build: fall back to previous image version on release PRs by meltsufin · Pull Request #12848 · googleapis/google-cloud-java

meltsufin · 2026-04-18T02:03:40Z

The library generation pipeline fails on release PRs because it attempts to pull a Docker image version that has not yet been built or pushed to the registry.

This PR adds a fallback mechanism in hermetic_library_generation.sh to use the previous version of the image from the main branch if the requested version fails to pull on a release PR.

To verify this in CI, this branch is named with the prefix 'release-please--' to simulate a release PR.

Fixes #12825

gemini-code-assist

Code Review

This pull request introduces a fallback mechanism for the hermetic library generation script. When a release PR branch is detected, the script attempts to pull the specified Docker image; if it fails, it tries to extract and use the image tag from the target branch's workflow configuration. The review feedback suggests improving the robustness of the tag extraction logic to better handle potential multiple matches, comments, or colons within the YAML file.

The library generation pipeline fails on release PRs because it attempts to pull a Docker image version that has not yet been built or pushed to the registry. This PR adds a fallback mechanism in hermetic_library_generation.sh to use the previous version of the image from the main branch if the requested version fails to pull on a release PR. To verify this in CI, this branch is named with the prefix 'release-please--' to simulate a release PR. Fixes #12825

meltsufin · 2026-04-18T02:49:37Z

Fallback validated in a separate release simulation PR #12849:

+ [[ release-please--simulation =~ ^release-please-- ]]
+ echo 'Detected release PR branch: release-please--simulation'
+ docker pull gcr.io/cloud-devrel-public-resources/java-library-generation:9.99.9
Detected release PR branch: release-please--simulation
Error response from daemon: manifest for gcr.io/cloud-devrel-public-resources/java-library-generation:9.99.9 not found: manifest unknown: Failed to fetch "9.99.9"
+ echo 'Image not found for version 9.99.9. Falling back to previous version from main.'
Image not found for version 9.99.9. Falling back to previous version from main.
++ git show main:.github/workflows/hermetic_library_generation.yaml
++ grep -m 1 '^[[:space:]]*image_tag:'
++ cut -d : -f 2-
++ cut -d '#' -f 1
++ xargs
+ previous_tag=2.71.0
+ '[' -n 2.71.0 ']'
+ echo 'Using previous image version: 2.71.0'
+ image_tag=2.71.0
Using previous image version: 2.71.0
++ id -u
++ id -g
++ pwd
+ docker run --rm -u 1001:1001 -v /home/runner/work/google-cloud-java/google-cloud-java:/workspace -v /tmp/tmp.dG9h7KnPTo:/workspace/googleapis -e GENERATOR_VERSION=2.71.0 gcr.io/cloud-devrel-public-resources/java-library-generation:2.71.0 --generation-config-path=/workspace/generation_config.yaml --library-names= --api-definitions-path=/workspace/googleapis
Unable to find image 'gcr.io/cloud-devrel-public-resources/java-library-generation:2.71.0' locally
2.71.0: Pulling from cloud-devrel-public-resources/java-library-generation

suztomo · 2026-04-20T15:29:04Z

+  echo "Detected release PR branch: $current_branch"
+  if ! docker pull "${IMAGE_NAME}:${image_tag}"; then
+    echo "Image not found for version ${image_tag}. Falling back to previous version from ${target_branch}."
+    previous_tag=$(git show "${target_branch}":.github/workflows/hermetic_library_generation.yaml | grep -m 1 "^[[:space:]]*image_tag:" | cut -d ':' -f 2- | cut -d '#' -f 1 | xargs || true)


The main branch is updated through a snapshot version of the container. Using an old version brings the change back.

Blake wrote:

The flow after migration is: every commit to main triggers a Cloud Build job -> create a snapshot hermetic image -> nightly generation uses the latest snapshot image to regenerate the whole repo -> google-cloud-java release

Can you clarify what is the problem?
Since Release Please PRs only update versions and changelogs and do not modify the generator itself, using the previously pushed image from the latest commit in main should be safe. It should not produce regressions because the generation logic is identical to what produced the current state of main.

using the previously pushed image from the latest commit in main

If that's the case (it's using the latest pushed snapshot image), then that's good. I was under the impression that the "previous image version" to be the one published in the previous release cycle (2 weeks ago). Can you confirm which is the case?

For reference, I got 2.71.0 from this command:

suztomo@suztomo:~/migration-work/google-cloud-java$ git show "${target_branch}":.github/workflows/hermetic_library_generation.yaml | grep -m 1 "^[[:space:]]*image_tag:" | cut -d ':' -f 2- | cut -d '#' -f 1 | xargs || true 2.71.0

Since Release Please PRs only update versions and changelogs and do not modify the generator itself

But the image contains the generator, I think this does introduce risks as @suztomo mentioned.

Why don't we just use the "latest" tag? The intention is more clear than these if-statements and $(git show "${target_branch}":.github/workflows/hermetic_library_generation.yaml | grep -m 1 "^[[:space:]]*image_tag:" | cut -d ':' -f 2- | cut -d '#' -f 1 | xargs || true).

@blakeli0 Can you please explain the risk a bit more? As far as I understand, the image gets rebuilt on push to main and tagged with :latest and :{version}. The version tag is floating to the latest build from that branch. So, a release pull request targeting that branch should be able to use the latest image at last version safely because it should have no functional difference with the release commit version of the generator.

Does the script checking for previous SNAPSHOT versions as well? If yes, then we should be good.

Yes, it should always use gapic-generator-java:current version, which would at times have -SNAPSHOT.

blakeli0 · 2026-04-20T17:11:11Z

+  echo "Detected release PR branch: $current_branch"
+  if ! docker pull "${IMAGE_NAME}:${image_tag}"; then
+    echo "Image not found for version ${image_tag}. Falling back to previous version from ${target_branch}."
+    previous_tag=$(git show "${target_branch}":.github/workflows/hermetic_library_generation.yaml | grep -m 1 "^[[:space:]]*image_tag:" | cut -d ':' -f 2- | cut -d '#' -f 1 | xargs || true)


Since Release Please PRs only update versions and changelogs and do not modify the generator itself

But the image contains the generator, I think this does introduce risks as @suztomo mentioned.

blakeli0 · 2026-04-20T17:12:14Z


 # run hermetic code generation docker image.
+# Attempt to pull the image to see if it exists on release PRs.
+if [[ "$current_branch" =~ ^release-please-- ]]; then


We could create release-please PRs from CLI as well.

That's fine, as long as the branch prefix is release-please--.

But that means we have to remember using release-please-- as the branch name, is there any harm we do this for every branches?

You shouldn't have to use the Release Please CLI going forward which should eliminate the need to remember the branch prefix. The risk of always falling back is that if someone configures and invalid generator version, they won't get a CI failure as feedback.

suztomo

Approving but please consider whether to use the "latest" tag.

suztomo · 2026-04-20T21:13:04Z

+  echo "Detected release PR branch: $current_branch"
+  if ! docker pull "${IMAGE_NAME}:${image_tag}"; then
+    echo "Image not found for version ${image_tag}. Falling back to previous version from ${target_branch}."
+    previous_tag=$(git show "${target_branch}":.github/workflows/hermetic_library_generation.yaml | grep -m 1 "^[[:space:]]*image_tag:" | cut -d ':' -f 2- | cut -d '#' -f 1 | xargs || true)


Why don't we just use the "latest" tag? The intention is more clear than these if-statements and $(git show "${target_branch}":.github/workflows/hermetic_library_generation.yaml | grep -m 1 "^[[:space:]]*image_tag:" | cut -d ':' -f 2- | cut -d '#' -f 1 | xargs || true).

meltsufin · 2026-04-20T21:47:29Z

Approving but please consider whether to use the "latest" tag.

@suztomo I think using the version in the target branch is more robust because it allows the code to support multiple branches with different versions of the generator.

…yaml

…g.yaml

meltsufin · 2026-04-21T02:02:24Z

@@ -1,4 +1,3 @@
-gapic_generator_version: 2.70.0


@blakeli0 Note that I'm removing this version declaration because it's confusing as it doesn't get updated, and it's not used anyway.

sonarqubecloud · 2026-04-21T02:21:27Z

Quality Gate passed for 'gapic-generator-java-root'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarqubecloud · 2026-04-21T02:25:36Z

Quality Gate passed for 'gapic-generator-java-root'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

meltsufin requested a review from a team as a code owner April 18, 2026 02:03

gemini-code-assist bot reviewed Apr 18, 2026

View reviewed changes

Comment thread sdk-platform-java/.github/scripts/hermetic_library_generation.sh Outdated

meltsufin force-pushed the release-please--fix-12825 branch from 6880d59 to def6f2d Compare April 18, 2026 02:16

meltsufin added 3 commits April 17, 2026 22:19

build: extract image name to variable in hermetic script

5fa7830

build: improve robustness of fallback version extraction

823b98c

meltsufin force-pushed the release-please--fix-12825 branch from def6f2d to 823b98c Compare April 18, 2026 02:20

meltsufin mentioned this pull request Apr 18, 2026

test: Release please simulation testing #12848 #12849

Draft

build: prevent script termination on empty fallback match

c1395d2

suztomo reviewed Apr 20, 2026

View reviewed changes

meltsufin requested a review from suztomo April 20, 2026 15:45

blakeli0 reviewed Apr 20, 2026

View reviewed changes

suztomo approved these changes Apr 20, 2026

View reviewed changes

meltsufin requested a review from blakeli0 April 21, 2026 00:53

blakeli0 approved these changes Apr 21, 2026

View reviewed changes

meltsufin added 3 commits April 20, 2026 21:38

refactor: centralize generator docker execution and fallback logic

53d67a1

refactor: extract fallback tag from versions.txt instead of workflow …

16cfa1b

…yaml

refactor: remove unused gapic_generator_version from generation_confi…

ef92609

…g.yaml

meltsufin force-pushed the release-please--fix-12825 branch from 9a162ab to ef92609 Compare April 21, 2026 02:01

meltsufin commented Apr 21, 2026

View reviewed changes

meltsufin added 2 commits April 20, 2026 22:09

fix: use remote ref origin/ for fallback tag extraction in CI

54269dc

Merge branch 'main' into release-please--fix-12825

b74fe50

Conversation

meltsufin commented Apr 18, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

meltsufin commented Apr 18, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

suztomo Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

suztomo left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

meltsufin commented Apr 20, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Apr 21, 2026

Quality Gate passed for 'gapic-generator-java-root'

Uh oh!

sonarqubecloud bot commented Apr 21, 2026

Quality Gate passed for 'gapic-generator-java-root'

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

suztomo Apr 20, 2026 •

edited

Loading