Replace Renovate with Dependabot (reactor#3377)

Configures `dependabot.yml` and removes `renovate.json`.
Moved some dependencies from version catalog
to `gradle/dependencies.gradle`.

---------

Co-authored-by: Simon Baslé <[email protected]>

Author: Dariusz Jędrzejczyk

.github/dependabot.yml

@@ -0,0 +1,41 @@
+version: 2
+updates:
+  - package-ecosystem: "gradle"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    labels:
+      - "type/dependency-upgrade"
+    reviewers:
+      - "reactor/core-team"
+    # updates in oldest maintenance branch, we'll forward-merge up to main
+    target-branch: "3.4.x"
+    ignore:
+      # JSR166 backport is fixed
+      - dependency-name: "io.projectreactor:jsr166"
+      # JSR305 backport is fixed to last version with annotations (3.0.1)
+      - dependency-name: "com.google.code.findbugs:jsr305"
+      # don't update Micrometer
+      - dependency-name: "io.micrometer:*"
+      # Kotlin: stay on 1.5
+      - dependency-name: "org.jetbrains.kotlin*"
+        versions: ["1.6.x"]
+      # SLF4J: don't upgrade to v2
+      - dependency-name: "org.slf4j:slf4j-api"
+        versions: ["2.x"]
+      # logback: don't upgrade to v1.3 or v1.4 (require slf4j v2, 1.4.x also requires JDK11+)
+      - dependency-name: "ch.qos.logback:logback-classic"
+        versions: ["1.3.x", "1.4.x"]
+      # TestNG: 7.6+ doesn't support JDK8 anymore
+      - dependency-name: "org.testng:testng"
+        versions: ["7.6.x"]
+  - package-ecosystem: "github-actions"
+    directory: ".github/workflows"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "type/chores"
+    reviewers:
+      - "reactor/core-team"
+    # updates in oldest maintenance branch, we'll forward-merge up to main
+    target-branch: "3.4.x"

.github/renovate.json

@@ -15,11 +15,11 @@ dependencies {
   compileOnly libs.reactor.perfBaseline.core
   compileOnly libs.jsr305
 
-  implementation libs.jmh.core
+  implementation "org.openjdk.jmh:jmh-core:$jmhVersion"
   implementation libs.reactor.perfBaseline.extra, {
     exclude group: 'io.projectreactor', module: 'reactor-core'
   }
-  annotationProcessor libs.jmh.annotations.processor
+  annotationProcessor "org.openjdk.jmh:jmh-generator-annprocess:$jmhVersion"
 
   current project(':reactor-core')
   baseline libs.reactor.perfBaseline.core, {

benchmarks/build.gradle

@@ -136,6 +136,7 @@ configure(subprojects) { p ->
 	apply plugin: 'java'
 	apply plugin: 'jacoco'
 	apply from: "${rootDir}/gradle/setup.gradle"
+	apply from: "${rootDir}/gradle/dependencies.gradle"
 
 	description = 'Non-Blocking Reactive Foundation for the JVM'
 	group = 'io.projectreactor'

build.gradle

@@ -23,9 +23,11 @@ repositories {
 	gradlePluginPortal()
 }
 
+apply from: "../gradle/dependencies.gradle"
+
 dependencies {
-	testImplementation libs.assertj
-	testImplementation platform(libs.junit.bom)
+	testImplementation "org.assertj:assertj-core:$assertjVersion"
+	testImplementation platform("org.junit:junit-bom:$junitVersion")
 	testImplementation "org.junit.jupiter:junit-jupiter-api"
 	testRuntimeOnly "org.junit.jupiter:junit-jupiter-engine"
 }

buildSrc/build.gradle

@@ -0,0 +1,18 @@
+ext {
+    // Library versions that Dependabot will monitor (in alphabetical order)
+    // See also gradle/libs.versions.toml for manually maintained dependencies and Gradle plugins
+    archUnitVersion = "0.23.1"
+    assertjVersion = "3.23.1"
+    awaitilityVersion = "4.2.0"
+    blockhoundVersion = "1.0.7.RELEASE"
+    byteBuddyVersion = "1.12.23"
+    cglibVersion = "3.3.0"
+    javaObjectLayoutVersion = "0.16"
+    jmhVersion = "1.35"
+    junitVersion = "5.9.2"
+    logbackVersion = "1.2.11"
+    mockitoVersion = "4.11.0"
+    slf4jVersion = "1.7.36"
+    testngVersion = "7.5" // since 7.6 JDK8 is unsupported, don't bump
+    throwingFunctionVersion = "1.5.1"
+}

gradle/dependencies.gradle

@@ -1,3 +1,10 @@
+# Versions and dependencies declared here are NOT covered by Dependabot.
+# Therefore it focuses on versions that should be updated by hand:
+#  - Reactor ecosystem
+#  - Fixed versions (JSR166, JSR305...)
+#  - Libraries that we want to more closely monitor / have an associated plugin (RS, Micrometer, Kotlin)
+#  - Plugins (including Kotlin)
+
 [versions]
 # Baselines, should be updated on every release
 baseline-core-api = "3.4.27"
@@ -6,37 +13,18 @@ baselinePerfExtra = "3.4.9"
 
 # Other shared versions
 asciidoctor = "3.3.2"
-bytebuddy = "1.12.23"
-jmh = "1.35"
-junit = "5.9.2"
 kotlin = "1.5.32"
 reactiveStreams = "1.0.4"
 
 [libraries]
-archUnit = "com.tngtech.archunit:archunit:0.23.1"
-assertj = "org.assertj:assertj-core:3.23.1"
-awaitility = "org.awaitility:awaitility:4.2.0"
-blockhound = "io.projectreactor.tools:blockhound:1.0.7.RELEASE"
-byteBuddy-agent = { module = "net.bytebuddy:byte-buddy-agent", version.ref = "bytebuddy" }
-byteBuddy-api = { module = "net.bytebuddy:byte-buddy", version.ref = "bytebuddy" }
-cglib = "cglib:cglib:3.3.0"
-javaObjectLayout = "org.openjdk.jol:jol-core:0.16"
-jmh-annotations-processor = { module = "org.openjdk.jmh:jmh-generator-annprocess", version.ref = "jmh" }
-jmh-core = { module = "org.openjdk.jmh:jmh-core", version.ref = "jmh" }
 jsr166backport = "io.projectreactor:jsr166:1.0.0.RELEASE"
 jsr305 = "com.google.code.findbugs:jsr305:3.0.1"
-junit-bom = { module = "org.junit:junit-bom", version.ref = "junit" }
 kotlin-stdlib = { module = "org.jetbrains.kotlin:kotlin-stdlib", version.ref = "kotlin" }
-logback = "ch.qos.logback:logback-classic:1.2.11"
 micrometer = "io.micrometer:micrometer-core:1.3.0"
-mockito = "org.mockito:mockito-core:4.11.0"
 reactiveStreams = { module = "org.reactivestreams:reactive-streams", version.ref = "reactiveStreams" }
 reactiveStreams-tck = { module = "org.reactivestreams:reactive-streams-tck", version.ref = "reactiveStreams" }
 reactor-perfBaseline-core = { module = "io.projectreactor:reactor-core", version.ref = "baselinePerfCore" }
 reactor-perfBaseline-extra = { module = "io.projectreactor.addons:reactor-extra", version.ref = "baselinePerfExtra" }
-slf4j = "org.slf4j:slf4j-api:1.7.36"
-testNg = "org.testng:testng:7.5" # since 7.6 JDK8 is unsupported, don't bump
-throwingFunction = "com.pivovarit:throwing-function:1.5.1"
 
 [plugins]
 artifactory = { id = "com.jfrog.artifactory", version = "4.31.0" }

gradle/libs.versions.toml

@@ -73,15 +73,15 @@ dependencies {
 		*/
 		exclude group: 'junit', module: 'junit'
 	}
-	tckTestImplementation libs.testNg
+	tckTestImplementation "org.testng:testng:$testngVersion"
 
 	// JSR-305 annotations
 	compileOnly libs.jsr305
 	testCompileOnly libs.jsr305
 
 	// Optional Logging Operator
-	compileOnly libs.slf4j
-	testCompileOnly libs.slf4j
+	compileOnly "org.slf4j:slf4j-api:$slf4jVersion"
+	testCompileOnly "org.slf4j:slf4j-api:$slf4jVersion"
 
 	// Optional Metrics
 	compileOnly libs.micrometer
@@ -91,29 +91,29 @@ dependencies {
 	testImplementation libs.kotlin.stdlib
 
 	// Optional BlockHound support
-	compileOnly libs.blockhound
+	compileOnly "io.projectreactor.tools:blockhound:$blockhoundVersion"
 	// Also make BlockHound visible in the CP of dedicated testset
-	blockHoundTestImplementation libs.blockhound
+	blockHoundTestImplementation "io.projectreactor.tools:blockhound:$blockhoundVersion"
 
 	// Optional JDK 9 Converter
 	jsr166backport libs.jsr166backport
 
 	// Testing
-	testImplementation platform(libs.junit.bom)
+	testImplementation platform("org.junit:junit-bom:$junitVersion")
 	testImplementation "org.junit.jupiter:junit-jupiter-api"
 	testImplementation "org.junit.platform:junit-platform-launcher"
 	testImplementation "org.junit.jupiter:junit-jupiter-params"
 	testRuntimeOnly "org.junit.jupiter:junit-jupiter-engine"
 	testImplementation(project(":reactor-test")) {
 		exclude module: 'reactor-core'
 	}
-	testImplementation libs.logback //need to access API to decrease some tests verbosity
-	testImplementation libs.assertj
-	testImplementation libs.mockito
-	testImplementation libs.javaObjectLayout
-	testImplementation libs.awaitility
-	testImplementation libs.throwingFunction
-	testImplementation libs.archUnit
+	testImplementation "ch.qos.logback:logback-classic:$logbackVersion" //need to access API to decrease some tests verbosity
+	testImplementation "org.assertj:assertj-core:$assertjVersion"
+	testImplementation "org.mockito:mockito-core:$mockitoVersion"
+	testImplementation "org.openjdk.jol:jol-core:$javaObjectLayoutVersion"
+	testImplementation "org.awaitility:awaitility:$awaitilityVersion"
+	testImplementation "com.pivovarit:throwing-function:$throwingFunctionVersion"
+	testImplementation "com.tngtech.archunit:archunit:$archUnitVersion"
 
 	// withMicrometerTest is a test-set that validates what happens when micrometer *IS*
 	// on the classpath. Needs sourceSets.test.output because tests there use helpers like AutoDisposingRule etc.
@@ -123,7 +123,7 @@ dependencies {
 	jcstressImplementation(project(":reactor-test")) {
 		exclude module: 'reactor-core'
 	}
-	jcstressImplementation libs.logback
+	jcstressImplementation "ch.qos.logback:logback-classic:$logbackVersion"
 
 }
 

reactor-core/build.gradle

@@ -44,14 +44,14 @@ dependencies {
 	compileOnly libs.kotlin.stdlib
 	testImplementation libs.kotlin.stdlib
 
-	testImplementation platform(libs.junit.bom)
+	testImplementation platform("org.junit:junit-bom:$junitVersion")
 	testImplementation "org.junit.jupiter:junit-jupiter-api"
 	testImplementation "org.junit.jupiter:junit-jupiter-params"
 	testRuntimeOnly "org.junit.jupiter:junit-jupiter-engine"
 
-	testRuntimeOnly libs.logback
-	testImplementation libs.assertj
-	testImplementation libs.mockito
+	testRuntimeOnly "ch.qos.logback:logback-classic:$logbackVersion"
+	testImplementation "org.assertj:assertj-core:$assertjVersion"
+	testImplementation "org.mockito:mockito-core:$mockitoVersion"
 }
 
 task downloadBaseline(type: Download) {

reactor-test/build.gradle

@@ -38,25 +38,25 @@ dependencies {
     compileOnly libs.jsr305
     compileOnly libs.jsr305
 
-    shaded libs.byteBuddy.api
-    shaded libs.byteBuddy.agent
+    shaded "net.bytebuddy:byte-buddy:$byteBuddyVersion"
+    shaded "net.bytebuddy:byte-buddy-agent:$byteBuddyVersion"
     for (dependency in project.configurations.shaded.dependencies) {
         compileOnly(dependency)
         testRuntimeOnly(dependency)
         javaAgentTestRuntimeOnly(dependency)
     }
 
-    testImplementation platform(libs.junit.bom)
+    testImplementation platform("org.junit:junit-bom:$junitVersion")
     testImplementation "org.junit.jupiter:junit-jupiter-api"
     testRuntimeOnly "org.junit.jupiter:junit-jupiter-engine"
 
-    testImplementation libs.assertj
-    testImplementation libs.cglib
+    testImplementation "org.assertj:assertj-core:$assertjVersion"
+    testImplementation "cglib:cglib:$cglibVersion"
 
-    jarFileTestImplementation libs.assertj
+    jarFileTestImplementation "org.assertj:assertj-core:$assertjVersion"
 
     buildPluginTestImplementation gradleTestKit()
-    buildPluginTestImplementation platform(libs.junit.bom)
+    buildPluginTestImplementation platform("org.junit:junit-bom:$junitVersion")
     buildPluginTestImplementation "org.junit.jupiter:junit-jupiter-api"
     buildPluginTestRuntimeOnly "org.junit.jupiter:junit-jupiter-engine"
 }
@@ -177,8 +177,8 @@ task generateMockGradle(type: Copy) {
       CORE: coreJar,
       AGENT: agentJar,
       REACTIVE_STREAMS_VERSION: libs.versions.reactiveStreams.get(),
-      JUNIT_BOM_VERSION: libs.versions.junit.get(),
-      BYTE_BUDDY_VERSION: libs.versions.bytebuddy.get()
+      JUNIT_BOM_VERSION: "$junitVersion".toString(),
+      BYTE_BUDDY_VERSION: "$byteBuddyVersion".toString()
     ])
 }