Move to JDK 25 for build only#1709
Open
balamurugana wants to merge 1 commit into
Open
Conversation
📝 WalkthroughWalkthroughUpgrades the build toolchain to Java 25 and Gradle 9.6, updates wrapper scripts and build dependencies, aligns CI functional-test setup, adds a SpotBugs suppression, and applies formatter-driven Java source changes. ChangesBuild infrastructure upgrade (Java 25 / Gradle 9.6)
Java source formatting via googleJavaFormat 1.35.0
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (3)
.github/workflows/gradle.yml (1)
33-33: ⚡ Quick winConsider pinning the GitHub Action to a commit hash.
The
actions/setup-java@v5reference uses a tag rather than a commit hash. Pinning to a specific commit SHA provides better security and reproducibility by preventing tag manipulation.🔒 Example of pinning to a commit hash
- - name: Setup java 25 for building - uses: actions/setup-java@v5 + - name: Setup java 25 for building + uses: actions/setup-java@v5 # v5.2.0 + # uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061bNote: Replace the commit hash with the actual SHA for the v5 release you intend to use.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/gradle.yml at line 33, Replace the tag reference in the `actions/setup-java@v5` action with a specific commit SHA hash instead of using the version tag. Find the uses statement that references `actions/setup-java@v5` and change it to pin to a full commit hash (the SHA of the v5 release). This improves security and reproducibility by preventing potential tag manipulation. You can find the correct commit SHA from the official actions/setup-java releases on GitHub.Source: Linters/SAST tools
build.gradle (1)
52-52: Version2.22is valid but consider using2.22.0for consistency.Maven Central confirms that
jackson-annotations:2.22is a valid release version and will resolve correctly. However, using the explicit patch version2.22.0would match the version specifiers used forjackson-coreandjackson-databind, improving consistency across Jackson dependencies.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@build.gradle` at line 52, The jackson-annotations dependency in build.gradle uses version 2.22 without an explicit patch version, which is inconsistent with the other Jackson dependencies that use the format X.Y.Z. Update the version of the jackson-annotations dependency from 2.22 to 2.22.0 to maintain consistency across all Jackson dependency declarations in the build file.gradle/wrapper/gradle-wrapper.properties (1)
5-6: Reconfigure retry settings to enable download resilience.The current configuration sets
retryBackOffMs=500whileretries=0, which disables retries entirely. This means the backoff setting is unused. If download reliability is desired, enable retries by settingretriesto a positive value (e.g.,retries=3). Whenretries=0(the default), the wrapper makes only a single download attempt.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@gradle/wrapper/gradle-wrapper.properties` around lines 5 - 6, The gradle-wrapper.properties file has retry functionality disabled with `retries=0`, which renders the `retryBackOffMs=500` setting ineffective since no retries are attempted. To enable download resilience, change the `retries` parameter from its current value of 0 to a positive integer such as 3. This will activate the retry mechanism and ensure that the `retryBackOffMs` backoff timing is actually used when download failures occur.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/gradle.yml:
- Line 33: Replace the tag reference in the `actions/setup-java@v5` action with
a specific commit SHA hash instead of using the version tag. Find the uses
statement that references `actions/setup-java@v5` and change it to pin to a full
commit hash (the SHA of the v5 release). This improves security and
reproducibility by preventing potential tag manipulation. You can find the
correct commit SHA from the official actions/setup-java releases on GitHub.
In `@build.gradle`:
- Line 52: The jackson-annotations dependency in build.gradle uses version 2.22
without an explicit patch version, which is inconsistent with the other Jackson
dependencies that use the format X.Y.Z. Update the version of the
jackson-annotations dependency from 2.22 to 2.22.0 to maintain consistency
across all Jackson dependency declarations in the build file.
In `@gradle/wrapper/gradle-wrapper.properties`:
- Around line 5-6: The gradle-wrapper.properties file has retry functionality
disabled with `retries=0`, which renders the `retryBackOffMs=500` setting
ineffective since no retries are attempted. To enable download resilience,
change the `retries` parameter from its current value of 0 to a positive integer
such as 3. This will activate the retry mechanism and ensure that the
`retryBackOffMs` backoff timing is actually used when download failures occur.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 6779d061-7d12-40d4-84d0-3f79a302b1de
⛔ Files ignored due to path filters (1)
gradle/wrapper/gradle-wrapper.jaris excluded by!**/*.jar
📒 Files selected for processing (11)
.github/workflows/gradle.ymladminapi/src/main/java/io/minio/admin/MinioAdminClient.javaapi/src/main/java/io/minio/Checksum.javaapi/src/main/java/io/minio/PartReader.javaapi/src/main/java/io/minio/errors/MinioException.javabuild.gradlefunctional/TestMinioClient.javagradle/wrapper/gradle-wrapper.propertiesgradlewgradlew.batspotbugs-filter.xml
balamurugana
force-pushed
the
Move-to-JDK-25-for-build-only
branch
from
9b40df5 to
bfc1340
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/gradle.yml:
- Line 33: The actions/setup-java action on line 33 uses the mutable tag `@v5`
which weakens supply-chain integrity. Replace `@v5` with a full immutable commit
SHA (e.g., `@abc1234def5678`...) to pin the action to a specific version and
ensure CI/CD security. You can find the appropriate commit SHA by checking the
GitHub releases page for the actions/setup-java repository.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 31abcdd3-5661-4c8e-b6e4-7066f91dea0d
⛔ Files ignored due to path filters (1)
gradle/wrapper/gradle-wrapper.jaris excluded by!**/*.jar
📒 Files selected for processing (12)
.gitattributes.github/workflows/gradle.ymladminapi/src/main/java/io/minio/admin/MinioAdminClient.javaapi/src/main/java/io/minio/Checksum.javaapi/src/main/java/io/minio/PartReader.javaapi/src/main/java/io/minio/errors/MinioException.javabuild.gradlefunctional/TestMinioClient.javagradle/wrapper/gradle-wrapper.propertiesgradlewgradlew.batspotbugs-filter.xml
✅ Files skipped from review due to trivial changes (6)
- .gitattributes
- api/src/main/java/io/minio/Checksum.java
- adminapi/src/main/java/io/minio/admin/MinioAdminClient.java
- api/src/main/java/io/minio/errors/MinioException.java
- functional/TestMinioClient.java
- api/src/main/java/io/minio/PartReader.java
🚧 Files skipped from review as they are similar to previous changes (5)
- spotbugs-filter.xml
- gradle/wrapper/gradle-wrapper.properties
- gradlew.bat
- gradlew
- build.gradle
balamurugana
force-pushed
the
Move-to-JDK-25-for-build-only
branch
from
bfc1340 to
ca6b18f
Compare
Signed-off-by: Bala.FA <bala@minio.io>
balamurugana
force-pushed
the
Move-to-JDK-25-for-build-only
branch
from
ca6b18f to
882a4e2
Compare
There was a problem hiding this comment.
♻️ Duplicate comments (1)
.github/workflows/gradle.yml (1)
33-33: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winPin
actions/setup-javato an immutable commit SHA.Line 33 still uses
@v5(mutable tag). Please pin to a full 40-char commit SHA to prevent supply-chain drift.Suggested change
- uses: actions/setup-java@v5 + uses: actions/setup-java@d81c4e45f3ac973cc936d79104023e20054ba578 # v5.3.0🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/gradle.yml at line 33, The GitHub Actions workflow still references actions/setup-java via the mutable v5 tag, so update the setup-java step to use an immutable full 40-character commit SHA instead. Make this change in the workflow entry that uses actions/setup-java@v5 so the action version is pinned and stable.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In @.github/workflows/gradle.yml:
- Line 33: The GitHub Actions workflow still references actions/setup-java via
the mutable v5 tag, so update the setup-java step to use an immutable full
40-character commit SHA instead. Make this change in the workflow entry that
uses actions/setup-java@v5 so the action version is pinned and stable.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 08debd24-9fee-4a68-bea9-a203eacef08f
⛔ Files ignored due to path filters (1)
gradle/wrapper/gradle-wrapper.jaris excluded by!**/*.jar
📒 Files selected for processing (13)
.gitattributes.github/workflows/gradle.ymladminapi/src/main/java/io/minio/admin/MinioAdminClient.javaapi/src/main/java/io/minio/Checksum.javaapi/src/main/java/io/minio/Http.javaapi/src/main/java/io/minio/PartReader.javaapi/src/main/java/io/minio/errors/MinioException.javabuild.gradlefunctional/TestMinioClient.javagradle/wrapper/gradle-wrapper.propertiesgradlewgradlew.batspotbugs-filter.xml
✅ Files skipped from review due to trivial changes (9)
- .gitattributes
- api/src/main/java/io/minio/Http.java
- api/src/main/java/io/minio/errors/MinioException.java
- spotbugs-filter.xml
- gradle/wrapper/gradle-wrapper.properties
- api/src/main/java/io/minio/Checksum.java
- adminapi/src/main/java/io/minio/admin/MinioAdminClient.java
- api/src/main/java/io/minio/PartReader.java
- functional/TestMinioClient.java
🚧 Files skipped from review as they are similar to previous changes (3)
- gradlew.bat
- gradlew
- build.gradle
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit