Skip to content

Fix the concurrency group, bump tooling, unpin CodeQL and gradle actions #151

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bernardladenthin merged 2 commits into from
Aug 29, 2026
+25 −10
Merged

Fix the concurrency group, bump tooling, unpin CodeQL and gradle actions #151

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2ef2768
fix: give every non-PR run its own concurrency group
claude Aug 29, 2026
32b6e3c
chore: bump build tooling, unpin CodeQL and gradle actions
claude Aug 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,9 +21,9 @@ jobs:
- uses: actions/checkout@v7
- uses: actions/setup-java@v6
with: { java-version: '21', distribution: temurin }
- uses: github/codeql-action/init@v4.37.8
- uses: github/codeql-action/init@v4
with: { languages: java, queries: +security-and-quality }
- name: Build with Maven
run: mvn --batch-mode --no-transfer-progress compile
- uses: github/codeql-action/analyze@v4.37.8
- uses: github/codeql-action/analyze@v4
with: { category: "/language:java" }
23 changes: 19 additions & 4 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,10 +24,25 @@
#
# cancel-in-progress is deliberately scoped to pull_request ONLY. A push to main or
# to a v* tag is a release path: cancelling one midway could leave a partially
# published set of artifacts, so those always run to completion even if another push
# lands behind them.
# published set of artifacts.
#
# cancel-in-progress: false is NOT sufficient on its own to protect a release run.
# GitHub cancels a *pending* run whenever a newer run joins the same group behind an
# in-progress one -- that rule is independent of cancel-in-progress. So with a plain
# `workflow-ref` group, a queued `publish_to_central` dispatch on main could be
# silently dropped by a later push to main, both sharing `Publish-refs/heads/main`.
# Giving every non-PR run its own group (via the unique run_id) means such a run is
# never queued behind a sibling and therefore can never be cancelled, while PR runs
# still share a group per ref and supersede each other as intended.
#
# One-time effect when this expression changes: GitHub reads `concurrency` from the
# workflow file at each run's own ref, so a run started before the change sits in the
# old group and a run started after it sits in the new one. They are different groups,
# so the new push does NOT supersede the in-flight old run -- exactly once, on the
# commit that lands this. It self-heals from the next push on. Expect the same overlap
# when porting this to a sibling repo; it is not a sign the expression is wrong.
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name == 'pull_request' && 'pr' || github.run_id }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
Expand Down Expand Up @@ -189,7 +204,7 @@
with:
java-version: '21'
distribution: temurin
- uses: gradle/actions/setup-gradle@v6.3.0
- uses: gradle/actions/setup-gradle@v6

Check failure on line 207 in .github/workflows/publish.yml

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use full commit SHA hash for this dependency. 


See more on https://sonarcloud.io/project/issues?id=bernardladenthin_streambuffer&issues=AaBONKA0REXdXm6pfz5U&open=AaBONKA0REXdXm6pfz5U&pullRequest=151
with:
gradle-version: "9.6.1"
- name: Sign a throwaway artifact via useInMemoryPgpKeys (BouncyCastle)
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/scorecard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,6 @@ jobs:
retention-days: 5

- name: Upload to code-scanning
uses: github/codeql-action/upload-sarif@v4.37.8
uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: results.sarif
6 changes: 3 additions & 3 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,8 +34,8 @@ SPDX-License-Identifier: Apache-2.0
<nullaway.version>0.14.0</nullaway.version>
<jspecify.version>1.0.1</jspecify.version>
<checker.version>4.2.2</checker.version>
<spotless.version>3.10.0</spotless.version>
<palantir-java-format.version>2.96.0</palantir-java-format.version>
<spotless.version>3.10.1</spotless.version>
<palantir-java-format.version>2.97.0</palantir-java-format.version>
<spotbugs.version>4.10.4.0</spotbugs.version>
<fb-contrib.version>7.7.4</fb-contrib.version>
<findsecbugs.version>1.14.0</findsecbugs.version>
Expand Down Expand Up @@ -318,7 +318,7 @@ SPDX-License-Identifier: Apache-2.0
<plugin>
<groupId>org.pitest</groupId>
<artifactId>pitest-maven</artifactId>
<version>1.25.9</version>
<version>1.30.0</version>
</plugin>
<plugin>
<groupId>org.sonatype.central</groupId>
Expand Down
Loading