diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs index aead1172..58f44dd3 100644 --- a/.git-blame-ignore-revs +++ b/.git-blame-ignore-revs @@ -3,3 +3,9 @@ # Scala Steward: Reformat with scalafmt 3.10.3 d8af028d2cd271ab7f3adec9842f07cce86a2ac3 + +# Scala Steward: Reformat with scalafmt 3.10.7 +83b819003b44835b1792e3ef8263da91a5b6d4ba + +# Scala Steward: Reformat with scalafmt 3.11.1 +5a8f52d4aeff3380e4e38e5cd8e63626711b2f86 diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml index a427ec6f..88301aec 100644 --- a/.github/workflows/CI.yml +++ b/.github/workflows/CI.yml @@ -15,8 +15,8 @@ jobs: docs: ${{ steps.changes.outputs.docs }} steps: - name: Checkout - uses: actions/checkout@v6 - - uses: dorny/paths-filter@v3 + uses: actions/checkout@v7 + - uses: dorny/paths-filter@v4 id: changes with: filters: | @@ -39,12 +39,17 @@ jobs: needs: changes if: ${{ needs.changes.outputs.code == 'true' }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 + # sbt 2 requires JDK 17+ to run + - uses: actions/setup-java@v5 + with: + distribution: 'zulu' + java-version: '21' - name: jcheckstyle run: ./sbt jcheckStyle - name: scalafmtCheckAll run: ./sbt scalafmtCheckAll - + test: name: Test JDK${{ matrix.java }} runs-on: ubuntu-latest @@ -54,17 +59,30 @@ jobs: matrix: java: ['8', '11', '17', '21', '24'] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 + # The JDK under test: msgpack-core forks its tests onto this JDK (via + # TEST_JAVA_HOME) so we still verify runtime behavior on each target JDK. - uses: actions/setup-java@v5 + id: target-jdk with: distribution: 'zulu' java-version: ${{ matrix.java }} - - uses: actions/cache@v5 + # sbt 2 itself requires JDK 17+ to run, so install a fixed, newer JDK to + # actually launch sbt. This becomes the default JDK on PATH/JAVA_HOME. + - uses: actions/setup-java@v5 + with: + distribution: 'zulu' + java-version: '21' + - uses: actions/cache@v6 with: path: ~/.cache key: ${{ runner.os }}-jdk${{ matrix.java }}-${{ hashFiles('**/*.sbt') }} restore-keys: ${{ runner.os }}-jdk${{ matrix.java }}- - name: Test + env: + TEST_JAVA_HOME: ${{ steps.target-jdk.outputs.path }} run: ./sbt test - name: Universal Buffer Test + env: + TEST_JAVA_HOME: ${{ steps.target-jdk.outputs.path }} run: ./sbt test -J-Dmsgpack.universal-buffer=true \ No newline at end of file diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml new file mode 100644 index 00000000..fa651d47 --- /dev/null +++ b/.github/workflows/auto-merge.yml @@ -0,0 +1,41 @@ +name: auto-merge +# pull_request_target runs in the base-branch context, which is required so +# that GITHUB_TOKEN gets the write permissions declared below even for PRs +# opened by Dependabot (which would otherwise receive a read-only token on +# regular pull_request events). This workflow never checks out PR head code, +# so the usual pull_request_target injection risk does not apply. +on: pull_request_target + +permissions: + contents: write + pull-requests: write + +jobs: + auto-merge-dependabot: + name: Auto-Merge Dependabot PRs + runs-on: ubuntu-latest + if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }} + steps: + - name: Dependabot metadata + id: metadata + uses: dependabot/fetch-metadata@v3 + - name: Enable auto-merge for non-major updates + if: ${{ steps.metadata.outputs.update-type != 'version-update:semver-major' }} + run: gh pr merge --squash --auto "${{ github.event.pull_request.html_url }}" + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + auto-merge-scala-steward: + name: Auto-Merge Scala Steward PRs + runs-on: ubuntu-latest + if: ${{ github.event.pull_request.user.login == 'scala-steward' }} + steps: + # Skip auto-merge if the PR carries a semver-major label. Note: this repo + # does not yet apply semver labels to Scala Steward PRs, so this guard is + # a no-op until early-semver-* labels are added to the repo and Scala + # Steward is configured to apply them. + - name: Enable auto-merge for non-major updates + if: ${{ !contains(github.event.pull_request.labels.*.name, 'semver-major') && !contains(github.event.pull_request.labels.*.name, 'early-semver-major') }} + run: gh pr merge --squash --auto "${{ github.event.pull_request.html_url }}" + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0cec5029..210b7c21 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,17 +11,24 @@ jobs: name: Release runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 10000 # Fetch all tags so that sbt-dynver can find the previous release version - run: git fetch --tags -f - # Install OpenJDK 8 + # We need to compile with JDK8 for Android compatibility + # https://github.com/msgpack/msgpack-java/issues/516 - uses: actions/setup-java@v5 + id: jdk8 with: - # We need to use JDK8 for Android compatibility https://github.com/msgpack/msgpack-java/issues/516 java-version: 8 distribution: adopt + # sbt 2 itself requires JDK 17+ to run; build.sbt forks the compiler (and tests) + # onto JDK8 via TEST_JAVA_HOME, so this becomes the default JDK on PATH/JAVA_HOME. + - uses: actions/setup-java@v5 + with: + java-version: 21 + distribution: adopt - name: Setup GPG env: PGP_SECRET: ${{ secrets.PGP_SECRET }} @@ -29,6 +36,7 @@ jobs: - name: Build bundle env: PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }} + TEST_JAVA_HOME: ${{ steps.jdk8.outputs.path }} run: | ./sbt publishSigned - name: Release to Sonatype diff --git a/.github/workflows/snapshot.yml b/.github/workflows/snapshot.yml index dc0fac1d..ec9edbfe 100644 --- a/.github/workflows/snapshot.yml +++ b/.github/workflows/snapshot.yml @@ -16,17 +16,25 @@ jobs: name: Publish snapshots runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 10000 # Fetch all tags so that sbt-dynver can find the previous release version - run: git fetch --tags - uses: actions/setup-java@v5 + id: jdk11 with: java-version: 11 distribution: adopt + # sbt 2 itself requires JDK 17+ to run; build.sbt forks the compiler onto JDK11 + # via TEST_JAVA_HOME, so this becomes the default JDK on PATH/JAVA_HOME. + - uses: actions/setup-java@v5 + with: + java-version: 21 + distribution: adopt - name: Publish snapshots env: SONATYPE_USERNAME: '${{ secrets.SONATYPE_USERNAME }}' SONATYPE_PASSWORD: '${{ secrets.SONATYPE_PASSWORD }}' + TEST_JAVA_HOME: ${{ steps.jdk11.outputs.path }} run: ./sbt publish diff --git a/.scala-steward.conf b/.scala-steward.conf new file mode 100644 index 00000000..7f143b54 --- /dev/null +++ b/.scala-steward.conf @@ -0,0 +1,8 @@ +# JUnit 6.x requires Java 17 at runtime, but this project still targets and +# tests on JDK 8 (see javacOptions in build.sbt and the test matrix in +# .github/workflows/CI.yml). Pin JUnit to the 5.x line until JDK 8 support is +# dropped. +updates.pin = [ + { groupId = "org.junit.jupiter", artifactId = "junit-jupiter", version = "5." }, + { groupId = "org.junit.vintage", artifactId = "junit-vintage-engine", version = "5." } +] diff --git a/.scalafmt.conf b/.scalafmt.conf index d30b0537..5190ffa6 100644 --- a/.scalafmt.conf +++ b/.scalafmt.conf @@ -1,4 +1,4 @@ -version = 3.10.3 +version = 3.11.1 project.layout = StandardConvention runner.dialect = scala3 maxColumn = 100 diff --git a/build.sbt b/build.sbt index 4d72279e..301cc3bb 100644 --- a/build.sbt +++ b/build.sbt @@ -1,9 +1,11 @@ +import scala.language.implicitConversions + Global / onChangedBuildSource := ReloadOnSourceChanges // For performance testing, ensure each test run one-by-one Global / concurrentRestrictions := Seq(Tags.limit(Tags.Test, 1)) -val AIRFRAME_VERSION = "2025.1.22" +val AIRFRAME_VERSION = "2026.2.2" // Use dynamic snapshot version strings for non tagged versions ThisBuild / dynverSonatypeSnapshots := true @@ -67,8 +69,25 @@ val buildSettings = Seq[Setting[?]]( crossPaths := false, publishMavenStyle := true, // JVM options for building - scalacOptions ++= Seq("-encoding", "UTF-8", "-deprecation", "-unchecked", "-feature"), + // -release 8 pins scalac's resolution of JDK API calls to the JDK8 surface (e.g. + // test code calling ByteBuffer.flip() resolves to the inherited Buffer.flip():Buffer + // rather than JDK9's covariant ByteBuffer.flip():ByteBuffer override, which doesn't + // exist on a real JDK8 at runtime -> NoSuchMethodError). Unlike javac's --release, + // this doesn't need an ignore-symbol-file escape hatch since test code never touches + // JDK-internal APIs the way the main sources' Unsafe usage does. + scalacOptions ++= + Seq("-encoding", "UTF-8", "-deprecation", "-unchecked", "-feature", "-release", "8"), Test / javaOptions ++= Seq("-ea"), + // sbt 2 itself requires JDK 17+ to run, but each CI lane still needs to compile and + // test against its own target JDK (e.g. 8) to faithfully reproduce runtime behavior: + // javac resolves API calls against whichever JDK actually runs it (-source/-target + // only constrain language level and bytecode version, not API resolution), so e.g. + // compiling on JDK9+ can bind to covariant overloads like ByteBuffer.flip(): + // ByteBuffer that don't exist on a real JDK8 at runtime. When TEST_JAVA_HOME is set, + // fork both compilation and test execution onto that JDK; otherwise use the JDK + // running sbt, as before. + javaHome := sys.env.get("TEST_JAVA_HOME").map(file), + Test / fork := true, javacOptions ++= Seq("-source", "1.8", "-target", "1.8"), Compile / compile / javacOptions ++= Seq("-encoding", "UTF-8", "-Xlint:unchecked", "-Xlint:deprecation"), @@ -92,14 +111,12 @@ val buildSettings = Seq[Setting[?]]( // Style check config: (sbt-jchekcstyle) jcheckStyleConfig := "facebook", // Run jcheckstyle both for main and test codes - Compile / compile := - ((Compile / compile) dependsOn (Compile / jcheckStyle)).value, - Test / compile := - ((Test / compile) dependsOn (Test / jcheckStyle)).value + Compile / compile := Def.uncached((Compile / compile).dependsOn(Compile / jcheckStyle).value), + Test / compile := Def.uncached((Test / compile).dependsOn(Test / jcheckStyle).value) ) -val junitJupiter = "org.junit.jupiter" % "junit-jupiter" % "5.14.1" % "test" -val junitVintage = "org.junit.vintage" % "junit-vintage-engine" % "5.14.1" % "test" +val junitJupiter = "org.junit.jupiter" % "junit-jupiter" % "5.14.4" % "test" +val junitVintage = "org.junit.vintage" % "junit-vintage-engine" % "5.14.4" % "test" // Project settings lazy val root = Project(id = "msgpack-java", base = file(".")) @@ -127,6 +144,7 @@ lazy val msgpackCore = Project(id = "msgpack-core", base = file("msgpack-core")) "org.msgpack.value", "org.msgpack.value.impl" ), + OsgiKeys.importPackage := Seq("!android.os", "!sun.*"), testFrameworks += new TestFramework("wvlet.airspec.Framework"), Test / javaOptions ++= Seq( @@ -135,7 +153,6 @@ lazy val msgpackCore = Project(id = "msgpack-core", base = file("msgpack-core")) "--add-opens=java.base/java.nio=ALL-UNNAMED", "--add-opens=java.base/sun.nio.ch=ALL-UNNAMED" ), - Test / fork := true, libraryDependencies ++= Seq( // msgpack-core should have no external dependencies @@ -163,7 +180,7 @@ lazy val msgpackJackson = Project(id = "msgpack-jackson", base = file("msgpack-j OsgiKeys.exportPackage := Seq("org.msgpack.jackson", "org.msgpack.jackson.dataformat"), libraryDependencies ++= Seq( - "com.fasterxml.jackson.core" % "jackson-databind" % "2.18.4", + "com.fasterxml.jackson.core" % "jackson-databind" % "2.22.1", junitJupiter, junitVintage, "org.apache.commons" % "commons-math3" % "3.6.1" % "test" diff --git a/msgpack-core/src/test/scala/org/msgpack/core/buffer/MessageBufferInputTest.scala b/msgpack-core/src/test/scala/org/msgpack/core/buffer/MessageBufferInputTest.scala index 0465aa69..5d3c3d9f 100644 --- a/msgpack-core/src/test/scala/org/msgpack/core/buffer/MessageBufferInputTest.scala +++ b/msgpack-core/src/test/scala/org/msgpack/core/buffer/MessageBufferInputTest.scala @@ -58,8 +58,9 @@ class MessageBufferInputTest extends AirSpec: def toByteBuffer = ByteBuffer.wrap(b) def saveToTmpFile: File = - val tmp = File.createTempFile("testbuf", ".dat", new File("target")) - tmp.getParentFile.mkdirs() + val dir = new File("target") + dir.mkdirs() + val tmp = File.createTempFile("testbuf", ".dat", dir) tmp.deleteOnExit() withResource(new FileOutputStream(tmp)) { out => out.write(b) diff --git a/plans/2026-05-05-auto-merge.md b/plans/2026-05-05-auto-merge.md new file mode 100644 index 00000000..0b43e132 --- /dev/null +++ b/plans/2026-05-05-auto-merge.md @@ -0,0 +1,84 @@ +# Add auto-merge GitHub Actions workflow + +## Goal + +Add a workflow that automatically enables auto-merge on PRs from trusted bots +(Dependabot and Scala Steward) for non-major version bumps, mirroring the +pattern used in `wvlet/uni/.github/workflows/auto-merge.yml`. + +## Context + +- Recent PR history shows the repo regularly receives many bot PRs: + - `dependabot[bot]` — for GitHub Actions version bumps + - `scala-steward` — for Scala/sbt/Java library updates +- These currently require manual merge from the maintainer. +- Repo settings already allow auto-merge (`allow_auto_merge: true`) and squash + is the default merge method. +- CI passes branch-protection checks on PRs; once a PR is approved and CI is + green, GitHub will merge it automatically. + +## Differences from wvlet/uni + +- **No GitHub App token.** wvlet/uni uses a GitHub App (`APP_ID` + + `APP_PRIVATE_KEY`) to bypass the read-only `GITHUB_TOKEN` that GitHub + hands to `pull_request` workflows triggered by Dependabot. msgpack/msgpack-java + doesn't have that App configured, so this workflow uses + `on: pull_request_target` instead — that event runs in the base-branch + context where the workflow's declared `permissions:` block actually grants + write access to `GITHUB_TOKEN`. We never check out PR head code, so the + usual `pull_request_target` injection risk does not apply. +- **Scala Steward actor is `scala-steward`**, not wvlet/uni's + `scala-steward-wvlet[bot]` or `xerial-bot` (visible in `gh pr list`). +- **Filter on `github.event.pull_request.user.login`**, not `github.actor`, + because under `pull_request_target` the latter can resolve to the merger + rather than the PR author. + +## Plan + +1. Add `.github/workflows/auto-merge.yml` with two jobs: + - **auto-merge-dependabot**: triggers when + `github.event.pull_request.user.login == 'dependabot[bot]'`, uses + `dependabot/fetch-metadata@v2` to read the update type, and runs + `gh pr merge --squash --auto` only when the update is **not** + `version-update:semver-major`. + - **auto-merge-scala-steward**: triggers when + `github.event.pull_request.user.login == 'scala-steward'` and + auto-merges unless the PR carries a `semver-major` or + `early-semver-major` label. +2. Set workflow-level `permissions` to the minimum required: + `contents: write` and `pull-requests: write`. +3. Use `GITHUB_TOKEN` directly via `env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}`. + +### Scala Steward label caveat + +This repo's current Scala Steward PRs only carry `library-update` (and +sometimes `internal`) — no semver labels are configured upstream, so the +`semver-major` / `early-semver-major` guard is effectively a no-op until: +- The labels are added to the repo (Scala Steward only applies labels that + already exist), and +- Scala Steward is configured (e.g. via `.scala-steward.conf`) to attach + them. + +This matches the same caveat in the wvlet/uni reference implementation, +which uses `semver-spec-major` against `github.event.issue.labels` (not even +the right field on a PR event) — so its guard is also effectively a no-op +in practice. We accept the same trade-off here: most Scala Steward PRs are +patch/minor library updates, CI runs across JDK 8/11/17/21/24 and will fail +the merge-readiness checks if anything regresses, and a major bump that +slips through can be reverted. A follow-up could tighten this by setting up +proper semver labels. + +## Out of scope + +- Setting up a GitHub App for elevated bot identity. +- Auto-approving PRs (a human approval may still be required by branch + protection — auto-merge will simply wait for it). +- Changing branch protection rules. +- Configuring Scala Steward to apply semver labels (see caveat above). + +## Validation + +- Lint the YAML by checking the file parses (visual review + actionlint if + available). +- After merge, watch the next dependabot/scala-steward PR to confirm + auto-merge gets enabled. diff --git a/project/build.properties b/project/build.properties index b1b10405..e0f81fa6 100755 --- a/project/build.properties +++ b/project/build.properties @@ -1,2 +1,2 @@ -sbt.version=1.11.7 +sbt.version=2.0.6 diff --git a/project/plugins.sbt b/project/plugins.sbt index a7594c7a..34eae69c 100644 --- a/project/plugins.sbt +++ b/project/plugins.sbt @@ -2,9 +2,9 @@ addSbtPlugin("com.github.sbt" % "sbt-pgp" % "2.3.1") // TODO: Fixes jacoco error: // java.lang.NoClassDefFoundError: Could not initialize class org.jacoco.core.internal.flow.ClassProbesAdapter //addSbtPlugin("com.github.sbt" % "sbt-jacoco" % "3.3.0") -addSbtPlugin("org.xerial.sbt" % "sbt-jcheckstyle" % "0.2.1") -addSbtPlugin("com.github.sbt" % "sbt-osgi" % "0.10.0") -addSbtPlugin("org.scalameta" % "sbt-scalafmt" % "2.5.6") +addSbtPlugin("org.xerial.sbt" % "sbt-jcheckstyle" % "0.3.0") +addSbtPlugin("com.github.sbt" % "sbt-osgi" % "0.11.0-RC1") +addSbtPlugin("org.scalameta" % "sbt-scalafmt" % "2.6.2") addSbtPlugin("com.github.sbt" % "sbt-dynver" % "5.1.1") scalacOptions ++= Seq("-deprecation", "-feature")