Merge branch 'apache:main' into bkd-prefetch-optimization

Author: abiesps

.devcontainer/devcontainer.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://raw.githubusercontent.com/devcontainers/spec/main/schemas/devContainer.schema.json",
+  "name": "Apache Lucene",
+  "service": "lucene",
+  "features": {
+    "ghcr.io/devcontainers/features/java:1": {
+      "version": "25",
+      "installMaven": "false",
+      "installGradle": "false"
+    }
+  },
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "redhat.java",
+        "editorconfig.editorconfig"
+      ],
+      "settings": {
+        "extensions.allowed": {
+          "vscjava.vscode-java-pack": false,
+          "vscjava.vscode-gradle": false,
+          "*": true
+        }
+      }
+    }
+  },
+  "updateContentCommand": "cd ${containerWorkspaceFolder} && ./gradlew eclipse"
+}

.github/actions/prepare-for-build/action.yml

@@ -15,6 +15,11 @@ inputs:
     default: "temurin"
     description: "The default JDK distribution type"
 
+  use-cache:
+    required: false
+    default: true
+    description: "Use setup-gradle for dependency caching"
+
 runs:
   using: "composite"
   steps:
@@ -26,13 +31,15 @@ runs:
         java-package: jdk
 
     - name: Cache gradle-wrapper.jar
+      if: ${{ fromJSON(inputs.use-cache) }}
       uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       with:
         path: gradle/wrapper/gradle-wrapper.jar
         key: gradle-wrapper-${{ hashFiles('gradle/wrapper/gradle-wrapper.jar.sha256') }}
 
     # This includes "smart" caching of gradle dependencies.
     - name: Set up Gradle
+      if: ${{ fromJSON(inputs.use-cache) }}
       uses: gradle/actions/setup-gradle@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1
       with:
         # increase expiry time for the temp. develocity token.

.github/workflows/actions.yml

@@ -11,13 +11,16 @@ on:
       - main
     paths:
       - '.github/**'
+  schedule:
+    - cron: '22 2 * * *'
 
 permissions: {}
 
 jobs:
   actionlint:
     name: Run actionlint
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout repository
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -30,6 +33,7 @@ jobs:
   zizmor:
     name: Run zizmor
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       security-events: write # integration with github advanced security
     steps:
@@ -43,8 +47,8 @@ jobs:
         run: uvx zizmor --pedantic --format=sarif . > results.sarif
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # TODO: offline checks only to avoid any rate-limiting issues, maybe enable nightly?
-          ZIZMOR_OFFLINE: true
+          # run offline for branches and PRs to avoid rate limits
+          ZIZMOR_OFFLINE: ${{ github.event_name == 'pull_request' || github.event_name == 'push' }}
       - name: Upload SARIF file
         uses: github/codeql-action/upload-sarif@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5
         with:

.github/workflows/auto-format.yml

@@ -124,7 +124,7 @@ jobs:
         if: ${{ steps.initial-validation.outcome == 'failure' }}
         run: |
           echo "Fixing formatting issues and updating lock file..."
-          ./gradlew tidy writeLocks updateLicenses
+          ./gradlew tidy writeLocks writeChecksums
 
       - name: Check if formatting fixes were made
         if: ${{ steps.initial-validation.outcome == 'failure' }}

.github/workflows/codeql.yml

@@ -18,6 +18,7 @@ jobs:
     name: Analyze (${{ matrix.language }})
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
     runs-on: ubuntu-24.04
+    timeout-minutes: 15
     permissions:
       security-events: write # integrate with Github Advanced Security
 

.github/workflows/dependency-submission.yml

@@ -15,6 +15,7 @@ jobs:
   dependency-submission:
     name: Submit gradle dependencies
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: write # see action's documentation
     steps:

.github/workflows/label-pull-request.yml

@@ -26,6 +26,7 @@ jobs:
       pull-requests: write # manipulate existing labels
 
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Run Labeler action

.github/workflows/mark-stale-PRs.yml

@@ -21,6 +21,8 @@ jobs:
       pull-requests: write # must comment/label PRs
       actions: write # must manipulate actions cache to split workload across multiple runs
 
+    timeout-minutes: 15
+
     steps:
       - name: Run stale PR action
         uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0

.github/workflows/run-checks-gradle-upgrade.yml

@@ -25,9 +25,38 @@ env:
   DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
 jobs:
+  gradleScriptBootstrapCheck:
+    name: "Check gradle boostrap script sanity on old JVMs."
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          distribution: 'temurin'
+          java-version: 11
+          java-package: jdk
+
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+
+      - shell: bash
+        run: |
+          set +e
+          output=$(./gradlew 2>&1)
+          if [[ "$output" == *"ERROR: java version must be"* ]]; then
+            echo "Passed."
+          else
+            echo "Something is not right: gradlew command returned suspicious output or status code on JDK 11"
+            echo -e "gradlew output echoed below:\n\n$output\n\n---(end of output)"
+            exit 1
+          fi
+
   gradleSanityCheck:
     name: "Run tasks (java: ${{ matrix.java-version }}, alt-java: ${{ matrix.uses-alt-java }})"
     timeout-minutes: 30
+    needs: gradleScriptBootstrapCheck
 
     strategy:
       matrix:
@@ -49,6 +78,7 @@ jobs:
       - uses: ./.github/actions/prepare-for-build
         with:
           java-version: ${{ matrix.java-version }}
+          use-cache: false
 
       - name: Set up RUNTIME_JAVA_HOME variable
         if: ${{ matrix.uses-alt-java }}
@@ -84,7 +114,7 @@ jobs:
         run: |
           # add this package for generateEmojiTokenizationTestChecksumLoad.
           sudo apt-get install libwww-perl
-          ./gradlew regenerate -x generateUAX29URLEmailTokenizerInternal --rerun-tasks
+          ./gradlew regenerate -x regenerateUAX29URLEmailTokenizer --rerun-tasks
           if [ ! -z "$(git status --porcelain)" ]; then
             echo ":warning: **regenerate left local checkout in modified state**" >> "$GITHUB_STEP_SUMMARY"
             echo '```' >> "$GITHUB_STEP_SUMMARY"
@@ -95,7 +125,7 @@ jobs:
 
       - run: ./gradlew allOptions
       - run: ./gradlew helpWorkflow
-      - run: ./gradlew licenses updateLicenses
+      - run: ./gradlew licenses writeChecksums
       - run: ./gradlew check -x test
       - run: ./gradlew assembleRelease mavenToLocal
       - run: ./gradlew eclipse

.github/workflows/run-nightly-smoketester.yml

@@ -25,6 +25,7 @@ jobs:
         java-version: [ '25' ]
 
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
 
     env:
       LUCENE_RELEASE_DIR: /tmp/lucene-release-dir
@@ -79,7 +80,7 @@ jobs:
 
       - name: "Store smoke tester logs"
         if: ${{ always() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: smoke-tester-logs-jdk-${{ matrix.java-version }}
           path: |