[FEAT] Update CI

.github/actions/setup-jdk/action.yml

@@ -0,0 +1,15 @@
+name: "setup-jdk"
+description: "Sets up the project JDK (Temurin) used across all workflows"
+inputs:
+  java-version:
+    description: "JDK version to install"
+    required: false
+    default: "25"
+runs:
+  using: "composite"
+  steps:
+    - name: Set up JDK ${{ inputs.java-version }}
+      uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+      with:
+        distribution: 'temurin'
+        java-version: ${{ inputs.java-version }}

.github/dependabot.yaml

@@ -19,7 +19,9 @@ updates:
           - patch
 
   - package-ecosystem: "github-actions"
-    directory: "/"
+    directories:
+      - "/"
+      - "/.github/actions/*"
     schedule:
       interval: "monthly"
       day: "monday"

.github/workflows/call-build-project.yml

@@ -1,9 +1,13 @@
-name: "detekt-validation"
+name: "build-project"
 on:
   workflow_call:
+
+permissions:
+  contents: read
+
 jobs:
-  build:
-    name: Build project with gradle
+  build_project:
+    name: Build ${{ matrix.id }} with Gradle
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -16,15 +20,12 @@ jobs:
             task: ":instances:bukkit:build"
     steps:
       - name: Checkout Git repo
-        uses: actions/checkout@v6
-      - name: Set up JDK 21
-        uses: actions/setup-java@v5
-        with:
-          distribution: 'adopt'
-          java-version: 21
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - name: Set up JDK
+        uses: ./.github/actions/setup-jdk
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
       - name: Give gradle permission
         run: chmod +x gradlew
-      - name: Build with Gradle
-        uses: gradle/gradle-build-action@v3
-        with:
-          arguments: ${{ matrix.task }} --stacktrace
+      - name: Build ${{ matrix.id }} with Gradle
+        run: ./gradlew ${{ matrix.task }} --stacktrace

.github/workflows/call-detekt-validation.yml

@@ -1,20 +1,22 @@
 name: "detekt-validation"
 on:
   workflow_call:
+
+permissions:
+  contents: read
+
 jobs:
-  detekt:
-    name: "Check project by detekt"
+  detekt_validation:
+    name: Validate project with detekt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - name: Set up JDK 21
-        uses: actions/setup-java@v5
-        with:
-          distribution: 'temurin'
-          java-version: '21'
+      - name: Checkout Git repo
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - name: Set up JDK
+        uses: ./.github/actions/setup-jdk
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
       - name: Give gradle permission
         run: chmod +x gradlew
-      - name: detekt
-        uses: gradle/gradle-build-action@v3
-        with:
-          arguments: detekt
+      - name: Run detekt
+        run: ./gradlew detekt

.github/workflows/call-gradle-wrapper-validation.yml

@@ -2,11 +2,15 @@ name: "gradle-wrapper-validation"
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
-  validation:
-    name: "Gradle Wrapper Validation"
+  gradle_wrapper_validation:
+    name: Validate Gradle wrapper
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - name: Validate Gradle Wrapper
-        uses: gradle/actions/wrapper-validation@v6
+      - name: Checkout Git repo
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - name: Validate Gradle wrapper
+        uses: gradle/actions/wrapper-validation@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6

.github/workflows/call-tests-validation.yml

@@ -1,21 +1,22 @@
-name: "tests"
+name: "tests-validation"
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
-  tests:
-    name: "Run tests"
+  tests_validation:
+    name: Run tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - name: Set up JDK 21
-        uses: actions/setup-java@v5
-        with:
-          distribution: 'adopt'
-          java-version: '21'
+      - name: Checkout Git repo
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - name: Set up JDK
+        uses: ./.github/actions/setup-jdk
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
       - name: Give gradle permission
         run: chmod +x gradlew
       - name: Run tests
-        uses: gradle/gradle-build-action@v3
-        with:
-          arguments: test
+        run: ./gradlew test

.github/workflows/call-upload-artifacts.yml

@@ -1,9 +1,13 @@
-name: "Upload artifacts"
+name: "upload-artifacts"
 on:
   workflow_call:
+
+permissions:
+  contents: read
+
 jobs:
   upload_artifacts:
-    name: Build and upload
+    name: Build and upload ${{ matrix.id }} dist
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -16,25 +20,24 @@ jobs:
             task: ":instances:bukkit:shadowJar"
     steps:
       - name: Checkout Git repo
-        uses: actions/checkout@v6
-      - uses: christian-draeger/read-properties@1.1.1
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - name: Read project properties
         id: properties
+        uses: christian-draeger/read-properties@908f99d3334be3802ec7cb528395a69d19914e7b # 1.1.1
         with:
           path: './gradle.properties'
           properties: 'klibs.project.name'
-      - name: Set up JDK 21
-        uses: actions/setup-java@v5
-        with:
-          distribution: 'adopt'
-          java-version: 21
+      - name: Set up JDK
+        uses: ./.github/actions/setup-jdk
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
       - name: Give gradle permission
         run: chmod +x gradlew
-      - name: Build with Gradle ${{ matrix.id }}
-        uses: gradle/gradle-build-action@v3
-        with:
-          arguments: ${{ matrix.task }} --stacktrace
-      - uses: actions/upload-artifact@6027e3dd177782cd8ab9af838c04fd81a07f1d47
-        name: "Upload ${{ matrix.id }}"
+      - name: Build ${{ matrix.id }} with Gradle
+        run: ./gradlew ${{ matrix.task }} --stacktrace
+      - name: Upload ${{ matrix.id }} dist
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
-          name: ${{ matrix.id }}
-          path: ./jars/${{ steps.properties.outputs.klibs-project-name }}-${{ matrix.id }}*.jar
+          name: dist-${{ matrix.id }}
+          # ./jars is the Gradle shadowJar output directory (see instances/*/build.gradle.kts)
+          path: ./jars/${{ steps.properties.outputs.klibs-project-name }}-${{ matrix.id }}*.jar

.github/workflows/call-upload-github-release.yml

@@ -1,46 +1,45 @@
-name: "Upload GitHub release"
+name: "upload-github-release"
 on:
   workflow_call:
     secrets:
       ACTIONS_TOKEN:
-        required: true
+        description: "Optional personal access token used to create the release. Falls back to the default GITHUB_TOKEN when not provided."
+        required: false
+
+# `contents: write` is required to create a release with the default
+# GITHUB_TOKEN. The caller job must grant the same permission.
+permissions:
+  contents: write
+
 jobs:
   upload_github_release:
     name: Upload GitHub release
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Git repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
-      - uses: christian-draeger/read-properties@1.1.1
+      - name: Read project properties
         id: properties
+        uses: christian-draeger/read-properties@908f99d3334be3802ec7cb528395a69d19914e7b # 1.1.1
         with:
           path: './gradle.properties'
           properties: 'klibs.project.name klibs.project.version.string'
-      - uses: actions/download-artifact@d0ce8fd1167ed839810201de977912a090ab10a7
-        name: "Download neoforge"
-        with:
-          name: neoforge
-          path: ./jars
-      - uses: actions/download-artifact@d0ce8fd1167ed839810201de977912a090ab10a7
-        name: "Download bukkit"
-        with:
-          name: bukkit
-          path: ./jars
-      - uses: actions/download-artifact@d0ce8fd1167ed839810201de977912a090ab10a7
-        name: "Download forge"
+      - name: Download dists
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
         with:
-          name: forge
-          path: ./jars
+          pattern: dist-*
+          path: ./dist
+          merge-multiple: true
 
-      - name: Create release
-        id: create_internal_release
-        uses: softprops/action-gh-release@v2
+      - name: Create GitHub release
+        id: create_github_release
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         env:
-          GITHUB_TOKEN: ${{ secrets.ACTIONS_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.ACTIONS_TOKEN || github.token }}
         with:
           files: |
-            ./jars/*.jar
+            ./dist/*.jar
           tag_name: ${{ steps.properties.outputs.klibs-project-version-string }}
           name: ${{ steps.properties.outputs.klibs-project-name }} - ${{ steps.properties.outputs.klibs-project-version-string }}
           draft: false

.github/workflows/call-upload-modrinth-release.yml

@@ -1,52 +1,51 @@
-name: "Upload Modrinth release"
+name: "upload-modrinth-release"
 on:
   workflow_call:
     secrets:
       MODRINTH_TOKEN:
+        description: "Modrinth API token used to publish the release."
         required: true
+
+permissions:
+  contents: read
+
 jobs:
-  upload_github_release:
-    name: Upload GitHub release
+  upload_modrinth_release:
+    name: Upload ${{ matrix.id }} Modrinth release
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        include:
-          - id: "neoforge"
-            task: ":instances:neoforge:shadowJar"
-          - id: "forge"
-            task: ":instances:forge:shadowJar"
-          - id: "bukkit"
-            task: ":instances:bukkit:shadowJar"
+        id: [ "neoforge", "forge", "bukkit" ]
     steps:
       - name: Checkout Git repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
-      - uses: christian-draeger/read-properties@1.1.1
+      - name: Read project properties
         id: properties
+        uses: christian-draeger/read-properties@908f99d3334be3802ec7cb528395a69d19914e7b # 1.1.1
         with:
           path: './gradle.properties'
           properties: 'klibs.project.name klibs.project.version.string'
 
-      - uses: actions/download-artifact@d0ce8fd1167ed839810201de977912a090ab10a7
-        name: "Download ${{ matrix.id }}"
+      - name: Download ${{ matrix.id }} dist
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
         with:
-          name: ${{ matrix.id }}
-          path: ./jars/${{ matrix.id }}
-      - uses: Kir-Antipov/mc-publish@v3.3
+          name: dist-${{ matrix.id }}
+          path: ./dist/${{ matrix.id }}
+      - name: Publish ${{ matrix.id }} to Modrinth
+        uses: Kir-Antipov/mc-publish@52307b03863581dec6b652b83e597aec02ebb075 # v3.3
         with:
-          # Only include this section if you wish to publish
-          # your assets on Modrinth.
           modrinth-id: 6NpNwzA1
           modrinth-token: ${{ secrets.MODRINTH_TOKEN }}
           name: ${{ steps.properties.outputs.klibs-project-name }}-${{ matrix.id }}
           version: ${{ steps.properties.outputs.klibs-project-version-string }}
           changelog: ${{ join(github.event.commits.*.message, '\n') }}
-          version_type: beta
+          version-type: beta
           java: |
             21
           loaders: |
             ${{ matrix.id }}
           game-versions: |
             [1.16,1.21.1)
           files: |
-            ./jars/${{ matrix.id }}/*.jar
+            ./dist/${{ matrix.id }}/*.jar