ci: bump api-diff baseline on the snapshot PR (#2219)

## Summary

- After `mvn deploy` succeeds, release.yml dispatches a new
`bump-api-diff-baseline.yml` that rewrites
`<api.diff.baseline.version>`, archives the previous `current_vs_latest`
as `<new>_vs_<old>`, regenerates `docs/apidiffs`, and pushes the result
onto release-please's open snapshot-bump PR branch
(`release-please--branches--main`). The next merge is then a single PR
that bumps to `-SNAPSHOT` *and* updates the api-diff baseline — no more
window where main has a stale baseline against the just-released
version.
- Removes the Renovate-driven `generate-api-diff-baseline.yml` flow
(workflow, package rule, custom manager) — the new flow replaces it
end-to-end. `workflow_dispatch` on the new workflow is the manual
fallback.
- Refreshes `docs/apidiffs/current_vs_latest` from a stale `1.8.0 vs
1.8.0` to `1.8.1-SNAPSHOT vs 1.8.0`.

## Test plan

- [ ] First release after merge: confirm the new workflow runs after
`mvn deploy`, pushes onto `release-please--branches--main`, and the
snapshot PR's combined diff looks correct.
- [ ] Confirm the snapshot PR's CI re-runs after close/reopen
(GITHUB_TOKEN pushes don't auto-trigger).
- [ ] Manual `workflow_dispatch` of `bump-api-diff-baseline.yml` works
as a fallback if the auto-trigger ever fails.

---------

Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>

Author: zeitlinger

.github/renovate-tracked-deps.json

@@ -26,7 +26,7 @@
         "mise"
       ]
     },
-    ".github/workflows/generate-api-diff-baseline.yml": {
+    ".github/workflows/bump-api-diff-baseline.yml": {
       "regex": [
         "mise"
       ]
@@ -183,11 +183,6 @@
       "maven-wrapper": [
         "maven-wrapper"
       ]
-    },
-    "pom.xml": {
-      "regex": [
-        "io.prometheus:prometheus-metrics-core"
-      ]
     }
   }
 }

.github/renovate.json5

@@ -45,13 +45,6 @@
       groupName: "protobuf",
       separateMajorMinor: false,
     },
-    {
-      description: "Isolate the api-diff baseline on renovate/api-diff-baseline so generate-api-diff-baseline can regenerate docs/apidiffs; merge manually after a close/reopen re-runs CI",
-      matchFileNames: ["pom.xml"],
-      matchPackageNames: ["io.prometheus:prometheus-metrics-core"],
-      groupName: "api-diff-baseline",
-      automerge: false,
-    },
     {
       "description": "Flint autofix: align extractVersion for protoc",
       "extractVersion": "^(?<version>.+)\\.0\\.0$",
@@ -69,14 +62,6 @@
          "# renovate: datasource=(?<datasource>[a-z-]+?)(?: depName=(?<depName>.+?))?(?: packageName=(?<packageName>.+?))?(?: versioning=(?<versioning>[a-z-]+?))?\\s.+?_VERSION\\s*=\\s*\"?(?<currentValue>[^@\"]+?)(?:@(?<currentDigest>sha256:[a-f0-9]+))?\"?\\s"
        ]
      },
-     {
-       "customType": "regex",
-       "description": "update the api-diff baseline to the latest published release",
-       "managerFilePatterns": ["/^pom\\.xml$/"],
-       "matchStrings": [
-         "<!-- renovate: datasource=(?<datasource>[a-z-]+?) packageName=(?<packageName>.+?) -->\\s*<api\\.diff\\.baseline\\.version>(?<currentValue>[^<]+)</api\\.diff\\.baseline\\.version>"
-       ]
-     },
      {
        customType: "regex",
        description: "track the latest Micrometer release for upstream compatibility",

.github/workflows/bump-api-diff-baseline.yml

@@ -0,0 +1,94 @@
+---
+name: Bump API Diff Baseline
+
+# After release.yml publishes to Maven Central, push a baseline bump and
+# regenerated docs/apidiffs onto release-please's open snapshot-bump PR branch
+# (release-please--branches--main). The user merges a single PR that bumps to
+# the next -SNAPSHOT *and* updates the api-diff baseline, so there is no window
+# where main has a stale baseline.
+#
+# If the snapshot PR branch no longer exists (already merged), this workflow
+# fails loudly — re-run via workflow_dispatch after recreating it, or bump
+# manually.
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Released tag (e.g. v1.8.0)"
+        required: true
+
+permissions: {}
+
+env:
+  SNAPSHOT_BRANCH: release-please--branches--main
+
+jobs:
+  bump:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write # push to the snapshot PR branch
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          ref: ${{ env.SNAPSHOT_BRANCH }}
+          persist-credentials: true
+      - uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0
+        with:
+          version: v2026.5.18
+          sha256: cfac593469d028d7ae5fe36e37bd7c59118b5238e92d8a876209578464f24a84
+      - name: Cache local Maven repository
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.m2/repository
+          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            ${{ runner.os }}-maven-
+      - name: Compute versions and bump baseline
+        id: bump
+        env:
+          TAG: ${{ inputs.tag }}
+        run: |
+          NEW="${TAG#v}"
+          baseline() {
+            grep -oP '(?<=<api\.diff\.baseline\.version>)[^<]+' "$1"
+          }
+          OLD=$(baseline pom.xml)
+          if [[ -z "$OLD" ]]; then
+            echo "::error::Could not read api.diff.baseline.version"
+            exit 1
+          fi
+          if [[ "$OLD" == "$NEW" ]]; then
+            echo "Baseline already $NEW; nothing to do"
+            echo "skip=true" >>"$GITHUB_OUTPUT"
+            exit 0
+          fi
+          sed -i -E \
+            "s|(<api\.diff\.baseline\.version>)[^<]+(</api\.diff\.baseline\.version>)|\1${NEW}\2|" \
+            pom.xml
+          if [[ -d docs/apidiffs/current_vs_latest ]]; then
+            cp -r docs/apidiffs/current_vs_latest "docs/apidiffs/${NEW}_vs_${OLD}"
+          fi
+          echo "old=${OLD}" >>"$GITHUB_OUTPUT"
+          echo "new=${NEW}" >>"$GITHUB_OUTPUT"
+      - name: Regenerate docs/apidiffs
+        if: steps.bump.outputs.skip != 'true'
+        run: mise run api-diff
+      - name: Push to snapshot PR branch
+        if: steps.bump.outputs.skip != 'true'
+        env:
+          NEW: ${{ steps.bump.outputs.new }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add pom.xml docs/apidiffs
+          OUTSIDE=$(git status --porcelain -- ':(exclude)pom.xml' ':(exclude)docs/apidiffs')
+          if [[ -n "$OUTSIDE" ]]; then
+            echo "::error::Unexpected changes outside pom.xml/docs/apidiffs:"
+            echo "$OUTSIDE"
+            exit 1
+          fi
+          git commit -m "chore: bump api-diff baseline to ${NEW}"
+          # Note: GITHUB_TOKEN pushes don't trigger CI re-runs on the PR.
+          # Close and reopen the snapshot PR to trigger CI after this commit.
+          git push origin "HEAD:${SNAPSHOT_BRANCH}"

.github/workflows/generate-api-diff-baseline.yml

@@ -15,7 +15,8 @@ jobs:
     if: ${{ github.repository == 'prometheus/client_java' }}
     environment: release
     runs-on: ubuntu-24.04
-    permissions: {}
+    permissions:
+      actions: write # required to trigger bump-api-diff-baseline.yml via `gh workflow run`
 
     steps:
       - name: Verify release secrets
@@ -94,3 +95,11 @@ jobs:
           MAVEN_USERNAME: ${{ secrets.SONATYPE_MAVEN_REPOSITORY_USERNAME }}
           MAVEN_CENTRAL_TOKEN: ${{ secrets.SONATYPE_MAVEN_REPOSITORY_PASSWORD }}
           MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_SIGNING_PASSPHRASE }}
+
+      - name: Bump api-diff baseline
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ inputs.tag }}
+        run: >
+          gh workflow run bump-api-diff-baseline.yml
+          --repo "${GITHUB_REPOSITORY}" -f "tag=${TAG}"