semantic-conventions-java This Week: Weaver 0.28, Gradle 9.8.2 and Pinned Action Bumps

semantic-conventions-java is the OpenTelemetry repo that publishes the Java artifacts for the semantic conventions. Its week was two Renovate merges: a Weaver bump, a Gradle patch release and a batch of pinned GitHub Actions. There is no change to the generated Java API in this window.

Toolchain bumps in one pull request

Update all patch and minor versions (#597) is the one that touches the build. The commit itself changes three things:

  • The Weaver container image goes from otel/weaver:v0.27.0 to otel/weaver:v0.28.0, still pinned by digest.
  • The Gradle wrapper goes from 9.8.1 to 9.8.2, with a new distributionSha256Sum.
  • The com.gradle.develocity plugin goes from 4.6.0 to 4.6.1.

Weaver is the piece worth noticing. It is the tool that generates code from the semantic conventions model, so a new version can change generated output in principle. The diff here only shows the image reference changing. I did not see any regenerated sources in this window, so treat it as a tooling bump until a release says otherwise.

The Gradle change lives in gradle-wrapper.properties. The Develocity plugin change is in settings.gradle.kts. Both are patch level.

GitHub Actions pinned to new SHAs

Update github actions (#598) spreads across the workflow files. The commit updates these pins:

  • actions/setup-java to v6.1.0
  • github/codeql-action (init and analyze) to v4.39.1
  • jdx/mise-action to v5.2.4
  • the shared workflow-failure-issue.yml from open-telemetry/shared-workflows, from v0.19.0 to v0.24.0

Files touched include build-common.yml, codeql.yml, auto-update-semconv.yml, fossa.yml and release.yml.

Every action is pinned to a full commit SHA with the version in a trailing comment. That is the pattern that lets a zizmor check pass, and the repo has a zizmor workflow for it. A pin like this looks like:

uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0

The jump of the shared failure issue workflow from v0.19.0 to v0.24.0 is the largest version gap in the batch. It only runs when a scheduled job fails, so you will notice it only when a nightly breaks.

Size of the change

Together the two commits touch 12 files with 20 insertions and 20 deletions. Every line is a one for one swap of a version or hash. Java 25 is still the build JDK in the workflows I saw.

What to watch

  • If you consume the published artifacts, there is nothing to act on from these two merges.
  • Watch the next semconv version update PR from auto-update-semconv.yml. It is the first run that will exercise Weaver v0.28.0 against new conventions.
  • If you copy this repo’s workflow pins into your own, the new SHAs above are verified from the diff. Still check the upstream tags before you reuse them.

← All updates