Merge branch 'main' into dependabot/gradle/main/com.fasterxml.jackson.dataformat-jackson-dataformat-xml-2.22.2

Author: abashev

.github/workflows/codeql-analysis.yml

@@ -35,7 +35,7 @@ jobs:
       # Initializes the CodeQL tools for scanning.
       # Must run AFTER setup-java so CodeQL hooks into the correct JDK.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         with:
           languages: 'java'
 
@@ -45,4 +45,4 @@ jobs:
         run: ./gradlew --no-build-cache clean compileJava compileTestJava
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4

.github/workflows/dependabot-automerge.yml

@@ -24,9 +24,8 @@ jobs:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Enable auto-merge for patch and minor updates
-        if: steps.metadata.outputs.update-type != 'version-update:semver-major'
+      - name: Enable auto-merge for all PRs
         run: gh pr merge --auto --squash "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.BOT_PAT }}

docs/icon/README.md

@@ -0,0 +1,38 @@
+# Icon
+
+A broken method chain: one long line, then a group of shorter ones sharing a left edge, with a
+column guide down the right. It is the formatter's own output shape — the thing that distinguishes
+it is deciding *where* to break and what to line up, not laying everything out uniformly.
+
+| File | Use |
+|---|---|
+| `icon.svg` | The mark. Inherits `currentColor`, so one file covers light, dark and monochrome. |
+| `favicon.svg` | Same geometry, guide at full strength. Below ~24px contrast is what keeps the guide visible, not shape. |
+| `avatar.svg` | The mark on a white rounded square, for the GitHub organisation and marketplace tiles. |
+| `avatar-512.png`, `avatar-128.png` | Rasterised from `avatar.svg`; GitHub organisation avatars must be raster. |
+
+Regenerate the PNGs after editing the SVG:
+
+```bash
+rsvg-convert -w 512 -h 512 docs/icon/avatar.svg -o docs/icon/avatar-512.png
+rsvg-convert -w 128 -h 128 docs/icon/avatar.svg -o docs/icon/avatar-128.png
+```
+
+## What not to break
+
+The mark has seven elements, which is the ceiling for 16px. Anything added has to displace
+something else.
+
+- **The shared right edge does the work.** The first and third bars end on the same x. That
+  implied vertical is what carries "there is a boundary" at sizes where the dashes disappear, and
+  it costs nothing because no thin element draws it. Changing either bar's width breaks the idea
+  silently — the icon will still look fine at 64px and mean nothing at 16px.
+- **The guide's rhythm must not match the bars'.** Three dashes against four bars is deliberate:
+  mismatched rhythms read as two layers, so the boundary belongs to the format rather than to any
+  one line. Align them and the dashes turn into decoration stuck on the bar ends.
+- **Check every edit at 16px first.** Every version of this mark looked fine large. The small size
+  is the only one that rejects anything.
+
+The two colours in `avatar.svg` are the only brand decision baked in here, and they are a
+placeholder. The white ground means that on GitHub's light theme the tile itself disappears and
+only the mark reads; an off-white ground keeps the tile visible if that is preferred.

docs/icon/avatar-128.png

@@ -25,17 +25,29 @@ run = "act push --job native --matrix platform:linux-aarch64"
 # (authenticated with admin on this repository) and the 1Password CLI (`op signin` first).
 
 [tasks."gh:secrets"]
-description = "Set the repository's Actions secrets from 1Password (op)"
+description = "Set the repository's Actions and Dependabot secrets from 1Password (op)"
 shell = "bash -c"
 quiet = true                 # suppress mise's `[task] $ <first line>` command echo
 env = { NO_COLOR = "1" }     # suppress gh's OSC-11 terminal-background probe
-run = '''
+run = """
 set -euo pipefail
 
-# BOT_PAT is consumed by .github/workflows/update-pr-branch.yml, and it cannot be GITHUB_TOKEN:
-# a push made with GITHUB_TOKEN does not start workflow runs, so a PR branch would be brought
-# up to date and then never re-checked — which is the whole point of that workflow. A
-# fine-grained PAT scoped to this repository with Contents: read and write is enough.
+# BOT_PAT is consumed by update-pr-branch.yml and by the auto-merge step of
+# dependabot-automerge.yml, and it cannot be GITHUB_TOKEN: a push made with GITHUB_TOKEN starts no
+# workflow runs, so a branch would be brought up to date — or a pull request merged — and then
+# never re-checked.
+#
+# The token needs these repository permissions:
+#   Pull requests  Write   PUT /repos/{owner}/{repo}/pulls/{n}/update-branch requires it
+#   Contents       Write   pushing the updated branch and the merge commit
+#
+# It is written to BOTH secret stores. A run triggered by a Dependabot event cannot read Actions
+# secrets at all — it reads the Dependabot store instead — so a token present only in Actions
+# expands to an empty string there, and gh fails with "set the GH_TOKEN environment variable".
+#
+# --repo, because this checkout has two remotes (origin and upstream) and gh refuses to guess.
+repo="$(git remote get-url origin | sed -E 's#(git@github\\.com:|https://github\\.com/)##; s#\\.git$##')"
+
 apply() {
   local name="$1" ref="$2" value
   if [[ "$ref" == *TODO* ]]; then
@@ -46,9 +58,11 @@ apply() {
     echo "  Create that item in 1Password (or point the reference at an existing one), then re-run." >&2
     return 1
   fi
-  gh secret set "$name" --body "$value"
-  echo "✓ $name set"
+  for store in actions dependabot; do
+    gh secret set "$name" --app "$store" --repo "$repo" --body "$value"
+    echo "✓ $name set ($store)"
+  done
 }
 
 apply BOT_PAT 'op://Private/open-java-format/GitHub/bot-pat'
-'''
+"""