chore(deps): Update Gradle to 9.5 and migrate dependency management with locking

.github/workflows/gradle-publish.yml

@@ -25,21 +25,23 @@ jobs:
       packages: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
           java-version: '21'
           distribution: 'temurin'
 
-#      - name: Validate Gradle wrapper
-#        uses: gradle/wrapper-validation-action@f9c9c575b8b21b6485636a91ffecd10e558c62f6
+      - name: Validate Gradle wrapper
+        uses: gradle/actions/wrapper-validation@39fdf500b386709a9a4a769f717dad447ac345b9 # v6
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@39fdf500b386709a9a4a769f717dad447ac345b9 # v6
+        with:
+          cache-provider: enhanced
 
       - name: Publish package
-        run: ./gradlew publish
+        run: ./gradlew publish --no-daemon
         env:
           GITHUB_ACTOR: ${{ github.actor }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/gradle.yml

@@ -25,37 +25,32 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
           java-version: '21'
           distribution: 'temurin'
 
       - name: Cache SonarCloud packages
-        uses: actions/cache@v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: ~/.sonar/cache
           key: ${{ runner.os }}-sonar
           restore-keys: ${{ runner.os }}-sonar
 
-      - name: Cache Gradle packages
-        uses: actions/cache@v4
-        with:
-          path: ~/.gradle/caches
-          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}
-          restore-keys: ${{ runner.os }}-gradle
-
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@39fdf500b386709a9a4a769f717dad447ac345b9 # v6
+        with:
+          cache-provider: enhanced
 
       - name: Build with Gradle
         run: ./gradlew build
 
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/release.yml

@@ -9,6 +9,6 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: "Generate release changelog"
-        uses: heinrichreimer/github-changelog-generator-action@v2.4
+        uses: heinrichreimer/github-changelog-generator-action@e60b5a2bd9fcd88dadf6345ff8327863fb8b490f # v2.4
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.GITHUB_TOKEN }}

build.gradle.kts

@@ -1,58 +1,72 @@
-import java.lang.Runtime
-
 plugins {
-    kotlin("jvm") version "2.1.20"
-    id("io.github.goooler.shadow") version "8.1.8"
-    jacoco
-    id("maven-publish")
-}
-
-repositories {
-    mavenCentral()
-    maven {
-        url = uri("https://repo.papermc.io/repository/maven-public/")
-    }
+    alias(libs.plugins.kotlin)
+    alias(libs.plugins.gradleup.shadow)
+    alias(libs.plugins.jacoco)
+    alias(libs.plugins.maven.publish)
 }
 
 dependencies {
-    compileOnly("io.papermc.paper:paper-api:1.21.3-R0.1-SNAPSHOT")
-    compileOnly("org.jetbrains:annotations:26.0.1")
+    compileOnly(libs.paper.api)
+    compileOnly(libs.jetbrains.annotations)
+
+    implementation(libs.kotlin.stdlib)
+    implementation(libs.classgraph)
+    implementation(libs.apache.commons.lang3)
+    implementation(libs.kotlinx.coroutines.core)
+
+    testImplementation(libs.junit.jupiter.api)
+    testImplementation(libs.mockbukkit)
+    testImplementation(libs.hamcrest)
 
-    implementation("org.jetbrains.kotlin:kotlin-stdlib-jdk8:2.1.0")
-    implementation("io.github.classgraph:classgraph:4.8.179")
-    implementation("org.apache.commons:commons-lang3:3.17.0")
-    implementation("org.jetbrains.kotlinx:kotlinx-coroutines-core:1.10.1")
+    testRuntimeOnly(libs.junit.platform.launcher)
 
-    testImplementation("org.junit.jupiter:junit-jupiter-api:5.14.4")
-    testImplementation("org.mockbukkit.mockbukkit:mockbukkit-v1.21:4.25.1")
-    testImplementation("org.hamcrest:hamcrest-library:3.0")
+}
 
-    testRuntimeOnly("org.junit.platform:junit-platform-launcher")
+dependencyLocking {
+    lockAllConfigurations()
 
+    ignoredDependencies.add("io.papermc.paper:paper-api")
 }
 
-val jarVersion = "1.5.0"
+version = "1.5.0"
+group = "de.thelooter"
 
 tasks {
 
     java {
         toolchain.languageVersion.set(JavaLanguageVersion.of(21))
     }
 
+    kotlin {
+        jvmToolchain(21)
+    }
+
+    jar {
+        archiveVersion.set(project.version.toString())
+    }
+
     shadowJar {
         relocate("io.github.classgraph", "de.thelooter.classgraph")
         relocate("org.apache.commons", "de.thelooter.commons")
 
-        archiveFileName.set("eventchecker-$jarVersion.jar")
+        archiveBaseName.set("eventchecker")
+        archiveClassifier.set("")
+        archiveVersion.set(project.version.toString())
+
+        mergeServiceFiles()
     }
 
-    jar {
+    assemble {
         dependsOn(shadowJar)
     }
 
     test {
         useJUnitPlatform()
-        maxParallelForks = (Runtime.getRuntime().availableProcessors() / 2).coerceAtLeast(1)
+        maxParallelForks = providers.gradleProperty("test.maxParallelForks")
+            .map(String::toInt)
+            .getOrElse((Runtime.getRuntime().availableProcessors() / 2).coerceAtLeast(1))
+
+        finalizedBy(jacocoTestReport)
     }
 
     jacoco {
@@ -65,24 +79,47 @@ tasks {
             html.required.set(true)
             html.outputLocation.set(layout.buildDirectory.dir("jacocoHtml"))
         }
-        dependsOn(test)
+    }
+
+    jacocoTestCoverageVerification {
+        violationRules {
+            rule {
+                limit {
+                    counter = "INSTRUCTION"
+                    value = "COVEREDRATIO"
+                    minimum = "0.85".toBigDecimal()
+                }
+                limit {
+                    counter = "BRANCH"
+                    value = "COVEREDRATIO"
+                    minimum = "0.60".toBigDecimal()
+                }
+            }
+        }
+
+        dependsOn(jacocoTestReport)
     }
 
     check {
         dependsOn(jacocoTestReport)
+        dependsOn(jacocoTestCoverageVerification)
     }
 
-}
+    withType<AbstractArchiveTask>().configureEach {
+        isPreserveFileTimestamps = false
+        isReproducibleFileOrder = true
+    }
 
+}
 
 publishing {
     publications {
         create<MavenPublication>("maven") {
-            groupId = "de.thelooter"
+            groupId = project.group.toString()
             artifactId = "eventchecker"
-            version = jarVersion
+            version = project.version.toString()
 
-            from(components["java"])
+            artifact(tasks.shadowJar)
         }
     }
 
@@ -91,8 +128,14 @@ publishing {
             name = "GitHubPackages"
             url = uri("https://maven.pkg.github.com/thelooter/EventChecker")
             credentials {
-                username = System.getenv("GITHUB_ACTOR")
-                password = System.getenv("GITHUB_TOKEN")
+                username =
+                    providers.gradleProperty("gpr.user")
+                        .orElse(providers.environmentVariable("GITHUB_ACTOR"))
+                        .orNull
+                password =
+                    providers.gradleProperty("gpr.key")
+                        .orElse(providers.environmentVariable("GITHUB_TOKEN"))
+                        .orNull
             }
         }
     }