Rebuild with refreshed dependencies

.claude/settings.json

@@ -14,6 +14,7 @@
       "Bash(git switch:*)",
       "Bash(git checkout:*)",
       "Bash(git add:*)",
+      "Bash(git commit:*)",
       "Bash(git restore:*)",
       "Bash(git stash:*)",
       "Bash(git fetch:*)",
@@ -48,7 +49,15 @@
       "Bash(gh release create:*)"
     ],
     "ask": [
-      "Bash(git commit:*)",
+      "Bash(git push --force*)",
+      "Bash(git push * --force*)",
+      "Bash(git push -f*)",
+      "Bash(git push * -f*)",
+      "Bash(git push -uf*)",
+      "Bash(git push * -uf*)",
+      "Bash(git push * +*)",
+      "Bash(git push --mirror*)",
+      "Bash(git push * --mirror*)",
       "Bash(git rebase:*)",
       "Bash(git merge:*)",
       "Bash(git cherry-pick:*)",

.github/workflows/publish.yml

@@ -1,81 +1,40 @@
 name: Publish
 
+# A thin caller. The job body — checkout, credentials, the Gradle publication
+# and the attestation — is the reusable `publishing.yml` hosted by `config`,
+# which the `uses:` line below points at. Keeping the body out of this
+# repository is what makes the attestation's signer `config` rather than this
+# file (SLSA Build Level 3); the comments in `publishing.yml` explain the
+# mechanism.
+#
+# `CONFIG_COMMIT` is a placeholder, not a ref: `migrate` replaces it on every
+# `./config/pull` with the commit of `config` this repository pins as its
+# submodule, so the workflow steps and `buildSrc` always come from the same
+# commit. It is never edited by hand.
+#
+# The permission grant is the union of what the two called jobs declare — a
+# called workflow can keep or reduce what it is given, never raise it — and
+# `secrets: inherit` passes the repository secrets the decryption steps need.
+
+# Consumers verify an artifact against the branch it was published from
+# (`gh attestation verify --source-ref`), which means something only while a
+# ruleset protects that branch. Publishing from `v<major>.x` release branches
+# takes `'v*.x'` added to this trigger in the template in `config`, not in a
+# consumer's copy, which `./config/pull` overwrites. The template reaches every
+# repository that publishes, so first make each of their rulesets cover that
+# pattern, including the creation of such branches.
 on:
   push:
     branches: [master]
 
 jobs:
   publish:
     name: Publish to Maven repositories
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          submodules: 'true'
-
-      - uses: actions/setup-java@v5
-        with:
-          java-version: 17
-          distribution: zulu
-
-      - uses: gradle/actions/setup-gradle@v6
-
-      - name: Decrypt CloudRepo credentials
-        run: ./config/scripts/decrypt.sh "$CLOUDREPO_CREDENTIALS_KEY" ./.github/keys/cloudrepo.properties.gpg ./cloudrepo.properties
-        env:
-          CLOUDREPO_CREDENTIALS_KEY: ${{ secrets.CLOUDREPO_CREDENTIALS_KEY }}
-
-      - name: Decrypt Git SSH credentials
-        run: ./config/scripts/decrypt.sh "$GIT_CREDENTIALS_KEY" ./.github/keys/deploy_key_rsa.gpg ./deploy_key_rsa
-        env:
-          GIT_CREDENTIALS_KEY: ${{ secrets.GIT_CREDENTIALS_KEY }}
-
-        # Make sure the SSH key is not "too visible". SSH agent will not accept it otherwise.
-      - name: Set file system permissions
-        run: chmod 400 ./deploy_key_rsa && chmod +x ./config/scripts/register-ssh-key.sh
-
-      - name: Decrypt GCS credentials
-        run: ./config/scripts/decrypt.sh "$GCS_CREDENTIALS_KEY" ./.github/keys/gcs-auth-key.json.gpg ./gcs-auth-key.json
-        env:
-          GCS_CREDENTIALS_KEY: ${{ secrets.GCS_CREDENTIALS_KEY }}
-
-      - name: Decrypt GCAR credentials
-        run: ./config/scripts/decrypt.sh "$MAVEN_PUBLISHER_KEY" ./.github/keys/maven-publisher.json.gpg ./maven-publisher.json
-        env:
-          MAVEN_PUBLISHER_KEY: ${{ secrets.MAVEN_PUBLISHER_KEY }}
-
-      - name: Decrypt Git SSH credentials
-        run: ./config/scripts/decrypt.sh "$GRADLE_PORTAL_CREDENTIALS_KEY" ./.github/keys/gradle-plugin-portal.secret.properties.gpg ./gradle-plugin-portal.secret.properties
-        env:
-          GRADLE_PORTAL_CREDENTIALS_KEY: ${{ secrets.GRADLE_PORTAL_CREDENTIALS_KEY }}
-
-      - name: Append Gradle properties
-        run: cat ./gradle-plugin-portal.secret.properties >> ./gradle.properties
-
-      - name: Publish artifacts to Maven
-        # Since we're in the `master` branch already, this means that tests of a PR passed.
-        # So, no need to run the tests again when publishing.
-        run: ./gradlew publish -x test --stacktrace
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          FORMAL_GIT_HUB_PAGES_AUTHOR: developers@spine.io
-          # https://docs.github.com/en/actions/reference/environment-variables
-          REPO_SLUG: ${{ github.repository }}    # e.g. SpineEventEngine/core-jvm
-          GOOGLE_APPLICATION_CREDENTIALS: ./maven-publisher.json
-          NPM_TOKEN: ${{ secrets.NPM_SECRET }}
-
-      # A failed publication on `master` is most often a version collision: a stale
-      # duplicate bump merged before `revalidate-versions.yml` could turn it red (the
-      # narrow auto-merge race). The artifact is safe — the registry rejects the
-      # overwrite — but the fix needs a human/agent, so make the failure loud and
-      # actionable instead of a quiet red run.
-      - name: Report a failed publication
-        if: failure()
-        shell: bash
-        run: |
-          echo "::error title=Publish failed::Publishing to Maven failed on the base branch. If this is a version collision, the version is already published (immutable). Bump 'version.gradle.kts' on the base branch (e.g. via a small PR) and re-run this workflow."
-          echo "Publish failed. If the cause is a version collision:"
-          echo "  1. Bump 'version.gradle.kts' on the base branch to the next free version."
-          echo "  2. Re-run this 'Publish' workflow."
-          echo "Stale duplicate bumps are normally caught before merge by 'revalidate-versions.yml'."
+    uses: SpineEventEngine/config/.github/workflows/publishing.yml@a0cbbbfe66c12475224563439fb6deb3da71ba58
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+      artifact-metadata: write
+    secrets: inherit

.gitignore

@@ -1,29 +1,15 @@
 # >>> shared config (managed by ./config/pull -- do not edit inside this block) >>>
+# Copyright 2026 CodeMatters, Lda.
 #
-# Copyright 2025, TeamDev. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file
+# except in compliance with the License. You may obtain a copy of the License at
 #
 # https://www.apache.org/licenses/LICENSE-2.0
 #
-# Redistribution and use in source and/or binary forms, with or without
-# modification, must retain the above copyright notice and the following
-# disclaimer.
-#
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-#
+# Unless required by applicable law or agreed to in writing, software distributed under
+# the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+# either express or implied. See the License for the specific language governing permissions
+# and limitations under the License.
 
 #
 # This file is used for two purposes:

buildSrc/build.gradle.kts

@@ -1,27 +1,15 @@
 /*
- * Copyright 2026, TeamDev. All rights reserved.
+ * Copyright 2026 CodeMatters, Lda.
  *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file
+ * except in compliance with the License. You may obtain a copy of the License at
  *
  * https://www.apache.org/licenses/LICENSE-2.0
  *
- * Redistribution and use in source and/or binary forms, with or without
- * modification, must retain the above copyright notice and the following
- * disclaimer.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific language governing permissions
+ * and limitations under the License.
  */
 
 import org.jetbrains.kotlin.gradle.dsl.JvmTarget
@@ -50,10 +38,19 @@ repositories {
  * This value is deliberately decoupled from [io.spine.dependency.lib.Jackson.version],
  * which now points to Jackson 3.x. The `buildSrc` sources still use the Jackson 2.x API
  * (`com.fasterxml.jackson.*`), so they must stay on a 2.x version until they are migrated
- * to `tools.jackson.*`. Any maintained 2.x release will do — bump this only when `buildSrc`
- * itself needs a fix from a later 2.x, not to track the newest one.
+ * to `tools.jackson.*`.
+ *
+ * The floor is set by the SPDX Gradle Plugin (see [spdxPluginVersion]). Its JSON store
+ * depends on `jackson-bom`, which aligns every Jackson 2.x module on the runtime classpath
+ * of `buildSrc` with the version it requires. A lower version here would compile `buildSrc`
+ * against one Jackson and run it against another. Raise this together with the plugin, or
+ * when `buildSrc` itself needs a fix from a later 2.x — not to track the newest one.
+ *
+ * Whatever the reason for a change, `jackson-core` and `jackson-databind` below `2.18.9`
+ * are exposed to published advisories, three of them rated `high` — `GHSA-r7wm-3cxj-wff9`,
+ * `GHSA-rmj7-2vxq-3g9f`, and `GHSA-j3rv-43j4-c7qm`.
  */
-val jacksonVersion = "2.18.3"
+val jacksonVersion = "2.22.0"
 
 /**
  * The version of Google Artifact Registry used by `buildSrc`.
@@ -80,15 +77,15 @@ val grGitVersion = "5.3.3"
  * This version may change from the [version of Kotlin][io.spine.dependency.lib.Kotlin.version]
  * used by the project.
  */
-val kotlinEmbeddedVersion = "2.4.10"
+val kotlinEmbeddedVersion = "2.4.21"
 
 /**
  * The version of Guava used in `buildSrc`.
  *
  * Always use the same version as the one specified in [io.spine.dependency.lib.Guava].
  * Otherwise, when testing Gradle plugins, clashes may occur.
  */
-val guavaVersion = "33.7.1-jre"
+val guavaVersion = "33.7.2-jre"
 
 /**
  * The version of ErrorProne Gradle plugin.
@@ -135,7 +132,7 @@ val kotestJvmPluginVersion = "0.4.11"
 /**
  * @see [io.spine.dependency.test.Kover]
  */
-val koverVersion = "0.9.9"
+val koverVersion = "0.9.11"
 
 /**
  * The version of the Shadow Plugin.
@@ -144,6 +141,28 @@ val koverVersion = "0.9.9"
  */
 val shadowVersion = "9.6.1"
 
+/**
+ * The version of the SPDX Gradle Plugin, which writes the SBOM published with each module.
+ *
+ * @see <a href="https://plugins.gradle.org/plugin/org.spdx.sbom">SPDX Gradle Plugin</a>
+ */
+val spdxPluginVersion = "0.12.0"
+
+/**
+ * The version of Plexus XML used by `buildSrc`, pinned to the line made for Maven 3.
+ *
+ * The Shadow plugin brings the 4.x line, made for Maven 4. It merges XML through
+ * `maven-xml`, which finds its `XmlService` via the context class loader of the current
+ * thread — a loader that does not see `buildSrc` on the threads Gradle runs tasks on.
+ * The SPDX Gradle Plugin (see [spdxPluginVersion]) builds effective POMs with the Maven 3
+ * model, which merges the plugin configuration of a POM with that of its parent. So with
+ * the 4.x line, the SBOM of a module fails for any dependency whose POM does that.
+ *
+ * The 3.x line implements the same API on its own. Shadow uses only its classic part,
+ * in `ComponentsXmlResourceTransformer`. Update this within the 3.x line only.
+ */
+val plexusXmlVersion = "3.1.0"
+
 /**
  * The version of JUnit used to test the build scripts.
  *
@@ -156,13 +175,14 @@ val junitVersion = "6.1.3"
  *
  * @see [io.spine.dependency.test.Kotest]
  */
-val kotestVersion = "6.2.4"
+val kotestVersion = "6.2.5"
 
 configurations.all {
     resolutionStrategy {
         force(
             "com.google.guava:guava:${guavaVersion}",
             "com.google.protobuf:protobuf-gradle-plugin:$protobufPluginVersion",
+            "org.codehaus.plexus:plexus-xml:$plexusXmlVersion",
 
             // Force Kotlin lib versions avoiding using those bundled with Gradle.
             "org.jetbrains.kotlin:kotlin-stdlib:$kotlinEmbeddedVersion",
@@ -205,7 +225,8 @@ dependencies {
         "org.jetbrains.dokka:dokka-gradle-plugin:$dokkaVersion",
         "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlinEmbeddedVersion",
         "org.jetbrains.kotlin:kotlin-reflect:$kotlinEmbeddedVersion",
-        "org.jetbrains.kotlinx:kover-gradle-plugin:$koverVersion"
+        "org.jetbrains.kotlinx:kover-gradle-plugin:$koverVersion",
+        "org.spdx:spdx-gradle-plugin:$spdxPluginVersion"
     ).forEach {
         implementation(it)
     }

buildSrc/quality/checkstyle-suppressions.xml

@@ -1,29 +1,17 @@
 <?xml version="1.0" ?>
 
 <!--
-  ~ Copyright 2026, TeamDev. All rights reserved.
+  ~ Copyright 2026 CodeMatters, Lda.
   ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
+  ~ Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file
+  ~ except in compliance with the License. You may obtain a copy of the License at
   ~
   ~ https://www.apache.org/licenses/LICENSE-2.0
   ~
-  ~ Redistribution and use in source and/or binary forms, with or without
-  ~ modification, must retain the above copyright notice and the following
-  ~ disclaimer.
-  ~
-  ~ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-  ~ "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-  ~ LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-  ~ A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-  ~ OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-  ~ SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-  ~ LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-  ~ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-  ~ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-  ~ (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-  ~ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+  ~ Unless required by applicable law or agreed to in writing, software distributed under
+  ~ the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+  ~ either express or implied. See the License for the specific language governing permissions
+  ~ and limitations under the License.
   -->
 
 <!DOCTYPE suppressions PUBLIC

buildSrc/quality/checkstyle.xml

@@ -1,29 +1,17 @@
 <?xml version="1.0" ?>
 
 <!--
-  ~ Copyright 2026, TeamDev. All rights reserved.
+  ~ Copyright 2026 CodeMatters, Lda.
   ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
+  ~ Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file
+  ~ except in compliance with the License. You may obtain a copy of the License at
   ~
   ~ https://www.apache.org/licenses/LICENSE-2.0
   ~
-  ~ Redistribution and use in source and/or binary forms, with or without
-  ~ modification, must retain the above copyright notice and the following
-  ~ disclaimer.
-  ~
-  ~ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-  ~ "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-  ~ LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-  ~ A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-  ~ OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-  ~ SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-  ~ LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-  ~ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-  ~ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-  ~ (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-  ~ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+  ~ Unless required by applicable law or agreed to in writing, software distributed under
+  ~ the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+  ~ either express or implied. See the License for the specific language governing permissions
+  ~ and limitations under the License.
   -->
 
 <!DOCTYPE module PUBLIC