Connect: 1.11.x error handling dlq

.asf.yaml

@@ -18,7 +18,7 @@
 #
 
 # The format of this file is documented at
-# https://cwiki.apache.org/confluence/display/INFRA/Git+-+.asf.yaml+features
+# https://github.com/apache/infrastructure-asfyaml/blob/main/README.md
 
 github:
   description: "Apache Iceberg"

.baseline/checkstyle/checkstyle-suppressions.xml

@@ -53,11 +53,6 @@
     <suppress files="org.apache.iceberg.flink.maintenance.api.ZkLockFactory" id="BanShadedClasses"/>
     <suppress files="org.apache.iceberg.flink.maintenance.api.TestZkLockFactory" id="BanShadedClasses"/>
 
-    <!-- Suppress checks for CometColumnReader -->
-    <suppress files="org.apache.iceberg.spark.data.vectorized.CometColumnReader" checks="IllegalImport"/>
-    <!-- Suppress checks for CometDeletedColumnVector -->
-    <suppress files="org.apache.iceberg.spark.data.vectorized.CometDeletedColumnVector" checks="IllegalImport"/>
-
     <!-- Suppress TestClassNamingConvention for main source files -->
     <suppress files=".*[/\\]src[/\\]main[/\\].*" id="TestClassNamingConvention" />
 </suppressions>

.baseline/checkstyle/checkstyle.xml

@@ -450,6 +450,11 @@
             <property name="format" value="^\s*(public\s+)?(abstract\s+)?class\s+[A-Za-z0-9]*Test(\s|&lt;)"/>
             <property name="message" value="Test class names should start with 'Test' prefix, not end with 'Test' suffix. Example: 'TestNewFeature' instead of 'NewFeatureTest'"/>
         </module>
+        <module name="RegexpSinglelineJava">
+            <property name="ignoreComments" value="true"/>
+            <property name="format" value="String::to(Lower|Upper)Case"/>
+            <property name="message" value="Use toLowerCase(Locale)/toUpperCase(Locale) instead of no-arg versions or method references. Prefer Locale.ROOT for locale-insensitive operations."/>
+        </module>
         <module name="IllegalToken">
             <property name="tokens" value="LITERAL_ASSERT"/>
         </module>

.github/ISSUE_TEMPLATE/iceberg_bug_report.yml

@@ -34,7 +34,8 @@ body:
       description: What Apache Iceberg version are you using?
       multiple: false
       options:
-        - "1.10.0 (latest release)"
+        - "1.10.1 (latest release)"
+        - "1.10.0"
         - "1.9.2"
         - "1.9.1"
         - "1.9.0"

.github/ISSUE_TEMPLATE/iceberg_question.yml

@@ -25,7 +25,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        Feel free to ask your question on [Slack](https://join.slack.com/t/apache-iceberg/shared_invite/zt-3kclosz6r-3heAW3d~_PHefmN2A_~cAg) as well.
+        Feel free to ask your question on [Slack](https://join.slack.com/t/apache-iceberg/shared_invite/zt-3tkrk9gpf-1eFZ8ozS2In0~zM_BeZiRQ) as well.
 
         Do **NOT** share any sensitive information like passwords, security tokens, private URLs etc.
   - type: textarea

.github/dependabot.yml

@@ -24,12 +24,16 @@ updates:
     schedule:
       interval: "weekly"
       day: "sunday"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "gradle"
     directory: "/"
     schedule:
       interval: "weekly"
       day: "sunday"
     open-pull-requests-limit: 50
+    cooldown:
+      default-days: 7
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
@@ -39,6 +43,8 @@ updates:
       interval: "weekly"
       day: "sunday"
     open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]

.github/workflows/api-binary-compatibility.yml

@@ -35,6 +35,9 @@ on:
       - 'api/**'
       - '.palantir/revapi.yml'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
@@ -43,22 +46,24 @@ jobs:
   revapi:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           # fetch-depth of zero ensures that the tags are pulled in and we're not in a detached HEAD state
           # revapi depends on the tags, specifically the tag from git describe, to find the relevant override
           # in the .palantir/revapi.yml file
           #
           # See https://github.com/actions/checkout/issues/124
           fetch-depth: 0
-      - uses: actions/setup-java@v5
+          persist-credentials: false
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: zulu
           java-version: 17
+      - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
       - run: |
           echo "Using the old version tag, as per git describe, of $(git describe)";
       - run: ./gradlew revapi --rerun-tasks
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: failure()
         with:
           name: test logs

.github/workflows/asf-allowlist-check.yml

@@ -0,0 +1,46 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+# Verifies all GitHub Actions refs are on the ASF allowlist.
+# Actions not on the allowlist silently fail with "Startup failure" — no logs,
+# no notifications, and PRs may appear green because no checks ran.
+# See https://github.com/apache/infrastructure-actions/issues/574
+name: "ASF Allowlist Check"
+
+on:
+  pull_request:
+    paths:
+      - ".github/**"
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/**"
+
+permissions:
+  contents: read
+
+jobs:
+  asf-allowlist-check:
+    runs-on: ubuntu-24.04
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        persist-credentials: false
+    - uses: apache/infrastructure-actions/allowlist-check@4e9c961f587f72b170874b6f5cd4ac15f7f26eb8  # main

.github/workflows/codeql.yml

@@ -0,0 +1,56 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '16 4 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze Actions
+    runs-on: ubuntu-slim
+    permissions:
+      contents: read
+      security-events: write
+      packages: read
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        persist-credentials: false
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+      with:
+        languages: actions
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+      with:
+        category: "/language:actions"

.github/workflows/cve-scan.yml

@@ -0,0 +1,168 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+name: "CVE Scan"
+on:
+  push:
+    branches:
+    - 'main'
+    - '0.*'
+    - '1.*'
+    - '2.*'
+    tags:
+    - 'apache-iceberg-**'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+
+  # ------------------------------------------------------------------
+  # Trivy CVE scan — scans bundled jars for known vulnerabilities.
+  #
+  # Runs on push to main/release branches only (not PRs). Results are
+  # uploaded as SARIF to the GitHub Security tab for ongoing tracking.
+  # The scan is informational and does not block the build.
+  # ------------------------------------------------------------------
+  cve-scan:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - distribution: kafka-connect-runtime
+          build-task: >-
+            -DkafkaVersions=3
+            :iceberg-kafka-connect:iceberg-kafka-connect-runtime:distZip
+          scan-path: kafka-connect/kafka-connect-runtime/build/distributions
+          unpack: true
+        - distribution: aws-bundle
+          build-task: :iceberg-aws-bundle:shadowJar
+          scan-path: aws-bundle/build/libs
+          unpack: false
+        - distribution: azure-bundle
+          build-task: :iceberg-azure-bundle:shadowJar
+          scan-path: azure-bundle/build/libs
+          unpack: false
+        - distribution: gcp-bundle
+          build-task: :iceberg-gcp-bundle:shadowJar
+          scan-path: gcp-bundle/build/libs
+          unpack: false
+        - distribution: spark-runtime-3.4_2.12
+          build-task: >-
+            -DsparkVersions=3.4
+            :iceberg-spark:iceberg-spark-runtime-3.4_2.12:shadowJar
+          scan-path: spark/v3.4/spark-runtime/build/libs
+          unpack: false
+        - distribution: spark-runtime-3.5_2.12
+          build-task: >-
+            -DsparkVersions=3.5
+            :iceberg-spark:iceberg-spark-runtime-3.5_2.12:shadowJar
+          scan-path: spark/v3.5/spark-runtime/build/libs
+          unpack: false
+        - distribution: spark-runtime-4.0_2.13
+          build-task: >-
+            -DsparkVersions=4.0
+            :iceberg-spark:iceberg-spark-runtime-4.0_2.13:shadowJar
+          scan-path: spark/v4.0/spark-runtime/build/libs
+          unpack: false
+        - distribution: spark-runtime-4.1_2.13
+          build-task: >-
+            -DsparkVersions=4.1
+            :iceberg-spark:iceberg-spark-runtime-4.1_2.13:shadowJar
+          scan-path: spark/v4.1/spark-runtime/build/libs
+          unpack: false
+        - distribution: flink-runtime-1.20
+          build-task: >-
+            -DflinkVersions=1.20
+            :iceberg-flink:iceberg-flink-runtime-1.20:shadowJar
+          scan-path: flink/v1.20/flink-runtime/build/libs
+          unpack: false
+        - distribution: flink-runtime-2.0
+          build-task: >-
+            -DflinkVersions=2.0
+            :iceberg-flink:iceberg-flink-runtime-2.0:shadowJar
+          scan-path: flink/v2.0/flink-runtime/build/libs
+          unpack: false
+        - distribution: flink-runtime-2.1
+          build-task: >-
+            -DflinkVersions=2.1
+            :iceberg-flink:iceberg-flink-runtime-2.1:shadowJar
+          scan-path: flink/v2.1/flink-runtime/build/libs
+          unpack: false
+        - distribution: open-api-test-fixtures-runtime
+          build-task: :iceberg-open-api:shadowJar
+          scan-path: open-api/build/libs
+          unpack: false
+    name: ${{ matrix.distribution }}
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      with:
+        distribution: zulu
+        java-version: 21
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2 # zizmor: ignore[cache-poisoning] -- cache writes are restricted to the default branch by setup-gradle
+    - name: Build ${{ matrix.distribution }}
+      run: |
+        ./gradlew -DsparkVersions= -DflinkVersions= \
+          ${{ matrix.build-task }} \
+          -Pquick=true -x test -x javadoc
+    - name: Prepare scan directory
+      run: |
+        mkdir -p /tmp/cve-scan
+        if [ "${{ matrix.unpack }}" = "true" ]; then
+          unzip ${{ matrix.scan-path }}/*.zip -d /tmp/cve-scan
+        else
+          cp ${{ matrix.scan-path }}/iceberg-${{ matrix.distribution }}-*.jar /tmp/cve-scan/
+        fi
+    - name: Run Trivy vulnerability scan
+      uses: lhotari/sandboxed-trivy-action@f01374b6cc3bf7264ab238293e94f6db7ada6dd0 # v1.0.2
+      with:
+        scan-type: 'rootfs'
+        scan-ref: '/tmp/cve-scan'
+        scanners: 'vuln'
+        severity: 'HIGH,CRITICAL'
+        limit-severities-for-sarif: true
+        exit-code: '0'
+        format: 'sarif'
+        output: 'trivy-results.sarif'
+    - name: Print Trivy scan results
+      if: always()
+      run: |
+        if [ -f trivy-results.sarif ]; then
+          echo "## Trivy CVE Scan Results — ${{ matrix.distribution }}"
+          jq -r '.runs[].results[] | "- \(.ruleId): \(.message.text)"' trivy-results.sarif 2>/dev/null || echo "No findings or unable to parse SARIF."
+        else
+          echo "No SARIF file found — scan may have failed to install."
+        fi
+    - name: Upload Trivy results to GitHub Security tab
+      if: always()
+      uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+      with:
+        sarif_file: 'trivy-results.sarif'
+        category: ${{ matrix.distribution }}