Merge pr 177

.github/workflows/analyze-releases-for-adk-docs-updates.yml

@@ -24,9 +24,9 @@ on:
 jobs:
   analyze-new-release-for-adk-docs-updates:
     runs-on: ubuntu-latest
-    # These permissions apply to this repo's GITHUB_TOKEN (used only for checkout).
-    # The agent writes issues, branches and pull requests to the docs repo via the
-    # ADK_TRIAGE_AGENT PAT, which must have issues + pull-requests + contents write there.
+    # Dry-run reads only (this repo + the public docs repo) and skips writes, so
+    # the built-in GITHUB_TOKEN suffices. For --no-dry-run, use a PAT with write
+    # access to the docs repo.
     permissions:
       contents: read
 
@@ -50,8 +50,10 @@ jobs:
 
       - name: Run the ADK Docs Release Analyzer
         env:
-          GITHUB_TOKEN: ${{ secrets.ADK_TRIAGE_AGENT }}
-          GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY_FOR_DOCS_AGENTS }}
+          # Built-in token is enough for dry-run (read-only). For --no-dry-run, use a
+          # PAT with docs-repo write access, e.g. ${{ secrets.ADK_TRIAGE_AGENT }}.
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           GOOGLE_GENAI_USE_VERTEXAI: '0'
           DOC_OWNER: 'google'
           CODE_OWNER: 'google'
@@ -78,6 +80,6 @@ jobs:
           fi
           # Install ADK libs + sample, then run exec:java scoped to this module
           # (exec:java with -am would also run on the parent, which has no mainClass).
-          ./mvnw -q -pl contrib/samples/github/adkreleasedocs -am install -DskipTests
-          ./mvnw -q -pl contrib/samples/github/adkreleasedocs exec:java \
+          ./mvnw -B -q -pl contrib/samples/github/adkreleasedocs -am install -DskipTests
+          ./mvnw -B -q -pl contrib/samples/github/adkreleasedocs exec:java \
             -Dexec.args="${args}"

.github/workflows/pr-title-check.yml

@@ -0,0 +1,31 @@
+# Validates that the PR title is a Conventional Commit. Pull requests are
+# squash-merged into a single commit (see pr-commit-check.yml), so the PR title
+# becomes the commit message release-please parses for versioning and changelog
+# generation.
+name: PR Title Check
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  contents: read
+
+jobs:
+  check-pr-title:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate Conventional Commit title
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          pattern='^(build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)(\([a-zA-Z0-9][a-zA-Z0-9/]*[a-zA-Z0-9]\))?!?:.*[^.[:space:]]$'
+          if [[ "$PR_TITLE" =~ $pattern ]]; then
+            echo "PR title is a valid Conventional Commit: $PR_TITLE"
+          else
+            echo "::error::Invalid PR title: \"$PR_TITLE\""
+            echo "Expected: <type>[(scope)][!]: <description>"
+            echo "Allowed types: build, chore, ci, docs, feat, fix, perf, refactor, revert, style, test"
+            echo "The description must not be empty and must not end with a period."
+            exit 1
+          fi

.github/workflows/pr-triage-adk-java.yml

@@ -29,6 +29,11 @@ on:
         description: 'The pull request number to triage'
         required: true
         type: 'string'
+      dry_run:
+        description: 'Dry run: preview only. Set to false to actually create the issue and PRs.'
+        required: false
+        default: true
+        type: boolean
 
 # Serialize runs that touch the same PR so a re-trigger (e.g. an "edited" event)
 # can't race an in-flight run on the same PR (which, with label appends, could
@@ -78,7 +83,7 @@ jobs:
           INTERACTIVE: '0'
           # Defaults to a dry run (logs intended labels/comments without writing).
           # Verify the pipeline, then set DRY_RUN to '0' to go live.
-          DRY_RUN: '1'
+          DRY_RUN: ${{ github.event.inputs.dry_run || 'true' }}
           EVENT_NAME: ${{ github.event_name }}
           PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
         run: |

.github/workflows/spam-detection-adk-java-issues.yml

@@ -0,0 +1,94 @@
+# Scans adk-java issues for spam/promotional content with the ADK Issue
+# Monitoring (Spam Detection) Agent sample under
+# contrib/samples/github/adkspam.
+#
+# Required repository secrets:
+#   - GOOGLE_API_KEY    : Gemini API key (or wire up Vertex AI credentials and
+#                         set GOOGLE_GENAI_USE_VERTEXAI=TRUE).
+# Labeling/commenting uses the built-in GITHUB_TOKEN (no secret to manage); the
+# `permissions:` block below grants it the `issues: write` scope it needs. Swap
+# in a PAT only if you specifically want the spam label/alert comment attributed
+# to a distinct bot identity.
+#
+# NOTE: the `spam` label (or whatever SPAM_LABEL_NAME is set to) must already
+# exist in the repository's labels; the agent applies it but does not create it.
+name: ADK Issue Monitoring (Spam Detection) Agent
+
+on:
+  issues:
+    types: [opened]
+  schedule:
+    # Run daily at 06:00 UTC, matching the Python issue-monitor workflow.
+    - cron: '0 6 * * *'
+  workflow_dispatch:
+    inputs:
+      full_scan:
+        description: 'Audit ALL open issues (not just those updated in the last 24h).'
+        required: false
+        default: false
+        type: boolean
+      dry_run:
+        description: 'Dry run: preview only. Set to false to actually create the issue and PRs.'
+        required: false
+        default: true
+        type: boolean
+
+# Serialize runs that touch the same issue so the scheduled sweep can't race a
+# per-issue run on that issue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.issue.number || github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  agent-scan-issues:
+    runs-on: ubuntu-latest
+    # Only run on the upstream repo, for newly-opened issues, the scheduled
+    # sweep, or a manual dispatch.
+    if: >-
+      github.repository == 'google/adk-java' && (
+        github.event_name == 'schedule' ||
+        github.event_name == 'workflow_dispatch' ||
+        github.event.action == 'opened'
+      )
+    permissions:
+      issues: write
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Java
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: maven
+
+      - name: Run Spam Detection Agent
+        env:
+          # Built-in token scoped by the `permissions:` block above. Replace with a
+          # PAT (e.g. ${{ secrets.ADK_TRIAGE_AGENT }}) only if you need a distinct
+          # bot identity for the label/comment actions.
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          GOOGLE_GENAI_USE_VERTEXAI: '0'
+          OWNER: ${{ github.repository_owner }}
+          REPO: ${{ github.event.repository.name }}
+          INTERACTIVE: '0'
+          # Defaults to a dry run (logs intended labels/comments without writing).
+          # Verify the pipeline, then set DRY_RUN to '0' to go live.
+          DRY_RUN: ${{ github.event.inputs.dry_run || 'true' }}
+          EVENT_NAME: ${{ github.event_name }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          ISSUE_TITLE: ${{ github.event.issue.title }}
+          ISSUE_BODY: ${{ github.event.issue.body }}
+          # Mapped to the manual-dispatch checkbox. On the daily schedule this is
+          # empty, so only issues updated in the last 24h are audited.
+          INITIAL_FULL_SCAN: ${{ github.event.inputs.full_scan }}
+        run: |
+          # Install the ADK libs + this sample, then run exec:java scoped to this
+          # module (exec:java with -am would also run on the parent/core modules,
+          # which have no mainClass).
+          ./mvnw -B -q -pl contrib/samples/github/adkspam -am install -DskipTests
+          ./mvnw -B -q -pl contrib/samples/github/adkspam exec:java

.github/workflows/stale-adk-java-issues.yml

@@ -0,0 +1,85 @@
+# Audits stale adk-java issues with the ADK Stale Issue Auditor sample under
+# contrib/samples/github/adkstale.
+#
+# Required repository secrets:
+#   - GOOGLE_API_KEY    : Gemini API key (or wire up Vertex AI credentials and
+#                         set GOOGLE_GENAI_USE_VERTEXAI=TRUE).
+# Commenting/labelling/closing uses the built-in GITHUB_TOKEN (no secret to
+# manage); the `permissions:` block below grants it the `issues: write` scope it
+# needs. Swap in a PAT only if you specifically want stale actions attributed to
+# a distinct bot identity.
+#
+# Prerequisite: the `stale` label (and, if used, `request clarification`) must
+# exist in the repository; GitHub will not auto-create labels when the agent
+# applies them.
+name: ADK Stale Issue Auditor
+
+on:
+  schedule:
+    # Run daily at 06:00 UTC.
+    - cron: '0 6 * * *'
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Dry run: preview only. Set to false to actually create the issue and PRs.'
+        required: false
+        default: true
+        type: boolean
+
+# Serialize runs so an in-flight daily sweep can't overlap a manual dispatch and
+# act on the same issues twice.
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  agent-audit-stale-issues:
+    runs-on: ubuntu-latest
+    # Only run on the upstream repo, on the daily schedule or a manual dispatch.
+    if: >-
+      github.repository == 'google/adk-java' && (
+        github.event_name == 'schedule' ||
+        github.event_name == 'workflow_dispatch'
+      )
+    permissions:
+      issues: write
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Java
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: maven
+
+      - name: Run Stale Issue Auditor
+        env:
+          # Built-in token scoped by the `permissions:` block above. Replace with a
+          # PAT (e.g. ${{ secrets.ADK_STALE_AGENT }}) only if you need a distinct
+          # bot identity for the comment/label/close actions.
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          GOOGLE_GENAI_USE_VERTEXAI: '0'
+          OWNER: ${{ github.repository_owner }}
+          REPO: ${{ github.event.repository.name }}
+          INTERACTIVE: '0'
+          # Defaults to a dry run (logs intended comments/labels/closures without
+          # writing). Flip to false via manual dispatch to actually mark as stale.
+          DRY_RUN: ${{ github.event.inputs.dry_run || 'true' }}
+          EVENT_NAME: ${{ github.event_name }}
+          # Max number of stale-candidate issues to audit per run.
+          ISSUE_COUNT_TO_PROCESS: '20'
+          # Optional: comma-separated GitHub handles to treat as maintainers when
+          # the token cannot list push-access collaborators. Stored as a repo
+          # variable rather than committed to source.
+          MAINTAINERS: ${{ vars.ADK_MAINTAINERS }}
+        run: |
+          # Install the ADK libs + this sample, then run exec:java scoped to this
+          # module (exec:java with -am would also run on the parent/core modules,
+          # which have no mainClass).
+          ./mvnw -B -q -pl contrib/samples/github/adkstale -am install -DskipTests
+          ./mvnw -B -q -pl contrib/samples/github/adkstale exec:java

.github/workflows/triage-adk-java-issues.yml

@@ -17,6 +17,12 @@ on:
     # Run every 6 hours to triage untriaged issues.
     - cron: '0 */6 * * *'
   workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Dry run: preview only. Set to false to actually create the issue and PRs.'
+        required: false
+        default: true
+        type: boolean
 
 # Serialize runs that touch the same issue so the scheduled batch sweep can't race
 # a per-issue run on that issue (which, with label appends, could duplicate labels).
@@ -63,7 +69,7 @@ jobs:
           INTERACTIVE: '0'
           # Defaults to a dry run (logs intended labels/assignees without writing).
           # Verify the pipeline, then set DRY_RUN to '0' to go live.
-          DRY_RUN: '1'
+          DRY_RUN: ${{ github.event.inputs.dry_run || 'true' }}
           EVENT_NAME: ${{ github.event_name }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           ISSUE_TITLE: ${{ github.event.issue.title }}

.github/workflows/validation.yml

@@ -16,7 +16,7 @@ jobs:
     timeout-minutes: 30
     strategy:
       matrix:
-        java-version: ["17", "21"]
+        java-version: ["17", "21", "25"]
 
     steps:
       - name: Checkout code

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "1.5.0"
+    ".": "1.6.0"
 }

CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## [1.6.0](https://github.com/google/adk-java/compare/v1.5.0...v1.6.0) (2026-07-06)
+
+
+### Features
+
+* Add ADK Issue Monitoring (Spam Detection) Agent sample for Java ([fd45dda](https://github.com/google/adk-java/commit/fd45dda7c07dfd241ff6650d41a323857bfd632e))
+* Add ADK Java Issue Triaging Agent sample ([fa94438](https://github.com/google/adk-java/commit/fa9443825bf9ecbaa6af5ee28f3fad8d162d74fa))
+* Add ADK PR Triaging Agent for google/adk-java ([f14f644](https://github.com/google/adk-java/commit/f14f6442c5a0f11d7772d8c47d92cc23013d0010))
+* Add chat-completions API support to ApigeeLlm ([df73784](https://github.com/google/adk-java/commit/df737840299cd2369a699abb4bd6028d7da1a630))
+* Add ClassPathSkillSource to load skills from the Java classpath ([587073a](https://github.com/google/adk-java/commit/587073a23ea781efd44990ad440b52caace3db4f))
+* Adds the ADK Stale Issue Auditor sample ([b6bd2dd](https://github.com/google/adk-java/commit/b6bd2dde4b1e26896815a23c686c9068b10e5397))
+* advance SequentialAgent to later sub-agents after a HITL resume when resumability is enabled ([407478b](https://github.com/google/adk-java/commit/407478bc131721c23318a3f8e8a06521490494e9))
+* **flows:** add RunConfig.groupFunctionResponsesInHistory to group function calls before responses ([1b9b395](https://github.com/google/adk-java/commit/1b9b39546728db9b776769fb5465aa54947ce488))
+* Updated Spring AI to 2.0.0, ECJ, build works with Java 25 ([3f6665b](https://github.com/google/adk-java/commit/3f6665b2734d6c3a610c069f30fa305ea137f35a))
+
+
+### Bug Fixes
+
+* **core:** allow Long values to match INTEGER schema type ([a6d41cf](https://github.com/google/adk-java/commit/a6d41cff76682bc16b9871f3f3fd5a11cb1cccf9))
+* **dev:** keep '*' CORS default, drive WebSocket origins from config, warn on '*' ([5029081](https://github.com/google/adk-java/commit/50290814c7821b08e8e542caddfab1113a5b8c45))
+* **dev:** use localhost port wildcard for default CORS/WebSocket origins ([cb73317](https://github.com/google/adk-java/commit/cb733173574cec5f54c23858ce0ecdbf9c74f2f0))
+* **flows:** end invocation on a deferred long-running tool call ([6dd4594](https://github.com/google/adk-java/commit/6dd459457c917f83c0667480b7fc443794f63da8))
+* **gemini:** align streaming function-call handling with ADK Python ([37bb5e6](https://github.com/google/adk-java/commit/37bb5e6a7b01470d9f07a7b03ac3019bb7ddcc14))
+* ignore usage-only responses outside bidi ([a6cb87a](https://github.com/google/adk-java/commit/a6cb87ae2016c6de25d2b8a7ae369c5e95a43d92))
+* Make dry_run configurable for ADK Java PR triage, spam detection, and issue triage workflows ([4225b07](https://github.com/google/adk-java/commit/4225b07ed356b5fc0a70c0620b42cbef297d722d))
+* Make stale issue workflow configurable for dry runs ([d0edd41](https://github.com/google/adk-java/commit/d0edd41bfa30388f03092d70813e1136cee3295d))
+* map ChatResponse usage metadata to LlmResponse ([71f6929](https://github.com/google/adk-java/commit/71f69293ecfe2eb92b48b3cc9d58b60c71758481))
+* map token usage metadata for Anthropic Claude model ([f76c5f9](https://github.com/google/adk-java/commit/f76c5f98ce15759723b1e21f4c0c6485a1c810fd))
+* Move @JsonCreator inside LiveRequest Builder ([d667db8](https://github.com/google/adk-java/commit/d667db8e4f18633f15e5fd375f45b036c2801048))
+* preserve non-text output in streaming responses ([b8be90d](https://github.com/google/adk-java/commit/b8be90d24ef87efdb06881e471a1396c2a281564))
+* prevent cross-user session data disclosure in VertexAiSessionService ([d1b1d92](https://github.com/google/adk-java/commit/d1b1d927f36c23cf50ef8a5abcf475c0215edd01))
+* Resolve NPE when McpTool description is null ([8ed64ea](https://github.com/google/adk-java/commit/8ed64ea2ad4cfecc71faf16d150c7c80da13ac1a))
+* Safely handle empty model in GoogleSearchTool request processor ([e255192](https://github.com/google/adk-java/commit/e255192b293980ab843616dbd459ee48d5debff7))
+* scope ADK Java docs release analyzer to a single language ([07a2ec9](https://github.com/google/adk-java/commit/07a2ec992713a4e215c93539ea1866d9469e78fd))
+* **skills:** prevent path traversal in LocalSkillSource ([55392f6](https://github.com/google/adk-java/commit/55392f64b554adf2d46ff7f9824ec4fd87434340))
+* use daemon threads in OkHttp dispatchers to allow graceful JVM shutdown ([9b046b6](https://github.com/google/adk-java/commit/9b046b6a3f72ff279fe852899d92627983baa2c2))
+* Use existing secrets and built-in token in ADK docs release analyzer workflow ([456234f](https://github.com/google/adk-java/commit/456234f264f519796609bbfc0556932b34a7f7a0))
+* widen Integer to Long in castValue() for boxed Long parameter ([bc32948](https://github.com/google/adk-java/commit/bc32948b462e8cc17c366c661f29564aade5c93e))
+
 ## [1.5.0](https://github.com/google/adk-java/compare/v1.4.0...v1.5.0) (2026-06-20)
 
 

README.md

@@ -50,13 +50,13 @@ If you're using Maven, add the following to your dependencies:
 <dependency>
   <groupId>com.google.adk</groupId>
   <artifactId>google-adk</artifactId>
-  <version>1.5.0</version>
+  <version>1.6.0</version>
 </dependency>
 <!-- Dev UI -->
 <dependency>
     <groupId>com.google.adk</groupId>
     <artifactId>google-adk-dev</artifactId>
-    <version>1.5.0</version>
+    <version>1.6.0</version>
 </dependency>
 ```
 

a2a/pom.xml

@@ -5,7 +5,7 @@
   <parent>
     <groupId>com.google.adk</groupId>
     <artifactId>google-adk-parent</artifactId>
-    <version>1.5.1-SNAPSHOT</version><!-- {x-version-update:google-adk:current} -->
+    <version>1.6.1-SNAPSHOT</version><!-- {x-version-update:google-adk:current} -->
   </parent>
 
   <artifactId>google-adk-a2a</artifactId>