Merge branch 'master' into clearAnnotation-only-typevar

.github/dependabot.yml

@@ -1,5 +1,10 @@
 version: 2
 updates:
+- package-ecosystem: "gradle"
+  directory: "/"
+  schedule:
+    interval: "daily"
+
 - package-ecosystem: "gradle"
   directory: "/docs/examples/errorprone/"
   schedule:

.github/workflows/ci.yml

@@ -0,0 +1,189 @@
+name: CI tests
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+
+# Configure GitHub Actions cancel in progress workflow to avoid redundant runs in pull requests.
+# See: https://docs.github.com/en/enterprise-cloud@latest/actions/writing-workflows/choosing-what-your-workflow-does/control-the-concurrency-of-workflows-and-jobs
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ !contains(github.ref, 'heads/master')}}
+
+jobs:
+  # Basic sanity tests on JDK 21.
+  sanity:
+    name: ${{ matrix.script }} on JDK ${{ matrix.java_version }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    strategy:
+      matrix:
+        script: ['cftests-junit', 'cftests-nonjunit']
+        java_version: [21]
+    env:
+      JAVA_VERSION: ${{ matrix.java_version }}
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up JDK ${{ matrix.java_version }}
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ matrix.java_version }}
+        distribution: 'temurin'
+
+    # Configure Gradle for optimal use in GitHub Actions, including caching of downloaded dependencies.
+    # See: https://github.com/gradle/actions/blob/main/setup-gradle/README.md
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@v4.0.1
+
+    - name: Setup Bazel
+      uses: bazel-contrib/setup-bazel@0.8.5
+      if: matrix.script == 'cftests-nonjunit'
+      with:
+        # Avoid downloading Bazel every time.
+        bazelisk-cache: true
+        # Store build cache per workflow.
+        disk-cache: ${{ github.workflow }}
+        # Share repository cache between workflows.
+        repository-cache: true
+
+    - name: Run test script checker/bin-devel/test-${{ matrix.script }}
+      run: ./checker/bin-devel/test-${{ matrix.script }}.sh
+
+  # The remaining tests for JDK 21. Separate from `sanity` to allow parallelism with `otheros`.
+  remainder:
+    name: ${{ matrix.script }} on JDK ${{ matrix.java_version }}
+    runs-on: ubuntu-latest
+    # Don't depend on sanity jobs, to have more parallelism.
+    # TODO: cancel these jobs if sanity fails.
+    # needs: sanity
+    permissions:
+      contents: read
+    strategy:
+      matrix:
+        # No need to run 'cftests-junit-jdk21' on JDK 21.
+        script: ['typecheck-part1', 'typecheck-part2', 'guava', 'plume-lib', 'daikon-part1', 'daikon-part2', 'jspecify-conformance', 'jspecify-reference-checker']
+        java_version: [21]
+    env:
+      JAVA_VERSION: ${{ matrix.java_version }}
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up JDK ${{ matrix.java_version }}
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ matrix.java_version }}
+        distribution: 'temurin'
+
+    # Configure Gradle for optimal use in GitHub Actions, including caching of downloaded dependencies.
+    # See: https://github.com/gradle/actions/blob/main/setup-gradle/README.md
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@v4.0.1
+
+    - name: Run test script checker/bin-devel/test-${{ matrix.script }}
+      run: ./checker/bin-devel/test-${{ matrix.script }}.sh
+
+  otherjdks:
+    name: ${{ matrix.script }} on JDK ${{ matrix.java.version }}
+    runs-on: ubuntu-latest
+    needs: sanity
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        # jspecify-conformance and jspecify-reference-checker only tested on JDK 21.
+        script: ['cftests-junit', 'cftests-nonjunit', 'cftests-junit-jdk21', 'typecheck-part1', 'typecheck-part2', 'guava', 'plume-lib', 'daikon-part1', 'daikon-part2']
+        # JDK 21 used by sanity before
+        java: [{version: '8', experimental: false},
+          {version: '11', experimental: false},
+          {version: '17', experimental: false},
+          {version: '22', experimental: true},
+          {version: '23-ea', experimental: true},
+          {version: '24-ea', experimental: true}]
+    env:
+      JAVA_VERSION: ${{ matrix.java.version }}
+    continue-on-error: ${{ matrix.java.experimental }}
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up JDK ${{ matrix.java.version }}
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ matrix.java.version }}
+        distribution: 'temurin'
+    - name: Set up JDK 21 on an experimental platform
+      if: matrix.java.experimental
+      uses: actions/setup-java@v4
+      with:
+        # Install JDK 21 second, to make it the default on which gradle runs.
+        # This unfortunately also means that all tests run on JDK 21 instead of the newer version.
+        java-version: 21
+        distribution: 'temurin'
+
+    # Configure Gradle for optimal use in GitHub Actions, including caching of downloaded dependencies.
+    # See: https://github.com/gradle/actions/blob/main/setup-gradle/README.md
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@v4.0.1
+
+    - name: Setup Bazel
+      uses: bazel-contrib/setup-bazel@0.8.5
+      if: matrix.script == 'cftests-nonjunit'
+      with:
+        # Avoid downloading Bazel every time.
+        bazelisk-cache: true
+        # Store build cache per workflow.
+        disk-cache: ${{ github.workflow }}
+        # Share repository cache between workflows.
+        repository-cache: true
+
+    - name: Run test script checker/bin-devel/test-${{ matrix.script }}
+      run: ./checker/bin-devel/test-${{ matrix.script }}.sh
+      # TODO: it would be nicer to not run the job at all, but GH Actions does
+      # not allow accessing the matrix on the job-if clause. There is also no way
+      # for an earlier step to stop execution successfully.
+      #
+      # At least one plume-lib project no longer works on Java 8.
+      # Java 8 does not allow toolchains, so testing 'cftests-junit-jdk21' is unnecessary.
+      # Daikon produces 'this-escape' compiler warnings in JDK 22+.
+      if: (matrix.java.version != 8 || (matrix.script != 'plume-lib' && matrix.script != 'cftests-junit-jdk21')) &&
+        (matrix.java.version <= 21 || (matrix.script != 'daikon-part1' && matrix.script != 'daikon-part2'))
+      # Set the compiler version to use, allowing us to e.g. run Java 23 while gradle does not work
+      # on Java 23 yet. This only tests the compiler, it does not use that version to run the tests.
+      env:
+        ORG_GRADLE_PROJECT_useJdkCompiler: ${{ matrix.java.version }}
+
+  # Sanity tests on Windows and MacOS.
+  otheros:
+    name: ${{ matrix.script }} on JDK ${{ matrix.java_version }} on ${{ matrix.os }}
+    runs-on: "${{ matrix.os }}"
+    needs: sanity
+    permissions:
+      contents: read
+    strategy:
+      matrix:
+        os: ['windows-latest', 'macos-latest']
+        script: ['cftests-junit']
+        java_version: [21]
+    env:
+      JAVA_VERSION: ${{ matrix.java_version }}
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up JDK ${{ matrix.java_version }}
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ matrix.java_version }}
+        distribution: 'temurin'
+
+    # Configure Gradle for optimal use in GitHub Actions, including caching of downloaded dependencies.
+    # See: https://github.com/gradle/actions/blob/main/setup-gradle/README.md
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@v4.0.1
+
+    - name: Install coreutils on MacOS
+      if: matrix.os == 'macos-latest'
+      run: brew install coreutils
+
+    - name: Run test script checker/bin-devel/test-${{ matrix.script }}
+      shell: bash
+      run: ./checker/bin-devel/test-${{ matrix.script }}.sh

.github/workflows/dependency-download-and-submit.yml

@@ -0,0 +1,20 @@
+# See: https://github.com/gradle/actions/blob/main/docs/dependency-submission.md#usage-with-pull-requests-from-public-forked-repositories
+name: Download and submit dependency graph
+
+on:
+  workflow_run:
+    workflows: ['Generate and save dependency graph']
+    types: [completed]
+
+permissions:
+  actions: read
+  contents: write
+
+jobs:
+  submit-dependency-graph:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download and submit dependency graph
+        uses: gradle/actions/dependency-submission@v4
+        with:
+          dependency-graph: download-and-submit # Download saved dependency-graph and submit

.github/workflows/dependency-generate-and-upload.yml

@@ -0,0 +1,30 @@
+# See: https://github.com/gradle/actions/blob/main/docs/dependency-submission.md#usage-with-pull-requests-from-public-forked-repositories
+name: Generate and save dependency graph
+
+on:
+  pull_request:
+
+# Configure GitHub Actions cancel in progress workflow to avoid redundant runs in pull requests.
+# See: https://docs.github.com/en/enterprise-cloud@latest/actions/writing-workflows/choosing-what-your-workflow-does/control-the-concurrency-of-workflows-and-jobs
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ !contains(github.ref, 'heads/master')}}
+
+permissions:
+  contents: read # 'write' permission is not available
+
+jobs:
+  dependency-submission:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up JDK 21
+        uses: actions/setup-java@v4
+        with:
+          java-version: '21'
+          distribution: 'temurin'
+
+      - name: Generate and save dependency graph
+        uses: gradle/actions/dependency-submission@v4
+        with:
+          dependency-graph: generate-and-upload

.github/workflows/dependency-review.yml

@@ -0,0 +1,25 @@
+# See: https://github.com/gradle/actions/blob/main/docs/dependency-submission.md#usage-with-pull-requests-from-public-forked-repositories
+name: Dependency review
+
+on:
+  pull_request:
+
+# Configure GitHub Actions cancel in progress workflow to avoid redundant runs in pull requests.
+# See: https://docs.github.com/en/enterprise-cloud@latest/actions/writing-workflows/choosing-what-your-workflow-does/control-the-concurrency-of-workflows-and-jobs
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ !contains(github.ref, 'heads/master')}}
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Dependency review'
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high
+          retry-on-snapshot-warnings: true
+          retry-on-snapshot-warnings-timeout: 600

.gitignore

@@ -40,6 +40,7 @@ docs/tmpapi/
 checker/build-temp
 checker/bin/.do-like-javac
 checker/bin/.scc/
+checker/bin-devel/.git-scripts
 checker/bin-devel/.html-tools
 checker/bin-devel/.plume-scripts
 checker/bin-devel/dockerdir