.github/scripts/rebuild-build.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 set -ev
 ./gradlew --no-daemon --version
-./gradlew --no-daemon -Dmaven.repo.local=dist/m2 :publish
+./gradlew --no-daemon -Dmaven.repo.local=dist/m2 :buildscriptDependencies :publish
 ./gradlew --no-daemon -Dmaven.repo.local=dist/m2 --warning-mode=fail :gradle-plugins:build
 ./gradlew --no-daemon -Dmaven.repo.local=dist/m2 :gradle-plugins:publish

.github/workflows/cibuild.yml

@@ -4,19 +4,17 @@ on:
   push:
     branches-ignore:
     - 'dependabot/**'
-    paths-ignore:
-    - 'docs/**'
-    - '.github/**/*docs*'
-    - '.github/**/*codeql*'
-    - '.github/**/*rebuild*'
-    - '.github/*.yml'
+    paths:
+    - '**'
+    - '!docs/**'
+    - '!.github/**'
+    - '.github/**/*ci*'
   pull_request:
-    paths-ignore:
-    - 'docs/**'
-    - '.github/**/*docs*'
-    - '.github/**/*codeql*'
-    - '.github/**/*rebuild*'
-    - '.github/*.yml'
+    paths:
+    - '**'
+    - '!docs/**'
+    - '!.github/**'
+    - '.github/**/*ci*'
 
 env:
   LC_ALL: en_US.UTF-8
@@ -44,6 +42,7 @@ jobs:
         java:
         - '8'
         - '11'
+        - '18'
         runner:
         - 'xvfb-run --auto-servernum {0}'
         include:
@@ -58,24 +57,29 @@ jobs:
     name: Build JDK${{ matrix.java }} ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
     - name: Git Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
       with:
         fetch-depth: ${{ matrix.fetch-depth }}
-    - name: Gradle Wrapper Validation
-      uses: gradle/wrapper-validation-action@v1
     - name: Set up Java ${{ matrix.java }}
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@de1bb2b0c5634f0fc4438d7aa9944e68f9bf86cc
       with:
         distribution: 'temurin'
         java-version: ${{ matrix.java }}
+    - name: Set up Gradle
+      uses: gradle/gradle-build-action@3fbe033aaae657f011f88f29be9e65ed26bd29ef
     - name: Build
       id: build
       run: |
         ${{ format(matrix.runner, './.github/scripts/ci-build.sh') }}
     - name: Configure settings.xml for Publish
       if: ${{ matrix.canonical }}
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@de1bb2b0c5634f0fc4438d7aa9944e68f9bf86cc
       with:
         distribution: 'temurin'
         java-version: ${{ matrix.java }}
@@ -93,7 +97,7 @@ jobs:
         JFROG_PASSWORD: ${{ secrets.JFROG_PASSWORD }}
     - name: Upload Test Reports
       if: ${{ always() && ((steps.build.outcome == 'success') || (steps.build.outcome == 'failure')) }}
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb
       with:
         name: Build_JDK${{ matrix.java }}_${{ matrix.os }}-test-reports
         path: |

.github/workflows/codeql.yml

@@ -42,22 +42,27 @@ jobs:
     name: CodeQL JDK${{ matrix.java }} ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
     - name: Checkout repository
-      uses: actions/checkout@v3
-    - name: Gradle Wrapper Validation
-      uses: gradle/wrapper-validation-action@v1
+      uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
     - name: Set up Java ${{ matrix.java }}
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@de1bb2b0c5634f0fc4438d7aa9944e68f9bf86cc
       with:
         distribution: 'temurin'
         java-version: ${{ matrix.java }}
+    - name: Set up Gradle
+      uses: gradle/gradle-build-action@3fbe033aaae657f011f88f29be9e65ed26bd29ef
     - name: Initialize CodeQL Analysis
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@c3b6fce4ee2ca25bc1066aa3bf73962fda0e8898
       with:
         languages: 'java'
     - name: Build for CodeQL Analysis
       id: build
       run: |
         ./.github/scripts/codeql-build.sh
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@c3b6fce4ee2ca25bc1066aa3bf73962fda0e8898

.github/workflows/docs.yml

@@ -30,10 +30,15 @@ jobs:
       BUNDLE_GEMFILE: Gemfile
       BUNDLE_PATH: vendor/bundle
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
     - name: Git Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
     - name: Set up Ruby
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@8ddb7b3348b3951590db24c346e94ebafdabc926
       with:
         ruby-version: 2.7
         bundler-cache: true

.github/workflows/rebuild.yml

@@ -4,19 +4,17 @@ on:
   push:
     branches-ignore:
     - 'dependabot/**'
-    paths-ignore:
-    - 'docs/**'
-    - '.github/**/*docs*'
-    - '.github/**/*codeql*'
-    - '.github/**/*ci*'
-    - '.github/*.yml'
+    paths:
+    - '**'
+    - '!docs/**'
+    - '!.github/**'
+    - '.github/**/*rebuild*'
   pull_request:
-    paths-ignore:
-    - 'docs/**'
-    - '.github/**/*docs*'
-    - '.github/**/*codeql*'
-    - '.github/**/*ci*'
-    - '.github/*.yml'
+    paths:
+    - '**'
+    - '!docs/**'
+    - '!.github/**'
+    - '.github/**/*rebuild*'
 
 env:
   LC_ALL: en_US.UTF-8
@@ -48,21 +46,26 @@ jobs:
     outputs:
       dist-bundles: Dist_Bundles_JDK${{ matrix.java }}_${{ matrix.os }}
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
     - name: Git Checkout
-      uses: actions/checkout@v3
-    - name: Gradle Wrapper Validation
-      uses: gradle/wrapper-validation-action@v1
+      uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
     - name: Set up Java ${{ matrix.java }}
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@de1bb2b0c5634f0fc4438d7aa9944e68f9bf86cc
       with:
         distribution: 'temurin'
         java-version: ${{ matrix.java }}
+    - name: Set up Gradle
+      uses: gradle/gradle-build-action@3fbe033aaae657f011f88f29be9e65ed26bd29ef
     - name: Build
       id: build
       run: |
         ./.github/scripts/rebuild-build.sh
     - name: Upload dist/bundles
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb
       with:
         name: Dist_Bundles_JDK${{ matrix.java }}_${{ matrix.os }}
         if-no-files-found: error
@@ -77,21 +80,28 @@ jobs:
         - 'ubuntu-latest'
         java:
         - '8'
-        - '17'
+        - '18'
         runner:
         - 'xvfb-run --auto-servernum {0}'
     name: Rebuild JDK${{ matrix.java }} ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
     - name: Git Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
     - name: Set up Java
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@de1bb2b0c5634f0fc4438d7aa9944e68f9bf86cc
       with:
         distribution: 'temurin'
         java-version: ${{ matrix.java }}
+    - name: Set up Gradle
+      uses: gradle/gradle-build-action@3fbe033aaae657f011f88f29be9e65ed26bd29ef
     - name: Download dist/bundles
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7
       with:
         name: ${{ needs.build.outputs.dist-bundles }}
         path: dist/bundles
@@ -101,7 +111,7 @@ jobs:
         ${{ format(matrix.runner, './.github/scripts/rebuild-test.sh') }}
     - name: Upload Test Reports
       if: ${{ always() && ((steps.build.outcome == 'success') || (steps.build.outcome == 'failure')) }}
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb
       with:
         name: Rebuild_JDK${{ matrix.java }}_${{ matrix.os }}-test-reports
         path: |

.github/workflows/stale.yml

@@ -0,0 +1,58 @@
+name: Stale
+
+on:
+  schedule:
+    - cron: '30 1 * * *'
+
+env:
+  LC_ALL: en_US.UTF-8
+
+defaults:
+  run:
+    shell: bash
+
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  stale:
+    name: Stale
+    runs-on: 'ubuntu-latest'
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - name: Stale Action
+      uses: actions/stale@5ebf00ea0e4c1561e9b43a292ed34424fb1d4578
+      with:
+        days-before-stale: 365
+        days-before-close: 21
+        exempt-all-milestones: true
+        stale-issue-label: 'stale'
+        stale-issue-message: >
+          This issue has been automatically marked as stale because it has not had recent activity.
+          Given the limited bandwidth of the team, it will be automatically closed if no further
+          activity occurs.
+          If you feel this is something you could contribute, please have a look
+          at our [Contributor Guide](https://github.com/bndtools/bnd/blob/main/CONTRIBUTING.md).
+          Thank you for your contribution.
+        close-issue-message: >
+          This issue has been automatically closed due to inactivity. If you can reproduce this
+          on a recent version of Bnd/Bndtools
+          or if you have a good use case for this feature, please feel free
+          to reopen the issue with steps to reproduce, a quick explanation of your use case or a
+          high-quality pull request.
+        stale-pr-label: 'stale'
+        stale-pr-message: >
+          This pull request has been automatically marked as stale because it has not had recent activity.
+          Given the limited bandwidth of the team, it will be closed if no further activity occurs.
+          If you intend to work on this pull request, please reopen the PR.
+          Thank you for your contributions.
+        close-pr-message: >
+          This pull request has been automatically closed due to inactivity.
+          If you are still interested in contributing this, please ensure that
+          it is rebased against the latest `main` branch, all review
+          comments have been addressed and the build is passing.