.github/FUNDING.yml

@@ -1,8 +1 @@
-# These are supported funding model platforms
-
-github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
-patreon: # Replace with a single Patreon username
-open_collective: # Replace with a single Open Collective username
-ko_fi: # Replace with a single Ko-fi username
-tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
 custom: https://junit.org/sponsoring

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,10 +1,11 @@
 ---
-name: Bug report
+name: Report a bug or regression
 about: Create a report to help us improve
-
+type: Bug
+labels: ["type: bug"]
 ---
 
-<!-- Please provide us the version of JUnit 5 you are using and, if possible, a failing unit test with your bug report. Don't forget to describe the rationale for this issue (e.g. expected vs. actual behavior). -->
+<!-- Please provide us the version of JUnit 5 you are using and, if possible, a failing unit test with your bug report. Don't forget to describe the rationale for this issue (e.g. expected vs. actual behavior). Please also mention where it's a regression compared to a previous version. -->
 
 ## Steps to reproduce
 

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Ask a question
+    url: https://github.com/junit-team/junit5/discussions/categories/q-a
+    about: Please ask and answer questions here
+  - name: Ask a question (Stack Overflow)
+    url: https://stackoverflow.com/questions/tagged/junit5
+    about: Alternatively, ask questions here

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,7 +1,8 @@
 ---
-name: Feature request
+name: Request a feature or enhancement
 about: Suggest an idea for this project
-
+type: Feature
+labels: ["type: new feature"]
 ---
 
 <!-- Start by telling us what problem you’re trying to solve. Often a solution already exists! Please, don’t send pull requests to implement new features without first getting our support. -->

.github/ISSUE_TEMPLATE/task.md

@@ -0,0 +1,12 @@
+---
+name: Create a task
+about: Create a task for a specific piece of work
+type: Task
+labels: ["type: task"]
+---
+
+<!-- Please describe what needs to be done to consider this task completed. -->
+
+## Deliverables
+
+- [ ] ...

.github/actions/main-build/action.yml

@@ -4,16 +4,20 @@ inputs:
   arguments:
     required: true
     description: Gradle arguments
-    default: build
+    default: :platform-tooling-support-tests:test build --no-configuration-cache # Disable configuration cache due to https://github.com/diffplug/spotless/issues/2318
+  encryptionKey:
+    required: true
+    description: Gradle cache encryption key
 runs:
   using: "composite"
   steps:
     - uses: ./.github/actions/setup-test-jdk
     - uses: ./.github/actions/run-gradle
       with:
         arguments: ${{ inputs.arguments }}
-    - uses: actions/upload-artifact@v3
+        encryptionKey: ${{ inputs.encryptionKey }}
+    - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       if: ${{ always() }}
       with:
-        name: Test Distribution trace files (${{ github.job }})
-        path: '**/build/test-results/*/trace.json'
+        name: Open Test Reports (${{ github.job }})
+        path: '**/build/reports/open-test-report.html'

.github/actions/maven-central-user-token/action.yml

@@ -0,0 +1,17 @@
+name: Prepare Maven Central user token
+description: Compute the Maven Central user token from username and password
+inputs:
+  username:
+    required: true
+    description: Maven Central username
+  password:
+    required: true
+    description: Maven Central password
+runs:
+  using: "composite"
+  steps:
+    - shell: bash
+      run: |
+        USER_TOKEN=$(printf "${{ inputs.username }}:${{ inputs.password }}" | base64)
+        echo "::add-mask::$USER_TOKEN"
+        echo "MAVEN_CENTRAL_USER_TOKEN=$USER_TOKEN" >> $GITHUB_ENV

.github/actions/run-gradle/action.yml

@@ -5,21 +5,29 @@ inputs:
     required: true
     description: Gradle arguments
     default: build
+  encryptionKey:
+    required: true
+    description: Gradle cache encryption key
 runs:
   using: "composite"
   steps:
-    - uses: actions/setup-java@v3
+    - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
       id: setup-gradle-jdk
       with:
         distribution: temurin
-        java-version: 17
-    - uses: gradle/gradle-build-action@v2
+        java-version: 21
+        check-latest: true
+    - uses: gradle/actions/setup-gradle@8379f6a1328ee0e06e2bb424dadb7b159856a326 # v4.4.0
+      with:
+        cache-encryption-key: ${{ inputs.encryptionKey }}
+    - shell: bash
       env:
         JAVA_HOME: ${{ steps.setup-gradle-jdk.outputs.path }}
-      with:
-        arguments: |
-          -Porg.gradle.java.installations.auto-download=false
-          -Penterprise.predictiveTestSelection.enabled=${{ github.event_name == 'pull_request' }}
-          "-Dscan.value.GitHub job=${{ github.job }}"
-          javaToolchains
-          ${{ inputs.arguments }}
+      run: |
+        ./gradlew \
+        -Porg.gradle.java.installations.auto-download=false \
+        -Pjunit.develocity.predictiveTestSelection.enabled=true \
+        -Pjunit.develocity.predictiveTestSelection.selectRemainingTests=${{ github.event_name != 'pull_request' }} \
+        "-Dscan.value.GitHub job=${{ github.job }}" \
+        javaToolchains \
+        ${{ inputs.arguments }}

.github/actions/setup-test-jdk/action.yml

@@ -1,11 +1,17 @@
 name: Set up Test JDK
 description: Sets up the JDK required to run platform-tooling-support-tests
+inputs:
+  distribution:
+    required: true
+    description: 'The JDK distribution to use'
+    default: 'liberica'
 runs:
   using: "composite"
   steps:
-    - uses: actions/setup-java@v3
+    - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
       with:
-        distribution: temurin
+        distribution: ${{ inputs.distribution }}
         java-version: 8
+        check-latest: true
     - shell: bash
       run: echo "JDK8=$JAVA_HOME" >> $GITHUB_ENV

.codecov.yml → .github/codecov.yml

@@ -1,8 +1,12 @@
 comment: false
+
 coverage:
   status:
     project:
       default:
-        threshold: 1
+        threshold: "1"
         informational: true
     patch: off
+
+codecov:
+  max_report_age: off

.github/renovate.json5

@@ -0,0 +1,36 @@
+{
+  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
+  extends: [
+    'github>junit-team/renovate-config',
+  ],
+  baseBranches: ["main", "/^develop\\/.*/"],
+  packageRules: [
+    {
+      matchCurrentValue: '/^2\\./',
+      allowedVersions: '(,3.0)',
+      matchPackageNames: [
+        'org.codehaus.groovy:{/,}**',
+      ],
+    },
+    {
+      matchCurrentValue: '/^4\\./',
+      allowedVersions: '(,5.0)',
+      matchPackageNames: [
+        'org.apache.groovy:{/,}**',
+      ],
+    },
+    {
+      matchCurrentValue: '/^1\\./',
+      allowedVersions: '/^1\\..*-groovy-2\\.*/',
+      matchPackageNames: [
+        'org.spockframework:{/,}**',
+      ],
+    },
+    {
+      allowedVersions: '!/-SNAPSHOT$/',
+      matchPackageNames: [
+        'org.opentest4j.reporting:{/,}**',
+      ],
+    },
+  ],
+}

.github/scripts/checkBuildReproducibility.sh

@@ -0,0 +1,30 @@
+#!/bin/bash -e
+
+rm -f checksums-1.txt checksums-2.txt
+
+SOURCE_DATE_EPOCH=$(date +%s)
+export SOURCE_DATE_EPOCH
+
+function calculate_checksums() {
+    OUTPUT=$1
+
+    ./gradlew \
+        --configuration-cache \
+        --no-build-cache \
+        -Porg.gradle.java.installations.auto-download=false \
+        -Dscan.tag.Reproducibility \
+        clean \
+        assemble
+
+    find . -name '*.jar' \
+        | grep '/build/libs/' \
+        | grep --invert-match 'javadoc' \
+        | sort \
+        | xargs sha512sum > "${OUTPUT}"
+}
+
+
+calculate_checksums checksums-1.txt
+calculate_checksums checksums-2.txt
+
+diff checksums-1.txt checksums-2.txt

.github/scripts/waitForUrl.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+URL=$1
+printf 'Waiting for %s' "$URL"
+until curl --output /dev/null --silent --location --head --fail "$URL"; do
+    printf '.'
+    sleep 5
+done
+echo ' OK'

.github/workflows/close-inactive-issues.yml

@@ -3,14 +3,15 @@ on:
   schedule:
     - cron: "30 1 * * *"
   workflow_dispatch:
+permissions: read-all
 jobs:
   close-issues:
     runs-on: ubuntu-latest
     permissions:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@v8
+      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
         with:
           only-labels: "status: waiting-for-feedback"
           days-before-stale: 14

.github/workflows/codeql-analysis.yml

@@ -13,8 +13,10 @@ on:
   schedule:
     - cron: '0 19 * * 3'
 
+permissions: read-all
+
 env:
-  GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
+  DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
 jobs:
   analyze:
@@ -30,18 +32,19 @@ jobs:
           - javascript
     steps:
     - name: Check out repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
       with:
         languages: ${{ matrix.language }}
-        tools: latest
+        tools: linked
     - name: Build
       uses: ./.github/actions/run-gradle
       with:
+        encryptionKey: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
         arguments: |
-          --no-build-cache
-          -Dscan.tag.CodeQL
+          --no-build-cache \
+          -Dscan.tag.CodeQL \
           allMainClasses
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18