Merge remote-tracking branch 'origin/update-from-template' into develop

Author: AB-xdev

.config/pmd/java/ruleset.xml

@@ -218,6 +218,71 @@
 		</properties>
 	</rule>
 
+	<rule name="AvoidPostConstruct"
+		language="java"
+		message="Avoid @PostConstruct"
+		class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
+		<description>
+			Using a `@PostConstruct` method is usually only done when field injection is used and initialization needs to be performed after that.
+
+			It's better to do this directly in the constructor with constructor injection, so that all logic will be encapsulated there.
+			This also makes using the bean in environments where JavaEE is not present - for example in tests - a lot easier, as forgetting to call the `@PostConstruct` method is no longer possible.
+		</description>
+		<priority>3</priority>
+		<properties>
+			<property name="xpath">
+				<value>
+					<![CDATA[
+//MethodDeclaration[pmd-java:hasAnnotation('jakarta.annotation.PostConstruct')]
+]]>
+				</value>
+			</property>
+		</properties>
+	</rule>
+
+	<rule name="AvoidPreDestroy"
+		language="java"
+		message="Avoid @PreDestroy"
+		class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
+		<description>
+			`@PreDestroy` should be replaced by implementing `AutoCloseable` and overwriting the `close` method instead.
+
+			This also makes using the bean in environments where JavaEE is not present - for example in tests - a lot easier, as forgetting to call the `@PreDestroy` method is no much more difficult.
+		</description>
+		<priority>3</priority>
+		<properties>
+			<property name="xpath">
+				<value>
+					<![CDATA[
+//MethodDeclaration[pmd-java:hasAnnotation('jakarta.annotation.PreDestroy')]
+]]>
+				</value>
+			</property>
+		</properties>
+	</rule>
+
+	<rule name="AvoidUnmanagedThreads"
+		language="java"
+		message="Avoid unmanaged threads"
+		class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
+		<description>
+			Trying to manually manage threads usually gets quickly out of control and may result in various problems like uncontrollable spawning of threads.
+			Threads can also not be cancelled properly.
+
+			Use managed Thread services like `ExecutorService` and `CompletableFuture` instead.
+		</description>
+		<priority>3</priority>
+		<properties>
+			<property name="xpath">
+				<value>
+					<![CDATA[
+//MethodCall[pmd-java:matchesSig('java.lang.Thread#start()') or pmd-java:matchesSig('java.lang.Thread#startVirtualThread(java.lang.Runnable)') or pmd-java:matchesSig('java.lang.Thread$Builder#start(java.lang.Runnable)')]
+]]>
+				</value>
+			</property>
+		</properties>
+	</rule>
+
 	<rule name="JavaObjectSerializationIsUnsafe"
 		language="java"
 		message="Using Java Object (De-)Serialization is unsafe and has led to too many security vulnerabilities"

.github/workflows/broken-links.yml

@@ -29,7 +29,7 @@ jobs:
           echo "number=$(gh issue list -l 'bug' -l 'automated' -L 1 -S 'in:title \"Link Checker Report\"' -s 'open' --json 'number' --jq '.[].number')" >> $GITHUB_OUTPUT
         env:
           GH_TOKEN: ${{ github.token }}
-          
+
       - name: Close issue if everything is fine
         if: steps.lychee.outputs.exit_code == 0 && steps.find-issue.outputs.number != ''
         run: gh issue close -r 'not planned' ${{ steps.find-issue.outputs.number }}

.github/workflows/check-build.yml

@@ -26,22 +26,27 @@ jobs:
   build:
     runs-on: ubuntu-latest
     timeout-minutes: 30
-
     strategy:
       matrix:
         java: [17, 21]
         distribution: [temurin]
-
     steps:
     - uses: actions/checkout@v5
-      
+
     - name: Set up JDK
       uses: actions/setup-java@v5
       with:
         distribution: ${{ matrix.distribution }}
         java-version: ${{ matrix.java }}
-        cache: 'maven'
-    
+
+    - name: Cache Maven
+      uses: actions/cache@v4
+      with:
+        path: ~/.m2/repository
+        key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }}
+        restore-keys: |
+          ${{ runner.os }}-mvn-build-
+
     - name: Cache Vaadin prod bundles
       uses: actions/cache@v4
       with:
@@ -50,10 +55,10 @@ jobs:
         key: ${{ runner.os }}-vaadin-prod-bundles-${{ hashFiles('**/pom.xml') }}
         restore-keys: |
           ${{ runner.os }}-vaadin-prod-bundles-
-      
+
     - name: Build with Maven
-      run: ./mvnw -B clean package -Pproduction
-      
+      run: ./mvnw -B clean package
+
     - name: Check for uncommited changes
       run: |
         if [[ "$(git status --porcelain)" != "" ]]; then
@@ -83,21 +88,34 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.event_name != 'pull_request' || !startsWith(github.head_ref, 'renovate/') }}
     timeout-minutes: 15
-
     strategy:
       matrix:
         java: [17]
         distribution: [temurin]
-
     steps:
     - uses: actions/checkout@v5
-      
+
     - name: Set up JDK
       uses: actions/setup-java@v5
       with:
         distribution: ${{ matrix.distribution }}
         java-version: ${{ matrix.java }}
-        cache: 'maven'
+
+    - name: Cache Maven
+      uses: actions/cache@v4
+      with:
+        path: ~/.m2/repository
+        key: ${{ runner.os }}-mvn-checkstyle-${{ hashFiles('**/pom.xml') }}
+        restore-keys: |
+          ${{ runner.os }}-mvn-checkstyle-
+
+    - name: CheckStyle Cache
+      uses: actions/cache@v4
+      with:
+        path: '**/target/checkstyle-cachefile'
+        key: ${{ runner.os }}-checkstyle-${{ hashFiles('**/pom.xml') }}
+        restore-keys: |
+          ${{ runner.os }}-checkstyle-
 
     - name: Run Checkstyle
       run: ./mvnw -B checkstyle:check -P checkstyle -T2C
@@ -106,12 +124,10 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.event_name != 'pull_request' || !startsWith(github.head_ref, 'renovate/') }}
     timeout-minutes: 15
-
     strategy:
       matrix:
         java: [17]
         distribution: [temurin]
-
     steps:
     - uses: actions/checkout@v5
 
@@ -120,7 +136,22 @@ jobs:
       with:
         distribution: ${{ matrix.distribution }}
         java-version: ${{ matrix.java }}
-        cache: 'maven'
+
+    - name: Cache Maven
+      uses: actions/cache@v4
+      with:
+        path: ~/.m2/repository
+        key: ${{ runner.os }}-mvn-pmd-${{ hashFiles('**/pom.xml') }}
+        restore-keys: |
+          ${{ runner.os }}-mvn-pmd-
+
+    - name: PMD Cache
+      uses: actions/cache@v4
+      with:
+        path: '**/target/pmd/pmd.cache'
+        key: ${{ runner.os }}-pmd-${{ hashFiles('**/pom.xml') }}
+        restore-keys: |
+          ${{ runner.os }}-pmd-
 
     - name: Run PMD
       run: ./mvnw -B test pmd:aggregate-pmd-no-fork pmd:check -P pmd -DskipTests -T2C

.github/workflows/release.yml

@@ -8,20 +8,30 @@ permissions:
   contents: write
   pull-requests: write
 
+# DO NOT RESTORE CACHE for critical release steps to prevent a (extremely unlikely) scenario 
+# where a supply chain attack could be achieved due to poisoned cache
 jobs:
   check-code:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
     - uses: actions/checkout@v5
-      
+
     - name: Set up JDK
       uses: actions/setup-java@v5
       with:
         java-version: '17'
         distribution: 'temurin'
-        cache: 'maven'
-      
+
+    # Try to reuse existing cache from check-build
+    - name: Try restore Maven Cache
+      uses: actions/cache/restore@v4
+      with:
+        path: ~/.m2/repository
+        key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }}
+        restore-keys: |
+          ${{ runner.os }}-mvn-build-
+
     - name: Build with Maven
       run: ./mvnw -B clean package -Pproduction -T2C
 
@@ -51,30 +61,30 @@ jobs:
       upload_url: ${{ steps.create-release.outputs.upload_url }}
     steps:
     - uses: actions/checkout@v5
-      
+
     - name: Configure Git
       run: |
         git config --global user.email "[email protected]"
         git config --global user.name "GitHub Actions"
-  
+
     - name: Un-SNAP 
       run: ./mvnw -B versions:set -DremoveSnapshot -DprocessAllModules -DgenerateBackupPoms=false
-  
+
     - name: Get version
       id: version
       run: |
         version=$(./mvnw help:evaluate -Dexpression=project.version -q -DforceStdout)
         echo "release=$version" >> $GITHUB_OUTPUT
         echo "releasenumber=${version//[!0-9]/}" >> $GITHUB_OUTPUT
-  
+
     - name: Commit and Push
       run: |
         git add -A
         git commit -m "Release ${{ steps.version.outputs.release }}"
         git push origin
         git tag v${{ steps.version.outputs.release }}
         git push origin --tags
-    
+
     - name: Create Release
       id: create-release
       uses: shogo82148/actions-create-release@4661dc54f7b4b564074e9fbf73884d960de569a3 # v1
@@ -118,7 +128,7 @@ jobs:
     timeout-minutes: 60
     steps:
     - uses: actions/checkout@v5
-    
+
     - name: Init Git and pull
       run: |
         git config --global user.email "[email protected]"
@@ -174,7 +184,7 @@ jobs:
     timeout-minutes: 15
     steps:
     - uses: actions/checkout@v5
-      
+
     - name: Init Git and pull
       run: |
         git config --global user.email "[email protected]"
@@ -186,7 +196,15 @@ jobs:
       with:
         java-version: '17'
         distribution: 'temurin'
-        cache: 'maven'
+
+    # Try to reuse existing cache from check-build
+    - name: Try restore Maven Cache
+      uses: actions/cache/restore@v4
+      with:
+        path: ~/.m2/repository
+        key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }}
+        restore-keys: |
+          ${{ runner.os }}-mvn-build-
 
     - name: Build site
       run: ./mvnw -B compile site -DskipTests -T2C
@@ -214,7 +232,7 @@ jobs:
     timeout-minutes: 10
     steps:
     - uses: actions/checkout@v5
-      
+
     - name: Init Git and pull
       run: |
         git config --global user.email "[email protected]"
@@ -229,7 +247,7 @@ jobs:
         git add -A
         git commit -m "Preparing for next development iteration"
         git push origin
-    
+
     - name: pull-request
       env:
         GH_TOKEN: ${{ github.token }}

.github/workflows/test-deploy.yml

@@ -33,7 +33,7 @@ jobs:
       env:
         PACKAGES_CENTRAL_TOKEN: ${{ secrets.PACKAGES_CENTRAL_TOKEN }}
         MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
-  
+
     - name: Set up JDK
       uses: actions/setup-java@v5
       with: # running setup-java again overwrites the settings.xml

.github/workflows/update-from-template.yml

@@ -43,7 +43,7 @@ jobs:
           # If no PAT is used the following error occurs on a push:
           # refusing to allow a GitHub App to create or update workflow `.github/workflows/xxx.yml` without `workflows` permission
           token: ${{ secrets.UPDATE_FROM_TEMPLATE_PAT }}
-      
+
       - name: Init Git
         run: |
           git config --global user.email "[email protected]"
@@ -190,7 +190,7 @@ jobs:
           # If no PAT is used the following error occurs on a push:
           # refusing to allow a GitHub App to create or update workflow `.github/workflows/xxx.yml` without `workflows` permission
           token: ${{ secrets.UPDATE_FROM_TEMPLATE_PAT }}
-      
+
       - name: Init Git
         run: |
           git config --global user.email "[email protected]"

.idea/codeStyles/Project.xml

@@ -273,7 +273,7 @@
 							<dependency>
 								<groupId>com.puppycrawl.tools</groupId>
 								<artifactId>checkstyle</artifactId>
-								<version>11.0.0</version>
+								<version>11.0.1</version>
 							</dependency>
 						</dependencies>
 						<configuration>
@@ -300,6 +300,7 @@
 						<artifactId>maven-pmd-plugin</artifactId>
 						<version>3.27.0</version>
 						<configuration>
+							<analysisCache>true</analysisCache>
 							<includeTests>true</includeTests>
 							<printFailingErrors>true</printFailingErrors>
 							<rulesets>

flow/pom.xml

@@ -49,7 +49,7 @@
 							<dependency>
 								<groupId>com.puppycrawl.tools</groupId>
 								<artifactId>checkstyle</artifactId>
-								<version>11.0.0</version>
+								<version>11.0.1</version>
 							</dependency>
 						</dependencies>
 						<configuration>
@@ -76,6 +76,7 @@
 						<artifactId>maven-pmd-plugin</artifactId>
 						<version>3.27.0</version>
 						<configuration>
+							<analysisCache>true</analysisCache>
 							<includeTests>true</includeTests>
 							<printFailingErrors>true</printFailingErrors>
 							<rulesets>