merge master to develop

.devcontainer/Dockerfile

@@ -1,3 +1,3 @@
 # From https://github.com/microsoft/vscode-dev-containers/blob/master/containers/go/.devcontainer/Dockerfile
-ARG VARIANT="17-jdk-bookworm"
+ARG VARIANT="21-jdk-bookworm"
 FROM mcr.microsoft.com/vscode/devcontainers/java:${VARIANT}

.devcontainer/devcontainer.json

@@ -5,7 +5,7 @@
 		"dockerfile": "Dockerfile",
 		"args": {
 			// Update the VARIANT arg to pick a version of Java
-			"VARIANT": "17-jdk-bookworm",
+			"VARIANT": "21-jdk-bookworm",
 		}
 	},
 	"containerEnv": {

.editorconfig

@@ -115,7 +115,7 @@ ij_java_for_statement_wrap = off
 ij_java_generate_final_locals = false
 ij_java_generate_final_parameters = false
 ij_java_if_brace_force = never
-ij_java_imports_layout = *,|,javax.**,java.**,|,$*
+ij_java_imports_layout = *,|,javax.**,jakarta.**,java.**,|,$*
 ij_java_indent_case_from_switch = true
 ij_java_insert_inner_class_imports = false
 ij_java_insert_override_annotation = true

.github/pull_request_template.md

@@ -0,0 +1,35 @@
+### 🔧 Type of changes
+- [ ] new bid adapter
+- [ ] bid adapter update
+- [ ] new feature
+- [ ] new analytics adapter
+- [ ] new module
+- [ ] module update
+- [ ] bugfix
+- [ ] documentation
+- [ ] configuration
+- [ ] dependency update
+- [ ] tech debt (test coverage, refactorings, etc.)
+
+### ✨ What's the context?
+What's the context for the changes?
+
+### 🧠 Rationale behind the change
+Why did you choose to make these changes? Were there any trade-offs you had to consider?
+
+### 🔎 New Bid Adapter Checklist
+- [ ] verify email contact works
+- [ ] NO fully dynamic hostnames
+- [ ] geographic host parameters are NOT required
+- [ ] direct use of HTTP is prohibited - *implement an existing Bidder interface that will do all the job*
+- [ ] if the ORTB is just forwarded to the endpoint, use the generic adapter - *define the new adapter as the alias of the generic adapter*
+- [ ] cover an adapter configuration with an integration test
+
+### 🧪 Test plan
+How do you know the changes are safe to ship to production?
+
+### 🏎 Quality check
+- [ ] Are your changes following [our code style guidelines](https://github.com/prebid/prebid-server-java/blob/master/docs/developers/code-style.md)?
+- [ ] Are there any breaking changes in your code?
+- [ ] Does your test coverage exceed 90%?
+- [ ] Are there any erroneous console logs, debuggers or leftover code in your changes?

.github/workflows/code-path-changes.yml

@@ -0,0 +1,37 @@
+name: Notify Code Path Changes
+
+on:
+  pull_request_target:
+    types: [ opened, synchronize ]
+    paths:
+      - '**'
+
+permissions:
+  contents: read
+
+env:
+  OAUTH2_CLIENT_ID: ${{ secrets.OAUTH2_CLIENT_ID }}
+  OAUTH2_CLIENT_SECRET: ${{ secrets.OAUTH2_CLIENT_SECRET }}
+  OAUTH2_REFRESH_TOKEN: ${{ secrets.OAUTH2_REFRESH_TOKEN }}
+  GITHUB_REPOSITORY: ${{ github.repository }}
+  GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+jobs:
+  notify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v5
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '18'
+
+      - name: Install dependencies
+        run: npm install axios nodemailer
+
+      - name: Run Notification Script
+        run: |
+          node .github/workflows/scripts/send-notification-on-change.js

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,60 @@
+name: CodeQL
+
+on:
+  pull_request:
+    branches: [ 'master' ]
+  schedule:
+    - cron: '0 3 * * 1'
+
+permissions:
+  security-events: write
+  packages: read
+  actions: read
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+          - language: java-kotlin
+            build-mode: manual
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Set up JDK
+        uses: actions/setup-java@v5
+        with:
+          distribution: 'temurin'
+          java-version: 21
+
+      - name: Cache Maven packages
+        uses: actions/cache@v5
+        with:
+          path: ~/.m2/repository
+          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            ${{ runner.os }}-maven-
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      - name: Build with Maven
+        if: matrix.build-mode == 'manual'
+        run: mvn -B package --file extra/pom.xml
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: '/language:${{ matrix.language }}'

.github/workflows/cross-repo-issue.yml

@@ -2,17 +2,20 @@ name: Cross-repo Issue Creation
 
 on:
   pull_request_target:
-    types: [closed]
+    types: [ closed ]
     branches:
-      - "master"
+      - 'master'
+
+permissions:
+  contents: read
 
 jobs:
   cross-repo:
     runs-on: ubuntu-latest
     steps:
       - name: Generate token
         id: generate_token
-        uses: tibdex/github-app-token@v1
+        uses: tibdex/github-app-token@v2.1.0
         with:
           app_id: ${{ secrets.XREPO_APP_ID }}
           private_key: ${{ secrets.XREPO_PEM }}
@@ -23,9 +26,10 @@ jobs:
           github.event.pull_request.merged
         env:
           GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
         run: |
           echo -e "A PR was merged over on PBS-Java\n\n- [https://github.com/prebid/prebid-server-java/pull/${{github.event.number}}](https://github.com/prebid/prebid-server-java/pull/${{github.event.number}})\n- timestamp: ${{ github.event.pull_request.merged_at}}" > msg
           export msg=$(cat msg)
-          gh issue create --repo prebid/prebid-server --title "Port PR from PBS-Java: ${{ github.event.pull_request.title }}" \
+          gh issue create --repo prebid/prebid-server --title "Port PR from PBS-Java: $PR_TITLE" \
               --body "$msg" \
               --label auto

.github/workflows/docker-image-publish.yml

@@ -1,10 +1,13 @@
 name: Publish Docker image for new tag/release
 
 on:
-  workflow_run:
-    workflows: [Publish release]
-    types:
-      - completed
+  push:
+    tags:
+      - '*'
+
+permissions:
+  contents: read
+  packages: write
 
 env:
   REGISTRY: ghcr.io
@@ -14,47 +17,57 @@ jobs:
   build:
     name: Publish Docker image for new tag/release
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     strategy:
       matrix:
-        java: [ 17 ]
-        dockerfile-path: [Dockerfile, extra/Dockerfile]
+        java: [ 21 ]
+        dockerfile-path: [ Dockerfile, Dockerfile-modules ]
         include:
           - dockerfile-path: Dockerfile
             build-cmd: mvn clean package -Dcheckstyle.skip -Dmaven.test.skip=true
             package-name: ghcr.io/${{ github.repository }}
-          - dockerfile-path: extra/Dockerfile
+
+          - dockerfile-path: Dockerfile-modules
             build-cmd: mvn clean package --file extra/pom.xml -Dcheckstyle.skip -Dmaven.test.skip=true
             package-name: ghcr.io/${{ github.repository }}-bundle
     steps:
+      - name: Check out Repository
+        uses: actions/checkout@v5
+
       - name: Set up JDK
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           cache: 'maven'
           java-version: ${{ matrix.java }}
+
       - name: Build .jar via Maven
         run: ${{ matrix.build-cmd }}
-      - name: Checkout repository
-        uses: actions/checkout@v4
+
       - name: Log in to the Container registry
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Extract metadata (tags, labels) for Docker Image
         id: meta
         uses: docker/metadata-action@v5
         with:
           images: ${{ matrix.package-name }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ${{ matrix.dockerfile-path }}
           push: true
+          platforms: linux/amd64,linux/arm64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

.github/workflows/issue_prioritization.yml

@@ -1,16 +1,18 @@
 name: Issue tracking
+
 on:
   issues:
     types:
       - opened
       - pinned
+
 jobs:
   track_issue:
     runs-on: ubuntu-latest
     steps:
       - name: Generate token
         id: generate_token
-        uses: tibdex/github-app-token@36464acb844fc53b9b8b2401da68844f6b05ebb0
+        uses: tibdex/github-app-token@v2.1.0
         with:
           app_id: ${{ secrets.PBS_PROJECT_APP_ID }}
           private_key: ${{ secrets.PBS_PROJECT_APP_PEM }}

.github/workflows/pr-functional-tests.yml

@@ -11,23 +11,51 @@ on:
     types:
       - created
 
+permissions:
+  contents: read
+  actions: read
+  checks: write
+
 jobs:
   build:
     runs-on: ubuntu-latest
 
     strategy:
       matrix:
-        java: [ 17 ]
+        java: [ 21 ]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up JDK
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           cache: 'maven'
           java-version: ${{ matrix.java }}
 
       - name: Build with Maven
-        run: mvn -B verify -DskipUnitTests=true -DskipModuleFunctionalTests=true -Dtests.max-container-count=5 -DdockerfileName=Dockerfile --file extra/pom.xml
+        id: build
+        run: |
+          mvn -B verify \
+          -DskipUnitTests=true \
+          -DskipModuleFunctionalTests=true \
+          -Dtests.max-container-count=5 \
+          -DdockerfileName=Dockerfile \
+          -Dcheckstyle.skip \
+          --file extra/pom.xml 
+
+      - name: Emitting run result of functional test
+        if: always()
+        uses: dorny/test-reporter@v2.5.0
+        with:
+          name: 'Functional tests'
+          working-directory: 'target/failsafe-reports'
+          path: 'TEST-*.xml'
+          reporter: java-junit
+          use-actions-summary: 'true'
+          list-suites: 'failed'
+          list-tests: 'failed'
+          fail-on-error: true
+          fail-on-empty: true
+          token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pr-java-ci.yml

@@ -11,22 +11,28 @@ on:
     types:
       - created
 
+permissions:
+  contents: read
+  actions: read
+  checks: write
+
 jobs:
   build:
     runs-on: ubuntu-latest
 
     strategy:
       matrix:
-        java: [ 17 ]
+        java: [ 21 ]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up JDK
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           cache: 'maven'
+          cache-dependency-path: extra/pom.xml
           java-version: ${{ matrix.java }}
 
       - name: Build with Maven