Port OreSpawn 4.0.16 to NeoForge 26.1.2

.github/workflows/ci.yml

@@ -1,24 +1,100 @@
-name: CI
+name: OreSpawn 26.1.2 NeoForge CI
 
-on: [push, pull_request]
-#on:
-#  push:
-#    branches: [ master-1.12 ]
-#  pull_request:
-#    # The branches below must be a subset of the branches above
-#    branches: [ master-1.12 ]
-#      types: [opened, synchronize, reopened]
+on:
+  push:
+    branches:
+      - master-26.1.2-neo
+      - 'feature/**'
+  pull_request:
+    branches:
+      - master-26.1.2-neo
+
+permissions:
+  contents: read
+
+concurrency:
+  group: orespawn-26.1.2-neo-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
+  cold-bootstrap:
+    name: Cold NeoForge bootstrap
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Install exact Java 25
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '25.0.3+9.0.LTS'
+      - name: Bootstrap an isolated empty NeoGradle cache
+        shell: bash
+        run: |
+          set -euo pipefail
+          chmod +x ./gradlew
+          test ! -d .gradle
+          export GRADLE_USER_HOME="$RUNNER_TEMP/orespawn-neoforge-cold-cache"
+          rm -rf "$GRADLE_USER_HOME"
+          gradle_jdk_args=(
+            "-Dorg.gradle.java.installations.paths=$JAVA_HOME"
+            -Dorg.gradle.java.installations.auto-detect=false
+            -Dorg.gradle.java.installations.auto-download=false
+          )
+          ./gradlew clean --no-daemon --no-build-cache --stacktrace --max-workers=2 "${gradle_jdk_args[@]}"
+          ./gradlew classes verifyLegacyFixtures --no-daemon --no-build-cache --stacktrace --max-workers=2 "${gradle_jdk_args[@]}"
+          ./gradlew clean --offline --no-daemon --no-build-cache --stacktrace --max-workers=2 "${gradle_jdk_args[@]}"
+          ./gradlew classes verifyLegacyFixtures --offline --no-daemon --no-build-cache --stacktrace --max-workers=2 "${gradle_jdk_args[@]}"
+
   build:
+    name: Build, test, and audit
     runs-on: ubuntu-latest
-    name: Build
+    timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-java@v1
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Install exact Java 25
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '25.0.3+9.0.LTS'
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
+      - name: Build, test, and audit release artifacts
+        shell: bash
+        run: |
+          set -euo pipefail
+          chmod +x ./gradlew
+          gradle_jdk_args=(
+            "-Dorg.gradle.java.installations.paths=$JAVA_HOME"
+            -Dorg.gradle.java.installations.auto-detect=false
+            -Dorg.gradle.java.installations.auto-download=false
+          )
+          ./gradlew clean --no-daemon --stacktrace --max-workers=2 "${gradle_jdk_args[@]}"
+          ./gradlew check build javadoc verifyReleaseArtifacts writeReleaseChecksums eclipse verifyEclipseProductionClasspath --no-daemon --stacktrace --max-workers=2 "${gradle_jdk_args[@]}"
+      - name: Upload audited release candidate
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: OreSpawn-26.1.2-neoforge-${{ github.sha }}
+          if-no-files-found: error
+          retention-days: 30
+          path: |
+            build/libs/OreSpawn-4.0.16.2601022.jar
+            build/libs/OreSpawn-4.0.16.2601022-sources.jar
+            build/libs/OreSpawn-4.0.16.2601022-javadoc.jar
+            build/release/SHA256SUMS
+            CHANGELOG.txt
+      - name: Upload diagnostics on failure
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
-          java-version: 8
-      - run: chmod a+x gradlew
-      - run: ./gradlew --version --no-daemon
-      - run: ./gradlew setupCIWorkspace -S
-      - run: ./gradlew clean build -S
+          name: OreSpawn-26.1.2-neoforge-diagnostics-${{ github.sha }}
+          if-no-files-found: ignore
+          retention-days: 14
+          path: |
+            build/test-results/**
+            build/reports/**
+            build/*-run/logs/**
+            build/surface-integration-run/**/*.properties
+            build/problems/**

.github/workflows/codeql-analysis.yml

@@ -1,73 +1,64 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-#
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
-name: "CodeQL"
+name: CodeQL
 
-on: [push, pull_request]
-#on:
-#  push:
-#    branches: [ master-1.12 ]
-#  pull_request:
-#    # The branches below must be a subset of the branches above
-#    branches: [ master-1.12 ]
-#      types: [opened, synchronize, reopened]
-#  schedule:
-#    - cron: '43 7 * * 4'
+on:
+  push:
+    branches:
+      - master-26.1.2-neo
+      - 'feature/**'
+  pull_request:
+    branches:
+      - master-26.1.2-neo
+  schedule:
+    - cron: '43 7 * * 4'
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
 
 jobs:
   analyze:
-    name: Analyze
+    name: Analyze Java
     runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'java' ]
-        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
-        # Learn more:
-        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
-
+    timeout-minutes: 45
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
-      with:
-        languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
-        # queries: ./path/to/local/query, your-org/your-repo/queries@main
-
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
-
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
-
-    #- run: |
-    #   make bootstrap
-    #   make release
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Install exact Java 25
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '25.0.3+9.0.LTS'
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
+        with:
+          languages: java-kotlin
+      - name: Compile production code
+        shell: bash
+        run: |
+          set -euo pipefail
+          chmod +x ./gradlew
+          gradle_jdk_args=(
+            "-Dorg.gradle.java.installations.paths=$JAVA_HOME"
+            -Dorg.gradle.java.installations.auto-detect=false
+            -Dorg.gradle.java.installations.auto-download=false
+          )
+          ./gradlew clean --no-daemon --stacktrace --max-workers=2 "${gradle_jdk_args[@]}"
+          gradle_args=(
+            classes --no-daemon --stacktrace --max-workers=2
+            "${gradle_jdk_args[@]}"
+          )
+          for attempt in 1 2 3; do
+            if ./gradlew "${gradle_args[@]}"; then
+              exit 0
+            fi
+            if [ "$attempt" -eq 3 ]; then
+              echo "CodeQL compilation failed after $attempt attempts." >&2
+              exit 1
+            fi
+            echo "::warning::CodeQL compilation attempt $attempt failed; retrying with the preserved NeoGradle cache."
+          done
+      - name: Analyze
+        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4

.github/workflows/release-on-tag.yml

@@ -0,0 +1,94 @@
+name: Start OreSpawn release from tag
+
+on:
+  push:
+    tags:
+      - '*.*.*.*'
+
+permissions:
+  actions: read
+  contents: read
+
+concurrency:
+  group: orespawn-release-starter-${{ github.ref_name }}
+  cancel-in-progress: false
+
+jobs:
+  validate-release-tag:
+    name: Validate tag for manual release confirmation
+    if: github.repository == 'MinecraftModDevelopmentMods/OreSpawn'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Check out tagged source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+
+      - name: Validate release tag, target metadata, and prior CI
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+
+          value() { sed -n "s/^$1=//p" gradle.properties; }
+          release_version="$(value mod_version)"
+          minecraft_version="$(value minecraft_version)"
+          loader_name="$(value loader_name)"
+          loader_code="$(value loader_code)"
+
+          IFS=. read -r mc_major mc_minor mc_patch extra <<<"$minecraft_version"
+          if [[ -n "${extra:-}" || -z "${mc_major:-}" || -z "${mc_minor:-}" ]]; then
+            echo "Invalid minecraft_version=$minecraft_version" >&2
+            exit 1
+          fi
+          mc_patch="${mc_patch:-0}"
+          if [[ ! "$mc_major" =~ ^[0-9]+$ || ! "$mc_minor" =~ ^[0-9]+$ || ! "$mc_patch" =~ ^[0-9]+$ ]]; then
+            echo "Invalid minecraft_version=$minecraft_version" >&2
+            exit 1
+          fi
+          case "$loader_name:$loader_code" in
+            forge:1|neoforge:2) ;;
+            *) echo "Invalid loader metadata $loader_name/$loader_code" >&2; exit 1 ;;
+          esac
+          printf -v minor_padded '%02d' "$((10#$mc_minor))"
+          printf -v patch_padded '%02d' "$((10#$mc_patch))"
+          target_suffix="${mc_major}${minor_padded}${patch_padded}${loader_code}"
+
+          if [[ ! "$release_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.${target_suffix}$ ]]; then
+            echo "mod_version $release_version does not match $minecraft_version $loader_name target $target_suffix" >&2
+            exit 1
+          fi
+          if [[ "$GITHUB_REF_NAME" != "$release_version" ]]; then
+            echo "Release tag must equal mod_version $release_version; found $GITHUB_REF_NAME" >&2
+            exit 1
+          fi
+
+          successful_ci="$(gh api \
+            "repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/check-runs?per_page=100" \
+            --jq '[.check_runs[] | select(.name == "Build, test, and audit" and .conclusion == "success")] | length')"
+          if [[ "$successful_ci" -lt 1 ]]; then
+            echo "The tagged commit has no successful Build, test, and audit check" >&2
+            exit 1
+          fi
+
+      - name: Record the required manual publication step
+        env:
+          RELEASE_WORKFLOW_URL: https://github.com/${{ github.repository }}/actions/workflows/deploy-release.yml
+        run: |
+          {
+            echo "## Release candidate validated"
+            echo
+            echo "Tag \`$GITHUB_REF_NAME\` matches the selected target and has a successful Build, test, and audit check."
+            echo
+            echo "**Nothing has been published.**"
+            echo
+            echo "To continue, open [Deploy OreSpawn release]($RELEASE_WORKFLOW_URL), select **Run workflow**, and enter:"
+            echo
+            echo "- release_version: \`$GITHUB_REF_NAME\`"
+            echo "- curseforge_release_level: \`release\`, \`beta\`, or \`alpha\`"
+            echo "- confirm_live_publication: \`true\`"
+            echo
+            echo "The dispatcher builds and audits the immutable bundle before the separate \`release\` environment approval gate."
+          } >> "$GITHUB_STEP_SUMMARY"