Merge branch 'main' into spannertest-changestreams

Author: christogav

.gemini/config.yaml

@@ -11,3 +11,6 @@ code_review:
     summary: false
     code_review: true
     include_drafts: true
+ignore_patterns:
+  - "*.pb.go"
+  - "**/internal/version.go"

.github/CODEOWNERS

@@ -1,10 +1,13 @@
 # Default owner for all directories not owned by others
 # The cloud-sdk-go-team team are the effective repo maintainers, but automatic
 # generation/releasing PRs are in the purview of the librarian team.
-*                       @googleapis/cloud-sdk-librarian-team @googleapis/cloud-sdk-go-team
+*                       @googleapis/cloud-sdk-go-team @googleapis/cloud-sdk-librarian-team
 
+/librarian.yaml         @googleapis/cloud-sdk-librarian-team
 /ai/                    @googleapis/vertexai-team @googleapis/cloud-sdk-go-team @googleapis/cloud-sdk-librarian-team
 /aiplatform/            @googleapis/vertexai-team @googleapis/cloud-sdk-go-team @googleapis/cloud-sdk-librarian-team
+/agentplatform/         @googleapis/vertexai-team @googleapis/cloud-sdk-go-team @googleapis/cloud-sdk-librarian-team
+/auth/                  @googleapis/aion-team @googleapis/cloud-sdk-go-team @googleapis/cloud-sdk-librarian-team
 /bigtable/              @googleapis/bigtable-team @googleapis/cloud-sdk-go-team @googleapis/cloud-sdk-librarian-team
 /bigtable/cmd/cbt       @googleapis/bigtable-team @googleapis/cloud-sdk-go-team @googleapis/cloud-sdk-librarian-team
 /bigtable/cmd/emulator  @googleapis/bigtable-team @googleapis/cloud-sdk-go-team @googleapis/cloud-sdk-librarian-team
@@ -23,12 +26,5 @@
 /internal/protoveneer/  @googleapis/cloud-sdk-go-team @googleapis/cloud-sdk-librarian-team
 
 
-# We mark the librarian state file as unowned to avoid gatekeeping librarian operations on 
-# a single owner.  This allows multiple teams to interact with librarian operations that cause
-# changes to librarian state.
-/.librarian/state.yaml
-# Similarly, we mark the internal/generated/snippets directory unowned to avoid
-# tracking granular ownership in the snippets directories, and to avoid chasing
-# code owners approvals for things like snippet metadata versioning bumps which
-# happen naturally as part of release activities.
-/internal/generated/snippets/
+# We mark the release please individual manifest unowned as well to allow teams to release the individual modules without secondary approvals.
+/.release-please-individual-manifest.json

.github/blunderbuss.yml

@@ -1,10 +1,14 @@
 assign_issues_by:
 - labels:
   - 'api: bigtable'
+  to:
+  - sushanb
+- labels:
   - 'api: datastore'
   - 'api: firestore'
   to:
-  - bhshkh
+  - hongalex
+  - shollyman
 - labels:
   - 'api: storage'
   to:

.github/release-please.yml

@@ -0,0 +1,17 @@
+handleGHRelease: true
+manifest: true
+tagPullRequestNumber: true
+
+branches:
+  - branch: main
+    handleGHRelease: true
+    tagPullRequestNumber: true
+    manifest: true
+    manifestFile: .release-please-bulk-manifest.json
+    manifestConfig: release-please-bulk-config.json
+  - branch: main
+    handleGHRelease: true
+    tagPullRequestNumber: true
+    manifest: true
+    manifestFile: .release-please-individual-manifest.json
+    manifestConfig: release-please-individual-config.json

.github/renovate.json

@@ -1,6 +1,6 @@
 {
     "extends": [
-        "config:base",
+        "config:best-practices",
         "schedule:weekly",
         ":disableDependencyDashboard",
         "docker:disable"
@@ -19,6 +19,11 @@
         "**/snippets/**"
     ],
     "packageRules": [
+    	{
+   	    "description": "prevent go version upgrades",
+      	    "matchManagers": ["gomod"],
+            "constraintsFiltering": "strict"
+    	},
         {
             "matchPackagePatterns": [
                 "^github.com/google/go-github/v",

.github/workflows/action_syntax.yml

@@ -14,5 +14,7 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/checkout@v6
-      - uses: reviewdog/action-actionlint@v1
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
+      - uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1

.github/workflows/apidiff.yml

@@ -13,14 +13,17 @@ jobs:
   scan_changes:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         ref: main
+        persist-credentials: false
     - name: Get main commit
       id: main
       run: echo "hash=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
-    - uses: actions/checkout@v6
-    - uses: actions/setup-go@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
       with:
         go-version: '1.26.x'
     - name: Get changed directories
@@ -52,14 +55,15 @@ jobs:
     strategy:
       matrix: ${{ fromJson(needs.scan_changes.outputs.changed_dirs) }}
     steps:
-    - uses: actions/setup-go@v6
+    - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
       with:
         go-version: '1.26.x'
     - name: Install latest apidiff
       run: go install golang.org/x/exp/cmd/apidiff@latest
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         ref: main
+        persist-credentials: false
     - name: Create baseline
       id: baseline
       run: |
@@ -73,14 +77,16 @@ jobs:
         MATRIX_CHANGED: ${{ matrix.changed }}
         STEPS_BASELINE_OUTPUTS_PKG: ${{ steps.baseline.outputs.pkg }}
     - name: Upload baseline package data
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: ${{ steps.baseline.outputs.pkg }}
         path: ${{ matrix.changed }}/${{ steps.baseline.outputs.pkg }}
         retention-days: 1
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      with:
+        persist-credentials: false
     - name: Download baseline package data
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
       with:
         name: ${{ steps.baseline.outputs.pkg }}
         path: ${{ matrix.changed }}
@@ -134,7 +140,7 @@ jobs:
     # review, even if they don't block the PR.
     - name: Add breaking change label
       if: ${{ steps.detect.outputs.breaking_change_found == 'true' && !github.event.pull_request.head.repo.fork }}
-      uses: actions/github-script@v8
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
       with:
         script: |
           github.rest.issues.addLabels({
@@ -150,12 +156,14 @@ jobs:
     # the failed presubmit check is the primary signal.
     - name: Post breaking change details as a comment
       if: ${{ steps.ga_check.outcome == 'success' && !github.event.pull_request.head.repo.fork }}
-      uses: actions/github-script@v8
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+      env:
+        CHANGED_MODULE: ${{ matrix.changed }}
       with:
         script: |
           const fs = require('fs');
-          const diff = fs.readFileSync('${{ matrix.changed }}/diff.txt', 'utf8');
-          const moduleName = '${{ matrix.changed }}';
+          const diff = fs.readFileSync(`${process.env.CHANGED_MODULE}/diff.txt`, 'utf8');
+          const moduleName = process.env.CHANGED_MODULE;
           const commentHeader = `### ⚠️ Breaking change detected in pre-GA module: \`${moduleName}\``;
           const body = `${commentHeader}\n\nThe apidiff check has detected one or more breaking changes in this module for pre-GA APIs.\n\nPre-GA breaking changes do not block the pull request, but are flagged here for review.\n\nFor any pre-GA breaking change that needs investigation, open a new issue containing a link to this comment, then you may proceed with reviewing and merging this PR.\n\n\`\`\`\n${diff}\n\`\`\``;
           const { data: comments } = await github.rest.issues.listComments({

.github/workflows/config_check.yml

@@ -39,15 +39,17 @@ jobs:
         go: [ '1.25', '1.26']
         folders: ['bigtable']
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         path: google-cloud-go
-    - uses: actions/checkout@v6
+        persist-credentials: false
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         repository: googleapis/cloud-bigtable-clients-test
         ref: v0.0.3
         path: cloud-bigtable-clients-test
-    - uses: actions/setup-go@v6
+        persist-credentials: false
+    - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
       with:
           go-version: ${{ matrix.go }}
     - run: go version

.github/workflows/conformance.yaml

@@ -1,9 +1,10 @@
 ---
 name: generation-check
 on:
-  schedule:
-    # Runs every day at 4:00 AM UTC
-    - cron: '0 4 * * *'
+  push:
+    branches:
+      - main
+  pull_request:
   # Allows manual triggering for debugging purpose.
   workflow_dispatch:
 permissions:
@@ -13,43 +14,45 @@ jobs:
   regeneration:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
-          go-version: '1.26.x'
-      - name: Install Protoc
-        uses: arduino/setup-protoc@v3
+          persist-credentials: false
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
+        id: changes
         with:
-          version: "25.7"
+          filters: |
+            librarian:
+              - 'librarian.yaml'
+      # Version of librarian is pulled from librarian.yaml,
+      # main corresponds to the action's source definition.
+      - uses: googleapis/librarian@main # zizmor: ignore[unpinned-uses]
+        if: steps.changes.outputs.librarian == 'true' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
+        with:
+          protoc-version: '33.2'
+          protoc-checksum: '8c0a8577311720cc83488f813aeb5046d69cb9824cbf39cb7447e0c5132d677952d5bb7c1130d9df381835eee7352828878d409873ebb407d7a4649ea2a4aee5'
       - name: Install tools
-        run: |
-          version=$(sed -n 's/^version: *//p' librarian.yaml)
-          go run "github.com/googleapis/librarian/cmd/librarian@${version}" install
+        if: steps.changes.outputs.librarian == 'true' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
+        run: librarian install
       - name: Regenerate
+        if: steps.changes.outputs.librarian == 'true' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
         run: |
-          version=$(sed -n 's/^version: *//p' librarian.yaml)
-          go run "github.com/googleapis/librarian/cmd/librarian@${version}" generate -all
-      - name: Create issue on diff
-        if: failure()
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
+          librarian generate --all
           if [ -n "$(git status --porcelain)" ]; then
-            TITLE="Daily regeneration check found diff"
-            RUN_URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-            DIFF_STAT=$(git diff --stat)
-            BODY="The daily [regeneration check]($RUN_URL) found a diff.
+            git status
+            echo "==================== GIT DIFF ===================="
+            git diff
+            echo "=================================================="
+            echo "Regeneration failed. Please run 'librarian generate --all' to update the generated files."
+            exit 1
+          fi
+      - name: Create issue if previous step fails
+        if: ${{ failure() && github.ref == 'refs/heads/main' }}
+        uses: googleapis/librarian/.github/actions/create-issue-on-failure@main # zizmor: ignore[unpinned-uses]
+        with:
+          title: "Librarian generate diff check failed on main branch"
+          body: |
+            The librarian generate diff check failed on main branch.
 
-            Diff summary:
-            \`\`\`
-            $DIFF_STAT
-            \`\`\`"
+            To keep the `main` branch healthy, please consider **reverting the triggering change** first. Once the revert is merged, you can investigate the failure and submit a new PR with the fix.
 
-            EXISTING_ISSUE=$(gh issue list --state open --search "in:title \"$TITLE\"" --json number --jq '.[0].number')
-            if [ -z "$EXISTING_ISSUE" ]; then
-              gh issue create --title "$TITLE" --body "$BODY"
-            else
-              echo "Issue #$EXISTING_ISSUE already exists, adding a comment."
-              gh issue comment "$EXISTING_ISSUE" --body "Another failure with diff occurred: $RUN_URL"
-            fi
-          fi
+            Please check the logs: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}