HHH-19971

.git-blame-ignore-revs

@@ -5,3 +5,14 @@
 9c7dd3bf34dfbb2f4fa9eb79a0294c2cc759c836
 b2a528f2945cee26667b22b867ccef143b7c430c
 4273f1cde06f3622f50c2846078398c1977a49c4
+# Hibernate Tools merging
+05a9a8742e1684419ca4bcabcca060dc31048053
+3710fc0e8332992d7b87f66839dc489c4f46a8c8
+09f4af10843fc1d1e1dcd01d1f4856991fa8989d
+c7cc700acfe372cf6e67d7e60b021a8bf08360c6
+6acfbba01701d767065ed87207269d96adbdc52f
+bede74dc6f816065c78e31cd62ef16981dd90497
+75f4ce5d156e7987579eb32834667975d2d81ad4
+c448b6ba40c93c648b8d645d59ccf4bba55df567
+c57ae64b723fc6c7cb23a06a6b871869dca6ff3f
+9580fd1af50a637431a7a51242cdcb35aa3c0fe8

.github/ci-prerequisites.sh

@@ -1,8 +1,14 @@
 # Reclaim disk space, otherwise we only have 13 GB free at the start of a job
 
+echo 'Before the cleanup:'
+df -h
 # Remove the container images for node:
-docker rmi node:10 node:12 mcr.microsoft.com/azure-pipelines/node8-typescript:latest
+echo 'Docker images (available for possible removal):'
+docker images
 # That is 18 GB
 sudo rm -rf /usr/share/dotnet
 # That is 1.2 GB
-sudo rm -rf /usr/share/swift
+sudo rm -rf /usr/share/swift
+
+echo 'After the cleanup:'
+df -h

.github/dependabot.yml

@@ -17,6 +17,8 @@ updates:
     allow:
       - dependency-name: "actions/*"
       - dependency-name: "redhat-actions/*"
+      - dependency-name: "graalvm/setup-graalvm"
+      - dependency-name: "oracle-actions/setup-testpilot"
   - package-ecosystem: "gradle"
     directory: "/"
     registries:

.github/hibernate-github-bot.yml

@@ -81,3 +81,27 @@ branches:
   ignore:
     - user: dependabot[bot]
       titlePattern: ".*"
+pullRequestTasks:
+  # Make the bot add list of tasks to the pull requests and enable the check that makes sure all tasks are completed:
+  enabled: true
+  tasks:
+    # List of tasks for commits without a Jira ID
+    # or for those with Jira ID but that don't have a specific configuration for a corresponding issue type:
+    default:
+      - Add test **OR** check there is no need for a test
+      - "Update documentation as relevant: javadoc for changed API, `documentation/src/main/asciidoc/userguide` for all features, `documentation/src/main/asciidoc/introduction` for main features, links from existing documentation"
+      - "Add entries as relevant to `migration-guide.adoc` (breaking changes) and `whats-new.adoc` (new features/improvements)"
+    # Tasks specific to the bug issue type:
+    bug:
+      - Add test reproducing the bug
+      - "Add entries as relevant to `migration-guide.adoc` **OR** check there are no breaking changes"
+    # Tasks specific to the improvement issue type:
+    improvement:
+      - Add tests for feature/improvement
+      - "Update documentation as relevant: javadoc for changed API, `documentation/src/main/asciidoc/userguide` for all features, `documentation/src/main/asciidoc/introduction` for main features, links from existing documentation"
+      - "Add entries as relevant to `migration-guide.adoc` (breaking changes) and `whats-new.adoc` (new features/improvements)"
+    # Tasks specific to the "new feature" issue type (same as improvement):
+    new feature:
+      - Add tests for feature/improvement
+      - "Update documentation as relevant: javadoc for changed API, `documentation/src/main/asciidoc/userguide` for all features, `documentation/src/main/asciidoc/introduction` for main features, links from existing documentation"
+      - "Add entries as relevant to `migration-guide.adoc` (breaking changes) and `whats-new.adoc` (new features/improvements)"

.github/workflows/ci-report.yml

@@ -17,12 +17,12 @@ jobs:
     steps:
       # Checkout target branch which has trusted code
       - name: Check out target branch
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           ref: ${{ github.ref }}
       - name: Set up JDK
-        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'temurin'
           java-version: '25'
@@ -38,7 +38,7 @@ jobs:
           echo "buildtool-monthly-branch-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}" >> $GITHUB_OUTPUT
           echo "buildtool-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}-${CURRENT_DAY}" >> $GITHUB_OUTPUT
       - name: Restore Maven/Gradle Dependency/Dist Caches
-        uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: |
             ~/.m2/repository/
@@ -52,7 +52,7 @@ jobs:
 
       - name: Download GitHub Actions artifacts for the Develocity build scans
         id: downloadBuildScan
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
         with:
           pattern: build-scan-data-*
           github-token: ${{ github.token }}
@@ -76,3 +76,116 @@ jobs:
           exit $status
         env:
           DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY_PR }}
+
+  publish-sonar-scans:
+    name: Publish Sonar scan
+    if: github.repository == 'hibernate/hibernate-orm' && github.event.workflow_run.conclusion != 'cancelled'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Determine the Branch Reference for which the original action was triggered
+        id: determine_branch_ref
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if [ "${{ github.event.workflow_run.event }}" == "pull_request" ]; then
+            echo "::notice::Triggering workflow was executed for a pull request"
+
+            FORK_OWNER="${{ github.event.workflow_run.head_repository.owner.login }}"
+            BRANCH_NAME="${{ github.event.workflow_run.head_branch }}"
+            if [ "${{ github.event.workflow_run.head_repository.owner.login }}" != "${{ github.event.workflow_run.repository.owner.login }}" ]; then
+              BRANCH_NAME="$FORK_OWNER:$BRANCH_NAME"
+            fi
+            GH_RESPONSE=$(gh pr view "$BRANCH_NAME" --repo ${{ github.event.workflow_run.repository.full_name }} --json number,baseRefName)
+            TARGET_BRANCH=$(echo $GH_RESPONSE | jq -r '.baseRefName')
+            PR_ID=$(echo $GH_RESPONSE | jq -r '.number')
+
+            echo "::notice::PR found. Target branch is: $TARGET_BRANCH"
+            echo "::notice::          Pull Request number is: $PR_ID"
+            echo "::notice::          Branch to merge is: $BRANCH_NAME"
+            echo "original_branch_ref=$TARGET_BRANCH" >> "$GITHUB_OUTPUT"
+            echo "pr_id=$PR_ID" >> "$GITHUB_OUTPUT"
+            echo "branch_to_merge=$BRANCH_NAME" >> "$GITHUB_OUTPUT"
+          else
+            echo "::notice::Triggering workflow was executed for a push event? Using the head_branch value."
+            echo "original_branch_ref=${{ github.event.workflow_run.head_branch }}" >> "$GITHUB_OUTPUT"
+          fi
+      # Checkout target branch (from the main repository)
+      - name: Check out target branch
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          # By default, a workflow that is triggered with on workflow_run would run on the main (default) branch.
+          #  Different branches might have different versions of Develocity, and we want to make sure
+          #  that we publish with the one that we built the scan with in the first place.
+          ref: ${{ steps.determine_branch_ref.outputs.original_branch_ref }}
+          fetch-depth: 0
+
+        # Note: we need to check out the code with all the changes so that we have the sources,
+        #  matching our compiled classes we'll pull from the build artifacts.
+        #  We won't be running any builds from the checked out code,
+        #  but we'll use the code to run the sonar scanner tool.
+        #
+        #  Only needed if we are analysing the PR,
+        #  as otherwise the previous checkout already did the work.
+      - name: Check out merged code (if PR)
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if [ "${{ github.event.workflow_run.event }}" == "pull_request" ]; then
+            gh pr checkout ${{steps.determine_branch_ref.outputs.pr_id}}
+          fi
+
+          # so we aren't tempted to run a Gradle command!
+          rm -rf gradlew*
+
+      - name: Set up Java 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: 25
+          distribution: temurin
+
+      - name: Download coverage reports
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # 7.0.0
+        with:
+          pattern: build-results-data
+          github-token: ${{ github.token }}
+          repository: ${{ github.repository }}
+          run-id: ${{ github.event.workflow_run.id }}
+          path: .
+          merge-multiple: 'true'
+        # Don't fail the build if there are no matching artifacts
+        continue-on-error: true
+
+      - name: Install Sonar CLI
+        run: |
+          SONAR_HASH=8fbfb1eb546b734a60fc3e537108f06e389a8ca124fbab3a16236a8a51edcc15
+          SONAR_SCANNER_VERSION=8.0.1.6346
+          export SONAR_SCANNER_HOME=$HOME/.sonar/sonar-scanner-$SONAR_SCANNER_VERSION
+          curl --create-dirs -sSLo $HOME/.sonar/sonar-scanner.zip https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-$SONAR_SCANNER_VERSION.zip
+          DOWNLOADED_HASH=$(sha256sum $HOME/.sonar/sonar-scanner.zip | awk '{print $1}')
+          if [ "$DOWNLOADED_HASH" == "$SONAR_HASH" ]; then
+            echo "Successfully verified the file checksum"
+          else
+            echo "Error: Failed the file checksum verification. Expected: $SONAR_HASH but got $DOWNLOADED_HASH instead"
+            exit 1
+          fi
+          unzip -o $HOME/.sonar/sonar-scanner.zip -d $HOME/.sonar/
+          mv "$HOME/.sonar/sonar-scanner-$SONAR_SCANNER_VERSION"/* "$HOME/.sonar/" 
+
+      - name: Sonar Analysis
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        run: |
+          find . -name "*.exec" -type f
+          EXTRA_ARGS=""
+          if [ "${{ github.event.workflow_run.event }}" == "pull_request" ]; then
+            echo "::notice::Triggering workflow was executed for a pull request"
+
+            EXTRA_ARGS="-Dsonar.pullrequest.branch=${{steps.determine_branch_ref.outputs.branch_to_merge}} -Dsonar.pullrequest.key=${{steps.determine_branch_ref.outputs.pr_id}} -Dsonar.pullrequest.base=${{steps.determine_branch_ref.outputs.original_branch_ref}} -Dsonar.pullrequest.provider=GitHub -Dsonar.pullrequest.github.repository=hibernate/hibernate-orm"
+          else
+            EXTRA_ARGS="-Dsonar.branch.name=${{github.event.workflow_run.head_branch}}"
+          fi
+
+          $HOME/.sonar/bin/sonar-scanner $EXTRA_ARGS \
+              -Dsonar.java.libraries="$(pwd)/target/sonar-dependencies/*.jar" \
+              -Dsonar.coverage.jacoco.xmlReportPaths="$(pwd)/reporting/target/reports/jacoco/mergeCodeCoverageReport/mergeCodeCoverageReport.xml"