diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f58243f..baba73a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,7 +18,7 @@ permissions: jobs: analyze: - uses: bernardladenthin/actions/.github/workflows/java-codeql.yml@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/.github/workflows/java-codeql.yml@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 permissions: actions: read contents: read diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml index f031c53..bdc9751 100644 --- a/.github/workflows/dependency-submission.yml +++ b/.github/workflows/dependency-submission.yml @@ -16,6 +16,6 @@ permissions: jobs: submit: - uses: bernardladenthin/actions/.github/workflows/java-maven-dependency-submission.yml@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/.github/workflows/java-maven-dependency-submission.yml@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 permissions: contents: write diff --git a/.github/workflows/formal-verification.yml b/.github/workflows/formal-verification.yml index 882f9c6..9c3a705 100644 --- a/.github/workflows/formal-verification.yml +++ b/.github/workflows/formal-verification.yml @@ -89,7 +89,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Display CPU Info - uses: bernardladenthin/actions/common/print-host-info@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/common/print-host-info@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version @@ -144,7 +144,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Display CPU Info - uses: bernardladenthin/actions/common/print-host-info@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/common/print-host-info@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version @@ -226,7 +226,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Display CPU Info - uses: bernardladenthin/actions/common/print-host-info@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/common/print-host-info@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: # 25 builds the repo's Java-8 production classes (matching the shipped bytecode); diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index 474ad01..3c47a06 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -19,7 +19,7 @@ permissions: jobs: scan: - uses: bernardladenthin/actions/.github/workflows/osv-scanner.yml@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/.github/workflows/osv-scanner.yml@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 permissions: actions: read contents: read diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index bd561dd..585a5a4 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -77,15 +77,15 @@ jobs: with: persist-credentials: false - name: Files equal their templates in bernardladenthin/actions - uses: bernardladenthin/actions/common/check-templates@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/common/check-templates@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 - name: Release gate (every job gates both publish jobs, or release-gate-exemptions.txt says why) - uses: bernardladenthin/actions/common/check-release-gate@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/common/check-release-gate@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 - name: Run scripts parse (bash -n over every bash run script of the workflows and actions) - uses: bernardladenthin/actions/common/check-run-scripts@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/common/check-run-scripts@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 - name: Maven versions (warns where a dependency or plugin differs from a sibling repository) - uses: bernardladenthin/actions/java/check-maven-versions@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/java/check-maven-versions@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 - name: Publication wiring and release asset contract (dry run) - uses: bernardladenthin/actions/java/check-publication@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/java/check-publication@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 # --------------------------------------------------------------------------- # GPG signing-key preflight (standalone, no `needs:` -- runs in parallel at the @@ -101,7 +101,7 @@ jobs: runs-on: ubuntu-latest environment: maven-central steps: - - uses: bernardladenthin/actions/common/verify-gpg-key@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + - uses: bernardladenthin/actions/common/verify-gpg-key@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 with: private-key: ${{ secrets.GPG_PRIVATE_KEY }} passphrase: ${{ secrets.GPG_PASSPHRASE }} @@ -121,7 +121,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - - uses: bernardladenthin/actions/java/verify-signing-key-gradle@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + - uses: bernardladenthin/actions/java/verify-signing-key-gradle@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 with: private-key: ${{ secrets.GPG_PRIVATE_KEY }} passphrase: ${{ secrets.GPG_PASSPHRASE }} @@ -135,7 +135,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - - uses: bernardladenthin/actions/java/maven-code-style@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + - uses: bernardladenthin/actions/java/maven-code-style@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 with: package-pattern: 'net\.ladenthin\.' @@ -186,7 +186,7 @@ jobs: # unconditionally because a classpath JVM never loads them. Runs before the smoke test so an # unloadable class is reported as such instead of as a mysterious smoke failure. - name: Verify Java 8 bytecode (no class newer than major 52) - uses: bernardladenthin/actions/java/verify-bytecode@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/java/verify-bytecode@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 with: max-major: "52" paths: | @@ -201,7 +201,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Display CPU Info - uses: bernardladenthin/actions/common/print-host-info@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/common/print-host-info@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version @@ -222,7 +222,7 @@ jobs: # Echo the crash logs into the job log (workspace/policies/ci-test-diagnostics.md 3.1). - name: Print crash logs (on failure) if: failure() - uses: bernardladenthin/actions/java/print-crash-logs@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/java/print-crash-logs@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 with: modules: . - name: Upload crash & surefire dumps @@ -246,7 +246,7 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Display CPU Info - uses: bernardladenthin/actions/common/print-host-info@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/common/print-host-info@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: { java-version-file: .java-version, distribution: temurin, cache: maven } - name: Test under vmlens @@ -331,7 +331,7 @@ jobs: # a release is tagged on. - name: Require a SNAPSHOT version if: inputs.publish_to_central - uses: bernardladenthin/actions/java/check-release-ref@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/java/check-release-ref@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 with: channel: snapshot @@ -346,7 +346,7 @@ jobs: persist-credentials: false # The tag names exactly the project version (v1.2.3 for 1.2.3), which is no SNAPSHOT. - name: Require the release version the tag names - uses: bernardladenthin/actions/java/check-release-ref@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/java/check-release-ref@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 with: channel: release @@ -394,7 +394,7 @@ jobs: MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} - name: Finalize and secure the signed publication id: finalize - uses: bernardladenthin/actions/java/finalize-publication@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/java/finalize-publication@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 with: channel: snapshot @@ -410,7 +410,7 @@ jobs: permissions: contents: write steps: - - uses: bernardladenthin/actions/java/publish-github@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + - uses: bernardladenthin/actions/java/publish-github@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 with: channel: snapshot assets-complete: ${{ needs.publish-snapshot.outputs.assets_complete }} @@ -451,7 +451,7 @@ jobs: MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} - name: Finalize and secure the signed publication id: finalize - uses: bernardladenthin/actions/java/finalize-publication@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/java/finalize-publication@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 with: channel: release @@ -464,7 +464,7 @@ jobs: permissions: contents: write steps: - - uses: bernardladenthin/actions/java/publish-github@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + - uses: bernardladenthin/actions/java/publish-github@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 with: channel: release assets-complete: ${{ needs.publish-release.outputs.assets_complete }} @@ -489,7 +489,7 @@ jobs: with: persist-credentials: false - name: Transfer frozen artifacts (no rebuild, signing or validation polling) - uses: bernardladenthin/actions/java/publish-central@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/java/publish-central@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 with: channel: snapshot assets-complete: ${{ needs.publish-snapshot.outputs.assets_complete }} @@ -510,7 +510,7 @@ jobs: with: persist-credentials: false - name: Transfer frozen artifacts (no rebuild, signing or validation polling) - uses: bernardladenthin/actions/java/publish-central@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/java/publish-central@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 with: channel: release assets-complete: ${{ needs.publish-release.outputs.assets_complete }} @@ -528,7 +528,7 @@ jobs: id-token: write attestations: write steps: - - uses: bernardladenthin/actions/java/attest-publication@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + - uses: bernardladenthin/actions/java/attest-publication@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 with: channel: snapshot assets-complete: ${{ needs.publish-snapshot.outputs.assets_complete }} @@ -544,7 +544,7 @@ jobs: id-token: write attestations: write steps: - - uses: bernardladenthin/actions/java/attest-publication@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + - uses: bernardladenthin/actions/java/attest-publication@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 with: channel: release assets-complete: ${{ needs.publish-release.outputs.assets_complete }} diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml index ac8738a..b467713 100644 --- a/.github/workflows/reuse.yml +++ b/.github/workflows/reuse.yml @@ -14,4 +14,4 @@ permissions: jobs: test: - uses: bernardladenthin/actions/.github/workflows/reuse.yml@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/.github/workflows/reuse.yml@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml index 2d8c50a..5816840 100644 --- a/.github/workflows/sonarqube.yml +++ b/.github/workflows/sonarqube.yml @@ -18,6 +18,6 @@ permissions: jobs: build: - uses: bernardladenthin/actions/.github/workflows/java-sonarqube.yml@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3 + uses: bernardladenthin/actions/.github/workflows/java-sonarqube.yml@44390bd464395f560f4170d2c4bfb7a6348541b3 # v1.1.0 secrets: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} diff --git a/CHANGELOG.md b/CHANGELOG.md index 808290d..984d2d5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,7 +8,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] ### Changed -- **`bernardladenthin/actions` pinned at v1.0.3.** v1.0.3 makes the snapshot publication survive +- **`bernardladenthin/actions` pinned at v1.1.0.** v1.1.0 adds `java/audit-publication`, an audit of a + published release from the outside (not used here yet); nothing changes for the actions in use. + v1.0.3 before it made the snapshot publication survive GitHub: the Central snapshot transfer lists the jobs of older runs 50 per page and repeats GitHub reads on a server error, and a refused move of the `snapshot` tag deletes and re-creates it (both failed in java-llama.cpp's first snapshot dispatch on v1.0.1). v1.0.2 before it carried a