diff --git a/.github/buildcheck/tests/helpers.py b/.github/buildcheck/tests/helpers.py index 375a812..6e1a4bb 100644 --- a/.github/buildcheck/tests/helpers.py +++ b/.github/buildcheck/tests/helpers.py @@ -21,6 +21,11 @@ def workflow_text(jobs): return "\n".join(lines) + "\n" -def upload(artifact, path="x/"): - return [" - uses: actions/upload-artifact@v7", " with:", f" name: {artifact}", - f" path: {path}"] +def upload(artifact, path="x/", overwrite=False, if_no_files_found=None): + lines = [" - uses: actions/upload-artifact@v7", " with:", f" name: {artifact}", + f" path: {path}"] + if overwrite: + lines.append(" overwrite: true") + if if_no_files_found: + lines.append(f" if-no-files-found: {if_no_files_found}") + return lines diff --git a/.github/buildcheck/versions.py b/.github/buildcheck/versions.py index 7b1270d..58b6bfa 100644 --- a/.github/buildcheck/versions.py +++ b/.github/buildcheck/versions.py @@ -32,7 +32,7 @@ NS = "{http://maven.apache.org/POM/4.0.0}" POMS = { - "java-llama.cpp": ("pom.xml", "llama/pom.xml", "llama-langchain4j/pom.xml", "llama-kotlin/pom.xml", + "java-llama.cpp": ("pom.xml", "llama/pom.xml", "llama-langchain4j/pom.xml", "llama-kotlin/pom.xml", "llama-ffm/pom.xml", "llama-platform/pom.xml", "llama-atmosphere-agent/pom.xml", "examples/server/pom.xml"), "BitcoinAddressFinder": ("pom.xml",), "srcmorph": ("pom.xml", "srcmorph/pom.xml", "srcmorph-cli/pom.xml", "srcmorph-maven-plugin/pom.xml"), diff --git a/.github/shared-files.sha256 b/.github/shared-files.sha256 index f4403c0..ea9c329 100644 --- a/.github/shared-files.sha256 +++ b/.github/shared-files.sha256 @@ -16,13 +16,13 @@ 5a70eee1bb8af180edfd2a4bae61be61fac15b409f5df6a8bb9869425d7fc381 .github/buildcheck/releasegate.py ff2aaec95e53916ea340a0a291bf0f57e0011522aedb486622b1fb1cac136865 .github/buildcheck/sharedfiles.py 0059120aab539c6ce8055675ae0d3b040097f80320051e40385072f68845ddb0 .github/buildcheck/tests/__init__.py -561efd3f26d7728e475c8ce83c10b4761a6703b585b7b2a7ab052df10f73166c .github/buildcheck/tests/helpers.py +a7af59d075b41c2dc9cce1facef527f96fc127b4e26e2ba7986a6e3f51a71e29 .github/buildcheck/tests/helpers.py 4985f25fa177bd79a79335742adfd0da0431e101124b4e7e214906b56ae903de .github/buildcheck/tests/test_workflow.py cbe504ad081ba31ec16e11c11f879c64179ca7741bf0b1d1318a7fc969ed67dd .github/buildcheck/tests/test_releasegate.py fe36042fbd5444f0b454ad1304cdafde901dd8cec57cfaba7c7086d996dfee27 .github/buildcheck/tests/test_sharedfiles.py 7fe208dd33184b4543328f97b339c95e23c408b120e6bfa6095de4182aeb9a19 .github/check-release-gate.py 1604ccdea83998814a3c1f98f746272222039867b0c7d692355e61495c1c648b .github/check-shared-files.py -74b4b18af6c5be2af54048de408ec6e138f37f85b9f9ed2fdef258e270a7c90c .github/buildcheck/versions.py +ea373db1a28e16711110e50f1c2159e5d40b4e400fa22779883d1ce75971eb6e .github/buildcheck/versions.py de437064302f9314028afff00e17fc995e48869e07ee402206d23708c7ed355a .github/buildcheck/tests/test_versions.py 0c78f43dd181f079d35edde7cbf25bb22eac92c907845d8dc8eec78e812aa097 .github/check-versions.py 33c70847b6568604e8725d167a9b1d5910cc2a1a5b01fec7362be31b488ddb02 .github/buildcheck/runscripts.py @@ -51,23 +51,23 @@ e8f444ef851bd134330f1505f52b4b0970ef9a62dd76e4c25829241814ba5c73 .github/ISSUE_ 71ec85b7a30e80b18a9ab1fac0199cc50d68548e6f00dd116ab0f904ad63aa50 .mvn/jvm.config.license 46fc025df0fd7b1bdbd84b875652ce9981aec87c2bb49b9263ae8c383cf7ce5a .mvn/settings.xml 8b8abf79508c4f53b2e765b78d6142655631d5ed69b59e95f234416a62e057b6 CITATION.cff?repo -21341be0ac0628437973ddc2eb21ba9ea68a365d9d71dedee1512e10507649f0 .github/workflows/sonarqube.yml?repo +49eda3d2e846e1b5ec1d0f646a1adafb45ef42efbc3a50931df207bf9759ef13 .github/workflows/sonarqube.yml?repo 6e2ae11dad0616f66bbb2b6e6556f580bb987fd911d7132aa6bee2bfc7cc7b52 .java-version 71ec85b7a30e80b18a9ab1fac0199cc50d68548e6f00dd116ab0f904ad63aa50 .java-version.license -bee58687456c0695990a925ac50a2c17b71768a8ef493b584d7ac679debed7b9 .github/workflows/claude.yml -19ccc3d4f0aef292c19883d4766a0193e9a3e998514f461df6609ccf65a19492 .github/workflows/claude-code-review.yml -13ada38d1cd8d06b5098aab0ee996429156a2251daa11fb331c02248b7e6a40e .github/workflows/scorecard.yml -c0e9885eaab7a660fe2c236e3f10df284a6b2f42dad9ce59084a2d7ab00aa9cf .github/workflows/reuse.yml -f3b1a0864200236c61a5807b1e59236d474431a27695cd9d977bc6636d582667 .github/workflows/osv-scanner.yml -2c43a2b7f4352b7bb09b6e487256ba74c18c170394946b0303b116c88f7b851c .github/workflows/codeql.yml +3f73b87c4675376cbe80f1fb914bd7020062dcdb9a7ee503d3ef787fd462358a .github/workflows/claude.yml +085f19495d9e0812dc90268ea7917579bd6eaf749c669a9f01922272a5cdf06f .github/workflows/claude-code-review.yml +463c34f6244675ee5bee3d28c28c84f5eb3c8bea4f45de3f6ce477348d29589c .github/workflows/scorecard.yml +480afc0c1e41f3997b195d7297750b43599ba71a7471657aa32bfc9662b6fd30 .github/workflows/reuse.yml +cf75cdc06e5ab02359c12b6a8eecb97f2dd3d95502cd2b397d539584cefa56c3 .github/workflows/osv-scanner.yml +52182fe4073eb696606813d768ff9444e6b751978f9d27a8d84cc269e9f6cb3a .github/workflows/codeql.yml c9e757f2d0a2f456a08791697a94161c776d9b008a8aa75890da4133c81a99e9 .github/dependabot.yml abea5fb970a46ccf9ba9127d59abf304202efd13c2d6a28da2ff75da0c92a9b8 .github/smoke-fatjar-cli.sh c38151495be64cedc3f11c23b88ffc53f4e0f9d2ce5c0aaaa42b14e4af7e13ec lombok.config f26d05f25a154b84d8f281bb92857811749e2225cdbc167362de930c48b532d1 .github/workflows/publish.yml#startgate -89738e9b6939e31a452ea7d40adb6514c89e6209ed57fd4d574c8ba047f11e36 .github/workflows/publish.yml#shared-files -fcb6cd0e2a71205b918f545f2680d378c790b774b9852129c5f9c7f3f8eb9860 .github/workflows/publish.yml#verify-signing-key +e3dde66089fd568f03caeefee86ea36a9f6eb7f47e5dc6d053e0e5784fd7a208 .github/workflows/publish.yml#shared-files +3ef45f189f4419e0d4087f572b3c1b6085c0fe39ac7979b07deb2e882f7ffe8c .github/workflows/publish.yml#verify-signing-key 09230b04c5f14bdda50a0c862152ff197a656cbc3fd0d110899c5f8150f8aa9a .github/workflows/publish.yml#check-snapshot 51e987d59efd9887b43e345edc0e0f3db21686879e3ca6ea9f0fdbc493d37121 .github/workflows/publish.yml#check-tag -a8637f88765da759a6eaba243d0d0d695053174df581ccbbcc5e5f3a475fc9e9 .github/workflows/publish.yml#verify-signing-key-gradle -83a1288c55d35e4d3972e013009577fb594a9a5fb8b9b7c96a7f6a19db20d8d1 .github/workflows/publish.yml#github-snapshot -ce90d90fcb1f2de35075b91c74411e9eb7d3b43e7965fd592744e914fd04c5db .github/workflows/publish.yml#github-release +06f0af70ed125dc5cc1506e27970059fb831971d3faaee56f868789f3282fdf9 .github/workflows/publish.yml#verify-signing-key-gradle +c2684a3f93aaf552c13f845307536c2a14dda315c7d7b1e416bc66951b811dc1 .github/workflows/publish.yml#github-snapshot +c09a030706dbea4221851ca0fcbfa6fc686165b408724724ade61724da6e123b .github/workflows/publish.yml#github-release diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index c8bcb91..5c777ba 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -19,13 +19,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 1 - name: Run Claude Code Review id: claude-review - uses: anthropics/claude-code-action@v1 + uses: anthropics/claude-code-action@a26b07d8c778b0c43f64618e5fd29fd0f8af72e8 # v1 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} prompt: | diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 60f20b8..f9eac01 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -30,13 +30,13 @@ jobs: actions: read # Required for Claude to read CI results on PRs steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 1 - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@v1 + uses: anthropics/claude-code-action@a26b07d8c778b0c43f64618e5fd29fd0f8af72e8 # v1 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 596b149..02f86b7 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,12 +18,18 @@ jobs: contents: read security-events: write steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + # Two JDKs, as in every job that builds a whole reactor: a module with a Java floor above + # .java-version (java-llama.cpp's llama-ffm, Java 22) builds through maven-toolchains-plugin, + # and setup-java writes a toolchains.xml entry per JDK it installs; the second step keeps + # JAVA_HOME on .java-version. Harmless in a repository without such a module. Shared file. + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 + with: { java-version: '25', distribution: temurin } + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: { java-version-file: .java-version, distribution: temurin } - - uses: github/codeql-action/init@v4 + - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4 with: { languages: java, queries: +security-and-quality } - name: Build with Maven run: mvn --batch-mode --no-transfer-progress compile - - uses: github/codeql-action/analyze@v4 + - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4 with: { category: "/language:java" } diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index 6073bc8..54644a8 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -18,7 +18,7 @@ permissions: jobs: scan-scheduled: if: ${{ github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }} - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.6.0" + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc" # v2.6.0 permissions: actions: read contents: read @@ -26,7 +26,7 @@ jobs: scan-pr: if: ${{ github.event_name == 'pull_request' }} - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.6.0" + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc" # v2.6.0 permissions: actions: read contents: read diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index ee23941..46cfaf3 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -73,7 +73,7 @@ jobs: needs: startgate runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - name: Shared files match .github/shared-files.sha256 (siblings compared, warnings only) @@ -111,7 +111,7 @@ jobs: runs-on: ubuntu-latest environment: maven-central steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - name: Import key + run sign/verify self-test (prints only PUBLIC metadata) @@ -146,12 +146,12 @@ jobs: runs-on: ubuntu-latest environment: maven-central steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin - - uses: gradle/actions/setup-gradle@v6 + - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6 with: gradle-version: "9.8.1" - name: Sign a throwaway artifact via useInMemoryPgpKeys (BouncyCastle) @@ -187,8 +187,8 @@ jobs: needs: startgate runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin @@ -223,15 +223,15 @@ jobs: needs: startgate runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin cache: maven - name: Build run: mvn --batch-mode --no-transfer-progress -DskipTests package - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: plugin-jars # All three reactor modules produce their own jars: srcmorph (core library), @@ -249,11 +249,11 @@ jobs: needs: [build] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Display CPU Info shell: bash run: bash .github/print-host-info.sh - - uses: actions/setup-java@v6 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin @@ -272,7 +272,7 @@ jobs: run: >- mvn -e --batch-mode --no-transfer-progress -P jcstress -Dnet.ladenthin.srcmorph.requireNativeLlama=true verify - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: jacoco-report # srcmorph carries the bulk of the test suite (and the only PIT gate); its report is @@ -293,7 +293,7 @@ jobs: run: bash .github/print-crash-logs.sh srcmorph srcmorph-cli srcmorph-maven-plugin - name: Upload crash & surefire dumps if: failure() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: crash-dumps-test # Repo-wide glob: a forked surefire JVM crash can happen in any of the three module @@ -323,7 +323,7 @@ jobs: echo "" fi done - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 if: always() with: { name: pit-reports, path: "*/target/pit-reports/" } @@ -332,11 +332,11 @@ jobs: needs: [build] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Display CPU Info shell: bash run: bash .github/print-host-info.sh - - uses: actions/setup-java@v6 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: { java-version-file: .java-version, distribution: temurin, cache: maven } - name: Test under vmlens (one class — staged scope) # VmlensInterleavingSmokeTest and the `vmlens` profile both live in @@ -353,7 +353,7 @@ jobs: run: >- mvn --batch-mode --no-transfer-progress -pl srcmorph-maven-plugin -am -Pvmlens test -Dtest=VmlensInterleavingSmokeTest -DfailIfNoTests=false -Dsurefire.failIfNoSpecifiedTests=false - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 if: always() with: name: vmlens-report @@ -380,12 +380,12 @@ jobs: needs: [build] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/download-artifact@v8 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: plugin-jars path: fatjar/ - - uses: actions/setup-java@v6 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin @@ -404,7 +404,7 @@ jobs: examples 'Main#run end\.' config_Plan.json - name: Upload smoke logs if: failure() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: smoke-fatjar-logs path: | @@ -429,8 +429,8 @@ jobs: needs: startgate runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin @@ -464,7 +464,7 @@ jobs: run: .github/plugin-it.sh '${{ steps.version.outputs.version }}' - name: Upload integration-test logs if: failure() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: plugin-it-logs path: | @@ -479,30 +479,30 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: { java-version-file: .java-version, distribution: temurin } # Only srcmorph's jacoco report is uploaded by the `test` job (see the comment there) — # it carries the bulk of the test suite and the only PIT gate. Coveralls/Codecov are # pointed at it directly rather than an aggregated multi-module report, matching the # single-primary-module precedent already used by the sibling java-llama.cpp reactor. - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: { name: jacoco-report, path: srcmorph/target/site/jacoco/ } continue-on-error: true # Submits the dependency graph to GitHub. Informational: it says nothing about whether the # artifacts are correct, but it sits in the `report` job, which the release path needs -- so # without this flag a third-party action having a bad day can block a publish. - - uses: advanced-security/maven-dependency-submission-action@v6 + - uses: advanced-security/maven-dependency-submission-action@a64327a7329c9939cf675e458452febe1894a70c # v6 continue-on-error: true - name: Coveralls - uses: coverallsapp/github-action@v2 + uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2 with: github-token: ${{ secrets.GITHUB_TOKEN }} file: srcmorph/target/site/jacoco/jacoco.xml format: jacoco continue-on-error: true - name: Codecov - uses: codecov/codecov-action@v7 + uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7 with: token: ${{ secrets.CODECOV_TOKEN }} files: srcmorph/target/site/jacoco/jacoco.xml @@ -535,8 +535,8 @@ jobs: runs-on: ubuntu-latest environment: maven-central steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin @@ -598,7 +598,7 @@ jobs: # all-platform CPU fat jar, GPG-sign each, and add them to the GitHub-Release assets. # These are GitHub-only (never Maven Central): every jar carries the multi-platform CPU # natives (llama-platform), and a classifier jar adds one ggml backend module on top (since - # llama 5.2.0 a GPU natives jar holds only that module), which ggml loads next to the CPU + # llama 6.0.0 a GPU natives jar holds only that module), which ggml loads next to the CPU # library when the vendor runtime is present and skips otherwise. Signing uses the key # setup-java already imported (armored detached .asc, same shape Central produces). - name: Build, sign & verify classifier fat jars (GitHub-only assets, never Central) @@ -643,7 +643,7 @@ jobs: # ever stops being wired through, the loop silently ships copies of the CPU build under # GPU names and nothing else in this pipeline notices. bash .github/verify-classifier-fatjars.sh signed-snapshot-assets "${CLASSIFIERS[@]}" - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 if: ${{ !cancelled() }} with: name: signed-snapshot-assets @@ -660,7 +660,7 @@ jobs: permissions: contents: write steps: - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: signed-snapshot-assets path: snapshot-assets/ @@ -787,8 +787,8 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin @@ -837,7 +837,7 @@ jobs: # all-platform CPU fat jar, GPG-sign each, and add them to the GitHub-Release assets. # These are GitHub-only (never Maven Central): every jar carries the multi-platform CPU # natives (llama-platform), and a classifier jar adds one ggml backend module on top (since - # llama 5.2.0 a GPU natives jar holds only that module), which ggml loads next to the CPU + # llama 6.0.0 a GPU natives jar holds only that module), which ggml loads next to the CPU # library when the vendor runtime is present and skips otherwise. Signing uses the key # setup-java already imported (armored detached .asc, same shape Central produces). - name: Build, sign & verify classifier fat jars (GitHub-only assets, never Central) @@ -882,7 +882,7 @@ jobs: # ever stops being wired through, the loop silently ships copies of the CPU build under # GPU names and nothing else in this pipeline notices. bash .github/verify-classifier-fatjars.sh signed-release-assets "${CLASSIFIERS[@]}" - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 if: ${{ !cancelled() }} with: name: signed-release-assets @@ -899,7 +899,7 @@ jobs: permissions: contents: write steps: - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: signed-release-assets path: release-assets/ @@ -934,7 +934,7 @@ jobs: [ "$missing" -eq 0 ] && echo "all $(echo "$artifacts" | wc -l) artifact(s) signed" exit 0 - name: Upload release assets - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3 with: files: release-assets/* - name: Fail if anything was attached unsigned diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml index a1e66bd..7d19b49 100644 --- a/.github/workflows/reuse.yml +++ b/.github/workflows/reuse.yml @@ -12,5 +12,5 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: fsfe/reuse-action@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 51cb023..102f0ca 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -24,25 +24,25 @@ jobs: actions: read steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - name: Run analysis - uses: ossf/scorecard-action@v2.4.4 + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 with: results_file: results.sarif results_format: sarif publish_results: true - name: Upload artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: SARIF file path: results.sarif retention-days: 5 - name: Upload to code-scanning - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4 with: sarif_file: results.sarif diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml index 37f74bd..c7b8290 100644 --- a/.github/workflows/sonarqube.yml +++ b/.github/workflows/sonarqube.yml @@ -14,22 +14,22 @@ jobs: name: Build and analyze runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis - name: Set up JDK 21 - uses: actions/setup-java@v6 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: 'zulu' - name: Cache SonarQube packages - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 with: path: ~/.sonar/cache key: ${{ runner.os }}-sonar restore-keys: ${{ runner.os }}-sonar - name: Cache Maven packages - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 with: path: ~/.m2 key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} diff --git a/CHANGELOG.md b/CHANGELOG.md index b7852dc..91e1a56 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -68,7 +68,7 @@ The release procedure (prompt template and step-by-step instructions) lives in [ - **Maven versions are compared with the sibling repositories**: `check-versions.py` (in the `shared-files` job) warns where a dependency or plugin -- incl. annotation-processor paths and the Spotless formatter version -- is used in another version than in a sibling's default branch. -- **`net.ladenthin:llama` 5.2.0's natives jars.** The binding is now the Java classes only, and every +- **`net.ladenthin:llama` 6.0.0's natives jars.** The binding is now the Java classes only, and every native build is its own jar of the same artifact (classifier `--`). `srcmorph` depends on `net.ladenthin:llama-platform` (a pom naming the CPU natives of every desktop platform), so the plugin and the CLI keep running everywhere with no change for users. A GPU natives jar is now @@ -135,7 +135,7 @@ The release procedure (prompt template and step-by-step instructions) lives in [ argv token — the load then died naming a flag the user never set. 1.2.0 shipped a refusal at plan time rather than that diagnostic. - `net.ladenthin:llama` **5.2.0** adds `ModelParameters.setFlashAttn(FlashAttn)`, so the provider now + `net.ladenthin:llama` **6.0.0** adds `ModelParameters.setFlashAttn(FlashAttn)`, so the provider now emits `--flash-attn on` when the knob is set. `false` still emits nothing, which leaves llama.cpp's own `auto` default in force — that is the correct behaviour for an unconfigured run, and it is what the knob's javadoc now says. @@ -160,11 +160,12 @@ The release procedure (prompt template and step-by-step instructions) lives in [ native** produces `Failed to parse model parameters` at load time and nothing earlier catches it. The knob sweep did — it is what surfaced the mismatch here. -- **`net.ladenthin:llama` 5.1.0 → 5.2.0.** Deliberately the *release* version, not `5.2.0-SNAPSHOT`: +- **`net.ladenthin:llama` 5.1.0 → 6.0.0** (the pin said 5.2.0 until 2026-10-15; jllama never published + that number and ships the breaking natives split as 6.0.0). Deliberately the *release* version, not `6.0.0-SNAPSHOT`: this repo declares no `` element (the `distributionManagement/snapshotRepository` is deploy-only), so the Central snapshot channel is not resolvable here at all — and a `-SNAPSHOT` dependency on `main` would block every srcmorph release, since Central rejects one. The build - therefore stays red until `net.ladenthin:llama:5.2.0` is published and goes green with no further + therefore stays red until `net.ladenthin:llama:6.0.0` is published and goes green with no further edit the moment it is — recorded here so nobody mistakes it for a regression. - **BREAKING: `chatTemplateEnableThinking` is a tri-state; the `enable_thinking` kwarg is only sent diff --git a/CLAUDE.md b/CLAUDE.md index e8e779d..04a127b 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -141,9 +141,9 @@ somebody decides how it is covered. **PIT mutation testing**: `mutationThreshold config/document/engine/indexer/prompt/provider/support, all killed at 100%. **All three modules are PIT-gated now**: `srcmorph-cli` (16/16) and `srcmorph-maven-plugin` (62/62) carry their own `pitest-maven` executions at the same threshold, and CI runs the goal reactor-wide. The natives come from `net.ladenthin:llama-platform` (a pom -naming the CPU natives jar of every desktop platform — since llama 5.2.0 `net.ladenthin:llama` is the +naming the CPU natives jar of every desktop platform — since llama 6.0.0 `net.ladenthin:llama` is the classes only); the `gpu-cuda`/`gpu-vulkan` profiles and `-Dllama.classifier=` (profile -`gpu-natives`) **add** a GPU module jar next to them (since llama 5.2.0 one ggml backend module, which +`gpu-natives`) **add** a GPU module jar next to them (since llama 6.0.0 one ggml backend module, which ggml loads when its vendor runtime is installed; otherwise the CPU modules run). They live here; the `jcstress` and `vmlens` profiles/tests currently still live in the **plugin** module (they were not moved in the extraction — see that module's section below), not here. @@ -400,7 +400,7 @@ assume it has already been updated. | Dependency | Version | Used by | |---|---|---| -| `net.ladenthin:llama` + `llama-platform` (pom) | 5.2.0 | `srcmorph` (`provider` package only) — llama.cpp JNI binding (classes) + the CPU natives jars; its own SLF4J binding is excluded transitively (see "Java 8 bytecode floor") | +| `net.ladenthin:llama` + `llama-platform` (pom) | 6.0.0 | `srcmorph` (`provider` package only) — llama.cpp JNI binding (classes) + the CPU natives jars; its own SLF4J binding is excluded transitively (see "Java 8 bytecode floor") | | `org.slf4j:slf4j-api` | 2.0.20 (converged in the parent) | `srcmorph`, `srcmorph-cli`, the plugin | | `org.slf4j:slf4j-simple` | 2.0.20 (converged in the parent) | `srcmorph-cli` (runtime binding) | | `ch.qos.logback:logback-classic` | 1.6.5 (converged in the parent) | `srcmorph` (**test scope only** — `ListAppender` capture) | @@ -595,7 +595,7 @@ Maven Central** (`srcmorph-cli/pom.xml` sets `false`), attached GPG `.asc`. CI builds **one fat jar per desktop GPU module jar of `net.ladenthin:llama`** (the default CPU jar + 14: `cuda13`, `vulkan`, `opencl`, `rocm`, `sycl`, `openvino` per OS/arch -- the `CLASSIFIERS` list in `publish.yml`, every `module` row of java-llama.cpp's `natives.csv` but the Android one; no -`msvc`, `sycl-fp*` or 32-bit jar exists since llama 5.2.0) and signs them via `.github/sign-fatjars.sh` +`msvc`, `sycl-fp*` or 32-bit jar exists since llama 6.0.0) and signs them via `.github/sign-fatjars.sh` (srcmorph's own since java-llama.cpp dropped its fat jars with its modular natives). The convention + per-repo shapes + the classifier keep-in-sync rule are documented in [`../workspace/policies/fat-jar-release-assets.md`](../workspace/policies/fat-jar-release-assets.md). diff --git a/srcmorph-maven-plugin/README.md b/srcmorph-maven-plugin/README.md index 8b412e2..7f53971 100644 --- a/srcmorph-maven-plugin/README.md +++ b/srcmorph-maven-plugin/README.md @@ -119,7 +119,7 @@ Running the plugin under Java 11 or newer needs no override. The plugin depends on [`net.ladenthin:llama`](https://central.sonatype.com/artifact/net.ladenthin/llama), the Java/JNI binding for llama.cpp (via the `srcmorph` core library it wraps). It is published on Maven Central and resolves automatically — no manual installation required. -Since `llama` 5.2.0 the binding is split: `net.ladenthin:llama` holds the Java classes only, and every +Since `llama` 6.0.0 the binding is split: `net.ladenthin:llama` holds the Java classes only, and every native build is a natives jar of the same artifact (classifier `--`). `srcmorph` depends on `net.ladenthin:llama-platform`, a pom naming the CPU natives of every desktop platform (macOS: Metal), so the plugin runs anywhere out of the box: @@ -128,7 +128,7 @@ platform (macOS: Metal), so the plugin runs anywhere out of the box: net.ladenthin llama-platform - 5.2.0 + 6.0.0 pom ``` @@ -584,7 +584,7 @@ runs on the CPU: net.ladenthin llama - 5.2.0 + 6.0.0 cuda13-windows-x86-64 diff --git a/srcmorph/pom.xml b/srcmorph/pom.xml index 7959774..b6eac0f 100644 --- a/srcmorph/pom.xml +++ b/srcmorph/pom.xml @@ -50,19 +50,19 @@ SPDX-License-Identifier: Apache-2.0 templating is unchanged. The rest of the provider's API surface (LlamaModel, InferenceParameters, ModelParameters, ChatResponse/Timings/Pair, ChatResponseParser, ReasoningFormat) is untouched by 5.1.0. - 5.2.0 is a BREAKING bump this module needs, not an optional one: the binding removed + 6.0.0 is a BREAKING bump this module needs, not an optional one: the binding removed ModelParameters.enableFlashAttn()/ModelFlag.FLASH_ATTN (the flash-attn flag takes a mandatory on|off|auto value since llama.cpp b10273, so the valueless flag emitted a broken argv) and renamed setTensorReadLazy/TensorReadLazyMode to setLazyMode/LazyMode (llama.cpp b10731 renamed the tensor-read-lazy flag to lazy-mode with no alias). The provider calls both, so it cannot compile against 5.1.0 any more. - This deliberately names the RELEASE, not 5.2.0-SNAPSHOT: a snapshot would need a + This deliberately names the RELEASE, not 6.0.0-SNAPSHOT: a snapshot would need a entry for the Central snapshot channel (this repo declares none; the distributionManagement/snapshotRepository below is deploy-only) AND would block every srcmorph release, since Central rejects a release with a -SNAPSHOT dependency. The - build therefore stays red until net.ladenthin:llama:5.2.0 is published, and goes green + build therefore stays red until net.ladenthin:llama:6.0.0 is published, and goes green with no further edit the moment it is. --> - 5.2.0 + 6.0.0 6.1.3 3.0 3.7 @@ -147,7 +147,7 @@ SPDX-License-Identifier: Apache-2.0