From 4d10b62663ab6080d5023d618cbadda8a13b24a1 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 15 Oct 2026 13:42:32 +0000 Subject: [PATCH 1/4] Pin every GitHub Action to a commit SHA Every uses: reference carries the commit the tag resolved to, with the tag in a comment; Dependabot keeps them current. Kept byte-identical with the sibling repositories (shared-files.sha256 rewritten). Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01MjAMq3jnoveX5dcvLGhNQw --- .github/shared-files.sha256 | 24 +++---- .github/workflows/claude-code-review.yml | 4 +- .github/workflows/claude.yml | 4 +- .github/workflows/codeql.yml | 8 +-- .github/workflows/measurement-tools.yml | 4 +- .github/workflows/osv-scanner.yml | 4 +- .github/workflows/publish.yml | 84 ++++++++++++------------ .github/workflows/reuse.yml | 4 +- .github/workflows/scorecard.yml | 8 +-- .github/workflows/sonarqube.yml | 8 +-- 10 files changed, 76 insertions(+), 76 deletions(-) diff --git a/.github/shared-files.sha256 b/.github/shared-files.sha256 index d499e942..c2306c5f 100644 --- a/.github/shared-files.sha256 +++ b/.github/shared-files.sha256 @@ -49,23 +49,23 @@ c47fad91718bf42aac298f569dcb8d0e36c81987f8706952d0637fb34ec1a1b5 .github/FUNDIN e8f444ef851bd134330f1505f52b4b0970ef9a62dd76e4c25829241814ba5c73 .github/ISSUE_TEMPLATE/config.yml?repo 46fc025df0fd7b1bdbd84b875652ce9981aec87c2bb49b9263ae8c383cf7ce5a .mvn/settings.xml 8b8abf79508c4f53b2e765b78d6142655631d5ed69b59e95f234416a62e057b6 CITATION.cff?repo -7ed2f843a5187d3cdc1ba9841cb737ecabfb86dea638a314f890c70409dfea96 .github/workflows/publish.yml#code-style +9a24b2a67ab8e6f52016093e9b6a89796adea29887b7820accede06cc0c0d170 .github/workflows/publish.yml#code-style 6e2ae11dad0616f66bbb2b6e6556f580bb987fd911d7132aa6bee2bfc7cc7b52 .java-version 71ec85b7a30e80b18a9ab1fac0199cc50d68548e6f00dd116ab0f904ad63aa50 .java-version.license -bee58687456c0695990a925ac50a2c17b71768a8ef493b584d7ac679debed7b9 .github/workflows/claude.yml -19ccc3d4f0aef292c19883d4766a0193e9a3e998514f461df6609ccf65a19492 .github/workflows/claude-code-review.yml -13ada38d1cd8d06b5098aab0ee996429156a2251daa11fb331c02248b7e6a40e .github/workflows/scorecard.yml -c0e9885eaab7a660fe2c236e3f10df284a6b2f42dad9ce59084a2d7ab00aa9cf .github/workflows/reuse.yml -f3b1a0864200236c61a5807b1e59236d474431a27695cd9d977bc6636d582667 .github/workflows/osv-scanner.yml -2c43a2b7f4352b7bb09b6e487256ba74c18c170394946b0303b116c88f7b851c .github/workflows/codeql.yml +3f73b87c4675376cbe80f1fb914bd7020062dcdb9a7ee503d3ef787fd462358a .github/workflows/claude.yml +085f19495d9e0812dc90268ea7917579bd6eaf749c669a9f01922272a5cdf06f .github/workflows/claude-code-review.yml +463c34f6244675ee5bee3d28c28c84f5eb3c8bea4f45de3f6ce477348d29589c .github/workflows/scorecard.yml +480afc0c1e41f3997b195d7297750b43599ba71a7471657aa32bfc9662b6fd30 .github/workflows/reuse.yml +cf75cdc06e5ab02359c12b6a8eecb97f2dd3d95502cd2b397d539584cefa56c3 .github/workflows/osv-scanner.yml +4ede8b606ec0cd83937a8723ffc8c122f3be7d4aef56db7e1c20fb84b4345985 .github/workflows/codeql.yml c9e757f2d0a2f456a08791697a94161c776d9b008a8aa75890da4133c81a99e9 .github/dependabot.yml abea5fb970a46ccf9ba9127d59abf304202efd13c2d6a28da2ff75da0c92a9b8 .github/smoke-fatjar-cli.sh c38151495be64cedc3f11c23b88ffc53f4e0f9d2ce5c0aaaa42b14e4af7e13ec lombok.config f26d05f25a154b84d8f281bb92857811749e2225cdbc167362de930c48b532d1 .github/workflows/publish.yml#startgate -89738e9b6939e31a452ea7d40adb6514c89e6209ed57fd4d574c8ba047f11e36 .github/workflows/publish.yml#shared-files -fcb6cd0e2a71205b918f545f2680d378c790b774b9852129c5f9c7f3f8eb9860 .github/workflows/publish.yml#verify-signing-key +e3dde66089fd568f03caeefee86ea36a9f6eb7f47e5dc6d053e0e5784fd7a208 .github/workflows/publish.yml#shared-files +3ef45f189f4419e0d4087f572b3c1b6085c0fe39ac7979b07deb2e882f7ffe8c .github/workflows/publish.yml#verify-signing-key 09230b04c5f14bdda50a0c862152ff197a656cbc3fd0d110899c5f8150f8aa9a .github/workflows/publish.yml#check-snapshot 51e987d59efd9887b43e345edc0e0f3db21686879e3ca6ea9f0fdbc493d37121 .github/workflows/publish.yml#check-tag -a8637f88765da759a6eaba243d0d0d695053174df581ccbbcc5e5f3a475fc9e9 .github/workflows/publish.yml#verify-signing-key-gradle -83a1288c55d35e4d3972e013009577fb594a9a5fb8b9b7c96a7f6a19db20d8d1 .github/workflows/publish.yml#github-snapshot -ce90d90fcb1f2de35075b91c74411e9eb7d3b43e7965fd592744e914fd04c5db .github/workflows/publish.yml#github-release +06f0af70ed125dc5cc1506e27970059fb831971d3faaee56f868789f3282fdf9 .github/workflows/publish.yml#verify-signing-key-gradle +c2684a3f93aaf552c13f845307536c2a14dda315c7d7b1e416bc66951b811dc1 .github/workflows/publish.yml#github-snapshot +c09a030706dbea4221851ca0fcbfa6fc686165b408724724ade61724da6e123b .github/workflows/publish.yml#github-release diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index c8bcb91a..5c777baa 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -19,13 +19,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 1 - name: Run Claude Code Review id: claude-review - uses: anthropics/claude-code-action@v1 + uses: anthropics/claude-code-action@a26b07d8c778b0c43f64618e5fd29fd0f8af72e8 # v1 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} prompt: | diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 60f20b8b..f9eac019 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -30,13 +30,13 @@ jobs: actions: read # Required for Claude to read CI results on PRs steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 1 - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@v1 + uses: anthropics/claude-code-action@a26b07d8c778b0c43f64618e5fd29fd0f8af72e8 # v1 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 596b1491..6c63cfbe 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,12 +18,12 @@ jobs: contents: read security-events: write steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: { java-version-file: .java-version, distribution: temurin } - - uses: github/codeql-action/init@v4 + - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4 with: { languages: java, queries: +security-and-quality } - name: Build with Maven run: mvn --batch-mode --no-transfer-progress compile - - uses: github/codeql-action/analyze@v4 + - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4 with: { category: "/language:java" } diff --git a/.github/workflows/measurement-tools.yml b/.github/workflows/measurement-tools.yml index 8c3887b0..15ce56a7 100644 --- a/.github/workflows/measurement-tools.yml +++ b/.github/workflows/measurement-tools.yml @@ -32,7 +32,7 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 # The version matters: register_machine.py is written for a contributor's own machine, so it # must keep working on whatever Python a distribution ships, not only on the newest. The matrix @@ -40,7 +40,7 @@ jobs: # October 2025) and the newest stable one -- that is what keeps the script working on both # ends rather than assumed. Move the lower bound up when it reaches end of life. - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index 6073bc8b..54644a8b 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -18,7 +18,7 @@ permissions: jobs: scan-scheduled: if: ${{ github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }} - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.6.0" + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc" # v2.6.0 permissions: actions: read contents: read @@ -26,7 +26,7 @@ jobs: scan-pr: if: ${{ github.event_name == 'pull_request' }} - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.6.0" + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc" # v2.6.0 permissions: actions: read contents: read diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 371dc3e2..9fe88ced 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -73,7 +73,7 @@ jobs: needs: startgate runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - name: Shared files match .github/shared-files.sha256 (siblings compared, warnings only) @@ -111,7 +111,7 @@ jobs: runs-on: ubuntu-latest environment: maven-central steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - name: Import key + run sign/verify self-test (prints only PUBLIC metadata) @@ -146,12 +146,12 @@ jobs: runs-on: ubuntu-latest environment: maven-central steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin - - uses: gradle/actions/setup-gradle@v6 + - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6 with: gradle-version: "9.8.1" - name: Sign a throwaway artifact via useInMemoryPgpKeys (BouncyCastle) @@ -187,8 +187,8 @@ jobs: needs: startgate runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin @@ -208,8 +208,8 @@ jobs: needs: startgate runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin @@ -235,14 +235,14 @@ jobs: # is produced+signed independently by the publish-release / publish-snapshot jobs (their # "Build & sign fat jar" step), not taken from this build job's upload-artifact. run: mvn --batch-mode --no-transfer-progress -P assembly -Dnet.ladenthin.bitcoinaddressfinder.disableLMDBTest=true -DskipTests -Dmaven.javadoc.skip=true package - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: { name: jars, path: target/*.jar } # Echo the crash logs into the job log (workspace/policies/ci-test-diagnostics.md 3.1). - name: Print crash logs (on failure) if: failure() shell: bash run: bash .github/print-crash-logs.sh . - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 if: always() with: name: build-surefire @@ -264,11 +264,11 @@ jobs: disable-lmdb: false runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Display CPU Info shell: bash run: bash .github/print-host-info.sh - - uses: actions/setup-java@v6 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin @@ -284,7 +284,7 @@ jobs: if: failure() shell: bash run: bash .github/print-crash-logs.sh . - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 if: always() with: name: surefire-and-crash-logs-${{ matrix.os }} @@ -295,7 +295,7 @@ jobs: - name: Memory after tests if: always() && runner.os == 'Linux' run: free -h - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 if: matrix.os == 'ubuntu-latest' with: name: jacoco-report @@ -315,7 +315,7 @@ jobs: echo "" fi done - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 if: always() && matrix.os == 'ubuntu-latest' with: { name: pit-reports, path: target/pit-reports/ } @@ -328,11 +328,11 @@ jobs: needs: [build] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Display CPU Info shell: bash run: bash .github/print-host-info.sh - - uses: actions/setup-java@v6 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin @@ -346,7 +346,7 @@ jobs: -Dtest=VmlensInterleavingSmokeTest,KeyProducerQueueBufferedInterleavingTest -DfailIfNoTests=false -Dnet.ladenthin.bitcoinaddressfinder.disableLMDBTest=true - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 if: always() with: name: vmlens-report @@ -393,11 +393,11 @@ jobs: needs: [build] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Display CPU Info shell: bash run: bash .github/print-host-info.sh - - uses: actions/setup-java@v6 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin @@ -423,7 +423,7 @@ jobs: - name: All tests including OpenCL (pocl) + JaCoCo coverage shell: bash run: mvn -e --batch-mode --no-transfer-progress -Dnet.ladenthin.bitcoinaddressfinder.disableLMDBTest=true --update-snapshots test jacoco:report - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: jacoco-report-opencl path: target/site/jacoco/jacoco.xml @@ -443,7 +443,7 @@ jobs: shopt -s nullglob echo "===== OpenCL surefire reports =====" for f in target/surefire-reports/*OpenCL*.txt; do [ -e "$f" ] && { echo "----- $f -----"; cat "$f"; }; done - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 if: always() with: name: surefire-and-crash-logs-opencl @@ -475,12 +475,12 @@ jobs: needs: [build] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/download-artifact@v8 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: jars path: fatjar/ - - uses: actions/setup-java@v6 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin @@ -499,7 +499,7 @@ jobs: examples 'Main#run end\.' config_AddressFilesToLMDB.json - name: Upload smoke logs if: failure() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: smoke-fatjar-logs path: | @@ -514,31 +514,31 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin # Prefer coverage from the pocl job: it runs ALL tests including @OpenCLTest # (the ubuntu `test` matrix skips those because no ICD is installed there, # so its jacoco-report shows 0% for the entire OpenCL pipeline). - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: { name: jacoco-report-opencl, path: target/site/jacoco/ } continue-on-error: true # Submits the dependency graph to GitHub. Informational: it says nothing about whether the # artifacts are correct, but it sits in the `report` job, which the release path needs -- so # without this flag a third-party action having a bad day can block a publish. - - uses: advanced-security/maven-dependency-submission-action@v6 + - uses: advanced-security/maven-dependency-submission-action@a64327a7329c9939cf675e458452febe1894a70c # v6 continue-on-error: true - name: Coveralls - uses: coverallsapp/github-action@v2 + uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2 with: github-token: ${{ secrets.GITHUB_TOKEN }} file: target/site/jacoco/jacoco.xml format: jacoco continue-on-error: true - name: Codecov - uses: codecov/codecov-action@v7 + uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7 with: token: ${{ secrets.CODECOV_TOKEN }} files: target/site/jacoco/jacoco.xml @@ -571,8 +571,8 @@ jobs: runs-on: ubuntu-latest environment: maven-central steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin @@ -646,7 +646,7 @@ jobs: # maven-gpg writes target/-.pom next to its .pom.asc; Central has both. cp target/*.pom signed-snapshot-assets/ 2>/dev/null || true cp target/*.pom.asc signed-snapshot-assets/ 2>/dev/null || true - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 if: ${{ !cancelled() }} with: name: signed-snapshot-assets @@ -663,7 +663,7 @@ jobs: permissions: contents: write steps: - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: signed-snapshot-assets path: snapshot-assets/ @@ -790,8 +790,8 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin @@ -852,7 +852,7 @@ jobs: # maven-gpg writes target/-.pom next to its .pom.asc; Central has both. cp target/*.pom signed-release-assets/ 2>/dev/null || true cp target/*.pom.asc signed-release-assets/ 2>/dev/null || true - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 if: ${{ !cancelled() }} with: name: signed-release-assets @@ -869,7 +869,7 @@ jobs: permissions: contents: write steps: - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: signed-release-assets path: release-assets/ @@ -904,7 +904,7 @@ jobs: [ "$missing" -eq 0 ] && echo "all $(echo "$artifacts" | wc -l) artifact(s) signed" exit 0 - name: Upload release assets - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3 with: files: release-assets/* - name: Fail if anything was attached unsigned diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml index a1e66bde..7d19b492 100644 --- a/.github/workflows/reuse.yml +++ b/.github/workflows/reuse.yml @@ -12,5 +12,5 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: fsfe/reuse-action@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 51cb023c..102f0cad 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -24,25 +24,25 @@ jobs: actions: read steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - name: Run analysis - uses: ossf/scorecard-action@v2.4.4 + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 with: results_file: results.sarif results_format: sarif publish_results: true - name: Upload artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: SARIF file path: results.sarif retention-days: 5 - name: Upload to code-scanning - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4 with: sarif_file: results.sarif diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml index e3ac3c47..a906a561 100644 --- a/.github/workflows/sonarqube.yml +++ b/.github/workflows/sonarqube.yml @@ -14,22 +14,22 @@ jobs: name: Build and analyze runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis - name: Set up JDK 21 - uses: actions/setup-java@v6 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: 'zulu' - name: Cache SonarQube packages - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 with: path: ~/.sonar/cache key: ${{ runner.os }}-sonar restore-keys: ${{ runner.os }}-sonar - name: Cache Maven packages - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 with: path: ~/.m2 key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} From 950f060fc9a6fd96ace873004451af794353e38b Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 15 Oct 2026 16:44:10 +0000 Subject: [PATCH 2/4] Shared files: versions.POMS names java-llama.cpp's new llama-ffm module Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01MjAMq3jnoveX5dcvLGhNQw --- .github/buildcheck/versions.py | 2 +- .github/shared-files.sha256 | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/buildcheck/versions.py b/.github/buildcheck/versions.py index 7b1270d8..58b6bfad 100644 --- a/.github/buildcheck/versions.py +++ b/.github/buildcheck/versions.py @@ -32,7 +32,7 @@ NS = "{http://maven.apache.org/POM/4.0.0}" POMS = { - "java-llama.cpp": ("pom.xml", "llama/pom.xml", "llama-langchain4j/pom.xml", "llama-kotlin/pom.xml", + "java-llama.cpp": ("pom.xml", "llama/pom.xml", "llama-langchain4j/pom.xml", "llama-kotlin/pom.xml", "llama-ffm/pom.xml", "llama-platform/pom.xml", "llama-atmosphere-agent/pom.xml", "examples/server/pom.xml"), "BitcoinAddressFinder": ("pom.xml",), "srcmorph": ("pom.xml", "srcmorph/pom.xml", "srcmorph-cli/pom.xml", "srcmorph-maven-plugin/pom.xml"), diff --git a/.github/shared-files.sha256 b/.github/shared-files.sha256 index c2306c5f..fea45c1e 100644 --- a/.github/shared-files.sha256 +++ b/.github/shared-files.sha256 @@ -22,7 +22,7 @@ cbe504ad081ba31ec16e11c11f879c64179ca7741bf0b1d1318a7fc969ed67dd .github/buildc fe36042fbd5444f0b454ad1304cdafde901dd8cec57cfaba7c7086d996dfee27 .github/buildcheck/tests/test_sharedfiles.py 7fe208dd33184b4543328f97b339c95e23c408b120e6bfa6095de4182aeb9a19 .github/check-release-gate.py 1604ccdea83998814a3c1f98f746272222039867b0c7d692355e61495c1c648b .github/check-shared-files.py -74b4b18af6c5be2af54048de408ec6e138f37f85b9f9ed2fdef258e270a7c90c .github/buildcheck/versions.py +ea373db1a28e16711110e50f1c2159e5d40b4e400fa22779883d1ce75971eb6e .github/buildcheck/versions.py de437064302f9314028afff00e17fc995e48869e07ee402206d23708c7ed355a .github/buildcheck/tests/test_versions.py 0c78f43dd181f079d35edde7cbf25bb22eac92c907845d8dc8eec78e812aa097 .github/check-versions.py 33c70847b6568604e8725d167a9b1d5910cc2a1a5b01fec7362be31b488ddb02 .github/buildcheck/runscripts.py From 4e84ab0d2720f6e7b3d0f68d2e9ad184babd4c87 Mon Sep 17 00:00:00 2001 From: Bernard Ladenthin Date: Thu, 15 Oct 2026 18:30:15 +0000 Subject: [PATCH 3/4] Sync the shared build-check test helper: upload() takes an overwrite flag java-llama.cpp's natives check now holds the job that re-uploads the Windows natives artifacts signed (`overwrite: true`); the shared helper that renders an upload-artifact step grew the parameter, kept byte-identical in the four repositories. No test here uses it yet. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01MjAMq3jnoveX5dcvLGhNQw --- .github/buildcheck/tests/helpers.py | 7 ++++--- .github/shared-files.sha256 | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/buildcheck/tests/helpers.py b/.github/buildcheck/tests/helpers.py index 375a8128..27c284ad 100644 --- a/.github/buildcheck/tests/helpers.py +++ b/.github/buildcheck/tests/helpers.py @@ -21,6 +21,7 @@ def workflow_text(jobs): return "\n".join(lines) + "\n" -def upload(artifact, path="x/"): - return [" - uses: actions/upload-artifact@v7", " with:", f" name: {artifact}", - f" path: {path}"] +def upload(artifact, path="x/", overwrite=False): + lines = [" - uses: actions/upload-artifact@v7", " with:", f" name: {artifact}", + f" path: {path}"] + return lines + [" overwrite: true"] if overwrite else lines diff --git a/.github/shared-files.sha256 b/.github/shared-files.sha256 index fea45c1e..32ca0823 100644 --- a/.github/shared-files.sha256 +++ b/.github/shared-files.sha256 @@ -16,7 +16,7 @@ 5a70eee1bb8af180edfd2a4bae61be61fac15b409f5df6a8bb9869425d7fc381 .github/buildcheck/releasegate.py ff2aaec95e53916ea340a0a291bf0f57e0011522aedb486622b1fb1cac136865 .github/buildcheck/sharedfiles.py 0059120aab539c6ce8055675ae0d3b040097f80320051e40385072f68845ddb0 .github/buildcheck/tests/__init__.py -561efd3f26d7728e475c8ce83c10b4761a6703b585b7b2a7ab052df10f73166c .github/buildcheck/tests/helpers.py +2e2afa80540545dc15770b41c3068504ca09287c3f2295d6197db7ec72c0412d .github/buildcheck/tests/helpers.py 4985f25fa177bd79a79335742adfd0da0431e101124b4e7e214906b56ae903de .github/buildcheck/tests/test_workflow.py cbe504ad081ba31ec16e11c11f879c64179ca7741bf0b1d1318a7fc969ed67dd .github/buildcheck/tests/test_releasegate.py fe36042fbd5444f0b454ad1304cdafde901dd8cec57cfaba7c7086d996dfee27 .github/buildcheck/tests/test_sharedfiles.py From 25610f8c7124b44a429f6bbbde362f785a12ffc3 Mon Sep 17 00:00:00 2001 From: Bernard Ladenthin Date: Thu, 15 Oct 2026 20:27:05 +0000 Subject: [PATCH 4/4] Sync shared files: codeql.yml installs a second JDK, the test helper renders if-no-files-found codeql.yml builds a whole reactor, and java-llama.cpp's reactor carries a module with a Java floor above .java-version (llama-ffm, Java 22 through maven-toolchains-plugin), so the shared workflow installs JDK 25 before the .java-version one -- harmless here, where no such module exists. The shared test helper's upload() also renders `if-no-files-found`, which java-llama.cpp's natives check now demands of its signed re-uploads. Both files are kept byte-identical in the four repositories. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01MjAMq3jnoveX5dcvLGhNQw --- .github/buildcheck/tests/helpers.py | 8 ++++++-- .github/shared-files.sha256 | 4 ++-- .github/workflows/codeql.yml | 6 ++++++ 3 files changed, 14 insertions(+), 4 deletions(-) diff --git a/.github/buildcheck/tests/helpers.py b/.github/buildcheck/tests/helpers.py index 27c284ad..6e1a4bbf 100644 --- a/.github/buildcheck/tests/helpers.py +++ b/.github/buildcheck/tests/helpers.py @@ -21,7 +21,11 @@ def workflow_text(jobs): return "\n".join(lines) + "\n" -def upload(artifact, path="x/", overwrite=False): +def upload(artifact, path="x/", overwrite=False, if_no_files_found=None): lines = [" - uses: actions/upload-artifact@v7", " with:", f" name: {artifact}", f" path: {path}"] - return lines + [" overwrite: true"] if overwrite else lines + if overwrite: + lines.append(" overwrite: true") + if if_no_files_found: + lines.append(f" if-no-files-found: {if_no_files_found}") + return lines diff --git a/.github/shared-files.sha256 b/.github/shared-files.sha256 index 32ca0823..18d4783e 100644 --- a/.github/shared-files.sha256 +++ b/.github/shared-files.sha256 @@ -16,7 +16,7 @@ 5a70eee1bb8af180edfd2a4bae61be61fac15b409f5df6a8bb9869425d7fc381 .github/buildcheck/releasegate.py ff2aaec95e53916ea340a0a291bf0f57e0011522aedb486622b1fb1cac136865 .github/buildcheck/sharedfiles.py 0059120aab539c6ce8055675ae0d3b040097f80320051e40385072f68845ddb0 .github/buildcheck/tests/__init__.py -2e2afa80540545dc15770b41c3068504ca09287c3f2295d6197db7ec72c0412d .github/buildcheck/tests/helpers.py +a7af59d075b41c2dc9cce1facef527f96fc127b4e26e2ba7986a6e3f51a71e29 .github/buildcheck/tests/helpers.py 4985f25fa177bd79a79335742adfd0da0431e101124b4e7e214906b56ae903de .github/buildcheck/tests/test_workflow.py cbe504ad081ba31ec16e11c11f879c64179ca7741bf0b1d1318a7fc969ed67dd .github/buildcheck/tests/test_releasegate.py fe36042fbd5444f0b454ad1304cdafde901dd8cec57cfaba7c7086d996dfee27 .github/buildcheck/tests/test_sharedfiles.py @@ -57,7 +57,7 @@ e8f444ef851bd134330f1505f52b4b0970ef9a62dd76e4c25829241814ba5c73 .github/ISSUE_ 463c34f6244675ee5bee3d28c28c84f5eb3c8bea4f45de3f6ce477348d29589c .github/workflows/scorecard.yml 480afc0c1e41f3997b195d7297750b43599ba71a7471657aa32bfc9662b6fd30 .github/workflows/reuse.yml cf75cdc06e5ab02359c12b6a8eecb97f2dd3d95502cd2b397d539584cefa56c3 .github/workflows/osv-scanner.yml -4ede8b606ec0cd83937a8723ffc8c122f3be7d4aef56db7e1c20fb84b4345985 .github/workflows/codeql.yml +52182fe4073eb696606813d768ff9444e6b751978f9d27a8d84cc269e9f6cb3a .github/workflows/codeql.yml c9e757f2d0a2f456a08791697a94161c776d9b008a8aa75890da4133c81a99e9 .github/dependabot.yml abea5fb970a46ccf9ba9127d59abf304202efd13c2d6a28da2ff75da0c92a9b8 .github/smoke-fatjar-cli.sh c38151495be64cedc3f11c23b88ffc53f4e0f9d2ce5c0aaaa42b14e4af7e13ec lombok.config diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 6c63cfbe..02f86b73 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -19,6 +19,12 @@ jobs: security-events: write steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + # Two JDKs, as in every job that builds a whole reactor: a module with a Java floor above + # .java-version (java-llama.cpp's llama-ffm, Java 22) builds through maven-toolchains-plugin, + # and setup-java writes a toolchains.xml entry per JDK it installs; the second step keeps + # JAVA_HOME on .java-version. Harmless in a repository without such a module. Shared file. + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 + with: { java-version: '25', distribution: temurin } - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: { java-version-file: .java-version, distribution: temurin } - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4