Generate Bazel dependency versions from pom.xml

.github/workflows/bazel.yml

@@ -18,6 +18,8 @@ on:
       - "**/*.java"
       - "**/BUILD.bazel"
       - "MODULE.bazel"
+      - "pom.xml"
+      - "scripts/sync_bazel_dependencies.py"
       - ".bazelversion"
       - ".bazelrc"
       - ".github/workflows/bazel.yml"
@@ -27,6 +29,8 @@ on:
       - "**/*.java"
       - "**/BUILD.bazel"
       - "MODULE.bazel"
+      - "pom.xml"
+      - "scripts/sync_bazel_dependencies.py"
       - ".bazelversion"
       - ".bazelrc"
       - ".github/workflows/bazel.yml"
@@ -74,11 +78,14 @@ jobs:
           path: |
             ~/.cache/bazel-disk-cache
             ~/.cache/bazel/cache/repos/v1
-          key: bazel-${{ runner.os }}-java${{ matrix.java }}-${{ hashFiles('MODULE.bazel', '.bazelversion', 'maven_install.json') }}
+          key: bazel-${{ runner.os }}-java${{ matrix.java }}-${{ hashFiles('MODULE.bazel', 'pom.xml', 'scripts/sync_bazel_dependencies.py', '.bazelversion', 'maven_install.json') }}
           restore-keys: |
             bazel-${{ runner.os }}-java${{ matrix.java }}-
             bazel-${{ runner.os }}-
 
+      - name: Verify Bazel dependency sync
+        run: python3 scripts/sync_bazel_dependencies.py --check
+
       # Re-generate the Maven lock file so it is always consistent with
       # MODULE.bazel.  The __INPUT_ARTIFACTS_HASH in the committed file is
       # intentionally set to -1 to signal that the file needs to be regenerated;

CONTRIBUTING.md

@@ -20,5 +20,15 @@ If you have any problem with the package or any suggestions, please file an [iss
 3. Submit a pull request.
 4. The bot will automatically assign someone to review your PR. Check the full list of bot commands [here](https://prow.k8s.io/command-help).
 
+### Sync Bazel dependency versions
+
+The root `pom.xml` is the source of truth for Maven and Bazel dependency versions.
+If you update a managed dependency version there, also regenerate the Bazel dependency
+block and lock file before sending your PR:
+
+1. Run `python3 scripts/sync_bazel_dependencies.py`
+2. Run `REPIN=1 bazel run @maven//:pin`
+3. Commit the updated `MODULE.bazel` and `maven_install.json`
+
 ### Contact
 You can reach the maintainers of this project at [SIG API Machinery](https://github.com/kubernetes/community/tree/master/sig-api-machinery) or on the [#kubernetes-client](https://kubernetes.slack.com/messages/kubernetes-client) channel on the Kubernetes slack.

MODULE.bazel

@@ -25,59 +25,60 @@ bazel_dep(name = "contrib_rules_jvm", version = "0.27.0")
 
 maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven")
 
+# BEGIN: generated by scripts/sync_bazel_dependencies.py
+# Generated from pom.xml by scripts/sync_bazel_dependencies.py.
+# Do not edit this block by hand; update pom.xml and rerun the script instead.
+# Artifact order follows pom.xml dependencyManagement order within each section.
 maven.install(
     artifacts = [
         # ---- core ----
-        # Versions kept in sync with the property values in the root pom.xml.
-        "jakarta.annotation:jakarta.annotation-api:3.0.0",
-        "io.swagger:swagger-annotations:1.6.16",
-        "com.squareup.okhttp3:okhttp:5.3.2",
-        "com.squareup.okhttp3:okhttp-jvm:5.3.2",
-        "com.squareup.okhttp3:logging-interceptor:5.3.2",
-        "com.squareup.okio:okio:3.16.4",
-        "com.squareup.okio:okio-jvm:3.16.4",
-        "com.google.code.gson:gson:2.14.0",
-        "com.fasterxml.jackson.core:jackson-databind:2.21.2",
-        "com.fasterxml.jackson.core:jackson-core:2.21.2",
-        "com.fasterxml.jackson.core:jackson-annotations:2.21",
-        "io.gsonfire:gson-fire:1.9.0",
         "org.apache.commons:commons-lang3:3.20.0",
         "org.apache.commons:commons-collections4:4.5.0",
+        "org.yaml:snakeyaml:2.6",
+        "commons-codec:commons-codec:1.22.0",
         "org.apache.commons:commons-compress:1.28.0",
         "commons-io:commons-io:2.22.0",
-        "commons-codec:commons-codec:1.22.0",
-        "org.yaml:snakeyaml:2.6",
-        "org.slf4j:slf4j-api:2.0.17",
+        "com.github.ben-manes.caffeine:caffeine:3.0.0",
+        "org.slf4j:slf4j-api:2.0.18",
         "org.bouncycastle:bcpkix-jdk18on:1.84",
         "org.bouncycastle:bcprov-jdk18on:1.84",
+        "software.amazon.awssdk:sts:2.44.8",
+        "software.amazon.awssdk:auth:2.44.8",
+        "software.amazon.awssdk:http-auth-aws:2.44.8",
+        "software.amazon.awssdk:http-auth-spi:2.44.8",
+        "software.amazon.awssdk:http-client-spi:2.44.8",
+        "software.amazon.awssdk:utils:2.44.8",
         "com.google.protobuf:protobuf-java:4.34.1",
         "org.bitbucket.b_c:jose4j:0.9.6",
-        "com.google.auth:google-auth-library-oauth2-http:1.46.0",
-        "software.amazon.awssdk:auth:2.43.0",
-        "software.amazon.awssdk:http-auth-aws:2.43.0",
-        "software.amazon.awssdk:http-auth-spi:2.43.0",
-        "software.amazon.awssdk:http-client-spi:2.43.0",
-        "software.amazon.awssdk:sts:2.43.0",
-        "software.amazon.awssdk:utils:2.43.0",
+        "com.bucket4j:bucket4j-core:8.10.1",
         "io.prometheus:simpleclient:0.16.0",
         "io.prometheus:simpleclient_httpserver:0.16.0",
-        "com.bucket4j:bucket4j-core:8.10.1",
-        "com.github.ben-manes.caffeine:caffeine:3.0.0",
-        "com.flipkart.zjsonpatch:zjsonpatch:0.4.16",
+        "com.google.code.gson:gson:2.14.0",
+        "com.fasterxml.jackson.core:jackson-databind:2.21.3",
+        "com.fasterxml.jackson.core:jackson-annotations:2.21",
+        "com.fasterxml.jackson.core:jackson-core:2.21.3",
+        "io.gsonfire:gson-fire:1.9.0",
+        "com.squareup.okhttp3:okhttp:5.3.2",
+        "com.squareup.okhttp3:logging-interceptor:5.3.2",
+        "io.swagger:swagger-annotations:1.6.16",
+        "jakarta.annotation:jakarta.annotation-api:3.0.0",
+        "com.google.auth:google-auth-library-oauth2-http:1.47.0",
         "org.jetbrains:annotations:26.1.0",
         "org.reflections:reflections:0.10.2",
+        "com.squareup.okhttp3:okhttp-jvm:5.3.2",
+        "com.squareup.okio:okio:3.16.4",
+        "com.squareup.okio:okio-jvm:3.16.4",
+        "com.flipkart.zjsonpatch:zjsonpatch:0.4.16",
         # ---- spring (Java 17+ modules) ----
-        # spring-boot 4.0.6 transitively brings in spring-framework 7.0.x, but the
-        # root pom.xml pins spring.version=6.2.12. Explicitly declare all
-        # spring-framework modules at 6.2.12 and use maven.artifact() with
-        # exclusions on the spring-boot artifacts so Coursier does not upgrade them.
-        "org.springframework:spring-aop:6.2.12",
-        "org.springframework:spring-beans:6.2.12",
-        "org.springframework:spring-context:6.2.12",
-        "org.springframework:spring-core:6.2.12",
-        "org.springframework:spring-expression:6.2.12",
-        "org.springframework:spring-test:6.2.12",
+        "org.springframework:spring-core:6.2.8",
+        "org.springframework:spring-aop:6.2.8",
+        "org.springframework:spring-beans:6.2.8",
+        "org.springframework:spring-context:6.2.8",
+        "org.springframework:spring-expression:6.2.8",
+        "org.springframework:spring-test:6.2.8",
         # ---- test ----
+        "ch.qos.logback:logback-classic:1.5.32",
+        "ch.qos.logback:logback-core:1.5.32",
         "org.junit.jupiter:junit-jupiter-api:5.13.4",
         "org.junit.jupiter:junit-jupiter-engine:5.13.4",
         "org.junit.jupiter:junit-jupiter-params:5.13.4",
@@ -90,10 +91,8 @@ maven.install(
         "uk.org.webcompere:system-stubs-jupiter:2.1.8",
         "uk.org.webcompere:system-stubs-core:2.1.8",
         "org.wiremock:wiremock:3.13.2",
-        "org.awaitility:awaitility:4.3.0",
         "org.assertj:assertj-core:3.27.7",
-        "ch.qos.logback:logback-classic:1.5.32",
-        "ch.qos.logback:logback-core:1.5.32",
+        "org.awaitility:awaitility:4.3.0",
     ],
     repositories = [
         "https://repo1.maven.org/maven2",
@@ -103,14 +102,13 @@ maven.install(
     lock_file = "//:maven_install.json",
 )
 
-# Spring Boot 4.0.6 artifacts declared with exclusions to pin spring-framework at
-# 6.2.12 (matching pom.xml spring.version) instead of the 7.0.x that spring-boot
-# 4.0.x normally pulls in.
+# Spring Boot 4.0.6 artifacts declared with exclusions to keep
+# spring-framework pinned to 6.2.8.
 _SPRING_FRAMEWORK_EXCLUSIONS = [
+    "org.springframework:spring-core",
     "org.springframework:spring-aop",
     "org.springframework:spring-beans",
     "org.springframework:spring-context",
-    "org.springframework:spring-core",
     "org.springframework:spring-expression",
     "org.springframework:spring-test",
 ]
@@ -143,4 +141,6 @@ maven.artifact(
     exclusions = _SPRING_FRAMEWORK_EXCLUSIONS,
 )
 
+# END: generated by scripts/sync_bazel_dependencies.py
+
 use_repo(maven, "maven")