Add an automatic GCP-BOM dependency upgrader

[Abacn]

Command: python scripts/tools/gcpbomupgrader.py 26.30.0

If run python scripts/tools/gcpbomupgrader.py 26.31.0 based on this PR, it would give:

INFO:root:Changed com.google.api:gax: 2.39.0 -> 2.41.0
INFO:root:Changed com.google.cloud:google-cloud-spanner: 6.56.0 -> 6.57.0
INFO:root:Changed io.grpc:grpc-netty: 1.60.0 -> 1.61.0
INFO:root:Unchanged: io.netty:netty-transport:4.1.100.Final
INFO:root:Changed com.google.protobuf:protobuf-java: 3.25.1 -> 3.25.2
INFO:root:Changed org.apache.arrow:arrow-memory-core: 14.0.2 -> 15.0.0

Please add a meaningful description for your change here

---

Thank you for your contribution! Follow this checklist to help us incorporate your contribution quickly and easily:

• Mention the appropriate issue in your description (for example: addresses #123), if applicable. This will automatically add a link to the pull request in the issue. If you would like the issue to automatically close on merging the pull request, comment fixes #<ISSUE NUMBER> instead.
• Update CHANGES.md with noteworthy changes.
• If this contribution is large, please file an Apache Individual Contributor License Agreement.

See the Contributor Guide for more tips on how to make review process smoother.

To check the build health, please visit https://github.com/apache/beam/blob/master/.test-infra/BUILD_STATUS.md

GitHub Actions Tests Status (on master branch)

See CI.md for more information about GitHub Actions CI or the workflows README to see a list of phrases to trigger workflows.

[Abacn]

CC: @dhruvdua @shunping

[shunping]

nits: the format looks strange here

[Abacn]

That was the result that I have run yapf on the script.

[shunping]

That's a great tool to facilitate libraries-bom version upgrade. Thanks Yi!

[shunping]

Could you also document what we should change BeamModulePlugin if we have a new dep that we want to pin and we want to leverage this tool later (or at least don't break the standardization)?

There are two cases here:

1. adding a new dep from a project that is already tracked in BeamModulePlugin, and
2. adding a new dep from a new project.

[Abacn]

Good point. Definitely will clean up this script when marked as ready for review. Currently it just serves as an "unoffical" tool.

[Abacn]

Added comments about the tags that the script relies on: https://github.com/apache/beam/pull/30262/files#diff-0435a83a413ec063bf7e682cadcd56776cd18fc878f197cc99a65fc231ef2047R595

[Abacn]

we again have the grpc version mismatch after #30181, my bad, fixed by this script

[Abacn]

R: @shunping ready for review now

[github-actions]

Stopping reviewer notifications for this pull request: review requested by someone other than the bot, ceding control

[shunping]

The code looks good. I am also wondering if we can use your script to add a presubmit test, so if the version is not right, the update cannot be submitted.

This may need to change your script to support two modes: in-place updating (which is already implemented) and reporting only. Then a new test can be added to call this script in reporting mode and check if there is any version mismatch.

WDYT?

[Abacn]

The code looks good. I am also wondering if we can use your script to add a presubmit test, so if the version is not right, the update cannot be submitted.

This may need to change your script to support two modes: in-place updating (which is already implemented) and reporting only. Then a new test can be added to call this script in reporting mode and check if there is any version mismatch.

WDYT?

This sounds good, similar to .github/workflows/update_python_dependencies.yml . We can setup a "test" to generate a PR / or fail like the referred workflow.

However in practice we already have many tests and there are infra related workflow no one cares and red for months. So the actual benefit I am not sure. As of the scope of this PR I am not intend to setup a test.

[shunping]

LGTM!