From cdbd713ed0a07b6b3de402fc98adb2d591ece70a Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Tue, 3 Feb 2026 04:43:13 +0000 Subject: [PATCH 01/25] Update net.sourceforge.pmd to v7.21.0 --- pom.xml | 4 ++-- template-placeholder/pom.xml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pom.xml b/pom.xml index d062774..803cb4d 100644 --- a/pom.xml +++ b/pom.xml @@ -83,12 +83,12 @@ net.sourceforge.pmd pmd-core - 7.20.0 + 7.21.0 net.sourceforge.pmd pmd-java - 7.20.0 + 7.21.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 597d823..cdb13a0 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -253,12 +253,12 @@ net.sourceforge.pmd pmd-core - 7.20.0 + 7.21.0 net.sourceforge.pmd pmd-java - 7.20.0 + 7.21.0 From 78e6f922261869bc7a6f939d185e46e35ed3f0aa Mon Sep 17 00:00:00 2001 From: AB Date: Wed, 4 Feb 2026 12:01:54 +0100 Subject: [PATCH 02/25] Updat to PMD 7.21.0 --- .config/pmd/java/ruleset.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index e96576b..e2325a9 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -146,7 +146,6 @@ - @@ -164,6 +163,7 @@ + From 076ea0fc43b6354042220d357fa595eeebf32f0b Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Fri, 6 Feb 2026 04:44:15 +0000 Subject: [PATCH 03/25] Update dependency com.puppycrawl.tools:checkstyle to v13.2.0 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index d062774..45d9bd4 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 13.1.0 + 13.2.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 597d823..0ea5a26 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 13.1.0 + 13.2.0 From 76cf22386537f750c979b63658ab3459f6b8586c Mon Sep 17 00:00:00 2001 From: AB Date: Fri, 20 Feb 2026 08:43:59 +0100 Subject: [PATCH 04/25] Disallow classes ending with Helper or Util Fixes https://github.com/xdev-software/java-setup-template/issues/7 --- .config/checkstyle/checkstyle.xml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.config/checkstyle/checkstyle.xml b/.config/checkstyle/checkstyle.xml index 463a629..262c9f9 100644 --- a/.config/checkstyle/checkstyle.xml +++ b/.config/checkstyle/checkstyle.xml @@ -79,6 +79,11 @@ + + + + + From 838f350c5da393d455f0b1de29397762af9111ac Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 23 Feb 2026 09:54:21 +0100 Subject: [PATCH 05/25] Avoid using Optional#get Fixes https://github.com/xdev-software/java-setup-template/issues/8 --- .config/pmd/java/ruleset.xml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index e2325a9..9dc7a0f 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -208,6 +208,36 @@ + + +`Optional#get` can be interpreted as a getter by developers, however this is not the case as it throws an exception when empty. + +It should be replaced by +* doing a mapping directly using `.map` or `.ifPresent` +* using the preferred `.orElseThrow`, `.orElse` or `.or` methods + +Java Developer Brian Goetz also writes regarding this topic: + +> Java 8 was a huge improvement to the platform, but one of the few mistakes we made was the naming of `Optional.get()`, because the name just invites people to call it without calling `isPresent()`, undermining the whole point of using `Optional` in the first place. +> +> During the Java 9 time frame, we proposed to deprecate `Optional.get()`, but the public response to that was ... let's say cold. As a smaller step, we introduced `orElseThrow()` in 10 (see [JDK-8140281](https://bugs.openjdk.java.net/browse/JDK-8140281)) as a more transparently named synonym for the current pernicious behavior of `get()`. IDEs warn on unconditional use of `get()`, but not on `orElseThrow()`, which is a step forward in teaching people to code better. The question is, in a sense, a "glass half empty" view of the current situation; `get()` is still problematic. + + 3 + + + + + + + + + Date: Thu, 26 Feb 2026 04:42:27 +0000 Subject: [PATCH 06/25] Update lycheeverse/lychee-action digest to 8646ba3 --- .github/workflows/broken-links.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/broken-links.yml b/.github/workflows/broken-links.yml index e6c3385..d768259 100644 --- a/.github/workflows/broken-links.yml +++ b/.github/workflows/broken-links.yml @@ -18,7 +18,7 @@ jobs: - name: Link Checker id: lychee - uses: lycheeverse/lychee-action@a8c4c7cb88f0c7386610c35eb25108e448569cb0 # v2 + uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2 with: fail: false # Don't fail on broken links, create an issue instead From 8b6624e632e759013ba7aa24ba6ec36f4951f500 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Thu, 26 Feb 2026 04:45:51 +0000 Subject: [PATCH 07/25] Update lycheeverse/lychee-action digest to 8646ba3 --- .github/workflows/broken-links.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/broken-links.yml b/.github/workflows/broken-links.yml index 2675c8b..5b50d06 100644 --- a/.github/workflows/broken-links.yml +++ b/.github/workflows/broken-links.yml @@ -19,7 +19,7 @@ jobs: - name: Link Checker id: lychee - uses: lycheeverse/lychee-action@a8c4c7cb88f0c7386610c35eb25108e448569cb0 # v2 + uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2 with: fail: false # Don't fail on broken links, create an issue instead From a53730bb4a5a0765d9972d93dd5884253f67b619 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Fri, 27 Feb 2026 04:43:58 +0000 Subject: [PATCH 08/25] Update actions/upload-artifact action to v7 --- .github/workflows/check-build.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check-build.yml b/.github/workflows/check-build.yml index b1a6d66..b5d7995 100644 --- a/.github/workflows/check-build.yml +++ b/.github/workflows/check-build.yml @@ -69,7 +69,7 @@ jobs: fi - name: Upload demo files - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@v7 with: name: demo-files-java-${{ matrix.java }} path: ${{ env.DEMO_MAVEN_MODULE }}/target/${{ env.DEMO_MAVEN_MODULE }}.jar @@ -152,7 +152,7 @@ jobs: - name: Upload report if: always() - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@v7 with: name: pmd-report if-no-files-found: ignore From 0dcf9cfe57c8d8c8ace1253845b67afb8bd47bda Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sun, 1 Mar 2026 04:48:23 +0000 Subject: [PATCH 09/25] Update dependency com.puppycrawl.tools:checkstyle to v13.3.0 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index a219280..e214afa 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 13.2.0 + 13.3.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 9e08842..2547c6f 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 13.2.0 + 13.3.0 From 77e37f981ecf107f1ebb690beb75262b3314b38e Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 2 Mar 2026 04:46:12 +0000 Subject: [PATCH 10/25] Update dependency net.sourceforge.pmd:pmd-core to v7.22.0 [SECURITY] --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index a219280..4cac133 100644 --- a/pom.xml +++ b/pom.xml @@ -83,7 +83,7 @@ net.sourceforge.pmd pmd-core - 7.21.0 + 7.22.0 net.sourceforge.pmd diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 9e08842..4a20d6d 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -253,7 +253,7 @@ net.sourceforge.pmd pmd-core - 7.21.0 + 7.22.0 net.sourceforge.pmd From 961291c3795ca9f249ce028fe98fe1524da6b0fb Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 2 Mar 2026 04:46:14 +0000 Subject: [PATCH 11/25] Update dependency net.sourceforge.pmd:pmd-java to v7.22.0 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index a219280..97f7b18 100644 --- a/pom.xml +++ b/pom.xml @@ -88,7 +88,7 @@ net.sourceforge.pmd pmd-java - 7.21.0 + 7.22.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 9e08842..3831400 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -258,7 +258,7 @@ net.sourceforge.pmd pmd-java - 7.21.0 + 7.22.0 From 6f9b5b39e904c2167782591b14a645b1fd49b730 Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 2 Mar 2026 12:00:46 +0100 Subject: [PATCH 12/25] Create report-gha-workflow-security-problems.yml Fixes https://github.com/xdev-software/base-template/issues/13 --- .../report-gha-workflow-security-problems.yml | 61 +++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 .github/workflows/report-gha-workflow-security-problems.yml diff --git a/.github/workflows/report-gha-workflow-security-problems.yml b/.github/workflows/report-gha-workflow-security-problems.yml new file mode 100644 index 0000000..b17aa53 --- /dev/null +++ b/.github/workflows/report-gha-workflow-security-problems.yml @@ -0,0 +1,61 @@ +name: Report workflow security problems + +on: + workflow_dispatch: + push: + branches: [ develop ] + paths: + - '.github/workflows/**' + +permissions: + issues: write + +jobs: + prt: + runs-on: ubuntu-latest + timeout-minutes: 15 + # Only run this in our repos (Prevent notification spam by forks) + if: ${{ github.repository_owner == 'xdev-software' }} + steps: + - uses: actions/checkout@v6 + + - name: Check + id: check + run: | + grep -l 'pull_request_target:' --exclude report-gha-workflow-security-problems.yml *.yml > reported.txt && exit 1 || exit 0 + working-directory: .github/workflows + + - name: Find already existing issue + id: find-issue + if: ${{ !cancelled() }} + run: | + echo "number=$(gh issue list -l 'bug' -l 'automated' -L 1 -S 'in:title "Incorrectly configure GHA workflow (prt)"' -s 'open' --json 'number' --jq '.[].number')" >> $GITHUB_OUTPUT + env: + GH_TOKEN: ${{ github.token }} + + - name: Close issue if everything is fine + if: ${{ success() && steps.find-issue.outputs.number != '' }} + run: gh issue close -r 'not planned' ${{ steps.find-issue.outputs.number }} + env: + GH_TOKEN: ${{ github.token }} + + - name: Create report + if: ${{ failure() && steps.check.conclusion == 'failure' }} + run: | + echo 'Detected usage of `pull_request_target`. This event is dangerous and MUST NOT BE USED AT ALL COST!' > reported.md + echo '' >> reported.md + echo '/cc @xdev-software/gha-workflow-security' >> reported.md + echo '' >> reported.md + echo '```' >> reported.md + cat .github/workflows/reported.txt >> reported.md + echo '```' >> reported.md + cat reported.md + + - name: Create Issue From File + if: ${{ failure() && steps.check.conclusion == 'failure' }} + uses: peter-evans/create-issue-from-file@fca9117c27cdc29c6c4db3b86c48e4115a786710 # v6 + with: + issue-number: ${{ steps.find-issue.outputs.number }} + title: 'Incorrectly configure GHA workflow (prt)' + content-filepath: ./reported.md + labels: bug, automated From 42dc90b3195e1e69fa68bd4229ed033f43475ccb Mon Sep 17 00:00:00 2001 From: AB Date: Fri, 6 Mar 2026 11:26:43 +0100 Subject: [PATCH 13/25] Ignore cancelled builds --- .github/workflows/check-build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/check-build.yml b/.github/workflows/check-build.yml index b5d7995..daae7b2 100644 --- a/.github/workflows/check-build.yml +++ b/.github/workflows/check-build.yml @@ -151,7 +151,7 @@ jobs: run: ./mvnw -B pmd:aggregate-cpd pmd:cpd-check -P pmd -DskipTests -T2C - name: Upload report - if: always() + if: ${{ !cancelled() }} uses: actions/upload-artifact@v7 with: name: pmd-report From 84e1242d26dadb2a8522dbaaa1563c0e613bf086 Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 9 Mar 2026 10:01:24 +0100 Subject: [PATCH 14/25] Enforce use of PMD plugin After feedback from colleague --- .idea/externalDependencies.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/.idea/externalDependencies.xml b/.idea/externalDependencies.xml index 78be5b8..0b477b8 100644 --- a/.idea/externalDependencies.xml +++ b/.idea/externalDependencies.xml @@ -3,5 +3,6 @@ + \ No newline at end of file From c8c9580accc185c3a234fda3012d41c089d0d913 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Tue, 10 Mar 2026 04:42:30 +0000 Subject: [PATCH 15/25] Update dependency maven to v3.9.13 --- .mvn/wrapper/maven-wrapper.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.mvn/wrapper/maven-wrapper.properties b/.mvn/wrapper/maven-wrapper.properties index 8dea6c2..71ea75a 100644 --- a/.mvn/wrapper/maven-wrapper.properties +++ b/.mvn/wrapper/maven-wrapper.properties @@ -1,3 +1,3 @@ wrapperVersion=3.3.4 distributionType=only-script -distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.12/apache-maven-3.9.12-bin.zip +distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.13/apache-maven-3.9.13-bin.zip From 4951b0b479fcf878b6ff00a3b1be5f3b465b25c0 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Fri, 13 Mar 2026 04:44:06 +0000 Subject: [PATCH 16/25] Update dependency maven to v3.9.14 --- .mvn/wrapper/maven-wrapper.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.mvn/wrapper/maven-wrapper.properties b/.mvn/wrapper/maven-wrapper.properties index 71ea75a..c595b00 100644 --- a/.mvn/wrapper/maven-wrapper.properties +++ b/.mvn/wrapper/maven-wrapper.properties @@ -1,3 +1,3 @@ wrapperVersion=3.3.4 distributionType=only-script -distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.13/apache-maven-3.9.13-bin.zip +distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.14/apache-maven-3.9.14-bin.zip From cbd7ac875acfbd2d36c29ffcbcbebcf315560235 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sun, 15 Mar 2026 04:56:46 +0000 Subject: [PATCH 17/25] Update shogo82148/actions-create-release digest to 6a39603 --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3f55399..2b7941b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -91,7 +91,7 @@ jobs: - name: Create Release id: create-release - uses: shogo82148/actions-create-release@559c27ce7eb834825e2b55927c64f6d1bd1db716 # v1 + uses: shogo82148/actions-create-release@6a396031bc74c57403da1018fec74d24c6aa03cd # v1 with: tag_name: v${{ steps.version.outputs.release }} release_name: v${{ steps.version.outputs.release }} From b6c60e60be46f6fa52a6fe415e0e0b16e8e2b886 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Sat, 28 Mar 2026 04:47:46 +0000 Subject: [PATCH 18/25] Update net.sourceforge.pmd to v7.23.0 --- pom.xml | 4 ++-- template-placeholder/pom.xml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pom.xml b/pom.xml index 4d53635..c19848e 100644 --- a/pom.xml +++ b/pom.xml @@ -83,12 +83,12 @@ net.sourceforge.pmd pmd-core - 7.22.0 + 7.23.0 net.sourceforge.pmd pmd-java - 7.22.0 + 7.23.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index abef60d..5931b6c 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -253,12 +253,12 @@ net.sourceforge.pmd pmd-core - 7.22.0 + 7.23.0 net.sourceforge.pmd pmd-java - 7.22.0 + 7.23.0 From 7192c1a29f1848257b77974333a1108d2869db49 Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 30 Mar 2026 05:09:13 +0000 Subject: [PATCH 19/25] Update dependency com.puppycrawl.tools:checkstyle to v13.4.0 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 4d53635..1f91c95 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 13.3.0 + 13.4.0 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index abef60d..97dc504 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 13.3.0 + 13.4.0 From 225c79b88ca0fb52a376de459f5ed4c7890a498f Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 30 Mar 2026 14:59:05 +0200 Subject: [PATCH 20/25] Prepare for new templating system --- .config/topo/upstream.yml | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 .config/topo/upstream.yml diff --git a/.config/topo/upstream.yml b/.config/topo/upstream.yml new file mode 100644 index 0000000..d78d893 --- /dev/null +++ b/.config/topo/upstream.yml @@ -0,0 +1,2 @@ +- url: https://github.com/xdev-software/base-template.git + branch: master From fcf8b930e9544886a329758cd7fe21ad474bd337 Mon Sep 17 00:00:00 2001 From: "Alex \"Blex\" B" <45384811+AB-xdev@users.noreply.github.com> Date: Mon, 30 Mar 2026 15:01:53 +0200 Subject: [PATCH 21/25] Update upstream.yml --- .config/topo/upstream.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.config/topo/upstream.yml b/.config/topo/upstream.yml index d78d893..7821ddf 100644 --- a/.config/topo/upstream.yml +++ b/.config/topo/upstream.yml @@ -1,2 +1,2 @@ -- url: https://github.com/xdev-software/base-template.git +- url: https://github.com/xdev-software/java-template.git branch: master From 3e30eebf5761e3e4ba41e2576938445c49500200 Mon Sep 17 00:00:00 2001 From: "Alex \"Blex\" B" <45384811+AB-xdev@users.noreply.github.com> Date: Mon, 30 Mar 2026 15:05:59 +0200 Subject: [PATCH 22/25] Create upstream.yml --- .config/topo/upstream.yml | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 .config/topo/upstream.yml diff --git a/.config/topo/upstream.yml b/.config/topo/upstream.yml new file mode 100644 index 0000000..8627eae --- /dev/null +++ b/.config/topo/upstream.yml @@ -0,0 +1,2 @@ +- url: https://github.com/xdev-software/java-setup-template.git + branch: master From 687c673ae447c3881b1c6fc8541111ccf847c842 Mon Sep 17 00:00:00 2001 From: AB Date: Mon, 30 Mar 2026 15:11:51 +0200 Subject: [PATCH 23/25] Update upstream.yml --- .config/topo/upstream.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.config/topo/upstream.yml b/.config/topo/upstream.yml index d78d893..7821ddf 100644 --- a/.config/topo/upstream.yml +++ b/.config/topo/upstream.yml @@ -1,2 +1,2 @@ -- url: https://github.com/xdev-software/base-template.git +- url: https://github.com/xdev-software/java-template.git branch: master From fa9ccfa8a0714ff512fb760675b7f14bf0534f21 Mon Sep 17 00:00:00 2001 From: AB Date: Tue, 31 Mar 2026 09:54:49 +0200 Subject: [PATCH 24/25] Update upstream.yml --- .config/topo/upstream.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.config/topo/upstream.yml b/.config/topo/upstream.yml index 7821ddf..0cc67cd 100644 --- a/.config/topo/upstream.yml +++ b/.config/topo/upstream.yml @@ -1,2 +1,2 @@ -- url: https://github.com/xdev-software/java-template.git +- url: https://github.com/xdev-software/standard-maven-template.git branch: master From c0e52bd19d9671cf5b53ddfffd8ba4fae4b86b67 Mon Sep 17 00:00:00 2001 From: AB Date: Tue, 31 Mar 2026 14:08:01 +0200 Subject: [PATCH 25/25] Delete update-from-template.yml Will be managed centrally now --- .github/workflows/update-from-template.yml | 318 --------------------- 1 file changed, 318 deletions(-) delete mode 100644 .github/workflows/update-from-template.yml diff --git a/.github/workflows/update-from-template.yml b/.github/workflows/update-from-template.yml deleted file mode 100644 index 7cff559..0000000 --- a/.github/workflows/update-from-template.yml +++ /dev/null @@ -1,318 +0,0 @@ -name: Update from Template - -# This workflow keeps the repo up to date with changes from the template repo (REMOTE_URL) -# It duplicates the REMOTE_BRANCH (into UPDATE_BRANCH) and tries to merge it into -# this repos default branch (which is checked out here) -# Note that this requires a PAT (Personal Access Token) - at best from a servicing account -# PAT permissions: read:discussion, read:org, repo, workflow -# Also note that you should have at least once merged the template repo into the current repo manually -# otherwise a "refusing to merge unrelated histories" error might occur. - -on: - schedule: - - cron: '55 2 * * 1' - workflow_dispatch: - inputs: - no_automatic_merge: - type: boolean - description: 'No automatic merge' - default: false - -env: - UPDATE_BRANCH: update-from-template - UPDATE_BRANCH_MERGED: update-from-template-merged - REMOTE_URL: https://github.com/xdev-software/base-template.git - REMOTE_BRANCH: master - -permissions: - contents: write - pull-requests: write - -jobs: - update: - runs-on: ubuntu-latest - outputs: - update_branch_merged_commit: ${{ steps.manage-branches.outputs.update_branch_merged_commit }} - create_update_branch_merged_pr: ${{ steps.manage-branches.outputs.create_update_branch_merged_pr }} - steps: - - uses: actions/checkout@v6 - with: - # Required because otherwise there are always changes detected when executing diff/rev-list - fetch-depth: 0 - # If no PAT is used the following error occurs on a push: - # refusing to allow a GitHub App to create or update workflow `.github/workflows/xxx.yml` without `workflows` permission - token: ${{ secrets.UPDATE_FROM_TEMPLATE_PAT }} - - - name: Init Git - run: | - git config --global user.email "111048771+xdev-gh-bot@users.noreply.github.com" - git config --global user.name "XDEV Bot" - - - name: Manage branches - id: manage-branches - run: | - echo "Adding remote template-repo" - git remote add template ${{ env.REMOTE_URL }} - - echo "Fetching remote template repo" - git fetch template - - echo "Deleting local branches that will contain the updates - if present" - git branch -D ${{ env.UPDATE_BRANCH }} || true - git branch -D ${{ env.UPDATE_BRANCH_MERGED }} || true - - echo "Checking if the remote template repo has new commits" - git rev-list ..template/${{ env.REMOTE_BRANCH }} - - if [ $(git rev-list --count ..template/${{ env.REMOTE_BRANCH }}) -eq 0 ]; then - echo "There are no commits new commits on the template repo" - - echo "Deleting origin branch(es) that contain the updates - if present" - git push -f origin --delete ${{ env.UPDATE_BRANCH }} || true - git push -f origin --delete ${{ env.UPDATE_BRANCH_MERGED }} || true - - echo "create_update_branch_pr=0" >> $GITHUB_OUTPUT - echo "create_update_branch_merged_pr=0" >> $GITHUB_OUTPUT - exit 0 - fi - - echo "Found new commits on the template repo" - - echo "Creating update branch" - git branch ${{ env.UPDATE_BRANCH }} template/${{ env.REMOTE_BRANCH }} - git branch --unset-upstream ${{ env.UPDATE_BRANCH }} - - echo "Pushing update branch" - git push -f -u origin ${{ env.UPDATE_BRANCH }} - - echo "Getting base branch" - base_branch=$(git branch --show-current) - echo "Base branch is $base_branch" - echo "base_branch=$base_branch" >> $GITHUB_OUTPUT - - echo "Trying to create auto-merged branch ${{ env.UPDATE_BRANCH_MERGED }}" - git branch ${{ env.UPDATE_BRANCH_MERGED }} ${{ env.UPDATE_BRANCH }} - git checkout ${{ env.UPDATE_BRANCH_MERGED }} - - echo "Merging branch $base_branch into ${{ env.UPDATE_BRANCH_MERGED }}" - git merge $base_branch && merge_exit_code=$? || merge_exit_code=$? - if [ $merge_exit_code -ne 0 ]; then - echo "Auto merge failed! Manual merge required" - echo "::notice ::Auto merge failed - Manual merge required" - - echo "Cleaning up failed merge" - git merge --abort - git checkout $base_branch - git branch -D ${{ env.UPDATE_BRANCH_MERGED }} || true - - echo "Deleting auto-merge branch - if present" - git push -f origin --delete ${{ env.UPDATE_BRANCH_MERGED }} || true - - echo "create_update_branch_pr=1" >> $GITHUB_OUTPUT - echo "create_update_branch_merged_pr=0" >> $GITHUB_OUTPUT - exit 0 - fi - - echo "Post processing: Trying to automatically fill in template variables" - find . -type f \ - -not -path "./.git/**" \ - -not -path "./.github/workflows/update-from-template.yml" -print0 \ - | xargs -0 sed -i "s/template-placeholder/${GITHUB_REPOSITORY#*/}/g" - - git status - git add --all - - if [[ "$(git status --porcelain)" != "" ]]; then - echo "Filled in template; Committing" - - git commit -m "Fill in template" - fi - - echo "Pushing auto-merged branch" - git push -f -u origin ${{ env.UPDATE_BRANCH_MERGED }} - - echo "update_branch_merged_commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT - - echo "Restoring base branch $base_branch" - git checkout $base_branch - - echo "create_update_branch_pr=0" >> $GITHUB_OUTPUT - echo "create_update_branch_merged_pr=1" >> $GITHUB_OUTPUT - echo "try_close_update_branch_pr=1" >> $GITHUB_OUTPUT - - - name: Create/Update PR update_branch - if: steps.manage-branches.outputs.create_update_branch_pr == 1 - env: - GH_TOKEN: ${{ secrets.UPDATE_FROM_TEMPLATE_PAT }} - run: | - gh_pr_up() { - gh pr create -H "${{ env.UPDATE_BRANCH }}" "$@" || (git checkout "${{ env.UPDATE_BRANCH }}" && gh pr edit "$@") - } - gh_pr_up -B "${{ steps.manage-branches.outputs.base_branch }}" \ - --title "Update from template" \ - --body "An automated PR to sync changes from the template into this repo" - - # Ensure that only a single PR is open (otherwise confusion and spam) - - name: Close PR update_branch - if: steps.manage-branches.outputs.try_close_update_branch_pr == 1 - env: - GH_TOKEN: ${{ secrets.UPDATE_FROM_TEMPLATE_PAT }} - run: | - gh pr close "${{ env.UPDATE_BRANCH }}" || true - - - name: Create/Update PR update_branch_merged - if: steps.manage-branches.outputs.create_update_branch_merged_pr == 1 - env: - GH_TOKEN: ${{ secrets.UPDATE_FROM_TEMPLATE_PAT }} - run: | - gh_pr_up() { - gh pr create -H "${{ env.UPDATE_BRANCH_MERGED }}" "$@" || (git checkout "${{ env.UPDATE_BRANCH_MERGED }}" && gh pr edit "$@") - } - gh_pr_up -B "${{ steps.manage-branches.outputs.base_branch }}" \ - --title "Update from template (auto-merged)" \ - --body "An automated PR to sync changes from the template into this repo" - - # Wait a moment so that checks of PR have higher prio than following job - sleep 3 - - # Split into two jobs to help with executor starvation - auto-merge: - needs: [update] - if: needs.update.outputs.create_update_branch_merged_pr == 1 - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v6 - with: - # Required because otherwise there are always changes detected when executing diff/rev-list - fetch-depth: 0 - # If no PAT is used the following error occurs on a push: - # refusing to allow a GitHub App to create or update workflow `.github/workflows/xxx.yml` without `workflows` permission - token: ${{ secrets.UPDATE_FROM_TEMPLATE_PAT }} - - - name: Init Git - run: | - git config --global user.email "111048771+xdev-gh-bot@users.noreply.github.com" - git config --global user.name "XDEV Bot" - - - name: Checking if auto-merge for PR update_branch_merged can be done - id: auto-merge-check - env: - GH_TOKEN: ${{ secrets.UPDATE_FROM_TEMPLATE_PAT }} - run: | - not_failed_conclusion="skipped|neutral|success" - not_relevant_app_slug="dependabot|github-pages|sonarqubecloud" - - echo "Waiting for checks to start..." - sleep 40s - - for i in {1..20}; do - echo "Checking if PR can be auto-merged. Try: $i" - - echo "Checking if update-branch-merged exists" - git fetch - if [[ $(git ls-remote --heads origin refs/heads/${{ env.UPDATE_BRANCH_MERGED }}) ]]; then - echo "Branch still exists; Continuing..." - else - echo "Branch origin/${{ env.UPDATE_BRANCH_MERGED }} is missing" - exit 0 - fi - - echo "Fetching checks" - cs_response=$(curl -sL \ - --fail-with-body \ - --connect-timeout 60 \ - --max-time 120 \ - -H "Accept: application/vnd.github+json" \ - -H "Authorization: Bearer $GH_TOKEN" \ - -H "X-GitHub-Api-Version: 2022-11-28" \ - https://api.github.com/repos/${{ github.repository }}/commits/${{ needs.update.outputs.update_branch_merged_commit }}/check-suites) - - cs_data=$(echo $cs_response | jq '.check_suites[] | { conclusion: .conclusion, slug: .app.slug, check_runs_url: .check_runs_url }') - echo $cs_data - - if [[ -z "$cs_data" ]]; then - echo "No check suite data - Assuming that there are no checks to run" - - echo "perform=1" >> $GITHUB_OUTPUT - exit 0 - fi - - cs_failed=$(echo $cs_data | jq --arg x "$not_failed_conclusion" 'select ((.conclusion == null or (.conclusion | test($x))) | not)') - if [[ -z "$cs_failed" ]]; then - echo "No check failed so far; Checking if relevant checks are still running" - - cs_relevant_still_running=$(echo $cs_data | jq --arg x "$not_relevant_app_slug" 'select (.conclusion == null and (.slug | test($x) | not))') - if [[ -z $cs_relevant_still_running ]]; then - echo "All relevant checks finished - PR can be merged" - - echo "perform=1" >> $GITHUB_OUTPUT - exit 0 - else - echo "Relevant checks are still running" - echo $cs_relevant_still_running - fi - else - echo "Detected failed check" - echo $cs_failed - - echo "perform=0" >> $GITHUB_OUTPUT - exit 0 - fi - - echo "Waiting before next run..." - sleep 30s - done - - echo "Timed out - Assuming executor starvation - Forcing merge" - echo "perform=1" >> $GITHUB_OUTPUT - - - name: Auto-merge update_branch_merged - if: steps.auto-merge-check.outputs.perform == 1 - run: | - echo "Getting base branch" - base_branch=$(git branch --show-current) - echo "Base branch is $base_branch" - - echo "Fetching..." - git fetch - if [[ $(git rev-parse origin/${{ env.UPDATE_BRANCH_MERGED }}) ]]; then - echo "Branch still exists; Continuing..." - else - echo "Branch origin/${{ env.UPDATE_BRANCH_MERGED }} is missing" - exit 0 - fi - - expected_commit="${{ needs.update.outputs.update_branch_merged_commit }}" - actual_commit=$(git rev-parse origin/${{ env.UPDATE_BRANCH_MERGED }}) - if [[ "$expected_commit" != "$actual_commit" ]]; then - echo "Branch ${{ env.UPDATE_BRANCH_MERGED }} contains unexpected commit $actual_commit" - echo "Expected: $expected_commit" - - exit 0 - fi - - echo "Ensuring that current branch $base_branch is up-to-date" - git pull - - echo "Merging origin/${{ env.UPDATE_BRANCH_MERGED }} into $base_branch" - git merge origin/${{ env.UPDATE_BRANCH_MERGED }} && merge_exit_code=$? || merge_exit_code=$? - if [ $merge_exit_code -ne 0 ]; then - echo "Unexpected merge failure $merge_exit_code - Requires manual resolution" - - exit 0 - fi - - if [[ "${{ inputs.no_automatic_merge }}" == "true" ]]; then - echo "Exiting due no_automatic_merge" - - exit 0 - fi - - echo "Pushing" - git push - - echo "Cleaning up" - git branch -D ${{ env.UPDATE_BRANCH }} || true - git branch -D ${{ env.UPDATE_BRANCH_MERGED }} || true - git push -f origin --delete ${{ env.UPDATE_BRANCH }} || true - git push -f origin --delete ${{ env.UPDATE_BRANCH_MERGED }} || true