ascheman commented on PR #13166: URL: https://github.com/apache/maven/pull/13166#issuecomment-5720789713
Nice — using `gh`/`git` instead of a third-party create-PR action keeps this within the ASF allowed-actions policy (only pinned `actions/checkout` + `setup-java`), and the dedup-PR check + `dependencies` label are good touches. One real issue plus two smaller points: **1. The `maven-4.0.x` matrix leg won't actually update anything.** This PR adds the `versions-update` profile to `pom.xml` on `master` only. `maven-4.0.x` has the 13 `version.maven-*` properties (from #13137) but not the profile, so when the matrix checks out `maven-4.0.x` and runs `mvn -Pversions-update …`, the profile is absent — Maven either warns "profile not found" and runs `versions:update-properties` without the explicit property→artifact mappings (updating nothing), or fails with `MissingProfilesException` on a Maven 4 runner. Either way that leg produces no PR. The `versions-update` profile needs to exist on `maven-4.0.x` too. **2. `git push --force-with-lease` on a freshly-created branch (question).** The branch is `git switch --create`d from the checked-out ref each run, and `actions/checkout` only fetched that ref, so there's no remote-tracking ref for `update/lifecycle-plugins-*` to lease against — on the second run `--force-with-lease` may be rejected. For a bot-owned throwaway branch, plain `--force` (or `git fetch origin "$BRANCH"` first) would be more reliable. **3. (nit)** consider `-ntp` on the mvn call to cut transfer-progress noise from the workflow log. Thanks for tackling the dependabot-core limitation head-on — clean interim until dependabot/dependabot-core#16331 lands. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
