Skip to content

Commit fb872e2

Browse files
tanmay-dbtanmay-db
committed
Merge remote-tracking branch 'origin/main' into default-oidc-audience
# Conflicts: # databricks-sdk-java/src/main/java/com/databricks/sdk/core/HostType.java
2 parents acb210f + 9df8048 commit fb872e2

24 files changed

Lines changed: 568 additions & 467 deletions

‎.github/actions/setup-build-environment/action.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
name: Setup build environment
2+
description: Set up JDK with JFrog Artifactory as Maven mirror for hardened runners
3+
4+
inputs:
5+
java-version:
6+
description: "Java version to install"
7+
required: true
8+
9+
runs:
10+
using: composite
11+
steps:
12+
- name: Setup JFrog CLI with OIDC
13+
if: runner.os != 'macOS'
14+
id: jfrog
15+
uses: jfrog/setup-jfrog-cli@279b1f629f43dd5bc658d8361ac4802a7ef8d2d5 # v4.9.1
16+
env:
17+
JF_URL: https://databricks.jfrog.io
18+
with:
19+
oidc-provider-name: github-actions
20+
21+
- name: Set up JDK
22+
uses: actions/setup-java@b6e674f4b717d7b0ae3baee0fbe79f498905dfde # v1.4.4
23+
with:
24+
java-version: ${{ inputs.java-version }}
25+
26+
- name: Configure Maven for JFrog
27+
if: runner.os != 'macOS'
28+
shell: bash
29+
run: |
30+
mkdir -p ~/.m2
31+
cat > ~/.m2/settings.xml << EOF
32+
<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
33+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
34+
xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">
35+
<mirrors>
36+
<mirror>
37+
<id>jfrog-maven</id>
38+
<url>https://databricks.jfrog.io/artifactory/db-maven/</url>
39+
<mirrorOf>*</mirrorOf>
40+
</mirror>
41+
</mirrors>
42+
<servers>
43+
<server>
44+
<id>jfrog-maven</id>
45+
<username>${{ steps.jfrog.outputs.oidc-user }}</username>
46+
<password><![CDATA[${{ steps.jfrog.outputs.oidc-token }}]]></password>
47+
</server>
48+
</servers>
49+
</settings>
50+
EOF

‎.github/workflows/push.yml‎

Lines changed: 49 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -6,66 +6,95 @@ on:
66
merge_group:
77
types: [checks_requested]
88

9+
permissions:
10+
id-token: write
11+
contents: read
12+
913
jobs:
1014
fmt:
11-
runs-on: ubuntu-latest
12-
steps:
13-
- name: Set up JDK 11
14-
uses: actions/setup-java@b6e674f4b717d7b0ae3baee0fbe79f498905dfde # v1.4.4
15-
with:
16-
java-version: 11
15+
runs-on:
16+
group: databricks-protected-runner-group
17+
labels: linux-ubuntu-latest
1718

19+
steps:
1820
- name: Checkout
1921
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
2022

2123
- name: Cache Maven packages
2224
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
2325
with:
24-
path: ~/.m2
26+
path: ~/.m2/repository
2527
key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
2628
restore-keys: ${{ runner.os }}-m2
2729

30+
- name: Setup build environment
31+
uses: ./.github/actions/setup-build-environment
32+
with:
33+
java-version: 11
34+
2835
- name: Check formatting
2936
run: mvn --errors spotless:check
3037

38+
- name: Check for JFrog proxy URLs in lockfiles
39+
run: |
40+
make fix-lockfile
41+
git diff --exit-code -- '**/lockfile.json'
42+
3143
unit-tests:
3244
strategy:
3345
fail-fast: false
3446
matrix:
3547
os: [macos-latest, ubuntu-latest]
3648
java-version: [8, 11, 17, 20] # 20 is the latest version as of 2023 and 17 is the latest LTS
49+
include:
50+
- os: ubuntu-latest
51+
runner:
52+
group: databricks-protected-runner-group
53+
labels: linux-ubuntu-latest
54+
- os: macos-latest
55+
runner: macos-latest
3756

38-
runs-on: ${{ matrix.os }}
57+
runs-on: ${{ matrix.runner }}
3958

4059
steps:
41-
- name: Set up JDK
42-
uses: actions/setup-java@b6e674f4b717d7b0ae3baee0fbe79f498905dfde # v1.4.4
43-
with:
44-
java-version: ${{ matrix.java-version }}
45-
4660
- name: Checkout
4761
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
4862

4963
- name: Cache Maven packages
5064
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
5165
with:
52-
path: ~/.m2
66+
path: ~/.m2/repository
5367
key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
5468
restore-keys: ${{ runner.os }}-m2
5569

70+
- name: Setup build environment
71+
uses: ./.github/actions/setup-build-environment
72+
with:
73+
java-version: ${{ matrix.java-version }}
74+
5675
- name: Check Unit Tests
5776
run: mvn --errors test
5877

5978
check-lock:
60-
runs-on: ubuntu-latest
61-
steps:
62-
- name: Set up JDK 11
63-
uses: actions/setup-java@b6e674f4b717d7b0ae3baee0fbe79f498905dfde # v1.4.4
64-
with:
65-
java-version: 11
79+
runs-on:
80+
group: databricks-protected-runner-group
81+
labels: linux-ubuntu-latest
6682

83+
steps:
6784
- name: Checkout
6885
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
6986

87+
- name: Cache Maven packages
88+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
89+
with:
90+
path: ~/.m2/repository
91+
key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
92+
restore-keys: ${{ runner.os }}-m2
93+
94+
- name: Setup build environment
95+
uses: ./.github/actions/setup-build-environment
96+
with:
97+
java-version: 11
98+
7099
- name: Validate lockfile
71100
run: make check-lock

‎.github/workflows/release.yml‎

Lines changed: 56 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -9,30 +9,79 @@ on:
99
branches:
1010
- "**"
1111

12+
permissions:
13+
id-token: write
14+
contents: read
15+
1216
jobs:
1317
publish:
1418
# Dynamically set the job name based on the trigger
1519
name: ${{ startsWith(github.ref, 'refs/tags/') && 'Publish Release' || 'Run Release Dry-Run' }}
1620

1721
runs-on:
18-
group: databricks-deco-testing-runner-group
19-
labels: ubuntu-latest-deco
22+
group: databricks-protected-runner-group
23+
labels: linux-ubuntu-latest
2024

2125
steps:
2226
- name: Checkout
2327
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
2428

29+
- name: Cache Maven packages
30+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
31+
with:
32+
path: ~/.m2/repository
33+
key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
34+
restore-keys: ${{ runner.os }}-m2
35+
36+
- name: Setup JFrog CLI with OIDC
37+
id: jfrog
38+
uses: jfrog/setup-jfrog-cli@279b1f629f43dd5bc658d8361ac4802a7ef8d2d5 # v4.9.1
39+
env:
40+
JF_URL: https://databricks.jfrog.io
41+
with:
42+
oidc-provider-name: github-actions
43+
2544
- name: Set up Java for publishing to Maven Central Repository
2645
uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3.14.1
2746
with:
2847
java-version: 8
29-
server-id: central
3048
distribution: "adopt"
31-
server-username: MAVEN_CENTRAL_USERNAME
32-
server-password: MAVEN_CENTRAL_PASSWORD
3349
gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
3450
gpg-passphrase: GPG_PASSPHRASE
35-
51+
52+
- name: Configure Maven for JFrog and Maven Central
53+
run: |
54+
mkdir -p ~/.m2
55+
cat > ~/.m2/settings.xml << EOF
56+
<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
57+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
58+
xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">
59+
<mirrors>
60+
<mirror>
61+
<id>jfrog-maven</id>
62+
<url>https://databricks.jfrog.io/artifactory/db-maven/</url>
63+
<mirrorOf>*</mirrorOf>
64+
</mirror>
65+
</mirrors>
66+
<servers>
67+
<server>
68+
<id>jfrog-maven</id>
69+
<username>${{ steps.jfrog.outputs.oidc-user }}</username>
70+
<password><![CDATA[${{ steps.jfrog.outputs.oidc-token }}]]></password>
71+
</server>
72+
<server>
73+
<id>central</id>
74+
<username>${{ secrets.MAVEN_CENTRAL_USERNAME }}</username>
75+
<password>${{ secrets.MAVEN_CENTRAL_PASSWORD }}</password>
76+
</server>
77+
<server>
78+
<id>gpg.passphrase</id>
79+
<passphrase>\${env.GPG_PASSPHRASE}</passphrase>
80+
</server>
81+
</servers>
82+
</settings>
83+
EOF
84+
3685
# This step runs ONLY on branch pushes (dry-run)
3786
- name: Run Release Dry-Run (Verify)
3887
if: "!startsWith(github.ref, 'refs/tags/')"
@@ -71,4 +120,4 @@ jobs:
71120
uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v0.1.15
72121
with:
73122
files: databricks-sdk-java/target/*.jar
74-
body_path: /tmp/release-notes/release-notes.md
123+
body_path: /tmp/release-notes/release-notes.md

‎Makefile‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,9 @@ lock:
1010
check-lock:
1111
mvn io.github.chains-project:maven-lockfile:5.5.2:validate
1212

13+
fix-lockfile:
14+
@# Replace JFrog proxy URLs with public Maven Central equivalents in lockfiles.
15+
@# Prevents proxy URLs from being accidentally committed.
16+
find . -type f -name 'lockfile.json' \
17+
-exec sed -i 's|databricks\.jfrog\.io/artifactory/db-maven|repo.maven.apache.org/maven2|g' {} +
18+

‎NEXT_CHANGELOG.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
* Added automatic detection of AI coding agents (Antigravity, Claude Code, Cline, Codex, Copilot CLI, Cursor, Gemini CLI, OpenCode) in the user-agent string. The SDK now appends `agent/<name>` to HTTP request headers when running inside a known AI agent environment.
77

88
### Bug Fixes
9+
* Added `X-Databricks-Org-Id` header to deprecated workspace SCIM APIs (Groups, ServicePrincipals, Users) for SPOG host compatibility.
910
* Fixed Databricks CLI authentication to detect when the cached token's scopes don't match the SDK's configured scopes. Previously, a scope mismatch was silently ignored, causing requests to use wrong permissions. The SDK now raises an error with instructions to re-authenticate.
1011

1112
### Security Vulnerabilities
@@ -23,4 +24,4 @@
2324
* Add `cascade` field for `com.databricks.sdk.service.pipelines.DeletePipelineRequest`.
2425
* Add `defaultBranch` field for `com.databricks.sdk.service.postgres.ProjectSpec`.
2526
* Add `defaultBranch` field for `com.databricks.sdk.service.postgres.ProjectStatus`.
26-
* Add `ingress` and `ingressDryRun` fields for `com.databricks.sdk.service.settings.AccountNetworkPolicy`.
27+
* Add `ingress` and `ingressDryRun` fields for `com.databricks.sdk.service.settings.AccountNetworkPolicy`.

0 commit comments

Comments
 (0)