You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@lucene.apache.org by dw...@apache.org on 2026/01/13 12:59:30 UTC

(lucene) branch branch_10x updated: Sync github workflow changes with the main branch (#15566)

This is an automated email from the ASF dual-hosted git repository.

dweiss pushed a commit to branch branch_10x
in repository https://gitbox.apache.org/repos/asf/lucene.git


The following commit(s) were added to refs/heads/branch_10x by this push:
     new 73950fa6c1a Sync github workflow changes with the main branch (#15566)
73950fa6c1a is described below

commit 73950fa6c1a2584d9e80cd84b730a339dcdfca07
Author: Dawid Weiss <da...@carrotsearch.com>
AuthorDate: Tue Jan 13 13:59:24 2026 +0100

    Sync github workflow changes with the main branch (#15566)
    
    * Sync github workflow changes with the main branch.
    
    * Correct incorrect whitespace.
    
    * Add gradle-script sanity checking block.
    
    * Downgrade min java for gradle tests.
    
    * Pass tests.workDir explicitly because build-options.local.properties are only on main.
    
    * Tweak kuromoji's source URL.
---
 .github/actions/prepare-for-build/action.yml       | 33 ++++++----
 .github/dependabot.yml                             | 42 ++++++++-----
 .github/workflows/mark-stale-PRs.yml               | 11 +++-
 .github/workflows/run-checks-all.yml               | 44 ++++++++++---
 .github/workflows/run-checks-gradle-upgrade.yml    | 72 +++++++++++++++++-----
 .../run-checks-mod-analysis-common-hunspell.yml    | 11 +++-
 .../run-checks-mod-distribution.tests.yml          | 12 +++-
 .github/workflows/run-checks-python.yml            | 12 +++-
 .github/workflows/run-nightly-smoketester.yml      | 29 ++++++---
 .github/workflows/run-scheduled-hunspell.yml       | 15 +++--
 gradle/generation/kuromoji.gradle                  |  3 +-
 11 files changed, 212 insertions(+), 72 deletions(-)

diff --git a/.github/actions/prepare-for-build/action.yml b/.github/actions/prepare-for-build/action.yml
index fadf03de919..fd0058f295c 100644
--- a/.github/actions/prepare-for-build/action.yml
+++ b/.github/actions/prepare-for-build/action.yml
@@ -5,35 +5,42 @@ name: Prepare Lucene build
 description: Creates a shared setup for other workflows
 
 inputs:
-   java-version:
-     required: false
-     default: "21"
-     description: "The default JDK version to set up."
+  java-version:
+    required: false
+    default: "21"
+    description: "The default JDK version to set up."
 
-   java-distribution:
-     required: false
-     default: "temurin"
-     description: "The default JDK distribution type"
+  java-distribution:
+    required: false
+    default: "temurin"
+    description: "The default JDK distribution type"
+
+  use-cache:
+    required: false
+    default: true
+    description: "Use setup-gradle for dependency caching"
 
 runs:
- using: "composite"
- steps:
+  using: "composite"
+  steps:
     - name: Set up Java (${{ inputs.java-distribution }}, ${{ inputs.java-version }})"
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
       with:
         distribution: ${{ inputs.java-distribution }}
         java-version: ${{ inputs.java-version }}
         java-package: jdk
 
     - name: Cache gradle-wrapper.jar
-      uses: actions/cache@v4
+      if: ${{ fromJSON(inputs.use-cache) }}
+      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: gradle/wrapper/gradle-wrapper.jar
         key: gradle-wrapper-${{ hashFiles('gradle/wrapper/gradle-wrapper.jar.sha256') }}
 
     # This includes "smart" caching of gradle dependencies.
     - name: Set up Gradle
-      uses: gradle/actions/setup-gradle@v4
+      if: ${{ fromJSON(inputs.use-cache) }}
+      uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
       with:
         # increase expiry time for the temp. develocity token.
         # https://github.com/gradle/actions/blob/main/docs/setup-gradle.md#increasing-the-expiry-time-for-develocity-access-tokens
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 0bcd325c3b1..959c9c7f473 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,25 +1,39 @@
 version: 2
 updates:
   - package-ecosystem: github-actions
-    directory: /
+    directories:
+      - "/"
+      - ".github/actions/eclint"
+      - ".github/actions/prepare-for-build"
+    open-pull-requests-limit: 25
     schedule:
-      interval: daily
+      interval: monthly
     commit-message:
       prefix: ci
-    labels: [dependencies]
-    open-pull-requests-limit: 1
-    groups:
-      actions:
-        patterns: ["*"]
+    labels: [dependencies, skip-changelog]
+    cooldown:
+      default-days: 7
 
+  # python dependencies in /dev-tools/scripts
   - package-ecosystem: pip
-    directory: /
+    directory: /dev-tools/scripts/
+    open-pull-requests-limit: 25
     schedule:
-      interval: daily
+      interval: monthly
     commit-message:
       prefix: build(deps)
-    labels:
-      - dependencies
-    groups:
-      pip:
-        patterns: ["*"]
+    labels: [dependencies, skip-changelog]
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: gradle
+    directory: /
+    open-pull-requests-limit: 25
+    schedule:
+      interval: weekly
+      day: tuesday
+    commit-message:
+      prefix: deps(java)
+    labels: [dependencies, skip-changelog]
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/mark-stale-PRs.yml b/.github/workflows/mark-stale-PRs.yml
index a4aa007c9d8..8da60a0390c 100644
--- a/.github/workflows/mark-stale-PRs.yml
+++ b/.github/workflows/mark-stale-PRs.yml
@@ -10,15 +10,22 @@ on:
   # Or run on demand
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   stale:
+    name: Mark stale PRs
     runs-on: ubuntu-latest
 
     permissions:
-      pull-requests: write
+      pull-requests: write # must comment/label PRs
+      actions: write # must manipulate actions cache to split workload across multiple runs
+
+    timeout-minutes: 15
 
     steps:
-      - uses: actions/stale@v5
+      - name: Run stale PR action
+        uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/run-checks-all.yml b/.github/workflows/run-checks-all.yml
index fdf23e4c346..05aeccd4f68 100644
--- a/.github/workflows/run-checks-all.yml
+++ b/.github/workflows/run-checks-all.yml
@@ -12,6 +12,8 @@ on:
       - 'main'
       - 'branch_10x'
 
+permissions: {}
+
 env:
   DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
@@ -37,11 +39,16 @@ jobs:
       - name: Correct git autocrlf
         run: git config --global core.autocrlf false
 
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/prepare-for-build
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: Configure tools
+        uses: ./.github/actions/prepare-for-build
 
       - name: Run gradle check (without tests)
-        run: ./gradlew check -x test "-Ptask.times=true" --max-workers 2
+        run: ./gradlew check -x test "-Ptask.times=true"
 
 
   # This runs all tests without any other validation checks.
@@ -52,8 +59,15 @@ jobs:
     strategy:
       matrix:
         # Operating systems to run on.
-        os: [ ubuntu-latest, windows-latest, macos-latest ]
+        os: [ ubuntu-latest, ubuntu-24.04-arm, windows-latest, macos-latest ]
         java: [ '21' ]
+        trigger:
+          - ${{ github.event_name }}
+        exclude:
+          - os: macos-latest
+            trigger: push
+          - os: macos-latest
+            trigger: pull_request
 
     runs-on: ${{ matrix.os }}
 
@@ -62,11 +76,27 @@ jobs:
         if: startsWith(matrix.os, 'windows')
         run: git config --global core.autocrlf false
 
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/prepare-for-build
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: Configure tools
+        uses: ./.github/actions/prepare-for-build
+
+      - name: Speedup MacOS runner
+        if: ${{ runner.os == 'macOS' }}
+        run: |
+          mkdir /tmp/tmpfs
+          sudo mount_tmpfs -o noowners -s 1g /tmp/tmpfs
+          sudo sysctl debug.lowpri_throttle_enabled=0
 
       - name: Run gradle tests
-        run: ./gradlew test "-Ptask.times=true" --max-workers 2
+        run: ./gradlew test "-Ptask.times=true" "-Pvalidation.errorprone=false" "-Ptests.workDir=/tmp/tmpfs/lucene"
+        env:
+          # Set to the defaults to override the "CI"-based logic that would enable C2
+          # we can't afford C2 on github runners.
+          TEST_JVM_ARGS: "-XX:TieredStopAtLevel=1 -XX:+UseParallelGC -XX:ActiveProcessorCount=1"
 
       - name: List automatically-initialized gradle.properties
         run: cat gradle.properties
diff --git a/.github/workflows/run-checks-gradle-upgrade.yml b/.github/workflows/run-checks-gradle-upgrade.yml
index 1db4b3c60bc..0079cd940f3 100644
--- a/.github/workflows/run-checks-gradle-upgrade.yml
+++ b/.github/workflows/run-checks-gradle-upgrade.yml
@@ -19,18 +19,49 @@ on:
       - '.github/workflows/run-checks-gradle-upgrade.yml'
       - 'gradle/wrapper/**'
 
+permissions: {}
+
 env:
   DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
 jobs:
+  gradleScriptBootstrapCheck:
+    name: "Check gradle boostrap script sanity on old JVMs."
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
+        with:
+          distribution: 'temurin'
+          java-version: 11
+          java-package: jdk
+
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+
+      - shell: bash
+        run: |
+          set +e
+          output=$(./gradlew 2>&1)
+          if [[ "$output" == *"ERROR: java version must be"* ]]; then
+            echo "Passed."
+          else
+            echo "Something is not right: gradlew command returned suspicious output or status code on JDK 11"
+            echo -e "gradlew output echoed below:\n\n$output\n\n---(end of output)"
+            exit 1
+          fi
+
   gradleSanityCheck:
     name: "Run tasks (java: ${{ matrix.java-version }}, alt-java: ${{ matrix.uses-alt-java }})"
     timeout-minutes: 30
+    needs: gradleScriptBootstrapCheck
 
     strategy:
       matrix:
         os: [ ubuntu-latest ]
-        java-version: [ '24' ]
+        java-version: [ '21' ]
         uses-alt-java: [ true, false ]
 
     runs-on: ${{ matrix.os }}
@@ -39,10 +70,15 @@ jobs:
       ALT_JAVA_DIR: /tmp/alt-java
 
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+
       - uses: ./.github/actions/prepare-for-build
         with:
           java-version: ${{ matrix.java-version }}
+          use-cache: false
 
       - name: Set up RUNTIME_JAVA_HOME variable
         if: ${{ matrix.uses-alt-java }}
@@ -51,24 +87,26 @@ jobs:
           set | grep "JAVA"
 
           echo "Gradle's 'RUNTIME_JAVA_HOME' JDK:"
-          RUNTIME_JAVA_HOME_VAR=JAVA_HOME_`echo ${{ matrix.java-version }} | egrep --only "[0-9]+"`_X64
-          echo ${RUNTIME_JAVA_HOME_VAR} points at ${!RUNTIME_JAVA_HOME_VAR}
-          
+          RUNTIME_JAVA_HOME_VAR=JAVA_HOME_$(echo "$JAVA_VERSION" | grep -E --only "[0-9]+")_X64
+          echo "${RUNTIME_JAVA_HOME_VAR}" points at "${!RUNTIME_JAVA_HOME_VAR}"
+
           # Copy the JDK from its default location to /tmp so that it appears different to gradle.
-          rsync -av ${!RUNTIME_JAVA_HOME_VAR}/ ${{ env.ALT_JAVA_DIR }}/
-          
+          rsync -av "${!RUNTIME_JAVA_HOME_VAR}/" "${ALT_JAVA_DIR}/"
+
           # This sets the environment variable and makes it available for subsequent job steps.
           # https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#setting-an-environment-variable
-          echo "RUNTIME_JAVA_HOME=${{ env.ALT_JAVA_DIR }}" >> "$GITHUB_ENV"
+          echo "RUNTIME_JAVA_HOME=$ALT_JAVA_DIR" >> "$GITHUB_ENV"
+        env:
+          JAVA_VERSION: ${{ matrix.java-version }}
 
       - name: ./gradlew tidy
         run: |
           ./gradlew tidy
           if [ ! -z "$(git status --porcelain)" ]; then
-          echo ":warning: **tidy left local checkout in modified state**" >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
-          git status --porcelain >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
+          echo ":warning: **tidy left local checkout in modified state**" >> "$GITHUB_STEP_SUMMARY"
+          echo '```' >> "$GITHUB_STEP_SUMMARY"
+          git status --porcelain >> "$GITHUB_STEP_SUMMARY"
+          echo '```' >> "$GITHUB_STEP_SUMMARY"
           git reset --hard && git clean -xfd .
           fi
 
@@ -77,11 +115,11 @@ jobs:
           # add this package for generateEmojiTokenizationTestChecksumLoad.
           sudo apt-get install libwww-perl
           ./gradlew regenerate -x generateUAX29URLEmailTokenizerInternal --rerun-tasks
-          if [ ! -z "$(git status --porcelain)" ]; then 
-            echo ":warning: **regenerate left local checkout in modified state**" >> $GITHUB_STEP_SUMMARY 
-            echo '```' >> $GITHUB_STEP_SUMMARY
-            git status --porcelain >> $GITHUB_STEP_SUMMARY
-            echo '```' >> $GITHUB_STEP_SUMMARY
+          if [ ! -z "$(git status --porcelain)" ]; then
+            echo ":warning: **regenerate left local checkout in modified state**" >> "$GITHUB_STEP_SUMMARY"
+            echo '```' >> "$GITHUB_STEP_SUMMARY"
+            git status --porcelain >> "$GITHUB_STEP_SUMMARY"
+            echo '```' >> "$GITHUB_STEP_SUMMARY"
             git reset --hard && git clean -xfd .
           fi
 
diff --git a/.github/workflows/run-checks-mod-analysis-common-hunspell.yml b/.github/workflows/run-checks-mod-analysis-common-hunspell.yml
index af907cf9da3..238fe41f5b3 100644
--- a/.github/workflows/run-checks-mod-analysis-common-hunspell.yml
+++ b/.github/workflows/run-checks-mod-analysis-common-hunspell.yml
@@ -19,6 +19,8 @@ on:
       - '.github/workflows/run-checks-mod-analysis-common.yml'
       - 'lucene/analysis/common/**'
 
+permissions: {}
+
 env:
   DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
@@ -30,8 +32,13 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/prepare-for-build
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: Configure tools
+        uses: ./.github/actions/prepare-for-build
 
       - name: Run Hunspell regression tests
         run: ./gradlew -p lucene/analysis/common -Ptests.hunspell.regressions=true -Ptests.verbose=true test --tests "TestAllDictionaries"
diff --git a/.github/workflows/run-checks-mod-distribution.tests.yml b/.github/workflows/run-checks-mod-distribution.tests.yml
index b78db6dd946..94b3831c31a 100644
--- a/.github/workflows/run-checks-mod-distribution.tests.yml
+++ b/.github/workflows/run-checks-mod-distribution.tests.yml
@@ -13,11 +13,14 @@ on:
       - 'main'
       - 'branch_10x'
 
+permissions: {}
+
 env:
   DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
 jobs:
   test:
+    name: Run distribution.tests
     timeout-minutes: 15
 
     strategy:
@@ -29,8 +32,13 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/prepare-for-build
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: Configure tools
+        uses: ./.github/actions/prepare-for-build
 
       - name: Run 'gradlew lucene/distribution.tests test' (on ${{ matrix.os }})
         run: ./gradlew -p lucene/distribution.tests test
diff --git a/.github/workflows/run-checks-python.yml b/.github/workflows/run-checks-python.yml
index 09dceffff3b..59d3ee1062a 100644
--- a/.github/workflows/run-checks-python.yml
+++ b/.github/workflows/run-checks-python.yml
@@ -19,18 +19,26 @@ on:
       - '.github/workflows/run-checks-python.yml'
       - 'dev-tools/scripts/**'
 
+permissions: {}
+
 jobs:
   lint:
+    name: Lint python scripts
     timeout-minutes: 15
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
           python-version: "3.12.6"
 
       - name: Lint Python
         run: "cd dev-tools/scripts && make"
+        env:
+          RUFF_OUTPUT_FORMAT: github
diff --git a/.github/workflows/run-nightly-smoketester.yml b/.github/workflows/run-nightly-smoketester.yml
index 75ce14198df..a3b5dd710ec 100644
--- a/.github/workflows/run-nightly-smoketester.yml
+++ b/.github/workflows/run-nightly-smoketester.yml
@@ -8,9 +8,13 @@ on:
   schedule:
     - cron: '4 2 * * *'
 
+permissions: {}
+
 jobs:
   smokeTestRelease:
     name: "Smoke test release on jdk ${{ matrix.java-version }}, ${{ matrix.os }}"
+    permissions:
+      contents: write # may work with contents:read
 
     # only run on schedule in the main Lucene repo (not in forks).
     if: (github.event_name == 'schedule' && github.repository == 'apache/lucene') || (github.event_name != 'schedule')
@@ -21,15 +25,20 @@ jobs:
         java-version: [ '21', '24' ]
 
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
 
     env:
       LUCENE_RELEASE_DIR: /tmp/lucene-release-dir
       TMP_DIR: /tmp/lucene-tmp-dir
 
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-java@v4
+      - name: Setup java
+        uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0
         with:
           distribution: 'temurin'
           java-package: jdk
@@ -45,29 +54,33 @@ jobs:
           set | grep "JAVA"
 
           echo "Gradle's 'RUNTIME_JAVA_HOME' JDK:"
-          RUNTIME_JAVA_HOME_VAR=JAVA_HOME_`echo ${{ matrix.java-version }} | egrep --only "[0-9]+"`_X64
-          echo ${RUNTIME_JAVA_HOME_VAR} points at ${!RUNTIME_JAVA_HOME_VAR}
+          RUNTIME_JAVA_HOME_VAR=JAVA_HOME_$(echo "$JAVA_VERSION" | grep -E --only "[0-9]+")_X64
+          echo "${RUNTIME_JAVA_HOME_VAR}" points at "${!RUNTIME_JAVA_HOME_VAR}"
 
           # This sets the environment variable and makes it available for subsequent job steps.
           # https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#setting-an-environment-variable
           echo "RUNTIME_JAVA_HOME=${!RUNTIME_JAVA_HOME_VAR}" >> "$GITHUB_ENV"
+        env:
+          JAVA_VERSION: ${{ matrix.java-version }}
 
       - name: "Run buildAndPushRelease.py (--dev-mode)"
         run: |
           # Assemble an unsigned release, in dev mode, publish locally.
-          python3 ./dev-tools/scripts/buildAndPushRelease.py --dev-mode --push-local ${{ env.LUCENE_RELEASE_DIR }}
+          python3 ./dev-tools/scripts/buildAndPushRelease.py --dev-mode --push-local "$LUCENE_RELEASE_DIR"
 
       - name: "Run smokeTestRelease.py (runtime java: ${{ matrix.java-version }})"
         run: |
+          subfolder=$(compgen -G "$LUCENE_RELEASE_DIR/lucene*")
+          subfolder=$(realpath "$subfolder")
           python3 -u dev-tools/scripts/smokeTestRelease.py \
             --not-signed \
-            --tmp-dir ${{ env.TMP_DIR }} \
-            file://`realpath ${{ env.LUCENE_RELEASE_DIR }}/lucene*` \
+            --tmp-dir "$TMP_DIR" \
+            "file://$subfolder" \
             -Ptests.filter="@skipall"
 
       - name: "Store smoke tester logs"
         if: ${{ always() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: smoke-tester-logs-jdk-${{ matrix.java-version }}
           path: |
diff --git a/.github/workflows/run-scheduled-hunspell.yml b/.github/workflows/run-scheduled-hunspell.yml
index 354719baacd..938e86b6bc0 100644
--- a/.github/workflows/run-scheduled-hunspell.yml
+++ b/.github/workflows/run-scheduled-hunspell.yml
@@ -7,6 +7,8 @@ on:
     # 4:13 on Mondays
     - cron: '13 4 * * 1'
 
+permissions: {}
+
 env:
   DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
@@ -18,15 +20,20 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/prepare-for-build
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: Configure tools
+        uses: ./.github/actions/prepare-for-build
 
       - name: Run Hunspell regression tests against latest commits in dictionary repositories
         run: >
-          ./gradlew -p lucene/analysis/common 
+          ./gradlew -p lucene/analysis/common
           -Ptests.hunspell.regressions=true
           -Ptests.verbose=true
           -Ptests.hunspell.libreoffice.ref=master
           -Ptests.hunspell.woorm.ref=main
-          test 
+          test
           --tests "TestAllDictionaries"
\ No newline at end of file
diff --git a/gradle/generation/kuromoji.gradle b/gradle/generation/kuromoji.gradle
index a5aa5fbd604..02def524648 100644
--- a/gradle/generation/kuromoji.gradle
+++ b/gradle/generation/kuromoji.gradle
@@ -55,7 +55,8 @@ configure(project(":lucene:analysis:kuromoji")) {
       dependsOn sourceSets.main.runtimeClasspath
 
       def dictionaryName = "mecab-ipadic-2.7.0-20070801"
-      def dictionarySource = "https://jaist.dl.sourceforge.net/project/mecab/mecab-ipadic/2.7.0-20070801/${dictionaryName}.tar.gz"
+      // original source: "https://jaist.dl.sourceforge.net/project/mecab/mecab-ipadic/2.7.0-20070801/${dictionaryName}.tar.gz"
+      def dictionarySource = "https://s3.amazonaws.com/lucene-testdata/mecab/${dictionaryName}.tar.gz"
       def dictionaryFile = file("${buildDir}/generate/${dictionaryName}.tar.gz")
       def unpackedDir = file("${buildDir}/generate/${dictionaryName}")