Sync shared files and pin net.ladenthin:llama to 6.0.0

.github/buildcheck/tests/helpers.py

@@ -21,6 +21,11 @@ def workflow_text(jobs):
     return "\n".join(lines) + "\n"
 
 
-def upload(artifact, path="x/"):
-    return ["      - uses: actions/upload-artifact@v7", "        with:", f"          name: {artifact}",
-            f"          path: {path}"]
+def upload(artifact, path="x/", overwrite=False, if_no_files_found=None):
+    lines = ["      - uses: actions/upload-artifact@v7", "        with:", f"          name: {artifact}",
+             f"          path: {path}"]
+    if overwrite:
+        lines.append("          overwrite: true")
+    if if_no_files_found:
+        lines.append(f"          if-no-files-found: {if_no_files_found}")
+    return lines

.github/buildcheck/versions.py

@@ -32,7 +32,7 @@
 
 NS = "{http://maven.apache.org/POM/4.0.0}"
 POMS = {
-    "java-llama.cpp": ("pom.xml", "llama/pom.xml", "llama-langchain4j/pom.xml", "llama-kotlin/pom.xml",
+    "java-llama.cpp": ("pom.xml", "llama/pom.xml", "llama-langchain4j/pom.xml", "llama-kotlin/pom.xml", "llama-ffm/pom.xml",
                        "llama-platform/pom.xml", "llama-atmosphere-agent/pom.xml", "examples/server/pom.xml"),
     "BitcoinAddressFinder": ("pom.xml",),
     "srcmorph": ("pom.xml", "srcmorph/pom.xml", "srcmorph-cli/pom.xml", "srcmorph-maven-plugin/pom.xml"),

.github/shared-files.sha256

@@ -16,13 +16,13 @@
 5a70eee1bb8af180edfd2a4bae61be61fac15b409f5df6a8bb9869425d7fc381  .github/buildcheck/releasegate.py
 ff2aaec95e53916ea340a0a291bf0f57e0011522aedb486622b1fb1cac136865  .github/buildcheck/sharedfiles.py
 0059120aab539c6ce8055675ae0d3b040097f80320051e40385072f68845ddb0  .github/buildcheck/tests/__init__.py
-561efd3f26d7728e475c8ce83c10b4761a6703b585b7b2a7ab052df10f73166c  .github/buildcheck/tests/helpers.py
+a7af59d075b41c2dc9cce1facef527f96fc127b4e26e2ba7986a6e3f51a71e29  .github/buildcheck/tests/helpers.py
 4985f25fa177bd79a79335742adfd0da0431e101124b4e7e214906b56ae903de  .github/buildcheck/tests/test_workflow.py
 cbe504ad081ba31ec16e11c11f879c64179ca7741bf0b1d1318a7fc969ed67dd  .github/buildcheck/tests/test_releasegate.py
 fe36042fbd5444f0b454ad1304cdafde901dd8cec57cfaba7c7086d996dfee27  .github/buildcheck/tests/test_sharedfiles.py
 7fe208dd33184b4543328f97b339c95e23c408b120e6bfa6095de4182aeb9a19  .github/check-release-gate.py
 1604ccdea83998814a3c1f98f746272222039867b0c7d692355e61495c1c648b  .github/check-shared-files.py
-74b4b18af6c5be2af54048de408ec6e138f37f85b9f9ed2fdef258e270a7c90c  .github/buildcheck/versions.py
+ea373db1a28e16711110e50f1c2159e5d40b4e400fa22779883d1ce75971eb6e  .github/buildcheck/versions.py
 de437064302f9314028afff00e17fc995e48869e07ee402206d23708c7ed355a  .github/buildcheck/tests/test_versions.py
 0c78f43dd181f079d35edde7cbf25bb22eac92c907845d8dc8eec78e812aa097  .github/check-versions.py
 33c70847b6568604e8725d167a9b1d5910cc2a1a5b01fec7362be31b488ddb02  .github/buildcheck/runscripts.py
@@ -51,23 +51,23 @@ e8f444ef851bd134330f1505f52b4b0970ef9a62dd76e4c25829241814ba5c73  .github/ISSUE_
 71ec85b7a30e80b18a9ab1fac0199cc50d68548e6f00dd116ab0f904ad63aa50  .mvn/jvm.config.license
 46fc025df0fd7b1bdbd84b875652ce9981aec87c2bb49b9263ae8c383cf7ce5a  .mvn/settings.xml
 8b8abf79508c4f53b2e765b78d6142655631d5ed69b59e95f234416a62e057b6  CITATION.cff?repo
-21341be0ac0628437973ddc2eb21ba9ea68a365d9d71dedee1512e10507649f0  .github/workflows/sonarqube.yml?repo
+49eda3d2e846e1b5ec1d0f646a1adafb45ef42efbc3a50931df207bf9759ef13  .github/workflows/sonarqube.yml?repo
 6e2ae11dad0616f66bbb2b6e6556f580bb987fd911d7132aa6bee2bfc7cc7b52  .java-version
 71ec85b7a30e80b18a9ab1fac0199cc50d68548e6f00dd116ab0f904ad63aa50  .java-version.license
-bee58687456c0695990a925ac50a2c17b71768a8ef493b584d7ac679debed7b9  .github/workflows/claude.yml
-19ccc3d4f0aef292c19883d4766a0193e9a3e998514f461df6609ccf65a19492  .github/workflows/claude-code-review.yml
-13ada38d1cd8d06b5098aab0ee996429156a2251daa11fb331c02248b7e6a40e  .github/workflows/scorecard.yml
-c0e9885eaab7a660fe2c236e3f10df284a6b2f42dad9ce59084a2d7ab00aa9cf  .github/workflows/reuse.yml
-f3b1a0864200236c61a5807b1e59236d474431a27695cd9d977bc6636d582667  .github/workflows/osv-scanner.yml
-2c43a2b7f4352b7bb09b6e487256ba74c18c170394946b0303b116c88f7b851c  .github/workflows/codeql.yml
+3f73b87c4675376cbe80f1fb914bd7020062dcdb9a7ee503d3ef787fd462358a  .github/workflows/claude.yml
+085f19495d9e0812dc90268ea7917579bd6eaf749c669a9f01922272a5cdf06f  .github/workflows/claude-code-review.yml
+463c34f6244675ee5bee3d28c28c84f5eb3c8bea4f45de3f6ce477348d29589c  .github/workflows/scorecard.yml
+480afc0c1e41f3997b195d7297750b43599ba71a7471657aa32bfc9662b6fd30  .github/workflows/reuse.yml
+cf75cdc06e5ab02359c12b6a8eecb97f2dd3d95502cd2b397d539584cefa56c3  .github/workflows/osv-scanner.yml
+52182fe4073eb696606813d768ff9444e6b751978f9d27a8d84cc269e9f6cb3a  .github/workflows/codeql.yml
 c9e757f2d0a2f456a08791697a94161c776d9b008a8aa75890da4133c81a99e9  .github/dependabot.yml
 abea5fb970a46ccf9ba9127d59abf304202efd13c2d6a28da2ff75da0c92a9b8  .github/smoke-fatjar-cli.sh
 c38151495be64cedc3f11c23b88ffc53f4e0f9d2ce5c0aaaa42b14e4af7e13ec  lombok.config
 f26d05f25a154b84d8f281bb92857811749e2225cdbc167362de930c48b532d1  .github/workflows/publish.yml#startgate
-89738e9b6939e31a452ea7d40adb6514c89e6209ed57fd4d574c8ba047f11e36  .github/workflows/publish.yml#shared-files
-fcb6cd0e2a71205b918f545f2680d378c790b774b9852129c5f9c7f3f8eb9860  .github/workflows/publish.yml#verify-signing-key
+e3dde66089fd568f03caeefee86ea36a9f6eb7f47e5dc6d053e0e5784fd7a208  .github/workflows/publish.yml#shared-files
+3ef45f189f4419e0d4087f572b3c1b6085c0fe39ac7979b07deb2e882f7ffe8c  .github/workflows/publish.yml#verify-signing-key
 09230b04c5f14bdda50a0c862152ff197a656cbc3fd0d110899c5f8150f8aa9a  .github/workflows/publish.yml#check-snapshot
 51e987d59efd9887b43e345edc0e0f3db21686879e3ca6ea9f0fdbc493d37121  .github/workflows/publish.yml#check-tag
-a8637f88765da759a6eaba243d0d0d695053174df581ccbbcc5e5f3a475fc9e9  .github/workflows/publish.yml#verify-signing-key-gradle
-83a1288c55d35e4d3972e013009577fb594a9a5fb8b9b7c96a7f6a19db20d8d1  .github/workflows/publish.yml#github-snapshot
-ce90d90fcb1f2de35075b91c74411e9eb7d3b43e7965fd592744e914fd04c5db  .github/workflows/publish.yml#github-release
+06f0af70ed125dc5cc1506e27970059fb831971d3faaee56f868789f3282fdf9  .github/workflows/publish.yml#verify-signing-key-gradle
+c2684a3f93aaf552c13f845307536c2a14dda315c7d7b1e416bc66951b811dc1  .github/workflows/publish.yml#github-snapshot
+c09a030706dbea4221851ca0fcbfa6fc686165b408724724ade61724da6e123b  .github/workflows/publish.yml#github-release

.github/workflows/claude-code-review.yml

@@ -19,13 +19,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 1
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@a26b07d8c778b0c43f64618e5fd29fd0f8af72e8 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           prompt: |

.github/workflows/claude.yml

@@ -30,13 +30,13 @@ jobs:
       actions: read # Required for Claude to read CI results on PRs
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 1
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@a26b07d8c778b0c43f64618e5fd29fd0f8af72e8 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 

.github/workflows/codeql.yml

@@ -18,12 +18,18 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-java@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      # Two JDKs, as in every job that builds a whole reactor: a module with a Java floor above
+      # .java-version (java-llama.cpp's llama-ffm, Java 22) builds through maven-toolchains-plugin,
+      # and setup-java writes a toolchains.xml entry per JDK it installs; the second step keeps
+      # JAVA_HOME on .java-version. Harmless in a repository without such a module. Shared file.
+      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
+        with: { java-version: '25', distribution: temurin }
+      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
         with: { java-version-file: .java-version, distribution: temurin }
-      - uses: github/codeql-action/init@v4
+      - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
         with: { languages: java, queries: +security-and-quality }
       - name: Build with Maven
         run: mvn --batch-mode --no-transfer-progress compile
-      - uses: github/codeql-action/analyze@v4
+      - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
         with: { category: "/language:java" }

.github/workflows/osv-scanner.yml

@@ -18,15 +18,15 @@ permissions:
 jobs:
   scan-scheduled:
     if: ${{ github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.6.0"
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc" # v2.6.0
     permissions:
       actions: read
       contents: read
       security-events: write
 
   scan-pr:
     if: ${{ github.event_name == 'pull_request' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.6.0"
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc" # v2.6.0
     permissions:
       actions: read
       contents: read