Merge branch 'main' into renovate/docker-login-action-4.x

Author: jupblb

.bazelrc

@@ -0,0 +1,4 @@
+common --java_language_version=17
+common --tool_java_language_version=17
+common --java_runtime_version=remotejdk_25
+common --tool_java_runtime_version=remotejdk_25

.bazelversion

@@ -1 +1 @@
-8.7.0
+9.1.1

.github/workflows/ci.yaml

@@ -5,14 +5,49 @@ on:
       - main
   pull_request:
 jobs:
+  format:
+    runs-on: ubuntu-latest
+    name: Formatting
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - uses: gradle/actions/setup-gradle@v4
+        with:
+          gradle-version: 9.4.1
+
+      - run: gradle spotlessCheck --no-daemon
+
+  kotlin_plugin:
+    runs-on: ubuntu-latest
+    name: scip-kotlinc
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - uses: gradle/actions/setup-gradle@v4
+        with:
+          gradle-version: 9.4.1
+
+      - name: scip-kotlinc tests
+        run: gradle :scip-kotlinc:test --no-daemon
+
   docker_test:
     runs-on: ubuntu-latest
     name: Docker CLI tests
     steps:
       - uses: actions/checkout@v4
 
       - name: Build Dockerised CLI
-        run: docker build -t sourcegraph/scip-java:latest .
+        run: docker build -t ghcr.io/scip-code/scip-java:latest .
 
       - name: Test repos
         shell: bash
@@ -23,7 +58,7 @@ jobs:
             mkdir -p ".repos/$REPO"
             git clone "https://github.com/$REPO.git" ".repos/$REPO" && cd ".repos/$REPO" && git submodule update --init
 
-            docker run -v "$PWD/.repos/$REPO:/sources" -w /sources sourcegraph/scip-java:latest scip-java index
+            docker run -v "$PWD/.repos/$REPO:/sources" -w /sources ghcr.io/scip-code/scip-java:latest scip-java index
             file ".repos/$REPO/index.scip" || (echo "$REPO SCIP index doesn't exist!"; exit 1)
           }
 

.github/workflows/nix.yaml

@@ -39,7 +39,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        java: [11, 17, 21]
+        java: [17, 21, 25]
     steps:
       - uses: actions/checkout@v4
 
@@ -107,21 +107,6 @@ jobs:
       - run: du -h index.scip
         working-directory: examples/bazel-example
 
-  kotlin_plugin:
-    runs-on: ubuntu-latest
-    name: scip-kotlinc
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: DeterminateSystems/nix-installer-action@v22
-        with:
-          summarize: false
-
-      - uses: DeterminateSystems/magic-nix-cache-action@v13
-
-      - name: scip-kotlinc tests
-        run: gradle :scip-kotlinc:test --no-daemon
-
   snapshots:
     runs-on: ubuntu-latest
     name: Snapshots
@@ -150,7 +135,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        java: [11, 17, 21]
+        java: [17, 21, 25]
     steps:
       - uses: actions/checkout@v4
 
@@ -169,7 +154,7 @@ jobs:
           printf 'SCIP_JAVA_VERSION=%s\n' "$SCIP_JAVA_VERSION" >> "$GITHUB_ENV"
           printf 'SCIP_JAVA_CLI=%s\n' "$PWD/scip-java/build/install/scip-java/bin/scip-java" >> "$GITHUB_ENV"
 
-      - run: mvn clean verify -DskipTests "-Dscip-java.version=$SCIP_JAVA_VERSION" sourcegraph:sourcegraphDependencies
+      - run: mvn clean verify -DskipTests "-Dscip-java.version=$SCIP_JAVA_VERSION" scip:dependencies
         working-directory: examples/maven-example
 
       - run: |

.github/workflows/release-cli.yaml

@@ -37,7 +37,7 @@ jobs:
           cd "$OUT_DIR"
 
           VERSION=${VERSION#v}
-          ARTIFACT="com.sourcegraph:scip-java:${VERSION}"
+          ARTIFACT="org.scip-code:scip-java:${VERSION}"
 
           for attempt in {1..10}; do
             if cs resolve "$ARTIFACT" >/dev/null 2>&1; then
@@ -57,7 +57,7 @@ jobs:
             --bat=true \
             -o scip-java \
             "$ARTIFACT" \
-            --main com.sourcegraph.scip_java.ScipJava
+            --main org.scip_code.scip_java.ScipJava
 
           chmod +x scip-java
           ./scip-java --help >/dev/null
@@ -74,11 +74,11 @@ jobs:
         run: |
           set -euo pipefail
 
-          if gh release view "$TAG" --repo "sourcegraph/scip-java" >/dev/null 2>&1; then
+          if gh release view "$TAG" --repo "scip-code/scip-java" >/dev/null 2>&1; then
             echo "exists=true" >> "$GITHUB_OUTPUT"
           else
             echo "exists=false" >> "$GITHUB_OUTPUT"
-            echo "GitHub release $TAG does not exist in sourcegraph/scip-java; skipping asset upload."
+            echo "GitHub release $TAG does not exist in scip-code/scip-java; skipping asset upload."
           fi
 
       - name: Upload release assets
@@ -96,5 +96,5 @@ jobs:
             "scip-java-${TAG}" \
             "scip-java-${TAG}.bat" \
             "scip-java-${TAG}.sha256" \
-            --repo "sourcegraph/scip-java" \
+            --repo "scip-code/scip-java" \
             --clobber

.github/workflows/release-docker.yaml

@@ -4,32 +4,91 @@ on:
     branches:
       - main
     tags: ["*"]
+
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - runner: ubuntu-latest
+            arch: amd64
+          - runner: ubuntu-24.04-arm
+            arch: arm64
+    runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+
       - uses: docker/setup-buildx-action@v3
-      - name: Login to DockerHub
+
+      - name: Login to GitHub Container Registry
         uses: docker/login-action@v4
         with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Build and push Docker image
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Resolve Docker tag
+        id: tag
         shell: bash
         run: |
           set -euo pipefail
 
-          tags=(--tag sourcegraph/scip-java:latest-snapshot)
-
+          image="ghcr.io/scip-code/scip-java"
           if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
             version="${GITHUB_REF_NAME#v}"
-            tags=(
-              --tag sourcegraph/scip-java:latest
-              --tag "sourcegraph/scip-java:${version}"
-            )
+            tag="${image}:${version}-${{ matrix.arch }}"
+          else
+            tag="${image}:latest-snapshot-${{ matrix.arch }}"
           fi
 
-          docker buildx build --push "${tags[@]}" .
+          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          platforms: linux/${{ matrix.arch }}
+          tags: ${{ steps.tag.outputs.tag }}
+          labels: |
+            org.opencontainers.image.source=https://github.com/scip-code/scip-java
+            org.opencontainers.image.revision=${{ github.sha }}
+
+  publish-manifest:
+    needs: publish
+    runs-on: ubuntu-latest
+    steps:
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create and push multi-arch manifest
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          image="ghcr.io/scip-code/scip-java"
+          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
+            version="${GITHUB_REF_NAME#v}"
+            docker buildx imagetools create \
+              --tag "${image}:latest" \
+              --tag "${image}:${version}" \
+              "${image}:${version}-amd64" \
+              "${image}:${version}-arm64"
+          else
+            docker buildx imagetools create \
+              --tag "${image}:latest-snapshot" \
+              "${image}:latest-snapshot-amd64" \
+              "${image}:latest-snapshot-arm64"
+          fi

.github/workflows/release-maven.yaml

@@ -19,19 +19,18 @@ jobs:
         if: ${{ !startsWith(github.ref, 'refs/tags/') }}
         run: nix develop --command gradle --no-daemon publishToMavenCentral
         env:
-          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_PASSWORD }}
-          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_USERNAME }}
+          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_PASSWORD }}
+          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_USERNAME }}
       - name: Publish release ${{ github.ref }}
         if: ${{ startsWith(github.ref, 'refs/tags/') }}
         run: |
           version="${GITHUB_REF_NAME#v}"
           nix develop --command gradle --no-daemon \
             "-PreleaseVersion=$version" publishAndReleaseToMavenCentral
         env:
-          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_PASSWORD }}
-          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_USERNAME }}
-          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.PGP_SECRET }}
-          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.PGP_PASSPHRASE }}
+          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_PASSWORD }}
+          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_USERNAME }}
+          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
 
   release-cli:
     if: ${{ startsWith(github.ref, 'refs/tags/') }}