build: release version 1.13.0 (#544)

At this point, the release of _Timefold Quickstarts_ is ready to be
published.

- Release branch has been created.
- Git tag has been published.

To finish the release of _Timefold Quickstarts_,
review and merge this PR to update the `stable` branch with new code.
Afterward, delete the branch that this PR is based on. 
(Typically a button appears on this page once the PR is merged.)

---------

Co-authored-by: Fred <[email protected]>

Author: timefold-release

.github/workflows/pull_request_gradle.yml

@@ -28,8 +28,11 @@ jobs:
         java-version: [ 17 ] # Only the first supported LTS; already too many jobs here.
     timeout-minutes: 120
     steps:
-      # Clone timefold-solver
-      # Need to check for stale repo, since Github is not aware of the build chain and therefore doesn't automate it.
+      - name: Checkout timefold-quickstarts
+        uses: actions/checkout@v4
+        with:
+          path: './timefold-quickstarts'
+
       - name: Checkout timefold-solver (PR) # Checkout the PR branch first, if it exists
         if: github.head_ref # Only true if this is a PR.
         id: checkout-solver-pr
@@ -48,21 +51,6 @@ jobs:
           ref: main
           path: ./timefold-solver
           fetch-depth: 0 # Otherwise merge will fail on account of not having history.
-      - name: Prevent stale fork of timefold-solver # Solver can't be stale if development/stable branch requested.
-        if: ${{ steps.checkout-solver-pr.outcome == 'success' }}
-        env:
-          BLESSED_REPO: "timefold-solver"
-          BLESSED_BRANCH: ${{ endsWith(github.head_ref, '.x') && github.head_ref || 'main' }}
-        shell: bash
-        working-directory: ./timefold-solver
-        run: .github/scripts/prevent_stale_fork.sh
-
-      # Clone timefold-quickstarts
-      # No need to check for stale repo, as Github merges the main repo into the fork automatically.
-      - name: Checkout timefold-quickstarts
-        uses: actions/checkout@v4
-        with:
-          path: './timefold-quickstarts'
 
       # Build the solver
       - name: "Setup Java and Gradle"

.github/workflows/pull_request_maven.yml

@@ -28,8 +28,11 @@ jobs:
         java-version: [ 17, 21, 22 ] #Latest two LTS + latest non-LTS.
     timeout-minutes: 120
     steps:
-      # Clone timefold-solver
-      # Need to check for stale repo, since Github is not aware of the build chain and therefore doesn't automate it.
+      - name: Checkout timefold-quickstarts
+        uses: actions/checkout@v4
+        with:
+          path: './timefold-quickstarts'
+
       - name: Checkout timefold-solver (PR) # Checkout the PR branch first, if it exists
         if: github.head_ref # Only true if this is a PR.
         id: checkout-solver-pr
@@ -48,21 +51,6 @@ jobs:
           ref: main
           path: ./timefold-solver
           fetch-depth: 0 # Otherwise merge will fail on account of not having history.
-      - name: Prevent stale fork of timefold-solver # Solver can't be stale if development/stable branch requested.
-        if: ${{ steps.checkout-solver-pr.outcome == 'success' }}
-        env:
-          BLESSED_REPO: "timefold-solver"
-          BLESSED_BRANCH: ${{ endsWith(github.head_ref, '.x') && github.head_ref || 'main' }}
-        shell: bash
-        working-directory: ./timefold-solver
-        run: .github/scripts/prevent_stale_fork.sh
-
-      # Clone timefold-quickstarts
-      # No need to check for stale repo, as Github merges the main repo into the fork automatically.
-      - name: Checkout timefold-quickstarts
-        uses: actions/checkout@v4
-        with:
-          path: './timefold-quickstarts'
 
       # Build and test
       - name: "Setup Java and Maven"

.github/workflows/pull_request_maven_long_running.yml

@@ -1,8 +1,8 @@
 name: Maven Long-Running
 
 on:
-  # Enables the workflow to run on PRs from forks;
-  # token sharing is safe here, because enterprise is a private repo and therefore fully under our control.
+  # Enables the workflow to run on PRs from forks.
+  # CI will only run for trusted users, to prevent stealing of secrets.
   pull_request_target:
     branches: [stable, development, '*.x']
     types:
@@ -16,7 +16,39 @@ on:
       - '.github/**/*.yml'
 
 jobs:
+  # Check if the user is a member of the organization; if so, allow the PR to sail through.
+  known_user:
+    runs-on: ubuntu-latest
+    outputs:
+      is_member_of_org: ${{ steps.auth_check.outputs.authorized }}
+    steps:
+      - id: auth_check
+        env:
+          GH_TOKEN: ${{ secrets.JRELEASER_GITHUB_TOKEN }}  # Release account is a Solver Gatekeeper.
+        shell: bash
+        run: |
+          # -g to allow actors such as dependabot[bot]
+          ORG_MEMBERSHIP=`curl -g -L -H "Accept: application/vnd.github+json" -H "Authorization: Bearer $GH_TOKEN" "https://api.github.com/orgs/TimefoldAI/memberships/${{ github.actor }}" | jq -r '.state == "active"'`
+          echo "authorized=$ORG_MEMBERSHIP" >> "$GITHUB_OUTPUT"
+      - id: validation
+        shell: bash
+        run: |
+          echo "Authorized user: ${{ steps.auth_check.outputs.authorized }}"
+  # If the user is not a member, require a member to approve the PR.
+  approval_required:
+    needs: known_user
+    environment:
+      ${{
+      github.event_name == 'pull_request_target' &&
+      github.event.pull_request.head.repo.full_name != github.repository &&
+      (needs.known_user.outputs.is_member_of_org != 'true' || github.actor == 'dependabot[bot]') &&
+      'external' || 'internal'
+      }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: true
   build-quarkus:
+    needs: approval_required
     concurrency:
       group: pull_request_long_running-${{ github.event_name }}-${{ github.head_ref }}-${{ matrix.module }}-${{ matrix.java-version }}
       cancel-in-progress: true
@@ -34,8 +66,14 @@ jobs:
         java-version: [ 17 ] # Only the first supported LTS; already too many jobs here.
     timeout-minutes: 120
     steps:
-      # Clone timefold-solver
-      # Need to check for stale repo, since Github is not aware of the build chain and therefore doesn't automate it.
+      - name: Checkout timefold-quickstarts
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ github.actor }}/timefold-quickstarts
+          ref: ${{ github.head_ref }}
+          path: ./timefold-quickstarts
+          fetch-depth: 0 # Otherwise merge will fail on account of not having history.
+
       - name: Checkout timefold-solver (PR) # Checkout the PR branch first, if it exists
         id: checkout-solver
         uses: actions/checkout@v4
@@ -53,21 +91,6 @@ jobs:
           ref: main
           path: ./timefold-solver
           fetch-depth: 0 # Otherwise merge will fail on account of not having history.
-      - name: Prevent stale fork of timefold-solver
-        if: steps.checkout-solver.outcome == 'success'
-        env:
-          BLESSED_REPO: "timefold-solver"
-          BLESSED_BRANCH: ${{ endsWith(github.head_ref, '.x') && github.head_ref || 'main' }}
-        shell: bash
-        working-directory: ./timefold-solver
-        run: .github/scripts/prevent_stale_fork.sh
-
-      # Clone timefold-quickstarts
-      # No need to check for stale repo, as Github merges the main repo into the fork automatically.
-      - name: Checkout timefold-quickstarts
-        uses: actions/checkout@v4
-        with:
-          path: './timefold-quickstarts'
 
       # Build and test
       - name: "Setup GraalVM native image"
@@ -90,6 +113,7 @@ jobs:
         run: mvn -B -Dnative -Pnative verify
 
   build-enterprise-quarkus:
+    needs: approval_required
     concurrency:
       group: pull_request_enterprise_long_running-${{ github.event_name }}-${{ github.head_ref }}-${{ matrix.module }}-${{ matrix.java-version }}
       cancel-in-progress: true
@@ -100,8 +124,14 @@ jobs:
         java-version: [ 17 ] # Only the first supported LTS; already too many jobs here.
     timeout-minutes: 120
     steps:
-      # Clone timefold-solver
-      # Need to check for stale repo, since Github is not aware of the build chain and therefore doesn't automate it.
+      - name: Checkout timefold-quickstarts
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ github.actor }}/timefold-quickstarts
+          ref: ${{ github.head_ref }}
+          path: ./timefold-quickstarts
+          fetch-depth: 0 # Otherwise merge will fail on account of not having history.
+
       - name: Checkout timefold-solver (PR) # Checkout the PR branch first, if it exists
         id: checkout-solver
         uses: actions/checkout@v4
@@ -119,16 +149,7 @@ jobs:
           ref: main
           path: ./timefold-solver
           fetch-depth: 0 # Otherwise merge will fail on account of not having history.
-      - name: Prevent stale fork of timefold-solver
-        if: steps.checkout-solver.outcome == 'success'
-        env:
-          BLESSED_REPO: "timefold-solver"
-          BLESSED_BRANCH: ${{ endsWith(github.head_ref, '.x') && github.head_ref || 'main' }}
-        shell: bash
-        working-directory: ./timefold-solver
-        run: .github/scripts/prevent_stale_fork.sh
-      # Clone timefold-solver-enterprise
-      # Need to check for stale repo, since Github is not aware of the build chain and therefore doesn't automate it.
+
       - name: Checkout timefold-solver-enterprise (PR) # Checkout the PR branch first, if it exists
         id: checkout-solver-enterprise
         uses: actions/checkout@v4
@@ -149,13 +170,6 @@ jobs:
           path: ./timefold-solver-enterprise
           fetch-depth: 0 # Otherwise merge will fail on account of not having history.
 
-      # Clone timefold-quickstarts
-      # No need to check for stale repo, as Github merges the main repo into the fork automatically.
-      - name: Checkout timefold-quickstarts
-        uses: actions/checkout@v4
-        with:
-          path: './timefold-quickstarts'
-
       # Build and test
       - name: "Setup GraalVM native image"
         uses: graalvm/setup-graalvm@v1
@@ -177,6 +191,7 @@ jobs:
         run: mvn -B -Dnative -Denterprise -Pnative verify
 
   build-spring-boot:
+    needs: approval_required
     concurrency:
       group: pull_request_long_running-${{ github.event_name }}-${{ github.head_ref }}-${{ matrix.module }}-${{ matrix.java-version }}
       cancel-in-progress: true
@@ -189,8 +204,14 @@ jobs:
         java-version: [ 17 ] # Only the first supported LTS; already too many jobs here.
     timeout-minutes: 120
     steps:
-      # Clone timefold-solver
-      # Need to check for stale repo, since Github is not aware of the build chain and therefore doesn't automate it.
+      - name: Checkout timefold-quickstarts
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ github.actor }}/timefold-quickstarts
+          ref: ${{ github.head_ref }}
+          path: ./timefold-quickstarts
+          fetch-depth: 0 # Otherwise merge will fail on account of not having history.
+
       - name: Checkout timefold-solver (PR) # Checkout the PR branch first, if it exists
         id: checkout-solver
         uses: actions/checkout@v4
@@ -208,21 +229,6 @@ jobs:
           ref: main
           path: ./timefold-solver
           fetch-depth: 0 # Otherwise merge will fail on account of not having history.
-      - name: Prevent stale fork of timefold-solver
-        if: steps.checkout-solver.outcome == 'success'
-        env:
-          BLESSED_REPO: "timefold-solver"
-          BLESSED_BRANCH: ${{ endsWith(github.head_ref, '.x') && github.head_ref || 'main' }}
-        shell: bash
-        working-directory: ./timefold-solver
-        run: .github/scripts/prevent_stale_fork.sh
-
-      # Clone timefold-quickstarts
-      # No need to check for stale repo, as Github merges the main repo into the fork automatically.
-      - name: Checkout timefold-quickstarts
-        uses: actions/checkout@v4
-        with:
-          path: './timefold-quickstarts'
 
       # Build and test
       - name: "Setup GraalVM native image"

.github/workflows/pull_request_python.yml

@@ -26,8 +26,11 @@ jobs:
         python-version: ['3.11', '3.12']
     timeout-minutes: 120
     steps:
-      # Clone timefold-solver
-      # Need to check for stale repo, since Github is not aware of the build chain and therefore doesn't automate it.
+      - name: Checkout timefold-quickstarts
+        uses: actions/checkout@v4
+        with:
+          path: './timefold-quickstarts'
+
       - name: Checkout timefold-solver (PR) # Checkout the PR branch first, if it exists
         if: github.head_ref # Only true if this is a PR.
         id: checkout-solver-pr
@@ -46,50 +49,6 @@ jobs:
           ref: main
           path: ./timefold-solver
           fetch-depth: 0 # Otherwise merge will fail on account of not having history.
-      - name: Prevent stale fork of timefold-solver # Solver can't be stale if development/stable branch requested.
-        if: ${{ steps.checkout-solver-pr.outcome == 'success' }}
-        env:
-          BLESSED_REPO: "timefold-solver"
-          BLESSED_BRANCH: ${{ endsWith(github.head_ref, '.x') && github.head_ref || 'main' }}
-        shell: bash
-        working-directory: ./timefold-solver
-        run: .github/scripts/prevent_stale_fork.sh
-
-      # Clone timefold-solver-python
-      # Need to check for stale repo, since Github is not aware of the build chain and therefore doesn't automate it.
-      - name: Checkout timefold-solver-python (PR) # Checkout the PR branch first, if it exists
-        if: github.head_ref # Only true if this is a PR.
-        id: checkout-solver-python-pr
-        uses: actions/checkout@v4
-        continue-on-error: true
-        with:
-          repository: ${{ github.actor }}/timefold-solver-python
-          ref: ${{ github.head_ref }}
-          path: ./timefold-solver-python
-          fetch-depth: 0 # Otherwise merge will fail on account of not having history.
-      - name: Checkout timefold-solver-python (main) # Checkout the main branch if the PR branch does not exist
-        if: ${{ steps.checkout-solver-python-pr.outcome != 'success' }}
-        uses: actions/checkout@v4
-        with:
-          repository: TimefoldAI/timefold-solver-python
-          ref: main
-          path: ./timefold-solver-python
-          fetch-depth: 0 # Otherwise merge will fail on account of not having history.
-      - name: Prevent stale fork of timefold-solver-python # Solver can't be stale if development/stable branch requested.
-        if: ${{ steps.checkout-solver-python-pr.outcome == 'success' }}
-        env:
-          BLESSED_REPO: "timefold-solver-python"
-          BLESSED_BRANCH: ${{ endsWith(github.head_ref, '.x') && github.head_ref || 'main' }}
-        shell: bash
-        working-directory: ./timefold-solver-python
-        run: ../timefold-solver/.github/scripts/prevent_stale_fork.sh
-
-      # Clone timefold-quickstarts
-      # No need to check for stale repo, as Github merges the main repo into the fork automatically.
-      - name: Checkout timefold-quickstarts
-        uses: actions/checkout@v4
-        with:
-          path: './timefold-quickstarts'
 
       # Build and test
       - name: "Setup Java and Maven"
@@ -109,19 +68,14 @@ jobs:
 
       - name: Install build
         run:
-          python -m pip install --upgrade pip
           pip install build
 
-      - name: Quickly build timefold-solver
+      - name: Build timefold for python
         working-directory: ./timefold-solver
-        run: mvn -B -Dquickly -DskipTests clean install
-
-      - name: Build timefold-solver-python
-        working-directory: ./timefold-solver-python
         run: python -m build
 
       - name: Build and test timefold-quickstarts
         working-directory: ./timefold-quickstarts
         env:
-          TIMEFOLD_SOLVER_PYTHON_DIST: "${{ github.workspace }}/timefold-solver-python/dist"
+          TIMEFOLD_SOLVER_PYTHON_DIST: "${{ github.workspace }}/timefold-solver/dist"
         run: .github/scripts/run_python_tests.sh

java/bed-allocation/pom.xml

@@ -11,12 +11,12 @@
         <maven.compiler.release>17</maven.compiler.release>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
-        <version.io.quarkus>3.12.1</version.io.quarkus>
-        <version.ai.timefold.solver>1.12.0</version.ai.timefold.solver>
+        <version.io.quarkus>3.13.2</version.io.quarkus>
+        <version.ai.timefold.solver>1.13.0</version.ai.timefold.solver>
 
         <version.compiler.plugin>3.13.0</version.compiler.plugin>
         <version.resources.plugin>3.3.1</version.resources.plugin>
-        <version.surefire.plugin>3.3.0</version.surefire.plugin>
+        <version.surefire.plugin>3.3.1</version.surefire.plugin>
     </properties>
 
     <dependencyManagement>
@@ -84,7 +84,7 @@
         <dependency>
             <groupId>org.assertj</groupId>
             <artifactId>assertj-core</artifactId>
-            <version>3.26.0</version>
+            <version>3.26.3</version>
             <scope>test</scope>
         </dependency>