Release IronAgeFurniture Phase 3 for Forge 1.14.4

.gitattributes

@@ -18,6 +18,10 @@ gradlew      text eol=lf
 *.yaml       text
 *.toml       text
 
+# Preserve every checksum-sealed Mavenizer fixture byte-for-byte across clones.
+# The upstream patch also contains intentional trailing spaces.
+ci-fixtures/tools/*      -text -whitespace
+
 # Documents
 *.pdf  binary
 

.github/workflows/ci.yml

@@ -0,0 +1,155 @@
+name: IronAgeFurniture 1.14.4 CI
+
+on:
+  push:
+    branches:
+      - master-1.14
+      - 'feature/**'
+  pull_request:
+    branches:
+      - master-1.14
+
+permissions:
+  contents: read
+
+concurrency:
+  group: iron-age-furniture-1.14-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  cold-forge-bootstrap:
+    name: Cold Forge bootstrap
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Install pinned Java 25 ForgeGradle Mavenizer runtime
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '25.0.3+9.0.LTS'
+
+      - name: Install pinned Java 8 compiler toolchain
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '8.0.502+7'
+
+      - name: Install pinned Java 17 Gradle runtime
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '17.0.1+12'
+
+      - name: Bootstrap Forge from an empty cache
+        shell: bash
+        env:
+          GRADLE_USER_HOME: ${{ runner.temp }}/iron-age-furniture-cold-gradle
+        run: |
+          set -euo pipefail
+          test ! -e .gradle
+          test ! -e "$GRADLE_USER_HOME"
+          mkdir -p "$GRADLE_USER_HOME"
+          chmod +x ./gradlew
+          ./gradlew verifyMavenizerCompatibilityFixture help \
+            --no-daemon --no-build-cache --stacktrace --max-workers=2 \
+            -Dorg.gradle.java.installations.paths="$JAVA_HOME,$JAVA_HOME_8_X64,$JAVA_HOME_25_X64" \
+            -Dorg.gradle.java.installations.auto-detect=false \
+            -Dorg.gradle.java.installations.auto-download=false \
+            | tee "$RUNNER_TEMP/cold-forge-bootstrap.log"
+          find "$GRADLE_USER_HOME" .gradle/mavenizer \
+            -type f \( -name '*.jar' -o -name '*.json' -o -name '*.pom' -o -name '*.module' \) -print0 \
+            | sort -z | xargs -0 -r sha256sum > "$RUNNER_TEMP/mavenizer-before.sha256"
+          test -s "$RUNNER_TEMP/mavenizer-before.sha256"
+
+      - name: Verify same-cache preparation is idempotent
+        shell: bash
+        env:
+          GRADLE_USER_HOME: ${{ runner.temp }}/iron-age-furniture-cold-gradle
+        run: |
+          set -euo pipefail
+          ./gradlew verifyMavenizerCompatibilityFixture help \
+            --no-daemon --no-build-cache --stacktrace --max-workers=2 \
+            -Dorg.gradle.java.installations.paths="$JAVA_HOME,$JAVA_HOME_8_X64,$JAVA_HOME_25_X64" \
+            -Dorg.gradle.java.installations.auto-detect=false \
+            -Dorg.gradle.java.installations.auto-download=false
+          find "$GRADLE_USER_HOME" .gradle/mavenizer \
+            -type f \( -name '*.jar' -o -name '*.json' -o -name '*.pom' -o -name '*.module' \) -print0 \
+            | sort -z | xargs -0 -r sha256sum > "$RUNNER_TEMP/mavenizer-after.sha256"
+          diff -u "$RUNNER_TEMP/mavenizer-before.sha256" "$RUNNER_TEMP/mavenizer-after.sha256"
+
+  build:
+    name: Build, test, and audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Install pinned Java 25 ForgeGradle Mavenizer runtime
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '25.0.3+9.0.LTS'
+
+      - name: Install pinned Java 8 compiler toolchain
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '8.0.502+7'
+
+      - name: Install pinned Java 17 Gradle runtime
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '17.0.1+12'
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
+
+      - name: Build, test, document, and audit
+        run: |
+          chmod +x ./gradlew
+          ./gradlew clean check build javadoc verifyReleaseArtifacts verifyReleaseChecksums \
+            --no-daemon --stacktrace \
+            -Dorg.gradle.java.installations.paths="$JAVA_HOME,$JAVA_HOME_8_X64,$JAVA_HOME_25_X64" \
+            -Dorg.gradle.java.installations.auto-detect=false \
+            -Dorg.gradle.java.installations.auto-download=false
+
+      - name: Generate and audit Eclipse production launches
+        run: >-
+          ./gradlew genEclipseRuns eclipse isolateEclipseProductionRuns verifyEclipseProductionClasspath
+          --no-daemon --stacktrace
+          -Dorg.gradle.java.installations.paths="$JAVA_HOME,$JAVA_HOME_8_X64,$JAVA_HOME_25_X64"
+          -Dorg.gradle.java.installations.auto-detect=false
+          -Dorg.gradle.java.installations.auto-download=false
+
+      - name: Upload audited release candidate
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: iron-age-furniture-1.14.4-${{ github.sha }}
+          if-no-files-found: error
+          retention-days: 30
+          path: |
+            build/libs/iron-age-furniture-0.3.0.114041.jar
+            build/libs/iron-age-furniture-0.3.0.114041-sources.jar
+            build/libs/iron-age-furniture-0.3.0.114041-javadoc.jar
+            build/release/SHA256SUMS
+            CHANGELOG.md
+
+      - name: Upload diagnostics on failure
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: iron-age-furniture-1.14.4-diagnostics-${{ github.sha }}
+          if-no-files-found: ignore
+          retention-days: 14
+          path: |
+            build/test-results/**
+            build/reports/**
+            build/problems/**
+            run/logs/**

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,76 @@
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - master-1.14
+      - 'feature/**'
+  pull_request:
+    branches:
+      - master-1.14
+  schedule:
+    - cron: '43 7 * * 4'
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze Java
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Install pinned Java 25 ForgeGradle Mavenizer runtime
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '25.0.3+9.0.LTS'
+
+      - name: Install pinned Java 8 compiler toolchain
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '8.0.502+7'
+
+      - name: Install pinned Java 17 Gradle runtime
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '17.0.1+12'
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
+        with:
+          languages: java-kotlin
+
+      - name: Compile production code
+        run: |
+          chmod +x ./gradlew
+          gradle_args=(
+            clean classes --rerun-tasks --no-build-cache --no-daemon --stacktrace
+            "-Dorg.gradle.java.installations.paths=$JAVA_HOME,$JAVA_HOME_8_X64,$JAVA_HOME_25_X64"
+            -Dorg.gradle.java.installations.auto-detect=false
+            -Dorg.gradle.java.installations.auto-download=false
+          )
+          for attempt in 1 2 3; do
+            if ./gradlew "${gradle_args[@]}"; then
+              exit 0
+            fi
+            if [ "$attempt" -eq 3 ]; then
+              echo "CodeQL compilation failed after $attempt attempts." >&2
+              exit 1
+            fi
+            echo "::warning::CodeQL compilation attempt $attempt failed; retrying with the preserved Forge cache."
+          done
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4

.github/workflows/release-on-tag.yml

@@ -0,0 +1,81 @@
+name: Validate IronAgeFurniture release tag
+
+on:
+  push:
+    tags:
+      - '*.*.*.*'
+
+permissions:
+  actions: read
+  contents: read
+
+concurrency:
+  group: iron-age-furniture-release-tag-${{ github.ref_name }}
+  cancel-in-progress: false
+
+jobs:
+  validate-release-tag:
+    name: Validate tag for manual release confirmation
+    if: github.repository == 'MinecraftModDevelopmentMods/IronAgeFurniture'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Check out tagged source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+
+      - name: Validate release tag, target metadata, and prior CI
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          value() { sed -n "s/^$1=//p" gradle.properties; }
+          release_version="$(value mod_version)"
+          minecraft_version="$(value minecraft_version)"
+          loader_name="$(value loader_name)"
+          loader_code="$(value loader_code)"
+
+          IFS=. read -r mc_major mc_minor mc_patch extra <<<"$minecraft_version"
+          if [[ -n "${extra:-}" || -z "${mc_major:-}" || -z "${mc_minor:-}" ]]; then
+            echo "Invalid minecraft_version=$minecraft_version" >&2
+            exit 1
+          fi
+          mc_patch="${mc_patch:-0}"
+          case "$loader_name:$loader_code" in
+            forge:1|neoforge:2) ;;
+            *) echo "Invalid loader metadata $loader_name/$loader_code" >&2; exit 1 ;;
+          esac
+          printf -v minor_padded '%02d' "$((10#$mc_minor))"
+          printf -v patch_padded '%02d' "$((10#$mc_patch))"
+          target_suffix="${mc_major}${minor_padded}${patch_padded}${loader_code}"
+          if [[ ! "$release_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.${target_suffix}$ ]]; then
+            echo "mod_version $release_version does not match $minecraft_version $loader_name target $target_suffix" >&2
+            exit 1
+          fi
+          if [[ "$GITHUB_REF_NAME" != "$release_version" ]]; then
+            echo "Release tag must equal mod_version $release_version; found $GITHUB_REF_NAME" >&2
+            exit 1
+          fi
+          successful_ci="$(gh api \
+            "repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/check-runs?per_page=100" \
+            --jq '[.check_runs[] | select(.name == "Build, test, and audit" and .conclusion == "success")] | length')"
+          if [[ "$successful_ci" -lt 1 ]]; then
+            echo "The tagged commit has no successful Build, test, and audit check" >&2
+            exit 1
+          fi
+
+      - name: Record the manual publication interface
+        env:
+          RELEASE_WORKFLOW_URL: https://github.com/${{ github.repository }}/actions/workflows/publish-release.yml
+        run: |
+          {
+            echo "## Release tag validated"
+            echo
+            echo "Tag \`$GITHUB_REF_NAME\` matches the selected target and has a successful Build, test, and audit check."
+            echo
+            echo "No artifact is published by this tag-validation workflow."
+            echo
+            echo "Use [Publish IronAgeFurniture release]($RELEASE_WORKFLOW_URL) on the default branch to start or recover guarded publication."
+          } >> "$GITHUB_STEP_SUMMARY"