Merge branch 'erlang:master' into crypto/dh-uint64-fix

Author: ruslandoga

.github/scripts/add-vex-license.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+
+## %CopyrightBegin%
+##
+## SPDX-License-Identifier: Apache-2.0
+##
+## Copyright Ericsson AB 2026. All Rights Reserved.
+##
+## Licensed under the Apache License, Version 2.0 (the "License");
+## you may not use this file except in compliance with the License.
+## You may obtain a copy of the License at
+##
+##     http://www.apache.org/licenses/LICENSE-2.0
+##
+## Unless required by applicable law or agreed to in writing, software
+## distributed under the License is distributed on an "AS IS" BASIS,
+## WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+## See the License for the specific language governing permissions and
+## limitations under the License.
+##
+## %CopyrightEnd%
+##
+
+set -euo pipefail
+
+CHANGED_FILES="${1:-/tmp/changed-vex.txt}"
+YEAR=$(date +%Y)
+
+while IFS= read -r FILE; do
+    [ -z "$FILE" ] && continue
+    LICENSE_FILE="${FILE}.sigstore.license"
+    if [ ! -f "$LICENSE_FILE" ]; then
+        printf '%%CopyrightBegin%%\n\nSPDX-License-Identifier: Apache-2.0\n\nCopyright Ericsson AB %s. All Rights Reserved.\n\n%%CopyrightEnd%%\n' "$YEAR" > "$LICENSE_FILE"
+        echo "Created $LICENSE_FILE"
+    else
+        echo "License file already exists: $LICENSE_FILE, skipping"
+    fi
+done < "$CHANGED_FILES"

.github/scripts/create-openvex-pr.sh

@@ -20,32 +20,58 @@
 ##
 ## %CopyrightEnd%
 
+# Note: This script is to be called internally as follows:
+# openvex-sync.yaml -->
+#    .github/scripts/otp-compliance.es vex verify -p -->
+#        create-openvex-pr.sh
+#
+# as such, the following assumptions follow:
+#
+# - current branch: orphan
+# - openvex-sync.yml has copied from `master`
+#   - .github/scripts/otp-compliance.es
+#   - .github/scripts/create-openvex-pr.sh
+# - execution of `.github/scripts/otp-compliance.es vex verify -p` calls `.github/scripts/create-openvex-pr.sh`
+#
+
+set -e   # exit immediately if any command fails
 
 REPO=$1
 BRANCH_NAME=$2
+ORPHAN_BRANCH="openvex"
+
 # Fetch PR data using gh CLI
-PR_STATUS=$(gh pr view "$BRANCH_NAME" --repo "$REPO" --json state -q ".state")
-FOUND_PR=$?
+if gh pr view "$BRANCH_NAME" --repo "$REPO" --json state -q ".state" > /tmp/pr_status 2>/dev/null; then
+  FOUND_PR=0
+  PR_STATUS=$(cat /tmp/pr_status)
+else
+  FOUND_PR=1
+  PR_STATUS=""
+fi
 
 if [ "$FOUND_PR" -ne 0 ]; then
   echo "No PR with name #$BRANCH_NAME in $REPO exists."
   echo "A new PR will be created"
 fi
 
-# Check if PR is closed
 if [ "$PR_STATUS" = "CLOSED" ] || [ "$PR_STATUS" = "MERGED" ] || [ "$FOUND_PR" -ne 0 ]; then
   echo "Pull request #$BRANCH_NAME is CLOSED or MERGED."
   echo "✅ A new pull request with name #$BRANCH_NAME will be created."
-  git branch "$BRANCH_NAME" master
-  git checkout "$BRANCH_NAME"
-  git add make/openvex.table
-  git add vex
+
+  # Create a new work branch inside the worktree
+  git checkout -b "$BRANCH_NAME"
+
+  # Commit inside the worktree
+  git add otp-*.openvex.json
+  git add otp-*.openvex.json.license
+  git add openvex.table
   git commit -m "Automatic update of OpenVEX Statements for erlang/otp"
   git push --force origin "$BRANCH_NAME"
-  gh pr create --repo "$REPO" -B master \
+
+  gh pr create --repo "$REPO" -B "$ORPHAN_BRANCH" \
+               --head "$BRANCH_NAME" \
                --title "Automatic update of OpenVEX Statements for erlang/otp" \
                --body "Automatic Action. There is a vulnerability from GH Advisories without a matching OpenVEX statement"
-  exit 0
 else
   echo "❌ Pull request #$BRANCH_NAME is OPEN. Create a PR once the PR is closed or merged."
   exit 0

.github/scripts/otp-compliance.es

@@ -46,13 +46,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
-env:
-    ## Equivalent to github.event_name == 'pull_request' ? github.base_ref : github.ref_name
-    BASE_BRANCH: ${{ github.event_name == 'pull_request' && github.base_ref || github.ref_name }}
-    ## 'true' if all steps should be built and all tests run
-    FULL_BUILD_AND_CHECK: ${{ github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'full-build-and-check') || github.event_name == 'schedule' }}
-    OTP_SBOM_VERSION: ${{ github.ref_type == 'tag' && github.ref_name || github.sha }}
-
 permissions:
   contents: read
   pull-requests: read

.github/workflows/main.yaml

@@ -41,8 +41,19 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
         with:
-          ref: 'master' # '' = default branch
+          ref: 'openvex' # '' = default branch
           persist-credentials: false
+          fetch-depth: 0
+
+      - name: 'Fetch Erlang/otp script dependencies'
+        run: |
+          git fetch origin master
+          WORKTREE=$(mktemp -d /tmp/master-worktree.XXXXXX)
+          git worktree add "$WORKTREE" master
+          mkdir -p .github/scripts/
+          cp -r "$WORKTREE/.github/scripts/." .github/scripts/
+          cp "$WORKTREE/otp_versions.table" .
+          git worktree remove "$WORKTREE"
 
       - uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # ratchet:erlef/setup-beam@v1.20.4
         with:
@@ -69,6 +80,12 @@ jobs:
         run: |
           echo "${STEPS_APP_TOKEN_OUTPUTS_TOKEN}" | gh auth login --with-token
 
+      # register `gh` as git credential helper => git push in otp-compliance
+      # uses the token from `gh`. otherwise, `persist-credentials` should not be `false`.
+      # changing `persist-credentials` is not a good option
+      - name: Configure git to use gh as credential helper
+        run: gh auth setup-git
+
       - name: Get GitHub App User ID
         id: get-user-id
         env:

.github/workflows/openvex-sync.yml

@@ -50,9 +50,10 @@ jobs:
             copyback: false
             disable-cache: true
             prepare: |
-              pkg update
-              pkg upgrade -y
-              pkg install -y bash gmake gtar autoconf ncurses pkgconf
+              # Don't update base FreeBSD system, only required ports
+              pkg update -fr FreeBSD-ports
+              pkg upgrade -yr FreeBSD-ports
+              pkg install -yr FreeBSD-ports bash gmake gtar autoconf ncurses pkgconf
 
             run: |
                 tar -xzf ./otp_src.tar.gz

.github/workflows/reusable-freebsd.yaml

@@ -32,9 +32,9 @@ on:
   release:
     types: [edited]
   pull_request:
-    branches: [master]
+    branches: [openvex]
     paths:
-      - 'vex/*.openvex.json'
+      - '*.openvex.json'
 
 permissions:
   contents: read
@@ -61,13 +61,10 @@ jobs:
         run: mkdir artifacts; cp *.tar.gz artifacts/
       - name: Attest Distribution Assets with SBoM
         id: attest-sbom
-        uses: actions/attest-sbom@4651f806c01d8637787e274ac3bdf724ef169f34 # v3
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # ratchet:actions/attest@v4.10
         with:
           subject-path: |
             artifacts/*.tar.gz
-            bom.*.json
-            bom.*.yml
-            bom.*.xml
           sbom-path: bom.spdx.json
       - name: Copy SBoM provenance
         id: sbom-provenance
@@ -77,7 +74,7 @@ jobs:
         run: |
           shopt -s nullglob
           mkdir attestations
-          for FILE in artifacts/*.tar.gz bom.*.xml bom.*.json bom.*.yml; do
+          for FILE in artifacts/*.tar.gz bom.*.json; do
             cp "$ATTESTATION" "attestations/$(basename "$FILE").sigstore"
           done
       - name: Update release
@@ -96,23 +93,6 @@ jobs:
       id-token: write
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout PR branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: "${{ github.head_ref }}"
-          fetch-depth: 0
-          persist-credentials: false
-      - name: Find modified OpenVEX files
-        id: changed
-        run: |
-          git diff --name-only --diff-filter=AM origin/master -- 'vex/*.openvex.json' > /tmp/changed-vex.txt
-          echo "Modified OpenVEX files:"
-          cat /tmp/changed-vex.txt
-          if [ -s /tmp/changed-vex.txt ]; then
-            echo "found=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "found=false" >> "$GITHUB_OUTPUT"
-          fi
       - name: Check PR author permission
         env:
           GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
@@ -134,12 +114,37 @@ jobs:
             echo "::error::Only maintainers or erlang-bot-app can trigger VEX attestations"
             exit 1
           fi
+
+      - name: Checkout PR branch
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: "${{ github.event.pull_request.head.repo.full_name }}"
+          ref: "${{ github.event.pull_request.head.ref }}"
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Find modified OpenVEX files
+        id: changed
+        run: |
+          git diff --name-only --diff-filter=AM HEAD~1 HEAD -- '*.openvex.json' > /tmp/changed-vex.txt
+          echo "Modified OpenVEX files:"
+          cat /tmp/changed-vex.txt
+          if [ -s /tmp/changed-vex.txt ]; then
+            echo "found=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "found=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Add license files for new OpenVEX files
+        if: steps.changed.outputs.found == 'true'
+        run: bash .github/scripts/add-vex-license.sh /tmp/changed-vex.txt
+
       - name: Attest OpenVEX files
         if: steps.changed.outputs.found == 'true'
         id: attest
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.10
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # ratchet:actions/attest@v4.10
         with:
-          subject-path: 'vex/*.openvex.json'
+          subject-path: '*.openvex.json'
       - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
         if: steps.changed.outputs.found == 'true'
         id: app-token
@@ -156,6 +161,14 @@ jobs:
           STEPS_APP_TOKEN_OUTPUTS_TOKEN: "${{ steps.app-token.outputs.token }}"
         run: |
           echo "${STEPS_APP_TOKEN_OUTPUTS_TOKEN}" | gh auth login --with-token
+
+      # register `gh` as git credential helper => git push in otp-compliance
+      # uses the token from `gh`. otherwise, `persist-credentials` should not be `false`.
+      # changing `persist-credentials` is not a good option
+      - name: Configure git to use gh as credential helper
+        if: steps.changed.outputs.found == 'true'
+        run: gh auth setup-git
+
       - name: Get GitHub App User ID
         if: steps.changed.outputs.found == 'true'
         id: get-user-id
@@ -169,15 +182,19 @@ jobs:
         env:
           ATTESTATION: "${{ steps.attest.outputs.bundle-path }}"
           STEPS_APP_TOKEN_OUTPUTS_APP_SLUG: "${{ steps.app-token.outputs.app-slug }}"
+          STEPS_APP_TOKEN_OUTPUTS_TOKEN: "${{ steps.app-token.outputs.token }}"
           STEPS_GET_USER_ID_OUTPUTS_USER_ID: "${{ steps.get-user-id.outputs.user-id }}"
+          PR_HEAD_REPO: "${{ github.event.pull_request.head.repo.full_name }}"
+          PR_HEAD_REF: "${{ github.event.pull_request.head.ref }}"
         run: |
           while IFS= read -r FILE; do
             [ -z "$FILE" ] && continue
             BASENAME=$(basename "$FILE")
-            cp "$ATTESTATION" "vex/${BASENAME}.sigstore"
+            cp "$ATTESTATION" "${BASENAME}.sigstore"
           done < /tmp/changed-vex.txt
           git config user.name "${STEPS_APP_TOKEN_OUTPUTS_APP_SLUG}[bot]"
           git config user.email "${STEPS_GET_USER_ID_OUTPUTS_USER_ID}+${STEPS_APP_TOKEN_OUTPUTS_APP_SLUG}[bot]@users.noreply.github.com"
-          git add vex/*.sigstore
+          git remote set-url origin "https://x-access-token:${STEPS_APP_TOKEN_OUTPUTS_TOKEN}@github.com/${PR_HEAD_REPO}.git"
+          git add *.sigstore *.sigstore.license
           git commit -m "Update sigstore attestations for OpenVEX files" || true
-          git push
+          git push origin "HEAD:${PR_HEAD_REF}"

.github/workflows/sigstore-updater.yml

@@ -236,7 +236,6 @@ JAVADOC-GENERATED
 /lib/compiler/test/*_no_ssa_opt_SUITE.erl
 /lib/compiler/test/*_post_opt_SUITE.erl
 /lib/compiler/test/*_inline_SUITE.erl
-/lib/compiler/test/*_r26_SUITE.erl
 /lib/compiler/test/*_no_module_opt_SUITE.erl
 /lib/compiler/test/*_no_type_opt_SUITE.erl
 /lib/compiler/test/*_dialyzer_SUITE.erl