- package-ecosystem: "maven"
    directory: "/"
    schedule:
      interval: "daily"
    target-branch: "maven-4.0.x"
    labels:
      - "mvn40"
      - "dependencies"

  - package-ecosystem: "maven"
    directory: "/"
    schedule:
      interval: "daily"
    target-branch: "maven-3.9.x"
    labels:
      - "mvn3"
      - "dependencies"

  - package-ecosystem: "maven"
    directory: "/"

[gh-build]: https://github.com/apache/maven/actions/workflows/maven.yml?query=branch%3Amaster
[gh-build-4.0]: https://github.com/apache/maven/actions/workflows/maven.yml?query=branch%3Amaven-4.0.x
[gh-build-3.10]: https://github.com/apache/maven/actions/workflows/maven.yml?query=branch%3Amaven-3.10.x
[gh-build-3.9]: https://github.com/apache/maven/actions/workflows/maven.yml?query=branch%3Amaven-3.9.x
[maven-home]: https://maven.apache.org/

# by a third-party and are governed by separate terms of service, privacy
# policy, and support documentation.

name: Scorecard supply-chain security
on:
  # For Branch-Protection check. Only the default branch is supported. See
  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
  branch_protection_rule:
  # To guarantee Maintained check is occasionally updated. See

      - name: Create Pull Request
        uses: peter-evans/create-pull-request@v8
        with:
          commit-message: Update performance test durations
          branch: bot-update-performance-test-durations
          branch-suffix: timestamp
          delete-branch: true
          title: 'Update performance test durations'
          signoff: true
          sign-commits: true
          labels: |
            in:building-gradle

 *
 * When merging `releaseX` branch into `master`, we should only use the release note from the `master` branch,
 * but sometimes changes on release notes.md was brought to master and merged unnoticed,
 * e.g https://github.com/gradle/gradle/pull/25825
 *
 * This script is to check if there is any merge commit that brings changes from release branch to master.
 *
 * Usage (Java 11+ single-file source execution):

        if: steps.check-changes.outputs.changes == 'true'
        uses: peter-evans/create-pull-request@v8
        with:
          commit-message: Update test buckets
          branch: devprod/update-test-buckets
          branch-suffix: timestamp
          delete-branch: true
          title: 'Update test buckets'
          signoff: true
          sign-commits: true
          labels: |
            in:building-gradle

                <configuration>
                    <format>kotlin</format>
                    <dstDir>target/generated-configs</dstDir>
                    <contextParameters>
                        <branch>${dslContextParameter.branch}</branch>
                    </contextParameters>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>

          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: pages deploy ./site --project-name=${{ env.PROJECT_NAME }} --branch=${{ env.BRANCH }}
      - name: Deploy Docs Status Error
        if: failure()
        run: uv run ./scripts/deploy_docs_status.py
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    outputs:
      docs: ${{ steps.filter.outputs.docs }}
    steps:
    - uses: actions/checkout@v6
    # For pull requests it's not necessary to checkout the code but for the main branch it is
    - uses: dorny/paths-filter@v4
      id: filter
      with:
        filters: |
          docs:
            - README.md
            - docs/**
            - docs_src/**
            - pyproject.toml

1.  API changes require discussion, use cases, etc. Code comes later.
2.  Pull requests are great for small fixes for bugs, documentation, etc.
3.  Pull requests are not merged directly into the master branch.
4.  Code contributions require signing a Google CLA.

API changes
-----------

We make changes to Guava's public [APIs][], including adding new APIs, very