From 6375d4f882d0a2a26a9598fa4aa418d0f25a2994 Mon Sep 17 00:00:00 2001 From: Valera V Harseko Date: Thu, 22 Oct 2026 13:25:00 +0300 Subject: [PATCH 1/2] [#378] Use actions/setup-java v6 in every workflow and have Dependabot keep the actions up to date, as in the other projects build.yml, deploy.yml and release.yml still used actions/setup-java@v5. OpenAM, OpenDJ, OpenICF and OpenIDM use v6 in every workflow, because Dependabot updates their actions, and this repository had no Dependabot configuration. The inputs used here (java-version, distribution, server-id, server-username, server-password) are the ones OpenAM deploys and releases with on v6. .github/dependabot.yml now asks for one grouped pull request a week for the GitHub Actions updates, labelled ci and dependencies, as in OpenDJ and OpenIDM. The three workflow files get the CDDL header that the workflows of OpenDJ carry. --- .github/dependabot.yml | 29 +++++++++++++++++++++++++++++ .github/workflows/build.yml | 16 +++++++++++++++- .github/workflows/deploy.yml | 16 +++++++++++++++- .github/workflows/release.yml | 16 +++++++++++++++- 4 files changed, 74 insertions(+), 3 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..69c6976e8 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,29 @@ +# The contents of this file are subject to the terms of the Common Development and +# Distribution License (the License). You may not use this file except in compliance with the +# License. +# +# You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the +# specific language governing permission and limitations under the License. +# +# When distributing Covered Software, include this CDDL Header Notice in each file and include +# the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL +# Header, with the fields enclosed by brackets [] replaced by your own identifying +# information: "Portions copyright [year] [name of copyright owner]". +# +# Copyright 2026 3A Systems, LLC. + +version: 2 +updates: + # Keeps the actions in .github/workflows up to date: Dependabot moves the version tags + # forward, and for a SHA-pinned action the commit hash with its "# vX.Y.Z" comment. + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + groups: + # One pull request per week for all action updates instead of one per action. + github-actions: + patterns: ["*"] + labels: + - "ci" + - "dependencies" diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e13ac8caf..278b5def1 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,3 +1,17 @@ +# The contents of this file are subject to the terms of the Common Development and +# Distribution License (the License). You may not use this file except in compliance with the +# License. +# +# You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the +# specific language governing permission and limitations under the License. +# +# When distributing Covered Software, include this CDDL Header Notice in each file and include +# the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL +# Header, with the fields enclosed by brackets [] replaced by your own identifying +# information: "Portions copyright [year] [name of copyright owner]". +# +# Copyright 2021-2026 3A Systems, LLC. + name: Build Maven on: @@ -25,7 +39,7 @@ jobs: steps: - uses: actions/checkout@v6 - name: ${{ matrix.Java }}-${{ matrix.os }} - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: java-version: ${{ matrix.java }} distribution: 'zulu' diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 94f78cc09..48f98f61f 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -1,3 +1,17 @@ +# The contents of this file are subject to the terms of the Common Development and +# Distribution License (the License). You may not use this file except in compliance with the +# License. +# +# You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the +# specific language governing permission and limitations under the License. +# +# When distributing Covered Software, include this CDDL Header Notice in each file and include +# the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL +# Header, with the fields enclosed by brackets [] replaced by your own identifying +# information: "Portions copyright [year] [name of copyright owner]". +# +# Copyright 2021-2026 3A Systems, LLC. + name: Deploy Maven on: @@ -33,7 +47,7 @@ jobs: submodules: recursive ref: ${{ github.event.workflow_run.head_branch }} - name: Set up Java for publishing to Maven Central Repository OSS - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: java-version: ${{ github.event.workflow_run.head_branch == 'sustaining/2.4.x' && '8' || '11'}} distribution: 'temurin' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d8c08d2d1..2d2c941dd 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,3 +1,17 @@ +# The contents of this file are subject to the terms of the Common Development and +# Distribution License (the License). You may not use this file except in compliance with the +# License. +# +# You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the +# specific language governing permission and limitations under the License. +# +# When distributing Covered Software, include this CDDL Header Notice in each file and include +# the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL +# Header, with the fields enclosed by brackets [] replaced by your own identifying +# information: "Portions copyright [year] [name of copyright owner]". +# +# Copyright 2022-2026 3A Systems, LLC. + name: Release Maven on: @@ -30,7 +44,7 @@ jobs: fetch-depth: 0 submodules: recursives - name: Set up Java for publishing to Maven Central Repository OSS - uses: actions/setup-java@v5 + uses: actions/setup-java@v6 with: java-version: ${{ github.event.workflow_run.head_branch == 'sustaining/2.4.x' && '8' || '11'}} distribution: 'temurin' From c9a134145082fce1a04101fe81cdecf7154ba0e8 Mon Sep 17 00:00:00 2001 From: Valera V Harseko Date: Thu, 22 Oct 2026 13:25:02 +0300 Subject: [PATCH 2/2] [#378] Set up the JDK of the release for the CodeQL Java analysis, so that its results no longer follow the default JDK of the runner image Fixes #378 With build-mode 'none' CodeQL infers no JDK from the project and models the JDK API on the java found on the PATH. When ubuntu-latest moved to ubuntu-26.04 on 2026-10-19 that java became 25 instead of 17, and code scanning opened alerts for APIs deprecated only after Java 11, the version the release is built with. The java-kotlin job now sets up the JDK of the release before Initialize CodeQL, with the setup-java parameters of release.yml: temurin, 8 on sustaining/2.4.x and 11 otherwise. The commented-out JDK step of the manual build is gone, since the step now serves it too. The file gets the CDDL header that codeql.yml carries in the other projects. --- .github/workflows/codeql.yml | 33 ++++++++++++++++++++++++++++----- 1 file changed, 28 insertions(+), 5 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index a4d37adb1..e44bb538e 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,3 +1,17 @@ +# The contents of this file are subject to the terms of the Common Development and +# Distribution License (the License). You may not use this file except in compliance with the +# License. +# +# You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the +# specific language governing permission and limitations under the License. +# +# When distributing Covered Software, include this CDDL Header Notice in each file and include +# the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL +# Header, with the fields enclosed by brackets [] replaced by your own identifying +# information: "Portions copyright [year] [name of copyright owner]". +# +# Copyright 2026 3A Systems, LLC. + name: "CodeQL" on: @@ -58,6 +72,20 @@ jobs: - name: Checkout repository uses: actions/checkout@v7 + # With build-mode 'none' CodeQL infers no JDK from this project and + # models the JDK API on the java found on the PATH, so without this step + # the results follow the default JDK of the runner image: ubuntu-26.04 + # brought JDK 25 and with it alerts for APIs deprecated only after + # Java 11. Pin the JDK and distribution the release is built with + # (release.yml): 8 on sustaining/2.4.x, 11 otherwise. It also serves + # the manual build below. + - name: Set up JDK + if: matrix.language == 'java-kotlin' + uses: actions/setup-java@v6 + with: + java-version: ${{ (github.base_ref || github.ref_name) == 'sustaining/2.4.x' && '8' || '11' }} + distribution: 'temurin' + - name: Initialize CodeQL uses: github/codeql-action/init@v4 with: @@ -79,11 +107,6 @@ jobs: - '**/doc-maven-plugin/src/main/resources/js/**' # --- Manual build (only used when build-mode is 'manual') ------------- - # - name: Set up JDK 11 - # uses: actions/setup-java@v5 - # with: - # java-version: '11' - # distribution: 'zulu' # - name: Cache Maven packages # uses: actions/cache@v6 # with: