Merge branch 'main' into dependabot/gradle/main/com.fasterxml.jackson.core-jackson-databind-2.22.2

Author: abashev

.github/workflows/ci.yml

@@ -29,7 +29,7 @@ jobs:
       # Everything the jars are built with. Gradle provisions no JDKs of its own —
       # auto-download is off in gradle.properties — so JDK21_HOME is the toolchain it reads.
       - name: Install JDK 21
-        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           distribution: temurin
           java-version: '21'
@@ -97,7 +97,7 @@ jobs:
       # After GraalVM, so JAVA_HOME — and the Gradle daemon — is 21 like everywhere else, and
       # so the jars this job feeds into native-image are compiled at 21. GRAALVM_HOME survives.
       - name: Install JDK 21 for the jars
-        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           distribution: temurin
           java-version: '21'

.github/workflows/codeql-analysis.yml

@@ -27,15 +27,15 @@ jobs:
       # are provisioned by gradle-jdks (gradle/jdks/**), because gradle.properties
       # disables installation auto-detection.
       - name: Set up a bootstrap JDK
-        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           distribution: temurin
           java-version: '21'
 
       # Initializes the CodeQL tools for scanning.
       # Must run AFTER setup-java so CodeQL hooks into the correct JDK.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         with:
           languages: 'java'
 
@@ -45,4 +45,4 @@ jobs:
         run: ./gradlew --no-build-cache clean compileJava compileTestJava
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4

.github/workflows/dependabot-automerge.yml

@@ -17,25 +17,14 @@ jobs:
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 
-      # GITHUB_TOKEN, deliberately: a review starts no workflow run and does not need to, so the
-      # short-lived token is enough and the approval shows in the PR as the bot rather than as a
-      # person. This needs `can_approve_pull_request_reviews` on the repository — no `permissions`
-      # block can stand in for it, and without it GitHub refuses with "GitHub Actions is not
-      # permitted to approve pull requests".
       - name: Approve patch and minor updates
         if: steps.metadata.outputs.update-type != 'version-update:semver-major'
         run: gh pr review --approve "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      # BOT_PAT here, and not GITHUB_TOKEN: auto-merge is completed on behalf of whoever enabled
-      # it, and a push made by GITHUB_TOKEN starts no workflow runs. Enabled with GITHUB_TOKEN the
-      # merge lands on main silently — no CI, no CodeQL, no dependency snapshot, and
-      # update-pr-branch never wakes to rebase the remaining PRs, so the automation cuts its own
-      # legs. A PAT is a real user, so the push behaves like any other.
-      - name: Enable auto-merge for patch and minor updates
-        if: steps.metadata.outputs.update-type != 'version-update:semver-major'
+      - name: Enable auto-merge for all PRs
         run: gh pr merge --auto --squash "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}

.github/workflows/dependency-submission.yml

@@ -14,7 +14,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up a bootstrap JDK
-        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           distribution: temurin
           java-version: '21'

mise.toml

@@ -25,17 +25,29 @@ run = "act push --job native --matrix platform:linux-aarch64"
 # (authenticated with admin on this repository) and the 1Password CLI (`op signin` first).
 
 [tasks."gh:secrets"]
-description = "Set the repository's Actions secrets from 1Password (op)"
+description = "Set the repository's Actions and Dependabot secrets from 1Password (op)"
 shell = "bash -c"
 quiet = true                 # suppress mise's `[task] $ <first line>` command echo
 env = { NO_COLOR = "1" }     # suppress gh's OSC-11 terminal-background probe
-run = '''
+run = """
 set -euo pipefail
 
-# BOT_PAT is consumed by .github/workflows/update-pr-branch.yml, and it cannot be GITHUB_TOKEN:
-# a push made with GITHUB_TOKEN does not start workflow runs, so a PR branch would be brought
-# up to date and then never re-checked — which is the whole point of that workflow. A
-# fine-grained PAT scoped to this repository with Contents: read and write is enough.
+# BOT_PAT is consumed by update-pr-branch.yml and by the auto-merge step of
+# dependabot-automerge.yml, and it cannot be GITHUB_TOKEN: a push made with GITHUB_TOKEN starts no
+# workflow runs, so a branch would be brought up to date — or a pull request merged — and then
+# never re-checked.
+#
+# The token needs these repository permissions:
+#   Pull requests  Write   PUT /repos/{owner}/{repo}/pulls/{n}/update-branch requires it
+#   Contents       Write   pushing the updated branch and the merge commit
+#
+# It is written to BOTH secret stores. A run triggered by a Dependabot event cannot read Actions
+# secrets at all — it reads the Dependabot store instead — so a token present only in Actions
+# expands to an empty string there, and gh fails with "set the GH_TOKEN environment variable".
+#
+# --repo, because this checkout has two remotes (origin and upstream) and gh refuses to guess.
+repo="$(git remote get-url origin | sed -E 's#(git@github\\.com:|https://github\\.com/)##; s#\\.git$##')"
+
 apply() {
   local name="$1" ref="$2" value
   if [[ "$ref" == *TODO* ]]; then
@@ -46,9 +58,11 @@ apply() {
     echo "  Create that item in 1Password (or point the reference at an existing one), then re-run." >&2
     return 1
   fi
-  gh secret set "$name" --body "$value"
-  echo "✓ $name set"
+  for store in actions dependabot; do
+    gh secret set "$name" --app "$store" --repo "$repo" --body "$value"
+    echo "✓ $name set ($store)"
+  done
 }
 
 apply BOT_PAT 'op://Private/open-java-format/GitHub/bot-pat'
-'''
+"""