diff --git a/.github/plugin-it.sh b/.github/plugin-it.sh
index f807f23..3eb710b 100755
--- a/.github/plugin-it.sh
+++ b/.github/plugin-it.sh
@@ -181,6 +181,7 @@ EXPECTED_PROPS="$(printf '%s\n' \
srcmorph.llama.modelPath \
srcmorph.llama.temperature \
srcmorph.llama.threads \
+ srcmorph.modelDirectory \
srcmorph.outputDirectory \
srcmorph.package.skip \
srcmorph.planOnly \
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f58243f..baba73a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -18,7 +18,7 @@ permissions:
jobs:
analyze:
- uses: bernardladenthin/actions/.github/workflows/java-codeql.yml@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ uses: bernardladenthin/actions/.github/workflows/java-codeql.yml@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
permissions:
actions: read
contents: read
diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml
index f031c53..bdc9751 100644
--- a/.github/workflows/dependency-submission.yml
+++ b/.github/workflows/dependency-submission.yml
@@ -16,6 +16,6 @@ permissions:
jobs:
submit:
- uses: bernardladenthin/actions/.github/workflows/java-maven-dependency-submission.yml@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ uses: bernardladenthin/actions/.github/workflows/java-maven-dependency-submission.yml@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
permissions:
contents: write
diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
index 474ad01..3c47a06 100644
--- a/.github/workflows/osv-scanner.yml
+++ b/.github/workflows/osv-scanner.yml
@@ -19,7 +19,7 @@ permissions:
jobs:
scan:
- uses: bernardladenthin/actions/.github/workflows/osv-scanner.yml@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ uses: bernardladenthin/actions/.github/workflows/osv-scanner.yml@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
permissions:
actions: read
contents: read
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ab328b2..14ae77d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -77,19 +77,19 @@ jobs:
with:
persist-credentials: false
- name: Files equal their templates in bernardladenthin/actions
- uses: bernardladenthin/actions/common/check-templates@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ uses: bernardladenthin/actions/common/check-templates@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
# This repository's own build checks build on actionlib (the setup step puts it on PYTHONPATH).
- - uses: bernardladenthin/actions/common/setup@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ - uses: bernardladenthin/actions/common/setup@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
- name: Build-check tests of this repository
run: python3 -m unittest discover -s .github/buildcheck/tests -t .github
- name: Release gate (every job gates both publish jobs, or release-gate-exemptions.txt says why)
- uses: bernardladenthin/actions/common/check-release-gate@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ uses: bernardladenthin/actions/common/check-release-gate@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
- name: Run scripts parse (bash -n over every bash run script of the workflows and actions)
- uses: bernardladenthin/actions/common/check-run-scripts@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ uses: bernardladenthin/actions/common/check-run-scripts@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
- name: Maven versions (warns where a dependency or plugin differs from a sibling repository)
- uses: bernardladenthin/actions/java/check-maven-versions@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ uses: bernardladenthin/actions/java/check-maven-versions@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
- name: Publication wiring and release asset contract (dry run)
- uses: bernardladenthin/actions/java/check-publication@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ uses: bernardladenthin/actions/java/check-publication@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
# ---------------------------------------------------------------------------
# GPG signing-key preflight (standalone, no `needs:` -- runs in parallel at the
@@ -105,7 +105,7 @@ jobs:
runs-on: ubuntu-latest
environment: maven-central
steps:
- - uses: bernardladenthin/actions/common/verify-gpg-key@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ - uses: bernardladenthin/actions/common/verify-gpg-key@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
with:
private-key: ${{ secrets.GPG_PRIVATE_KEY }}
passphrase: ${{ secrets.GPG_PASSPHRASE }}
@@ -125,7 +125,7 @@ jobs:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
with:
persist-credentials: false
- - uses: bernardladenthin/actions/java/verify-signing-key-gradle@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ - uses: bernardladenthin/actions/java/verify-signing-key-gradle@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
with:
private-key: ${{ secrets.GPG_PRIVATE_KEY }}
passphrase: ${{ secrets.GPG_PASSPHRASE }}
@@ -180,7 +180,7 @@ jobs:
cache: maven
# srcmorph-cli runs the license collector of bernardladenthin/actions while packaging
# (ACTIONS_DIR, exported here).
- - uses: bernardladenthin/actions/common/setup@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ - uses: bernardladenthin/actions/common/setup@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
- name: Build
run: mvn --batch-mode --no-transfer-progress -DskipTests package
- uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
@@ -203,12 +203,15 @@ jobs:
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- name: Display CPU Info
- uses: bernardladenthin/actions/common/print-host-info@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ uses: bernardladenthin/actions/common/print-host-info@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
- uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
with:
java-version-file: .java-version
distribution: temurin
cache: maven
+ # `verify` packages srcmorph-cli, whose license collector comes from bernardladenthin/actions
+ # (ACTIONS_DIR, exported here) -- as in `build`.
+ - uses: bernardladenthin/actions/common/setup@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
- name: Memory before tests
run: free -h
- name: Test
@@ -240,7 +243,7 @@ jobs:
# Echo the crash logs into the job log (workspace/policies/ci-test-diagnostics.md 3.1).
- name: Print crash logs (on failure)
if: failure()
- uses: bernardladenthin/actions/java/print-crash-logs@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ uses: bernardladenthin/actions/java/print-crash-logs@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
with:
modules: srcmorph srcmorph-cli srcmorph-maven-plugin
- name: Upload crash & surefire dumps
@@ -286,7 +289,7 @@ jobs:
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- name: Display CPU Info
- uses: bernardladenthin/actions/common/print-host-info@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ uses: bernardladenthin/actions/common/print-host-info@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
- uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
with: { java-version-file: .java-version, distribution: temurin, cache: maven }
- name: Test under vmlens (one class — staged scope)
@@ -349,13 +352,13 @@ jobs:
# jar; module-info.class and META-INF/versions/** are skipped unconditionally because a
# classpath JVM never loads them. The java/verify-bytecode action of bernardladenthin/actions.
- name: Verify Java 8 bytecode (no class newer than major 52)
- uses: bernardladenthin/actions/java/verify-bytecode@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ uses: bernardladenthin/actions/java/verify-bytecode@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
with:
max-major: "52"
paths: |
fatjar
- name: Run fat-jar smoke test
- uses: bernardladenthin/actions/java/smoke-fatjar-cli@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ uses: bernardladenthin/actions/java/smoke-fatjar-cli@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
with:
jar-dir: fatjar
jar-glob: 'srcmorph-cli-*-jar-with-dependencies.jar'
@@ -481,7 +484,7 @@ jobs:
# a release is tagged on.
- name: Require a SNAPSHOT version
if: inputs.publish_to_central
- uses: bernardladenthin/actions/java/check-release-ref@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ uses: bernardladenthin/actions/java/check-release-ref@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
with:
channel: snapshot
@@ -496,7 +499,7 @@ jobs:
persist-credentials: false
# The tag names exactly the project version (v1.2.3 for 1.2.3), which is no SNAPSHOT.
- name: Require the release version the tag names
- uses: bernardladenthin/actions/java/check-release-ref@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ uses: bernardladenthin/actions/java/check-release-ref@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
with:
channel: release
@@ -539,7 +542,7 @@ jobs:
esac
# srcmorph-cli runs the license collector of bernardladenthin/actions while packaging
# (ACTIONS_DIR, exported here).
- - uses: bernardladenthin/actions/common/setup@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ - uses: bernardladenthin/actions/common/setup@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
- name: Show effective POM (debug)
run: mvn --batch-mode --no-transfer-progress -P release -DskipUpload=true help:effective-pom
- name: Stage snapshot
@@ -586,7 +589,7 @@ jobs:
bash .github/verify-classifier-fatjars.sh fatjar-assets "${CLASSIFIERS[@]}"
- name: Finalize and secure the signed publication
id: finalize
- uses: bernardladenthin/actions/java/finalize-publication@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ uses: bernardladenthin/actions/java/finalize-publication@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
with:
channel: snapshot
maven-assets: central-assets
@@ -603,7 +606,7 @@ jobs:
permissions:
contents: write
steps:
- - uses: bernardladenthin/actions/java/publish-github@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ - uses: bernardladenthin/actions/java/publish-github@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
with:
channel: snapshot
assets-complete: ${{ needs.publish-snapshot.outputs.assets_complete }}
@@ -639,7 +642,7 @@ jobs:
gpg-passphrase: MAVEN_GPG_PASSPHRASE
# srcmorph-cli runs the license collector of bernardladenthin/actions while packaging
# (ACTIONS_DIR, exported here).
- - uses: bernardladenthin/actions/common/setup@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ - uses: bernardladenthin/actions/common/setup@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
- name: Show effective POM (debug)
run: mvn --batch-mode --no-transfer-progress -P release -DskipUpload=true help:effective-pom
- name: Stage release
@@ -686,7 +689,7 @@ jobs:
bash .github/verify-classifier-fatjars.sh fatjar-assets "${CLASSIFIERS[@]}"
- name: Finalize and secure the signed publication
id: finalize
- uses: bernardladenthin/actions/java/finalize-publication@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ uses: bernardladenthin/actions/java/finalize-publication@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
with:
channel: release
maven-assets: central-assets
@@ -700,7 +703,7 @@ jobs:
permissions:
contents: write
steps:
- - uses: bernardladenthin/actions/java/publish-github@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ - uses: bernardladenthin/actions/java/publish-github@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
with:
channel: release
assets-complete: ${{ needs.publish-release.outputs.assets_complete }}
@@ -725,7 +728,7 @@ jobs:
with:
persist-credentials: false
- name: Transfer frozen artifacts (no rebuild, signing or validation polling)
- uses: bernardladenthin/actions/java/publish-central@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ uses: bernardladenthin/actions/java/publish-central@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
with:
channel: snapshot
assets-complete: ${{ needs.publish-snapshot.outputs.assets_complete }}
@@ -746,7 +749,7 @@ jobs:
with:
persist-credentials: false
- name: Transfer frozen artifacts (no rebuild, signing or validation polling)
- uses: bernardladenthin/actions/java/publish-central@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ uses: bernardladenthin/actions/java/publish-central@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
with:
channel: release
assets-complete: ${{ needs.publish-release.outputs.assets_complete }}
@@ -764,7 +767,7 @@ jobs:
id-token: write
attestations: write
steps:
- - uses: bernardladenthin/actions/java/attest-publication@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ - uses: bernardladenthin/actions/java/attest-publication@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
with:
channel: snapshot
assets-complete: ${{ needs.publish-snapshot.outputs.assets_complete }}
@@ -780,7 +783,7 @@ jobs:
id-token: write
attestations: write
steps:
- - uses: bernardladenthin/actions/java/attest-publication@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ - uses: bernardladenthin/actions/java/attest-publication@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
with:
channel: release
assets-complete: ${{ needs.publish-release.outputs.assets_complete }}
diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml
index ac8738a..b467713 100644
--- a/.github/workflows/reuse.yml
+++ b/.github/workflows/reuse.yml
@@ -14,4 +14,4 @@ permissions:
jobs:
test:
- uses: bernardladenthin/actions/.github/workflows/reuse.yml@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ uses: bernardladenthin/actions/.github/workflows/reuse.yml@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml
index 2d8c50a..5816840 100644
--- a/.github/workflows/sonarqube.yml
+++ b/.github/workflows/sonarqube.yml
@@ -18,6 +18,6 @@ permissions:
jobs:
build:
- uses: bernardladenthin/actions/.github/workflows/java-sonarqube.yml@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
+ uses: bernardladenthin/actions/.github/workflows/java-sonarqube.yml@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0
secrets:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c03fed1..1e988df 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,7 +12,9 @@ The release procedure (prompt template and step-by-step instructions) lives in [
## [Unreleased]
### Changed
-- **`bernardladenthin/actions` pinned at v1.0.3.** v1.0.3 makes the snapshot publication survive
+- **`bernardladenthin/actions` pinned at v1.1.0.** v1.1.0 adds `java/audit-publication`, an audit of a
+ published release from the outside (not used here yet); nothing changes for the actions in use.
+ v1.0.3 before it made the snapshot publication survive
GitHub: the Central snapshot transfer lists the jobs of older runs 50 per page and repeats GitHub
reads on a server error, and a refused move of the `snapshot` tag deletes and re-creates it (both
failed in java-llama.cpp's first snapshot dispatch on v1.0.1). v1.0.2 before it carried a
@@ -54,6 +56,15 @@ The release procedure (prompt template and step-by-step instructions) lives in [
directory unless the entry was edited.
### Fixed
+- **Two CI defects that the unresolvable llama 6.0.0 had hidden.** Until 6.0.0 reached Central, every
+ run stopped at the first Maven step. The first run that resolved it (srcmorph#243) went further and
+ found two more:
+ - The `Test` job runs `verify`, which packages `srcmorph-cli` and runs its license collector from
+ bernardladenthin/actions. Unlike `build`, the job had no `common/setup`, so `ACTIONS_DIR` was
+ unset and the collector stopped the build. The job now runs `common/setup` too.
+ - The plugin integration test compares the descriptor's `srcmorph.*` properties both ways against
+ a deliberate list. `srcmorph.modelDirectory`, added with the model-directory resolution, was
+ never added to that list. It is listed now, and all six steps pass locally (20 properties).
- **`srcmorph-cli` could not be built on Windows at all.** The `collect-runtime-licenses` execution passes a
one-line Python program to `python3 -c`, and `exec-maven-plugin` drops the double quotes out of that
argument on Windows: `find_spec("actionlib")` reached Python as `find_spec(actionlib)`, so every
@@ -70,7 +81,7 @@ The release procedure (prompt template and step-by-step instructions) lives in [
- **...and that fix left `spotbugs:check` red.** SpotBugs reports `VA_FORMAT_STRING_USES_NEWLINE` for every
`String.format` pattern containing `\n` and asks for `%n` — the platform separator this block must not
carry, so the rule and the requirement are in direct conflict. Nothing could have shown it: the reactor
- still dies earlier on the unresolvable `net.ladenthin:llama:6.0.0` (see `TODO.md`), so no CI run reaches
+ still died earlier on the then unresolvable `net.ladenthin:llama:6.0.0`, so no CI run reached
SpotBugs, and `main` was red on a check that never executed. `appendPasteBlock` appends the newline as a
literal through a new `appendXmlNumber` helper now — the shape `appendJsonNumber`/`appendYamlNumber`
already use for the same reason — and formats the numbers at the call site through the `FORMAT_*` constants
diff --git a/TODO.md b/TODO.md
index 844651c..fd0c1a3 100644
--- a/TODO.md
+++ b/TODO.md
@@ -10,21 +10,6 @@ everything below is genuinely still open.
## Open
-- **`main` does not build until `net.ladenthin:llama` 6.0.0 is released.** `srcmorph/pom.xml` pins
- `6.0.0` (`b710796`; jllama renumbered its next release from 5.2.0 to
- 6.0.0), and Central's newest is still `5.1.0`
- (`llama-6.0.0.pom` is HTTP 404, checked 2026-10-20). This reactor declares no repository besides
- Central, so every CI run is red at the first Maven step until that release exists. It passes locally
- wherever an earlier `mvn install` of java-llama.cpp left the version in `~/.m2`; reproduce the real
- state with `mvn -Dmaven.repo.local=/tmp/empty dependency:get -Dartifact=net.ladenthin:llama:6.0.0`.
- **Reverting is not an option**: the pom comment explains why 6.0.0 is a breaking bump this module
- needs (the binding removed `enableFlashAttn()`/`FLASH_ATTN` and renamed `setTensorReadLazy` to
- `setLazyMode`; the provider uses the new forms, so it cannot compile against 5.1.0), and the reactor additionally depends on 6.0.0's
- natives-jar split (`net.ladenthin:llama-platform`, GPU natives jars via `-Dllama.classifier`). Against a locally installed snapshot of it
- (`-Dllama.version=-SNAPSHOT install`, measured under the old 5.2.0 number) the whole reactor was
- green, so the jllama release is the
- only thing missing -- this item closes with it, nothing to change here.
-
- **The GPU classifier fat jars are verified structurally, never launched.** Since 1.2.0
`.github/verify-classifier-fatjars.sh` asserts each is the artifact its name claims (one jar per
classifier, the promised backend directory next to the default CPU natives, so a broken
diff --git a/srcmorph/pom.xml b/srcmorph/pom.xml
index f894bf2..2a6c6cd 100644
--- a/srcmorph/pom.xml
+++ b/srcmorph/pom.xml
@@ -59,9 +59,9 @@ SPDX-License-Identifier: Apache-2.0
This deliberately names the RELEASE, not 6.0.0-SNAPSHOT: a snapshot would need a
entry for the Central snapshot channel (this repo declares none; the
distributionManagement/snapshotRepository below is deploy-only) AND would block every
- srcmorph release, since Central rejects a release with a -SNAPSHOT dependency. The
- build therefore stays red until net.ladenthin:llama:6.0.0 is published, and goes green
- with no further edit the moment it is. -->
+ srcmorph release, since Central rejects a release with a -SNAPSHOT dependency. Until
+ net.ladenthin:llama:6.0.0 reached Central (2026-10-25) every CI run was red at the first
+ Maven step; with it the reactor builds from an empty local repository. -->
6.0.0
6.1.3
3.0