Merge branch 'main' into jdbc

Author: laurit

.github/scripts/dependencies.dockerfile

@@ -0,0 +1,3 @@
+# this file exists so that Renovate can auto-update docker image versions that are then used elsewhere
+
+FROM lycheeverse/lychee:sha-2aa22f8@sha256:2e3786630482c41f9f2dd081e06d7da1c36d66996e8cf6573409b8bc418d48c4 AS lychee

.github/scripts/link-check.sh

@@ -0,0 +1,35 @@
+#!/bin/bash
+
+set -e
+
+export MSYS_NO_PATHCONV=1 # for Git Bash on Windows
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+LYCHEE_CONFIG="$SCRIPT_DIR/../../.lychee.toml"
+DEPENDENCIES_DOCKERFILE="$SCRIPT_DIR/dependencies.dockerfile"
+
+# Extract lychee version from dependencies.dockerfile
+LYCHEE_VERSION=$(grep "FROM lycheeverse/lychee:" "$DEPENDENCIES_DOCKERFILE" | sed 's/.*FROM lycheeverse\/lychee:\([^ ]*\).*/\1/')
+
+# Build the lychee command with optional GitHub token
+CMD="lycheeverse/lychee:$LYCHEE_VERSION --verbose --config $(basename "$LYCHEE_CONFIG")"
+
+# Add GitHub token if available
+if [[ -n "$GITHUB_TOKEN" ]]; then
+    CMD="$CMD --github-token $GITHUB_TOKEN"
+fi
+
+# Add the target directory
+CMD="$CMD ."
+
+# Determine if we should allocate a TTY
+DOCKER_FLAGS="--rm --init"
+if [[ -t 0 ]]; then
+    DOCKER_FLAGS="$DOCKER_FLAGS -it"
+else
+    DOCKER_FLAGS="$DOCKER_FLAGS -i"
+fi
+
+# Run lychee with proper signal handling
+# shellcheck disable=SC2086
+exec docker run $DOCKER_FLAGS -v "$(dirname "$LYCHEE_CONFIG")":/data -w /data $CMD

.github/workflows/build-daily-no-build-cache.yml

@@ -27,7 +27,7 @@ jobs:
   # muzzle is not included here because it doesn't use gradle cache anyway and so is already covered
   # by the normal daily build
 
-  # markdown-link-check and misspell-check are not included here because they don't use gradle cache
+  # link-check and misspell-check are not included here because they don't use gradle cache
   # anyway and so are already covered by the normal daily build
 
   workflow-notification:

.github/workflows/build-daily.yml

@@ -26,8 +26,8 @@ jobs:
   shell-script-check:
     uses: ./.github/workflows/reusable-shell-script-check.yml
 
-  markdown-link-check:
-    uses: ./.github/workflows/reusable-markdown-link-check.yml
+  link-check:
+    uses: ./.github/workflows/reusable-link-check.yml
 
   markdown-lint-check:
     uses: ./.github/workflows/reusable-markdown-lint-check.yml
@@ -43,7 +43,7 @@ jobs:
       - common
       - test-latest-deps
       - muzzle
-      - markdown-link-check
+      - link-check
       - misspell-check
     if: always()
     uses: ./.github/workflows/reusable-workflow-notification.yml
@@ -53,6 +53,6 @@ jobs:
           needs.common.result == 'success' &&
           needs.test-latest-deps.result == 'success' &&
           needs.muzzle.result == 'success' &&
-          needs.markdown-link-check.result == 'success' &&
+          needs.link-check.result == 'success' &&
           needs.misspell-check.result == 'success'
         }}

.github/workflows/build-pull-request.yml

@@ -43,11 +43,11 @@ jobs:
     uses: ./.github/workflows/reusable-shell-script-check.yml
 
   # this is not a required check to avoid blocking pull requests if external links break
-  markdown-link-check:
+  markdown-check:
     # release branches are excluded because the README.md javaagent download link has to be updated
     # on release branches before the release download has been published
     if: "!startsWith(github.ref_name, 'release/') && !startsWith(github.base_ref, 'release/')"
-    uses: ./.github/workflows/reusable-markdown-link-check.yml
+    uses: ./.github/workflows/reusable-link-check.yml
 
   markdown-lint-check:
     uses: ./.github/workflows/reusable-markdown-lint-check.yml

.github/workflows/build.yml

@@ -37,12 +37,12 @@ jobs:
     if: "!startsWith(github.ref_name, 'release/')"
     uses: ./.github/workflows/reusable-shell-script-check.yml
 
-  markdown-link-check:
+  link-check:
     # release branches are excluded to avoid unnecessary maintenance if external links break
     # (and also because the README.md javaagent download link has to be updated on release branches
     #  before the release download has been published)
     if: "!startsWith(github.ref_name, 'release/')"
-    uses: ./.github/workflows/reusable-markdown-link-check.yml
+    uses: ./.github/workflows/reusable-link-check.yml
 
   markdown-lint-check:
     # release branches are excluded
@@ -58,7 +58,7 @@ jobs:
   publish-snapshots:
     needs:
       # intentionally not blocking snapshot publishing on test-latest-deps, muzzle,
-      # markdown-link-check, or misspell-check
+      # link-check, or misspell-check
       - common
     runs-on: ubuntu-latest
     # skipping release branches because the versions in those branches are not snapshots

.github/workflows/codeql.yml

@@ -57,7 +57,7 @@ jobs:
           cache-read-only: ${{ github.event_name == 'pull_request' }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
+        uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           languages: ${{ matrix.language }}
           # using "latest" helps to keep up with the latest Kotlin support
@@ -73,6 +73,6 @@ jobs:
         run: ./gradlew assemble -x javadoc -x :instrumentation:quarkus-resteasy-reactive:quarkus3-testing:quarkusGenerateCodeDev -x :instrumentation:quarkus-resteasy-reactive:quarkus2-testing:quarkusGenerateCodeDev --no-build-cache --no-daemon
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
+        uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/ossf-scorecard.yml

@@ -42,6 +42,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
+        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           sarif_file: results.sarif

.github/workflows/release.yml

@@ -100,7 +100,8 @@ jobs:
           SONATYPE_KEY: ${{ secrets.SONATYPE_KEY }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}
-        run: ./gradlew assemble spdxSbom publishToSonatype closeAndReleaseSonatypeStagingRepository
+        # run: ./gradlew assemble spdxSbom publishToSonatype closeAndReleaseSonatypeStagingRepository
+        run: ./gradlew assemble spdxSbom publishAllPublicationToReleaseRepoRepository generateReleaseBundle uploadReleaseBundle
 
       - name: Build and publish gradle plugins
         env:

.github/workflows/reusable-link-check.yml

@@ -0,0 +1,18 @@
+name: Reusable - Link check
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  link-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Link check
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: ./.github/scripts/link-check.sh