From e0d6d9347b324825b38c11216e6c8432ebb24990 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 22 Oct 2026 19:20:16 +0000 Subject: [PATCH] Bump the shared Claude/CodeQL pins; declare five implicit Maven plugins - anthropics/claude-code-action v1.0.255 -> v1.0.258 (claude.yml, claude-code-review.yml) - github/codeql-action v4.39.0 -> v4.39.1 (codeql.yml, scorecard.yml) - maven-clean-plugin 3.5.0, maven-resources-plugin 3.5.0, maven-install-plugin 3.2.0, maven-deploy-plugin 3.2.0 and maven-dependency-plugin 3.11.0 in a new pluginManagement of the parent POM. No POM named them, so their versions came from whichever Maven ran the build: Maven 3.10.0 (the Ubuntu runners) binds clean 3.5.0, resources 3.5.0, install 3.2.0 and deploy 3.2.0 and manages no dependency plugin; a 3.9 Maven binds clean 3.2.0, resources 3.3.1, install and deploy 3.1.x and dependency 3.7.0. Now the build does not depend on the Maven that runs it, and check-versions.py sees them. Resource output is byte-identical under resources 3.3.1 and 3.5.0. - shared-files.sha256 rewritten for the four shared workflows - publish.yml: the vmlens step's comment named 1.1.0-SNAPSHOT and called srcmorph never published. It now gives the actual reason -am is needed: no repository this build resolves from carries a -SNAPSHOT. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01VBFFnrhtvXiUeyxjmUc4R2 --- .github/shared-files.sha256 | 8 ++--- .github/workflows/claude-code-review.yml | 2 +- .github/workflows/claude.yml | 2 +- .github/workflows/codeql.yml | 4 +-- .github/workflows/publish.yml | 7 +++-- .github/workflows/scorecard.yml | 2 +- CHANGELOG.md | 11 +++++-- pom.xml | 40 ++++++++++++++++++++++++ 8 files changed, 62 insertions(+), 14 deletions(-) diff --git a/.github/shared-files.sha256 b/.github/shared-files.sha256 index b06080d..b047fda 100644 --- a/.github/shared-files.sha256 +++ b/.github/shared-files.sha256 @@ -54,12 +54,12 @@ e8f444ef851bd134330f1505f52b4b0970ef9a62dd76e4c25829241814ba5c73 .github/ISSUE_ 49eda3d2e846e1b5ec1d0f646a1adafb45ef42efbc3a50931df207bf9759ef13 .github/workflows/sonarqube.yml?repo 6e2ae11dad0616f66bbb2b6e6556f580bb987fd911d7132aa6bee2bfc7cc7b52 .java-version 71ec85b7a30e80b18a9ab1fac0199cc50d68548e6f00dd116ab0f904ad63aa50 .java-version.license -30b3bed932fd05a34d79af0155166b548a7597e5ee4913aa105dd82a41d1936d .github/workflows/claude.yml -de1479c5c1e662c0f01d6afd0d18b4a71e8d8168b377287ca6e93285eef63358 .github/workflows/claude-code-review.yml -fe768632e9abc1a8cd39b038a77c1a79dbfd036129bb7f0d84b393251b369be6 .github/workflows/scorecard.yml +48cf852de627f1b11f402e408af907ce3e9ec926f6ba11720467645117e92e3a .github/workflows/claude.yml +362d1d169821b8954dc305dac36b8e2437acdbe2921ac42e9887a215663fa666 .github/workflows/claude-code-review.yml +d4371cbcd6c5511e9b712599bbadc7b4c2437f3107f5d706a9adccdda24c2c44 .github/workflows/scorecard.yml 480afc0c1e41f3997b195d7297750b43599ba71a7471657aa32bfc9662b6fd30 .github/workflows/reuse.yml 93aedaf67af1c4d63b2502107a51f2f454f2b3b4bc5f2fe892561e12363e57a9 .github/workflows/osv-scanner.yml -52182fe4073eb696606813d768ff9444e6b751978f9d27a8d84cc269e9f6cb3a .github/workflows/codeql.yml +ed4231dc5b4ba9357a06974cb61e92b60e3eaac9a293810087efb2933e0cac82 .github/workflows/codeql.yml c9e757f2d0a2f456a08791697a94161c776d9b008a8aa75890da4133c81a99e9 .github/dependabot.yml abea5fb970a46ccf9ba9127d59abf304202efd13c2d6a28da2ff75da0c92a9b8 .github/smoke-fatjar-cli.sh c38151495be64cedc3f11c23b88ffc53f4e0f9d2ce5c0aaaa42b14e4af7e13ec lombok.config diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index f19ab4d..c96753c 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -25,7 +25,7 @@ jobs: - name: Run Claude Code Review id: claude-review - uses: anthropics/claude-code-action@e4a6faad497d33dbc7144135c75e41f82f0bf6c0 # v1 + uses: anthropics/claude-code-action@6b6870e649b5ff408753befeaee5fc7989d4e6a9 # v1 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} prompt: | diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 1cbdb2b..2600eff 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -36,7 +36,7 @@ jobs: - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@e4a6faad497d33dbc7144135c75e41f82f0bf6c0 # v1 + uses: anthropics/claude-code-action@6b6870e649b5ff408753befeaee5fc7989d4e6a9 # v1 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 02f86b7..da8c6ad 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -27,9 +27,9 @@ jobs: with: { java-version: '25', distribution: temurin } - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: { java-version-file: .java-version, distribution: temurin } - - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4 + - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4 with: { languages: java, queries: +security-and-quality } - name: Build with Maven run: mvn --batch-mode --no-transfer-progress compile - - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4 + - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4 with: { category: "/language:java" } diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 0c7ae02..c4f7c6e 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -342,9 +342,10 @@ jobs: # VmlensInterleavingSmokeTest and the `vmlens` profile both live in # srcmorph-maven-plugin/pom.xml (they were not relocated during the core # extraction — see CLAUDE.md) — scope directly to that module rather than the whole - # reactor. `-am` is required (not just an optimization): srcmorph is a reactor-local - # dependency, never published, so without `-am` this module's compile would fail trying - # to resolve net.ladenthin:srcmorph:1.1.0-SNAPSHOT from a remote repo. That in turn means + # reactor. `-am` is required (not just an optimization): this module depends on srcmorph at + # the reactor's own -SNAPSHOT version, and no repository this build resolves from carries a + # -SNAPSHOT (Maven Central holds releases only, and no snapshot is declared), so + # without `-am` its compile would fail trying to resolve that version. That in turn means # the `test` phase also runs for srcmorph, where -Dtest=VmlensInterleavingSmokeTest # matches no class — `-DfailIfNoTests=false` does NOT suppress that (it only covers "no # tests at all"); the actual guard for "the -Dtest pattern matched nothing" is diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 98e295b..2ffe907 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -43,6 +43,6 @@ jobs: retention-days: 5 - name: Upload to code-scanning - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4 + uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4 with: sarif_file: results.sarif diff --git a/CHANGELOG.md b/CHANGELOG.md index 596fc73..b91442a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,9 +12,16 @@ The release procedure (prompt template and step-by-step instructions) lives in [ ## [Unreleased] ### Changed +- Build tooling bumped in step with the sibling repositories: `anthropics/claude-code-action` v1.0.258 and + `github/codeql-action` v4.39.1. maven-clean-plugin 3.5.0, maven-resources-plugin 3.5.0, + maven-install-plugin 3.2.0, maven-deploy-plugin 3.2.0 and maven-dependency-plugin 3.11.0 are now declared, + in a new pluginManagement of the parent POM: no POM named them, so their versions came from whichever + Maven ran the build. Maven 3.9 runs clean 3.2.0, resources 3.3.1, install and deploy 3.1.x and dependency + 3.7.0; the Ubuntu runners' Maven 3.10.0 already matches, except that it leaves the dependency plugin to + the newest release. Resource output is byte-identical under resources 3.3.1 and 3.5.0. - Dependencies and build tooling bumped in step with the sibling repositories: Jackson 2.22.3 -> - 2.22.4 (the CLI's JSON/YAML configuration binding); `anthropics/claude-code-action` v1.0.255 and - Gradle 9.8.2 in the shared `verify-signing-key-gradle` job. + 2.22.4 (the CLI's JSON/YAML configuration binding) and Gradle 9.8.2 in the shared + `verify-signing-key-gradle` job. - **Build tooling: spotbugs-maven-plugin 4.10.4.1 -> 4.10.5.0** in all three modules, in step with the sibling repositories, and `checker-qual` 4.3.1 managed in the parent (it had stayed at 4.3.0 next to the 4.3.1 Checker Framework processor). With the SpotBugs bump, **Lombok-generated code carries JSpecify nullness** (`lombok.addNullAnnotations = jspecify` in the diff --git a/pom.xml b/pom.xml index 29dc0c4..3a72bcf 100644 --- a/pom.xml +++ b/pom.xml @@ -218,6 +218,46 @@ SPDX-License-Identifier: Apache-2.0 + + + + + + org.apache.maven.plugins + maven-clean-plugin + 3.5.0 + + + org.apache.maven.plugins + maven-resources-plugin + 3.5.0 + + + org.apache.maven.plugins + maven-install-plugin + 3.2.0 + + + org.apache.maven.plugins + maven-deploy-plugin + 3.2.0 + + + org.apache.maven.plugins + maven-dependency-plugin + 3.11.0 + + + + +