ci: run current OATS consumer suites

.github/renovate-tracked-deps.json

@@ -73,6 +73,16 @@
         "mise"
       ]
     },
+    ".github/workflows/pr-benchmarks.yml": {
+      "regex": [
+        "mise"
+      ]
+    },
+    ".github/workflows/regenerate-api-diff-otel.yml": {
+      "regex": [
+        "mise"
+      ]
+    },
     ".github/workflows/release.yml": {
       "regex": [
         "mise"
@@ -148,10 +158,12 @@
       "mise": [
         "actionlint",
         "aqua:grafana/flint",
+        "aqua:grafana/gcx",
         "aqua:jonwiggins/xmloxide",
         "aqua:owenlamont/ryl",
         "biome",
         "editorconfig-checker",
+        "go",
         "go:github.com/grafana/oats",
         "google-java-format",
         "hugo",

.github/renovate.json5

@@ -1,6 +1,6 @@
 {
   $schema: "https://docs.renovatebot.com/renovate-schema.json",
-  extends: ["config:best-practices", "config:recommended", "github>grafana/flint#v0.22.5"],
+  extends: ["config:best-practices", "config:recommended", "github>grafana/flint#v0.22.7"],
   platformCommit: "enabled",
   automerge: true,
   ignorePaths: [
@@ -45,13 +45,6 @@
       groupName: "protobuf",
       separateMajorMinor: false,
     },
-    {
-      "description": "Flint autofix: align extractVersion for protoc",
-      "extractVersion": "^(?<version>.+)\\.0\\.0$",
-      "matchDepNames": [
-        "protoc"
-      ]
-    }
   ],
   customManagers: [
   {

.github/workflows/acceptance-tests.yml

@@ -12,10 +12,10 @@ jobs:
       - name: Check out
         with:
           persist-credentials: false
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
-          version: v2026.6.12
-          sha256: ff0cf4917acc96b7ffdd0382261d17f405572e9240f95fafb980e44aaf60c514
+          version: v2026.7.5
+          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
       - name: Run acceptance tests
         run: mise run acceptance-test

.github/workflows/api-diff.yml

@@ -7,8 +7,6 @@ on:
       - opened
       - synchronize
       - reopened
-      - labeled
-      - unlabeled
   workflow_dispatch:
     inputs:
       baseline_version:
@@ -29,19 +27,17 @@ jobs:
       # Empty unless overridden via workflow_dispatch; the api-diff task then
       # falls back to <api.diff.baseline.version> in pom.xml.
       API_DIFF_BASELINE_VERSION: ${{ inputs.baseline_version }}
-      BREAKING_API_CHANGE_ACCEPTED: >-
-        ${{ contains(github.event.pull_request.labels.*.name, 'breaking-api-change-accepted') }}
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
-          version: v2026.6.12
-          sha256: ff0cf4917acc96b7ffdd0382261d17f405572e9240f95fafb980e44aaf60c514
+          version: v2026.7.5
+          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
       - name: Cache local Maven repository
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
@@ -54,38 +50,3 @@ jobs:
             echo "Run 'mise run api-diff' locally and commit the updated docs/apidiffs."
             exit 1
           fi
-      - name: Fail on incompatible published API changes
-        run: |
-          python3 - <<'PY'
-          import os
-          from pathlib import Path
-          import sys
-          import xml.etree.ElementTree as ET
-
-          failures = []
-          for report in sorted(Path(".").glob("**/target/japicmp/api-diff.xml")):
-              parts = report.parts
-              module = "/".join(parts[: parts.index("target")])
-              tree = ET.parse(report)
-              for change in tree.findall(".//compatibilityChange"):
-                  binary = change.get("binaryCompatible") == "false"
-                  source = change.get("sourceCompatible") == "false"
-                  if binary or source:
-                      failures.append((module, change.get("type", "unknown")))
-
-          if not failures:
-              print("No incompatible published API changes detected.")
-              sys.exit(0)
-
-          print("Incompatible published API changes detected:")
-          for module, change_type in failures[:100]:
-              print(f"- {module}: {change_type}")
-          if len(failures) > 100:
-              print(f"... and {len(failures) - 100} more")
-          if os.environ.get("BREAKING_API_CHANGE_ACCEPTED") == "true":
-              print("Accepted by PR label `breaking-api-change-accepted`.")
-              sys.exit(0)
-          print("Run `mise run api-diff` locally for full japicmp output.")
-          print("Reports are written to `**/target/japicmp/*`.")
-          sys.exit(1)
-          PY

.github/workflows/approve-workflows.yml

@@ -0,0 +1,27 @@
+---
+###
+# This action is synced from https://github.com/prometheus/prometheus
+###
+name: Approve pending workflows
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions: read-all
+
+jobs:
+  approve:
+    if: >-
+      github.event.issue.pull_request &&
+      github.event.comment.body == '/workflow-approve' &&
+      (github.repository_owner == 'prometheus' || github.repository_owner == 'prometheus-community')
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: prometheus/promci/approve_workflows@370e8c15dcec50043cbe66f2f34633d9efc0a190 # v0.9.0
+        with:
+          github_token: ${{ github.token }}

.github/workflows/build.yml

@@ -9,15 +9,15 @@ jobs:
   build:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
-          version: v2026.6.12
-          sha256: ff0cf4917acc96b7ffdd0382261d17f405572e9240f95fafb980e44aaf60c514
+          version: v2026.7.5
+          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
       - name: Cache local Maven repository
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}

.github/workflows/bump-api-diff-baseline.yml

@@ -29,16 +29,16 @@ jobs:
     permissions:
       contents: write # push to the snapshot PR branch
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ env.SNAPSHOT_BRANCH }}
           persist-credentials: true
-      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+      - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
         with:
-          version: v2026.6.12
-          sha256: ff0cf4917acc96b7ffdd0382261d17f405572e9240f95fafb980e44aaf60c514
+          version: v2026.7.5
+          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
       - name: Cache local Maven repository
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}

.github/workflows/codeql.yml

@@ -21,23 +21,23 @@ jobs:
       security-events: write # required for github/codeql-action/analyze to upload SARIF
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
       - name: Set up Java
-        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
         with:
           distribution: temurin
           java-version: "25"
 
       - name: Cache Maven repository
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-codeql-${{ hashFiles('**/pom.xml') }}
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/init@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
         with:
           languages: java
           tools: linked
@@ -56,6 +56,6 @@ jobs:
           -Djavadoc.skip=true
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/analyze@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
         with:
           category: /language:java

.github/workflows/detect-api-changes.yml

@@ -0,0 +1,117 @@
+---
+name: Detect API Changes
+
+on:
+  # pull_request_target is used so the workflow can update labels and comments
+  # without checking out or executing code from the PR branch.
+  # zizmor: ignore[dangerous-triggers] -- this workflow only reads PR metadata
+  # via the GitHub API and never checks out or executes code from the PR branch.
+  pull_request_target:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+
+permissions: {}
+
+jobs:
+  detect-api-changes:
+    if: github.repository == 'prometheus/client_java'
+    runs-on: ubuntu-24.04
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Check for API changes and update PR
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+        run: |
+          MARKER="<!-- api-change-detector -->"
+          BREAKING_LABEL="breaking-api-change"
+
+          api_files=$(gh api "repos/${REPO}/pulls/${PR_NUMBER}/files" --paginate \
+            --jq '.[] | select(.filename | startswith("docs/apidiffs/current_vs_latest/")) | .filename')
+
+          comment_id=$(gh api "repos/${REPO}/issues/${PR_NUMBER}/comments" --paginate \
+            --jq ".[] | select(.body | startswith(\"${MARKER}\")) | .id" | head -1)
+
+          if [[ -z "$api_files" ]]; then
+            echo "No API diff files changed."
+            gh pr edit "$PR_NUMBER" --repo "$REPO" --remove-label "api-change" 2>/dev/null || true
+            gh pr edit "$PR_NUMBER" --repo "$REPO" --remove-label "$BREAKING_LABEL" 2>/dev/null || true
+            if [[ -n "$comment_id" ]]; then
+              gh api --method DELETE "repos/${REPO}/issues/comments/${comment_id}"
+            fi
+            exit 0
+          fi
+
+          echo "API diff files changed:"
+          echo "$api_files"
+
+          gh pr edit "$PR_NUMBER" --repo "$REPO" --add-label "api-change"
+
+          modules=$(echo "$api_files" \
+            | sed 's|docs/apidiffs/current_vs_latest/||' \
+            | sed 's|\.txt$||' \
+            | sort \
+            | sed 's/^/- /')
+
+          HEAD_SHA=$(gh api "repos/${REPO}/pulls/${PR_NUMBER}" --jq .head.sha)
+          breaking_files=()
+          while IFS= read -r file; do
+            [[ -z "$file" ]] && continue
+            content=$(gh api \
+              -H "Accept: application/vnd.github.raw" \
+              "repos/${REPO}/contents/${file}?ref=${HEAD_SHA}")
+            if grep -Eq '^[[:space:]]*(\*\*\*!|---!|\+\+\+!)' <<<"$content"; then
+              breaking_files+=("$file")
+            fi
+          done <<<"$api_files"
+
+          if [[ ${#breaking_files[@]} -gt 0 ]]; then
+            gh pr edit "$PR_NUMBER" --repo "$REPO" --add-label "$BREAKING_LABEL"
+            breaking_modules=$(printf '%s\n' "${breaking_files[@]}" \
+              | sed 's|docs/apidiffs/current_vs_latest/||' \
+              | sed 's|\.txt$||' \
+              | sort \
+              | sed 's/^/- /')
+            body=$(cat <<EOF
+          ${MARKER}
+          ## :warning: Breaking API changes detected — maintainer review required
+
+          This PR modifies the published API diff for the following module(s):
+
+          ${modules}
+
+          The committed API diff contains breaking-change markers for:
+
+          ${breaking_modules}
+
+          Please review the changes in \`docs/apidiffs/current_vs_latest/\` carefully before approving.
+          EOF
+            )
+          else
+            gh pr edit "$PR_NUMBER" --repo "$REPO" --remove-label "$BREAKING_LABEL" 2>/dev/null || true
+
+            body=$(cat <<EOF
+          ${MARKER}
+          ## :warning: API changes detected — maintainer review required
+
+          This PR modifies the published API diff for the following module(s):
+
+          ${modules}
+
+          Please review the changes in \`docs/apidiffs/current_vs_latest/\` carefully before approving.
+          EOF
+            )
+          fi
+
+          if [[ -n "$comment_id" ]]; then
+            gh api --method PATCH "repos/${REPO}/issues/comments/${comment_id}" \
+              --field body="$body"
+          else
+            gh pr comment "$PR_NUMBER" --repo "$REPO" --body "$body"
+          fi