Fix CI

.github/actions/jbang-check/action.yml

@@ -3,6 +3,10 @@ description: 'Builds all JBang scripts and verifies the launchers support --help
 runs:
   using: 'composite'
   steps:
+    - name: Resolve //DEPS into the cached directory
+      # JBang resolves script dependencies into ~/.m2, which is not cached here.
+      shell: bash
+      run: echo "JBANG_REPO=$HOME/.jbang/repository" >> "$GITHUB_ENV"
     - name: Build .jbang scripts
       shell: bash
       run: |

.github/actions/setup-gradle/action.yml

@@ -1,5 +1,5 @@
-name: Setup JDK, JBang, and gradle
-description: Setup JDK, JBang and gradle
+name: Setup JDK and gradle
+description: Setup JDK and gradle. JBang is installed by the dev.jbang gradle plugin on demand; jobs calling `jbang` from the shell need jbangdev/setup-jbang themselves.
 
 inputs:
   distribution:
@@ -26,17 +26,18 @@ runs:
         gradle-version: current
       env:
         GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED: false
-    - name: Generate JBang cache key
-      id: cache-key
+    # JBang resolves the //DEPS of a script into the local Maven repository (~/.m2 by default),
+    # which nothing in this repository caches. Point it into the Gradle user home's "caches"
+    # directory instead - gradle/actions/setup-gradle caches that one out of the box.
+    # Two steps because JBang is a Java program: on Windows it needs a native path
+    # (C:\Users\runneradmin\...), not the Git Bash form (/c/Users/...).
+    - name: Set JBANG_REPO
+      if: runner.os != 'Windows'
       shell: bash
+      run: echo "JBANG_REPO=${GRADLE_USER_HOME:-$HOME/.gradle}/caches/jbang-repo" >> "$GITHUB_ENV"
+    - name: Set JBANG_REPO (Windows)
+      if: runner.os == 'Windows'
+      shell: pwsh
       run: |
-        echo "cache_key=jbang-$(date +%Y-%m)" >> $GITHUB_OUTPUT
-    - name: Cache JBang
-      uses: actions/cache@v6
-      with:
-        path: ~/.jbang
-        key: ${{ steps.cache-key.outputs.cache_key }}
-        restore-keys:
-          jbang-
-    - name: Setup JBang
-      uses: jbangdev/setup-jbang@main
+        $gradleUserHome = if ($env:GRADLE_USER_HOME) { $env:GRADLE_USER_HOME } else { Join-Path $env:USERPROFILE '.gradle' }
+        "JBANG_REPO=$(Join-Path $gradleUserHome 'caches\jbang-repo')" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8

.github/workflows/pr-comment.yml

@@ -138,9 +138,32 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      # Setup JBang (included at setup-gralde)
-      - uses: ./.github/actions/setup-gradle
+      # No setup-gradle here: this job never runs Gradle, it only needs a JDK and JBang.
+      - uses: actions/setup-java@v5
         if: ${{ github.event_name == 'workflow_dispatch' || (steps.check-label.outputs.has_label == 'false' && steps.read-pr_number.outputs.pr_number != '' && steps.isCrossRepository.outputs.isCrossRepository == 'true') }}
+        with:
+          distribution: 'corretto'
+          java-version: '25'
+      - name: Generate JBang cache key
+        if: ${{ github.event_name == 'workflow_dispatch' || (steps.check-label.outputs.has_label == 'false' && steps.read-pr_number.outputs.pr_number != '' && steps.isCrossRepository.outputs.isCrossRepository == 'true') }}
+        id: cache-key
+        run: echo "cache_key=jbang-ghprcomment-$(date +%Y-%m)" >> $GITHUB_OUTPUT
+      - name: Cache JBang
+        # Own key: ghprcomment pulls different dependencies than the other JBang jobs.
+        if: ${{ github.event_name == 'workflow_dispatch' || (steps.check-label.outputs.has_label == 'false' && steps.read-pr_number.outputs.pr_number != '' && steps.isCrossRepository.outputs.isCrossRepository == 'true') }}
+        uses: actions/cache@v6
+        with:
+          path: ~/.jbang
+          key: ${{ steps.cache-key.outputs.cache_key }}
+          restore-keys:
+            jbang-ghprcomment-
+      - name: Resolve //DEPS into the cached directory
+        # JBang resolves script dependencies into ~/.m2, which is not cached here.
+        if: ${{ github.event_name == 'workflow_dispatch' || (steps.check-label.outputs.has_label == 'false' && steps.read-pr_number.outputs.pr_number != '' && steps.isCrossRepository.outputs.isCrossRepository == 'true') }}
+        run: echo "JBANG_REPO=$HOME/.jbang/repository" >> "$GITHUB_ENV"
+      - name: Setup JBang
+        if: ${{ github.event_name == 'workflow_dispatch' || (steps.check-label.outputs.has_label == 'false' && steps.read-pr_number.outputs.pr_number != '' && steps.isCrossRepository.outputs.isCrossRepository == 'true') }}
+        uses: jbangdev/setup-jbang@2b1b465a7b75f4222b81426f23a01e013aa7b95c # v0.1.1
 
       - name: ghprcomment@main
         if: ${{ github.event_name == 'workflow_dispatch' || (steps.check-label.outputs.has_label == 'false' && steps.read-pr_number.outputs.pr_number != '' && steps.isCrossRepository.outputs.isCrossRepository == 'true') }}

.github/workflows/tests-code.yml

@@ -242,13 +242,16 @@ jobs:
       - name: Cache JBang
         # Combined cache action: restores at start and saves ~/.jbang on a
         # cache miss in the post-job step. A madrlint-specific key keeps this
-        # cache separate from the shared "jbang-" cache used by setup-gradle.
+        # cache separate from the other JBang-using jobs.
         uses: actions/cache@v6
         with:
           path: ~/.jbang
           key: ${{ steps.cache-key.outputs.cache_key }}
           restore-keys:
             jbang-madrlint-
+      - name: Resolve //DEPS into the cached directory
+        # JBang resolves script dependencies into ~/.m2, which is not cached here.
+        run: echo "JBANG_REPO=$HOME/.jbang/repository" >> "$GITHUB_ENV"
       - uses: actions/setup-java@v5
         with:
           distribution: 'corretto'
@@ -296,15 +299,19 @@ jobs:
         shell: bash
         run: |
           echo "cache_key=jbang-heylogs-$(date +%Y-%m)" >> $GITHUB_OUTPUT
-      - name: Use cache
-        uses: actions/cache/restore@v6
+      - name: Cache JBang
+        # Combined cache action: the restore-only variant never wrote the key.
+        uses: actions/cache@v6
         with:
           path: ~/.jbang
           key: ${{ steps.cache-key.outputs.cache_key }}
           restore-keys:
             jbang-heylogs-
+      - name: Resolve //DEPS into the cached directory
+        # JBang resolves script dependencies into ~/.m2, which is not cached here.
+        run: echo "JBANG_REPO=$HOME/.jbang/repository" >> "$GITHUB_ENV"
       - name: Setup JBang
-        uses: jbangdev/setup-jbang@main
+        uses: jbangdev/setup-jbang@2b1b465a7b75f4222b81426f23a01e013aa7b95c # v0.1.1
       - name: Lint CHANGELOG.md
         run: |
           # the grep is needed to filter out an error about all h2 containing a version, which is not relevant for us, because we have an "Unreleased" section
@@ -522,6 +529,21 @@ jobs:
         with:
           submodules: 'false'
           show-progress: 'false'
+      - name: Generate JBang cache key
+        id: cache-key
+        shell: bash
+        run: echo "cache_key=jbang-check-$(date +%Y-%m)" >> $GITHUB_OUTPUT
+      - name: Cache JBang
+        # Shared by the "JBang (main)" and "JBang (PR)" jobs - both build the same scripts,
+        # so they resolve the same dependencies. A PR run restores the entry written on main.
+        uses: actions/cache@v6
+        with:
+          path: ~/.jbang
+          key: ${{ steps.cache-key.outputs.cache_key }}
+          restore-keys:
+            jbang-check-
+      - name: Setup JBang
+        uses: jbangdev/setup-jbang@2b1b465a7b75f4222b81426f23a01e013aa7b95c # v0.1.1
       - uses: ./.github/actions/setup-gradle
       - name: Build JBang scripts and run launchers
         uses: ./.github/actions/jbang-check
@@ -537,12 +559,29 @@ jobs:
         with:
           submodules: 'true'
           show-progress: 'false'
+      - name: Generate JBang cache key
+        id: cache-key
+        shell: bash
+        run: echo "cache_key=jbang-check-$(date +%Y-%m)" >> $GITHUB_OUTPUT
+      - name: Cache JBang
+        # Shared by the "JBang (main)" and "JBang (PR)" jobs - both build the same scripts,
+        # so they resolve the same dependencies. A PR run restores the entry written on main.
+        uses: actions/cache@v6
+        with:
+          path: ~/.jbang
+          key: ${{ steps.cache-key.outputs.cache_key }}
+          restore-keys:
+            jbang-check-
+      - name: Setup JBang
+        uses: jbangdev/setup-jbang@2b1b465a7b75f4222b81426f23a01e013aa7b95c # v0.1.1
       - uses: ./.github/actions/setup-gradle
       # Publish jablib to the local Maven repository so the JBang scripts pick up
       # unreleased changes. -PprojVersion=6.0 makes the artifact 6.0-SNAPSHOT
       # (the default would be 0.1.0-SNAPSHOT, which the scripts do not reference).
       - name: Publish jablib to the local Maven repository
-        run: gradle -PprojVersion=6.0 :jablib:publishToMavenLocal
+        # -Dmaven.repo.local: the jbang-check action points JBANG_REPO at ~/.jbang/repository,
+        # so the snapshot has to be published there instead of into ~/.m2.
+        run: gradle -Dmaven.repo.local="$HOME/.jbang/repository" -PprojVersion=6.0 :jablib:publishToMavenLocal
       - name: Build JBang scripts and run launchers
         uses: ./.github/actions/jbang-check
 

build-logic/build.gradle.kts

@@ -3,6 +3,12 @@ plugins {
 }
 
 repositories {
+    // Workaround for Maven Central rate limiting (HTTP 429).
+    // gradlePluginPortal() redirects non-portal artifacts (kotlin-stdlib, ...)
+    // to repo.maven.apache.org, which enforces consumption limits since 2026.
+    // See https://central.sonatype.org/faq/429-error/ and gradle/gradle#37880.
+    maven { url = uri("https://maven-central.storage-download.googleapis.com/maven2/") }
+
     gradlePluginPortal()
     maven { url = uri("https://jitpack.io") }
 }

jablib/build.gradle.kts

@@ -100,13 +100,17 @@ tasks.generateGrammarSource {
     arguments = arguments + listOf("-visitor", "-long-messages")
 }
 
+evaluationDependsOn(":versions")
+val jbangVersion = project(":versions").extra["jbangVersion"] as String
+
 val abbrvJabRefOrgDir = layout.projectDirectory.dir("src/main/abbrv.jabref.org")
 val generatedJournalFile = layout.buildDirectory.file("generated/resources/journals/journal-list.mv")
 
 var taskGenerateJournalListMV = tasks.register<JBangTask>("generateJournalListMV") {
     group = "JabRef"
     description = "Converts the comma-separated journal abbreviation file to a H2 MVStore"
     dependsOn(tasks.named("generateGrammarSource"))
+    version = jbangVersion
 
     script = '"' + rootProject.layout.projectDirectory.file("build-support/src/main/java/JournalListMvGenerator.java").asFile.absolutePath + '"'
 
@@ -121,6 +125,7 @@ var taskGenerateCitationStyleCatalog = tasks.register<JBangTask>("generateCitati
     description = "Generates a catalog of all available citation styles"
     // The JBang gradle plugin doesn't handle parallization well - thus we enforce sequential execution
     mustRunAfter(taskGenerateJournalListMV)
+    version = jbangVersion
 
     script = '"' + rootProject.layout.projectDirectory.file("build-support/src/main/java/CitationStyleCatalogGenerator.java").asFile.absolutePath + '"'
 
@@ -136,6 +141,7 @@ var taskGenerateLtwaListMV = tasks.register<JBangTask>("generateLtwaListMV") {
     description = "Converts the LTWA CSV file to a H2 MVStore"
     // The JBang gradle plugin doesn't handle parallization well - thus we enforce sequential execution
     mustRunAfter(taskGenerateCitationStyleCatalog)
+    version = jbangVersion
 
     script = '"' + rootProject.layout.projectDirectory.file("build-support/src/main/java/LtwaListMvGenerator.java").asFile.absolutePath + '"'
 

renovate.json

@@ -16,6 +16,14 @@
         "//DEPS ((?<depName>\\S+:\\S+):(?<currentValue>[^$]\\S+))(\\@\\w+)?"
       ],
       "datasourceTemplate": "maven"
+    },
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["versions/build.gradle.kts"],
+      "matchStrings": ["val jbang = \"(?<currentValue>.+)\""],
+      "depNameTemplate": "jbangdev/jbang",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v(?<version>.+)$"
     }
   ],
   "packageRules": [

versions/build.gradle.kts

@@ -21,6 +21,11 @@ val lucene = "10.5.0"
 
 val pdfbox = "3.0.8"
 
+// Pinned instead of the dev.jbang plugin default "latest": a PATH miss would otherwise fetch
+// https://www.jbang.dev/releases/latest/download/version.txt (10 s timeout, no retries).
+val jbang = "0.141.0"
+extra["jbangVersion"] = jbang
+
 dependencies {
     api(platform("ai.djl:bom:0.36.0"))
     api(platform("dev.langchain4j:langchain4j-bom:1.18.1"))