From 008f606c51f7c5b12112a258450a6f0210904842 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 15 Oct 2026 13:42:35 +0000 Subject: [PATCH 1/5] Pin every GitHub Action to a commit SHA Every uses: reference carries the commit the tag resolved to, with the tag in a comment; Dependabot keeps them current. Kept byte-identical with the sibling repositories (shared-files.sha256 rewritten). Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01MjAMq3jnoveX5dcvLGhNQw --- .github/shared-files.sha256 | 24 +++---- .github/workflows/claude-code-review.yml | 4 +- .github/workflows/claude.yml | 4 +- .github/workflows/codeql.yml | 8 +-- .github/workflows/osv-scanner.yml | 4 +- .github/workflows/publish.yml | 80 ++++++++++++------------ .github/workflows/reuse.yml | 4 +- .github/workflows/scorecard.yml | 8 +-- .github/workflows/sonarqube.yml | 8 +-- 9 files changed, 72 insertions(+), 72 deletions(-) diff --git a/.github/shared-files.sha256 b/.github/shared-files.sha256 index f4403c0..145a143 100644 --- a/.github/shared-files.sha256 +++ b/.github/shared-files.sha256 @@ -51,23 +51,23 @@ e8f444ef851bd134330f1505f52b4b0970ef9a62dd76e4c25829241814ba5c73 .github/ISSUE_ 71ec85b7a30e80b18a9ab1fac0199cc50d68548e6f00dd116ab0f904ad63aa50 .mvn/jvm.config.license 46fc025df0fd7b1bdbd84b875652ce9981aec87c2bb49b9263ae8c383cf7ce5a .mvn/settings.xml 8b8abf79508c4f53b2e765b78d6142655631d5ed69b59e95f234416a62e057b6 CITATION.cff?repo -21341be0ac0628437973ddc2eb21ba9ea68a365d9d71dedee1512e10507649f0 .github/workflows/sonarqube.yml?repo +49eda3d2e846e1b5ec1d0f646a1adafb45ef42efbc3a50931df207bf9759ef13 .github/workflows/sonarqube.yml?repo 6e2ae11dad0616f66bbb2b6e6556f580bb987fd911d7132aa6bee2bfc7cc7b52 .java-version 71ec85b7a30e80b18a9ab1fac0199cc50d68548e6f00dd116ab0f904ad63aa50 .java-version.license -bee58687456c0695990a925ac50a2c17b71768a8ef493b584d7ac679debed7b9 .github/workflows/claude.yml -19ccc3d4f0aef292c19883d4766a0193e9a3e998514f461df6609ccf65a19492 .github/workflows/claude-code-review.yml -13ada38d1cd8d06b5098aab0ee996429156a2251daa11fb331c02248b7e6a40e .github/workflows/scorecard.yml -c0e9885eaab7a660fe2c236e3f10df284a6b2f42dad9ce59084a2d7ab00aa9cf .github/workflows/reuse.yml -f3b1a0864200236c61a5807b1e59236d474431a27695cd9d977bc6636d582667 .github/workflows/osv-scanner.yml -2c43a2b7f4352b7bb09b6e487256ba74c18c170394946b0303b116c88f7b851c .github/workflows/codeql.yml +3f73b87c4675376cbe80f1fb914bd7020062dcdb9a7ee503d3ef787fd462358a .github/workflows/claude.yml +085f19495d9e0812dc90268ea7917579bd6eaf749c669a9f01922272a5cdf06f .github/workflows/claude-code-review.yml +463c34f6244675ee5bee3d28c28c84f5eb3c8bea4f45de3f6ce477348d29589c .github/workflows/scorecard.yml +480afc0c1e41f3997b195d7297750b43599ba71a7471657aa32bfc9662b6fd30 .github/workflows/reuse.yml +cf75cdc06e5ab02359c12b6a8eecb97f2dd3d95502cd2b397d539584cefa56c3 .github/workflows/osv-scanner.yml +4ede8b606ec0cd83937a8723ffc8c122f3be7d4aef56db7e1c20fb84b4345985 .github/workflows/codeql.yml c9e757f2d0a2f456a08791697a94161c776d9b008a8aa75890da4133c81a99e9 .github/dependabot.yml abea5fb970a46ccf9ba9127d59abf304202efd13c2d6a28da2ff75da0c92a9b8 .github/smoke-fatjar-cli.sh c38151495be64cedc3f11c23b88ffc53f4e0f9d2ce5c0aaaa42b14e4af7e13ec lombok.config f26d05f25a154b84d8f281bb92857811749e2225cdbc167362de930c48b532d1 .github/workflows/publish.yml#startgate -89738e9b6939e31a452ea7d40adb6514c89e6209ed57fd4d574c8ba047f11e36 .github/workflows/publish.yml#shared-files -fcb6cd0e2a71205b918f545f2680d378c790b774b9852129c5f9c7f3f8eb9860 .github/workflows/publish.yml#verify-signing-key +e3dde66089fd568f03caeefee86ea36a9f6eb7f47e5dc6d053e0e5784fd7a208 .github/workflows/publish.yml#shared-files +3ef45f189f4419e0d4087f572b3c1b6085c0fe39ac7979b07deb2e882f7ffe8c .github/workflows/publish.yml#verify-signing-key 09230b04c5f14bdda50a0c862152ff197a656cbc3fd0d110899c5f8150f8aa9a .github/workflows/publish.yml#check-snapshot 51e987d59efd9887b43e345edc0e0f3db21686879e3ca6ea9f0fdbc493d37121 .github/workflows/publish.yml#check-tag -a8637f88765da759a6eaba243d0d0d695053174df581ccbbcc5e5f3a475fc9e9 .github/workflows/publish.yml#verify-signing-key-gradle -83a1288c55d35e4d3972e013009577fb594a9a5fb8b9b7c96a7f6a19db20d8d1 .github/workflows/publish.yml#github-snapshot -ce90d90fcb1f2de35075b91c74411e9eb7d3b43e7965fd592744e914fd04c5db .github/workflows/publish.yml#github-release +06f0af70ed125dc5cc1506e27970059fb831971d3faaee56f868789f3282fdf9 .github/workflows/publish.yml#verify-signing-key-gradle +c2684a3f93aaf552c13f845307536c2a14dda315c7d7b1e416bc66951b811dc1 .github/workflows/publish.yml#github-snapshot +c09a030706dbea4221851ca0fcbfa6fc686165b408724724ade61724da6e123b .github/workflows/publish.yml#github-release diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index c8bcb91..5c777ba 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -19,13 +19,13 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 1 - name: Run Claude Code Review id: claude-review - uses: anthropics/claude-code-action@v1 + uses: anthropics/claude-code-action@a26b07d8c778b0c43f64618e5fd29fd0f8af72e8 # v1 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} prompt: | diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 60f20b8..f9eac01 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -30,13 +30,13 @@ jobs: actions: read # Required for Claude to read CI results on PRs steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 1 - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@v1 + uses: anthropics/claude-code-action@a26b07d8c778b0c43f64618e5fd29fd0f8af72e8 # v1 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 596b149..6c63cfb 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,12 +18,12 @@ jobs: contents: read security-events: write steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: { java-version-file: .java-version, distribution: temurin } - - uses: github/codeql-action/init@v4 + - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4 with: { languages: java, queries: +security-and-quality } - name: Build with Maven run: mvn --batch-mode --no-transfer-progress compile - - uses: github/codeql-action/analyze@v4 + - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4 with: { category: "/language:java" } diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index 6073bc8..54644a8 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -18,7 +18,7 @@ permissions: jobs: scan-scheduled: if: ${{ github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }} - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.6.0" + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc" # v2.6.0 permissions: actions: read contents: read @@ -26,7 +26,7 @@ jobs: scan-pr: if: ${{ github.event_name == 'pull_request' }} - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.6.0" + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc" # v2.6.0 permissions: actions: read contents: read diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index ee23941..2f58697 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -73,7 +73,7 @@ jobs: needs: startgate runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - name: Shared files match .github/shared-files.sha256 (siblings compared, warnings only) @@ -111,7 +111,7 @@ jobs: runs-on: ubuntu-latest environment: maven-central steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - name: Import key + run sign/verify self-test (prints only PUBLIC metadata) @@ -146,12 +146,12 @@ jobs: runs-on: ubuntu-latest environment: maven-central steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin - - uses: gradle/actions/setup-gradle@v6 + - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6 with: gradle-version: "9.8.1" - name: Sign a throwaway artifact via useInMemoryPgpKeys (BouncyCastle) @@ -187,8 +187,8 @@ jobs: needs: startgate runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin @@ -223,15 +223,15 @@ jobs: needs: startgate runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin cache: maven - name: Build run: mvn --batch-mode --no-transfer-progress -DskipTests package - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: plugin-jars # All three reactor modules produce their own jars: srcmorph (core library), @@ -249,11 +249,11 @@ jobs: needs: [build] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Display CPU Info shell: bash run: bash .github/print-host-info.sh - - uses: actions/setup-java@v6 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin @@ -272,7 +272,7 @@ jobs: run: >- mvn -e --batch-mode --no-transfer-progress -P jcstress -Dnet.ladenthin.srcmorph.requireNativeLlama=true verify - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: jacoco-report # srcmorph carries the bulk of the test suite (and the only PIT gate); its report is @@ -293,7 +293,7 @@ jobs: run: bash .github/print-crash-logs.sh srcmorph srcmorph-cli srcmorph-maven-plugin - name: Upload crash & surefire dumps if: failure() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: crash-dumps-test # Repo-wide glob: a forked surefire JVM crash can happen in any of the three module @@ -323,7 +323,7 @@ jobs: echo "" fi done - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 if: always() with: { name: pit-reports, path: "*/target/pit-reports/" } @@ -332,11 +332,11 @@ jobs: needs: [build] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Display CPU Info shell: bash run: bash .github/print-host-info.sh - - uses: actions/setup-java@v6 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: { java-version-file: .java-version, distribution: temurin, cache: maven } - name: Test under vmlens (one class — staged scope) # VmlensInterleavingSmokeTest and the `vmlens` profile both live in @@ -353,7 +353,7 @@ jobs: run: >- mvn --batch-mode --no-transfer-progress -pl srcmorph-maven-plugin -am -Pvmlens test -Dtest=VmlensInterleavingSmokeTest -DfailIfNoTests=false -Dsurefire.failIfNoSpecifiedTests=false - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 if: always() with: name: vmlens-report @@ -380,12 +380,12 @@ jobs: needs: [build] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/download-artifact@v8 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: plugin-jars path: fatjar/ - - uses: actions/setup-java@v6 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin @@ -404,7 +404,7 @@ jobs: examples 'Main#run end\.' config_Plan.json - name: Upload smoke logs if: failure() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: smoke-fatjar-logs path: | @@ -429,8 +429,8 @@ jobs: needs: startgate runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin @@ -464,7 +464,7 @@ jobs: run: .github/plugin-it.sh '${{ steps.version.outputs.version }}' - name: Upload integration-test logs if: failure() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: plugin-it-logs path: | @@ -479,30 +479,30 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: { java-version-file: .java-version, distribution: temurin } # Only srcmorph's jacoco report is uploaded by the `test` job (see the comment there) — # it carries the bulk of the test suite and the only PIT gate. Coveralls/Codecov are # pointed at it directly rather than an aggregated multi-module report, matching the # single-primary-module precedent already used by the sibling java-llama.cpp reactor. - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: { name: jacoco-report, path: srcmorph/target/site/jacoco/ } continue-on-error: true # Submits the dependency graph to GitHub. Informational: it says nothing about whether the # artifacts are correct, but it sits in the `report` job, which the release path needs -- so # without this flag a third-party action having a bad day can block a publish. - - uses: advanced-security/maven-dependency-submission-action@v6 + - uses: advanced-security/maven-dependency-submission-action@a64327a7329c9939cf675e458452febe1894a70c # v6 continue-on-error: true - name: Coveralls - uses: coverallsapp/github-action@v2 + uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2 with: github-token: ${{ secrets.GITHUB_TOKEN }} file: srcmorph/target/site/jacoco/jacoco.xml format: jacoco continue-on-error: true - name: Codecov - uses: codecov/codecov-action@v7 + uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7 with: token: ${{ secrets.CODECOV_TOKEN }} files: srcmorph/target/site/jacoco/jacoco.xml @@ -535,8 +535,8 @@ jobs: runs-on: ubuntu-latest environment: maven-central steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin @@ -643,7 +643,7 @@ jobs: # ever stops being wired through, the loop silently ships copies of the CPU build under # GPU names and nothing else in this pipeline notices. bash .github/verify-classifier-fatjars.sh signed-snapshot-assets "${CLASSIFIERS[@]}" - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 if: ${{ !cancelled() }} with: name: signed-snapshot-assets @@ -660,7 +660,7 @@ jobs: permissions: contents: write steps: - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: signed-snapshot-assets path: snapshot-assets/ @@ -787,8 +787,8 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@v7 - - uses: actions/setup-java@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: temurin @@ -882,7 +882,7 @@ jobs: # ever stops being wired through, the loop silently ships copies of the CPU build under # GPU names and nothing else in this pipeline notices. bash .github/verify-classifier-fatjars.sh signed-release-assets "${CLASSIFIERS[@]}" - - uses: actions/upload-artifact@v7 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 if: ${{ !cancelled() }} with: name: signed-release-assets @@ -899,7 +899,7 @@ jobs: permissions: contents: write steps: - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8 with: name: signed-release-assets path: release-assets/ @@ -934,7 +934,7 @@ jobs: [ "$missing" -eq 0 ] && echo "all $(echo "$artifacts" | wc -l) artifact(s) signed" exit 0 - name: Upload release assets - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3 with: files: release-assets/* - name: Fail if anything was attached unsigned diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml index a1e66bd..7d19b49 100644 --- a/.github/workflows/reuse.yml +++ b/.github/workflows/reuse.yml @@ -12,5 +12,5 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: fsfe/reuse-action@v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + - uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 51cb023..102f0ca 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -24,25 +24,25 @@ jobs: actions: read steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - name: Run analysis - uses: ossf/scorecard-action@v2.4.4 + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 with: results_file: results.sarif results_format: sarif publish_results: true - name: Upload artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 with: name: SARIF file path: results.sarif retention-days: 5 - name: Upload to code-scanning - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4 with: sarif_file: results.sarif diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml index 37f74bd..c7b8290 100644 --- a/.github/workflows/sonarqube.yml +++ b/.github/workflows/sonarqube.yml @@ -14,22 +14,22 @@ jobs: name: Build and analyze runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis - name: Set up JDK 21 - uses: actions/setup-java@v6 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6 with: java-version-file: .java-version distribution: 'zulu' - name: Cache SonarQube packages - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 with: path: ~/.sonar/cache key: ${{ runner.os }}-sonar restore-keys: ${{ runner.os }}-sonar - name: Cache Maven packages - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 with: path: ~/.m2 key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} From b7107964487e4c659c6c2cb7c2e579fea49bce43 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 15 Oct 2026 16:25:20 +0000 Subject: [PATCH 2/5] Pin net.ladenthin:llama to 6.0.0: jllama renumbered its next release java-llama.cpp never published 5.2.0; the natives split and the other breaking changes ship as 6.0.0 (decided 2026-10-15). The pin, the plugin README's snippets, the CI comments and the changelog follow; the build stays red until that release exists, as before. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01MjAMq3jnoveX5dcvLGhNQw --- .github/workflows/publish.yml | 4 ++-- CHANGELOG.md | 9 +++++---- CLAUDE.md | 8 ++++---- srcmorph-maven-plugin/README.md | 6 +++--- srcmorph/pom.xml | 12 ++++++------ 5 files changed, 20 insertions(+), 19 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 2f58697..46cfaf3 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -598,7 +598,7 @@ jobs: # all-platform CPU fat jar, GPG-sign each, and add them to the GitHub-Release assets. # These are GitHub-only (never Maven Central): every jar carries the multi-platform CPU # natives (llama-platform), and a classifier jar adds one ggml backend module on top (since - # llama 5.2.0 a GPU natives jar holds only that module), which ggml loads next to the CPU + # llama 6.0.0 a GPU natives jar holds only that module), which ggml loads next to the CPU # library when the vendor runtime is present and skips otherwise. Signing uses the key # setup-java already imported (armored detached .asc, same shape Central produces). - name: Build, sign & verify classifier fat jars (GitHub-only assets, never Central) @@ -837,7 +837,7 @@ jobs: # all-platform CPU fat jar, GPG-sign each, and add them to the GitHub-Release assets. # These are GitHub-only (never Maven Central): every jar carries the multi-platform CPU # natives (llama-platform), and a classifier jar adds one ggml backend module on top (since - # llama 5.2.0 a GPU natives jar holds only that module), which ggml loads next to the CPU + # llama 6.0.0 a GPU natives jar holds only that module), which ggml loads next to the CPU # library when the vendor runtime is present and skips otherwise. Signing uses the key # setup-java already imported (armored detached .asc, same shape Central produces). - name: Build, sign & verify classifier fat jars (GitHub-only assets, never Central) diff --git a/CHANGELOG.md b/CHANGELOG.md index b7852dc..91e1a56 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -68,7 +68,7 @@ The release procedure (prompt template and step-by-step instructions) lives in [ - **Maven versions are compared with the sibling repositories**: `check-versions.py` (in the `shared-files` job) warns where a dependency or plugin -- incl. annotation-processor paths and the Spotless formatter version -- is used in another version than in a sibling's default branch. -- **`net.ladenthin:llama` 5.2.0's natives jars.** The binding is now the Java classes only, and every +- **`net.ladenthin:llama` 6.0.0's natives jars.** The binding is now the Java classes only, and every native build is its own jar of the same artifact (classifier `--`). `srcmorph` depends on `net.ladenthin:llama-platform` (a pom naming the CPU natives of every desktop platform), so the plugin and the CLI keep running everywhere with no change for users. A GPU natives jar is now @@ -135,7 +135,7 @@ The release procedure (prompt template and step-by-step instructions) lives in [ argv token — the load then died naming a flag the user never set. 1.2.0 shipped a refusal at plan time rather than that diagnostic. - `net.ladenthin:llama` **5.2.0** adds `ModelParameters.setFlashAttn(FlashAttn)`, so the provider now + `net.ladenthin:llama` **6.0.0** adds `ModelParameters.setFlashAttn(FlashAttn)`, so the provider now emits `--flash-attn on` when the knob is set. `false` still emits nothing, which leaves llama.cpp's own `auto` default in force — that is the correct behaviour for an unconfigured run, and it is what the knob's javadoc now says. @@ -160,11 +160,12 @@ The release procedure (prompt template and step-by-step instructions) lives in [ native** produces `Failed to parse model parameters` at load time and nothing earlier catches it. The knob sweep did — it is what surfaced the mismatch here. -- **`net.ladenthin:llama` 5.1.0 → 5.2.0.** Deliberately the *release* version, not `5.2.0-SNAPSHOT`: +- **`net.ladenthin:llama` 5.1.0 → 6.0.0** (the pin said 5.2.0 until 2026-10-15; jllama never published + that number and ships the breaking natives split as 6.0.0). Deliberately the *release* version, not `6.0.0-SNAPSHOT`: this repo declares no `` element (the `distributionManagement/snapshotRepository` is deploy-only), so the Central snapshot channel is not resolvable here at all — and a `-SNAPSHOT` dependency on `main` would block every srcmorph release, since Central rejects one. The build - therefore stays red until `net.ladenthin:llama:5.2.0` is published and goes green with no further + therefore stays red until `net.ladenthin:llama:6.0.0` is published and goes green with no further edit the moment it is — recorded here so nobody mistakes it for a regression. - **BREAKING: `chatTemplateEnableThinking` is a tri-state; the `enable_thinking` kwarg is only sent diff --git a/CLAUDE.md b/CLAUDE.md index e8e779d..04a127b 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -141,9 +141,9 @@ somebody decides how it is covered. **PIT mutation testing**: `mutationThreshold config/document/engine/indexer/prompt/provider/support, all killed at 100%. **All three modules are PIT-gated now**: `srcmorph-cli` (16/16) and `srcmorph-maven-plugin` (62/62) carry their own `pitest-maven` executions at the same threshold, and CI runs the goal reactor-wide. The natives come from `net.ladenthin:llama-platform` (a pom -naming the CPU natives jar of every desktop platform — since llama 5.2.0 `net.ladenthin:llama` is the +naming the CPU natives jar of every desktop platform — since llama 6.0.0 `net.ladenthin:llama` is the classes only); the `gpu-cuda`/`gpu-vulkan` profiles and `-Dllama.classifier=` (profile -`gpu-natives`) **add** a GPU module jar next to them (since llama 5.2.0 one ggml backend module, which +`gpu-natives`) **add** a GPU module jar next to them (since llama 6.0.0 one ggml backend module, which ggml loads when its vendor runtime is installed; otherwise the CPU modules run). They live here; the `jcstress` and `vmlens` profiles/tests currently still live in the **plugin** module (they were not moved in the extraction — see that module's section below), not here. @@ -400,7 +400,7 @@ assume it has already been updated. | Dependency | Version | Used by | |---|---|---| -| `net.ladenthin:llama` + `llama-platform` (pom) | 5.2.0 | `srcmorph` (`provider` package only) — llama.cpp JNI binding (classes) + the CPU natives jars; its own SLF4J binding is excluded transitively (see "Java 8 bytecode floor") | +| `net.ladenthin:llama` + `llama-platform` (pom) | 6.0.0 | `srcmorph` (`provider` package only) — llama.cpp JNI binding (classes) + the CPU natives jars; its own SLF4J binding is excluded transitively (see "Java 8 bytecode floor") | | `org.slf4j:slf4j-api` | 2.0.20 (converged in the parent) | `srcmorph`, `srcmorph-cli`, the plugin | | `org.slf4j:slf4j-simple` | 2.0.20 (converged in the parent) | `srcmorph-cli` (runtime binding) | | `ch.qos.logback:logback-classic` | 1.6.5 (converged in the parent) | `srcmorph` (**test scope only** — `ListAppender` capture) | @@ -595,7 +595,7 @@ Maven Central** (`srcmorph-cli/pom.xml` sets `false`), attached GPG `.asc`. CI builds **one fat jar per desktop GPU module jar of `net.ladenthin:llama`** (the default CPU jar + 14: `cuda13`, `vulkan`, `opencl`, `rocm`, `sycl`, `openvino` per OS/arch -- the `CLASSIFIERS` list in `publish.yml`, every `module` row of java-llama.cpp's `natives.csv` but the Android one; no -`msvc`, `sycl-fp*` or 32-bit jar exists since llama 5.2.0) and signs them via `.github/sign-fatjars.sh` +`msvc`, `sycl-fp*` or 32-bit jar exists since llama 6.0.0) and signs them via `.github/sign-fatjars.sh` (srcmorph's own since java-llama.cpp dropped its fat jars with its modular natives). The convention + per-repo shapes + the classifier keep-in-sync rule are documented in [`../workspace/policies/fat-jar-release-assets.md`](../workspace/policies/fat-jar-release-assets.md). diff --git a/srcmorph-maven-plugin/README.md b/srcmorph-maven-plugin/README.md index 8b412e2..7f53971 100644 --- a/srcmorph-maven-plugin/README.md +++ b/srcmorph-maven-plugin/README.md @@ -119,7 +119,7 @@ Running the plugin under Java 11 or newer needs no override. The plugin depends on [`net.ladenthin:llama`](https://central.sonatype.com/artifact/net.ladenthin/llama), the Java/JNI binding for llama.cpp (via the `srcmorph` core library it wraps). It is published on Maven Central and resolves automatically — no manual installation required. -Since `llama` 5.2.0 the binding is split: `net.ladenthin:llama` holds the Java classes only, and every +Since `llama` 6.0.0 the binding is split: `net.ladenthin:llama` holds the Java classes only, and every native build is a natives jar of the same artifact (classifier `--`). `srcmorph` depends on `net.ladenthin:llama-platform`, a pom naming the CPU natives of every desktop platform (macOS: Metal), so the plugin runs anywhere out of the box: @@ -128,7 +128,7 @@ platform (macOS: Metal), so the plugin runs anywhere out of the box: net.ladenthin llama-platform - 5.2.0 + 6.0.0 pom ``` @@ -584,7 +584,7 @@ runs on the CPU: net.ladenthin llama - 5.2.0 + 6.0.0 cuda13-windows-x86-64 diff --git a/srcmorph/pom.xml b/srcmorph/pom.xml index 7959774..b6eac0f 100644 --- a/srcmorph/pom.xml +++ b/srcmorph/pom.xml @@ -50,19 +50,19 @@ SPDX-License-Identifier: Apache-2.0 templating is unchanged. The rest of the provider's API surface (LlamaModel, InferenceParameters, ModelParameters, ChatResponse/Timings/Pair, ChatResponseParser, ReasoningFormat) is untouched by 5.1.0. - 5.2.0 is a BREAKING bump this module needs, not an optional one: the binding removed + 6.0.0 is a BREAKING bump this module needs, not an optional one: the binding removed ModelParameters.enableFlashAttn()/ModelFlag.FLASH_ATTN (the flash-attn flag takes a mandatory on|off|auto value since llama.cpp b10273, so the valueless flag emitted a broken argv) and renamed setTensorReadLazy/TensorReadLazyMode to setLazyMode/LazyMode (llama.cpp b10731 renamed the tensor-read-lazy flag to lazy-mode with no alias). The provider calls both, so it cannot compile against 5.1.0 any more. - This deliberately names the RELEASE, not 5.2.0-SNAPSHOT: a snapshot would need a + This deliberately names the RELEASE, not 6.0.0-SNAPSHOT: a snapshot would need a entry for the Central snapshot channel (this repo declares none; the distributionManagement/snapshotRepository below is deploy-only) AND would block every srcmorph release, since Central rejects a release with a -SNAPSHOT dependency. The - build therefore stays red until net.ladenthin:llama:5.2.0 is published, and goes green + build therefore stays red until net.ladenthin:llama:6.0.0 is published, and goes green with no further edit the moment it is. --> - 5.2.0 + 6.0.0 6.1.3 3.0 3.7 @@ -147,7 +147,7 @@ SPDX-License-Identifier: Apache-2.0