/v0.6.0)

Updates `io.github.java-helpers:simple-builders-processor` from 0.6.0-SNAPSHOT to 0.6.0
- [Release notes](https://github.com/java-helpers/simple-builders/releases)
- [Changelog](https://github.com/java-helpers/simple-builders/blob/main/RELEASE.md)
- [Commits](https://github.com/java-helpers/simple-builders/commits/v0.6.0)

---
updated-dependencies:
- dependency-name: io.github.java-helpers:simple-builders-core
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: io.github.java-helpers:simple-builders-processor
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Oct 11, 2026
@igel-devin-ai igel-devin-ai mentioned this pull request Oct 11, 2026
Merged
AndreasIgel pushed a commit that referenced this pull request Oct 11, 2026
@igel-devin-ai @devin-ai-integration
Version all POMs in the release workflow and verify they stay in sync (…
efa3b1a 
…#338)

* Version all POMs in the release workflow and verify they stay in sync

The release workflow bumped a hardcoded module list, so performance-test
(only part of a profile) was left on 0.6.0-SNAPSHOT, which made Dependabot
propose bumping it to the released 0.6.0 (#336).

- add .github/scripts/project-version.sh (set|verify) discovering all
  tracked POMs via git
- use it for the release and next-snapshot bumps and stage all POMs
- fail CI and the release when any POM drifts from the root version
- align performance-test with 0.7.0-SNAPSHOT

* Simplify project-version.sh and verify versions only on release PRs

- readable functions and explicit --set <version> / --verify / --help options
- run the version check only for release/* PRs, not on every CI build
  nor in the release workflow

* Verify POM versions in the release workflow instead of normal CI

* Use a simple if/elif chain for version script options

* Use plain POM patterns when staging release versions

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@dependabot @github

dependabot Bot commented on behalf of github Oct 11, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/maven/performance-test/project.version-0.6.0 branch October 11, 2026 21:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants