Update some asserts in search tests

.github/actions/prepare-for-build/action.yml

@@ -7,7 +7,7 @@ description: Creates a shared setup for other workflows
 inputs:
   java-version:
     required: false
-    default: "24"
+    default: "25"
     description: "The default JDK version to set up."
 
   java-distribution:

.github/workflows/activity-report.sh

@@ -29,16 +29,16 @@ echo -n "* The number of commits to any branch: "
 git log --all --pretty='format:%h,%as,%an,%s' --since="$SINCE" --before="$UNTIL" | wc -l
 
 echo -n "* The number of issues filed: "
-gh issue list --state all --search "created:$SINCE_TS..$UNTIL_TS" --repo $REPO --limit 1000 --json id | jq length
+gh issue list --state all --search "created:$SINCE_TS..$UNTIL_TS" --repo "$REPO" --limit 1000 --json id | jq length
 
 echo -n "* The number of closed issues out of those filed: "
-gh issue list --state all --search "created:$SINCE_TS..$UNTIL_TS is:closed" --repo $REPO --limit 1000 --json id | jq length
+gh issue list --state all --search "created:$SINCE_TS..$UNTIL_TS is:closed" --repo "$REPO" --limit 1000 --json id | jq length
 
 echo -n "* The number of pull requests: "
-gh pr list --state all --search "created:$SINCE_TS..$UNTIL_TS" --repo $REPO --limit 1000 --json id | jq length
+gh pr list --state all --search "created:$SINCE_TS..$UNTIL_TS" --repo "$REPO" --limit 1000 --json id | jq length
 
 echo -n "* The number of closed pull requests out of those filed: "
-gh pr list --state all --search "created:$SINCE_TS..$UNTIL_TS is:closed" --repo $REPO --limit 1000 --json id | jq length
+gh pr list --state all --search "created:$SINCE_TS..$UNTIL_TS is:closed" --repo "$REPO" --limit 1000 --json id | jq length
 
 echo
 echo "## Top contributors in the given time period (all commits, any branch)"
@@ -55,15 +55,15 @@ echo '```'
 echo
 echo "## All pull requests:"
 echo '```'
-gh pr list --state all --search "created:$SINCE_TS..$UNTIL_TS" --repo $REPO --limit 1000 \
+gh pr list --state all --search "created:$SINCE_TS..$UNTIL_TS" --repo "$REPO" --limit 1000 \
   --json number,author,title,createdAt,state \
   --template '{{range .}}{{tablerow (printf "#%v" .number ) .state .title .author.name (timeago .createdAt)}}{{end}}'
 echo '```'
 
 echo
 echo "## All issues:"
 echo '```'
-gh issue list --state all --search "created:$SINCE_TS..$UNTIL_TS" --repo $REPO --limit 1000 \
+gh issue list --state all --search "created:$SINCE_TS..$UNTIL_TS" --repo "$REPO" --limit 1000 \
   --json number,author,title,createdAt,state \
   --template '{{range .}}{{tablerow (printf "#%v" .number ) .state .title .author.name (timeago .createdAt)}}{{end}}'
 echo '```'

.github/workflows/activity-report.yml

@@ -1,5 +1,7 @@
 name: "Generate project activity report"
 
+permissions: {}
+
 on:
   workflow_dispatch:
     inputs:
@@ -17,16 +19,24 @@ on:
 
 jobs:
   generate:
+    name: Project Activity
     timeout-minutes: 15
+    permissions:
+      issues: read # inspects issues and reports on them
+      pull-requests: read # inspects PRs and reports on them
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
-      - name: generate report
+      - name: Generate report
+        run: |
+          bash ./.github/workflows/activity-report.sh >> "$GITHUB_STEP_SUMMARY"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          SINCE="${{ inputs.since }}" UNTIL="${{ inputs.until }}" bash ./.github/workflows/activity-report.sh >> $GITHUB_STEP_SUMMARY
+          SINCE: ${{ inputs.since }}
+          UNTIL: ${{ inputs.until }}

.github/workflows/run-checks-all.yml

@@ -29,7 +29,7 @@ jobs:
     strategy:
       matrix:
         os: [ ubuntu-latest ]
-        java: [ '24' ]
+        java: [ '25' ]
 
     runs-on: ${{ matrix.os }}
 
@@ -63,7 +63,7 @@ jobs:
       matrix:
         # Operating systems to run on.
         os: [ ubuntu-latest, windows-latest, macos-latest ]
-        java: [ '24' ]
+        java: [ '25' ]
 
     runs-on: ${{ matrix.os }}
 

.github/workflows/run-checks-gradle-upgrade.yml

@@ -19,6 +19,8 @@ on:
       - '.github/workflows/run-checks-gradle-upgrade.yml'
       - 'gradle/wrapper/**'
 
+permissions: {}
+
 env:
   DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
@@ -30,7 +32,7 @@ jobs:
     strategy:
       matrix:
         os: [ ubuntu-latest ]
-        java-version: [ '24' ]
+        java-version: [ '25' ]
         uses-alt-java: [ true, false ]
 
     runs-on: ${{ matrix.os }}
@@ -39,7 +41,11 @@ jobs:
       ALT_JAVA_DIR: /tmp/alt-java
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+
       - uses: ./.github/actions/prepare-for-build
         with:
           java-version: ${{ matrix.java-version }}
@@ -51,24 +57,26 @@ jobs:
           set | grep "JAVA"
 
           echo "Gradle's 'RUNTIME_JAVA_HOME' JDK:"
-          RUNTIME_JAVA_HOME_VAR=JAVA_HOME_`echo ${{ matrix.java-version }} | egrep --only "[0-9]+"`_X64
-          echo ${RUNTIME_JAVA_HOME_VAR} points at ${!RUNTIME_JAVA_HOME_VAR}
+          RUNTIME_JAVA_HOME_VAR=JAVA_HOME_$(echo "$JAVA_VERSION" | grep -E --only "[0-9]+")_X64
+          echo "${RUNTIME_JAVA_HOME_VAR}" points at "${!RUNTIME_JAVA_HOME_VAR}"
 
           # Copy the JDK from its default location to /tmp so that it appears different to gradle.
-          rsync -av ${!RUNTIME_JAVA_HOME_VAR}/ ${{ env.ALT_JAVA_DIR }}/
+          rsync -av "${!RUNTIME_JAVA_HOME_VAR}/" "${ALT_JAVA_DIR}/"
 
           # This sets the environment variable and makes it available for subsequent job steps.
           # https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#setting-an-environment-variable
-          echo "RUNTIME_JAVA_HOME=${{ env.ALT_JAVA_DIR }}" >> "$GITHUB_ENV"
+          echo "RUNTIME_JAVA_HOME=$ALT_JAVA_DIR" >> "$GITHUB_ENV"
+        env:
+          JAVA_VERSION: ${{ matrix.java-version }}
 
       - name: ./gradlew tidy
         run: |
           ./gradlew tidy
           if [ ! -z "$(git status --porcelain)" ]; then
-          echo ":warning: **tidy left local checkout in modified state**" >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
-          git status --porcelain >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
+          echo ":warning: **tidy left local checkout in modified state**" >> "$GITHUB_STEP_SUMMARY"
+          echo '```' >> "$GITHUB_STEP_SUMMARY"
+          git status --porcelain >> "$GITHUB_STEP_SUMMARY"
+          echo '```' >> "$GITHUB_STEP_SUMMARY"
           git reset --hard && git clean -xfd .
           fi
 
@@ -78,10 +86,10 @@ jobs:
           sudo apt-get install libwww-perl
           ./gradlew regenerate -x generateUAX29URLEmailTokenizerInternal --rerun-tasks
           if [ ! -z "$(git status --porcelain)" ]; then
-            echo ":warning: **regenerate left local checkout in modified state**" >> $GITHUB_STEP_SUMMARY
-            echo '```' >> $GITHUB_STEP_SUMMARY
-            git status --porcelain >> $GITHUB_STEP_SUMMARY
-            echo '```' >> $GITHUB_STEP_SUMMARY
+            echo ":warning: **regenerate left local checkout in modified state**" >> "$GITHUB_STEP_SUMMARY"
+            echo '```' >> "$GITHUB_STEP_SUMMARY"
+            git status --porcelain >> "$GITHUB_STEP_SUMMARY"
+            echo '```' >> "$GITHUB_STEP_SUMMARY"
             git reset --hard && git clean -xfd .
           fi
 

.github/workflows/run-nightly-smoketester.yml

@@ -8,17 +8,21 @@ on:
   schedule:
     - cron: '4 2 * * *'
 
+permissions: {}
+
 jobs:
   smokeTestRelease:
     name: "Smoke test release on jdk ${{ matrix.java-version }}, ${{ matrix.os }}"
+    permissions:
+      contents: write # may work with contents:read
 
     # only run on schedule in the main Lucene repo (not in forks).
     if: (github.event_name == 'schedule' && github.repository == 'apache/lucene') || (github.event_name != 'schedule')
 
     strategy:
       matrix:
         os: [ ubuntu-latest ]
-        java-version: [ '24' ]
+        java-version: [ '25' ]
 
     runs-on: ${{ matrix.os }}
 
@@ -27,9 +31,13 @@ jobs:
       TMP_DIR: /tmp/lucene-tmp-dir
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      - name: Setup java
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
           distribution: 'temurin'
           java-package: jdk
@@ -45,24 +53,28 @@ jobs:
           set | grep "JAVA"
 
           echo "Gradle's 'RUNTIME_JAVA_HOME' JDK:"
-          RUNTIME_JAVA_HOME_VAR=JAVA_HOME_`echo ${{ matrix.java-version }} | egrep --only "[0-9]+"`_X64
-          echo ${RUNTIME_JAVA_HOME_VAR} points at ${!RUNTIME_JAVA_HOME_VAR}
+          RUNTIME_JAVA_HOME_VAR=JAVA_HOME_$(echo "$JAVA_VERSION" | grep -E --only "[0-9]+")_X64
+          echo "${RUNTIME_JAVA_HOME_VAR}" points at "${!RUNTIME_JAVA_HOME_VAR}"
 
           # This sets the environment variable and makes it available for subsequent job steps.
           # https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#setting-an-environment-variable
           echo "RUNTIME_JAVA_HOME=${!RUNTIME_JAVA_HOME_VAR}" >> "$GITHUB_ENV"
+        env:
+          JAVA_VERSION: ${{ matrix.java-version }}
 
       - name: "Run buildAndPushRelease.py (--dev-mode)"
         run: |
           # Assemble an unsigned release, in dev mode, publish locally.
-          python3 ./dev-tools/scripts/buildAndPushRelease.py --dev-mode --push-local ${{ env.LUCENE_RELEASE_DIR }}
+          python3 ./dev-tools/scripts/buildAndPushRelease.py --dev-mode --push-local "$LUCENE_RELEASE_DIR"
 
       - name: "Run smokeTestRelease.py (runtime java: ${{ matrix.java-version }})"
         run: |
+          subfolder=$(compgen -G "$LUCENE_RELEASE_DIR/lucene*")
+          subfolder=$(realpath "$subfolder")
           python3 -u dev-tools/scripts/smokeTestRelease.py \
             --not-signed \
-            --tmp-dir ${{ env.TMP_DIR }} \
-            file://`realpath ${{ env.LUCENE_RELEASE_DIR }}/lucene*` \
+            --tmp-dir "$TMP_DIR" \
+            "file://$subfolder" \
             -Ptests.filter="@skipall"
 
       - name: "Store smoke tester logs"

.github/workflows/run-special-checks-sandbox.yml

@@ -20,7 +20,7 @@ jobs:
     strategy:
       matrix:
         os: [ ubuntu-latest ]
-        java: [ '24' ]
+        java: [ '25' ]
         faiss-version: [ '1.11.0' ]
 
     runs-on: ${{ matrix.os }}

.github/workflows/verify-changelog-and-set-milestone.yml

@@ -1,68 +1,65 @@
 name: "Change Log Entry Verifier and Milestone Setter"
 run-name: Change log entry verifier and milestone setter
 on:
-  - pull_request_target
+  - pull_request_target # zizmor: ignore[dangerous-triggers]
 
-env:
-  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  ISSUE: ${{ github.event.issue.html_url }}
-  BASE_REPO: ${{ github.repository }}
-  SKIP_CHANGELOG_LABEL: ${{ '"skip-changelog"' }}
-  CHANGE_LOG_FILE: ${{ 'lucene/CHANGES.txt' }}
+permissions: {}
 
 jobs:
   changelog-verifier-and-milestone-setter:
     name: Verify Change Log Entry and Set Milestone
     runs-on: ubuntu-latest
     if: github.event.pull_request.draft == false
+    permissions:
+      pull-requests: write # edits PR milestones, adds comments
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
           ref: ${{ github.event.pull_request.head.ref }}
+          persist-credentials: false
 
       - name: ChangeLog Entry Verifier and Milestone Setter
         run: |
           echo "################## STEP 1 ##################"
-          echo "Get all labels from PR #${{ github.event.number }}"
+          echo "Get all labels from PR #$PR_NUMBER"
           # Use the BASE_REPO variable to ensure it expands correctly
-          mapfile -t labels < <(gh pr view ${{ github.event.number }} --repo "$BASE_REPO" --json labels -q '.labels[].name')
+          mapfile -t labels < <(gh pr view "$PR_NUMBER" --repo "$BASE_REPO" --json labels -q '.labels[].name')
           IFS=','; echo "${labels[*]}"
           for label in "${labels[@]}"; do
-            if [[ $label == ${{ env.SKIP_CHANGELOG_LABEL }} ]]; then
+            if [[ "$label" == "$SKIP_CHANGELOG_LABEL" ]]; then
               echo "Skipping github action workflow as label: ${SKIP_CHANGELOG_LABEL} is found in the PR."
               exit 0
             fi
           done
-          echo "${{ env.SKIP_CHANGELOG_LABEL }} not found in the PR. Proceeding with next steps."
+          echo "$SKIP_CHANGELOG_LABEL not found in the PR. Proceeding with next steps."
 
           echo -e "\n"
           echo "################## STEP 2 ##################"
-          echo "Checking for change log entry in ${{ env.CHANGE_LOG_FILE }}"
-          git remote add upstream https://github.com/${{ github.repository }}.git
+          echo "Checking for change log entry in $CHANGE_LOG_FILE"
+          git remote add upstream "https://github.com/${BASE_REPO}.git"
 
           # Add and fetch full history of the base branch
-          BASE_BRANCH=${{ github.event.pull_request.base.ref }}
           # We need this to ensure we will be able to find the merge base
-          git fetch upstream $BASE_BRANCH --unshallow
+          git fetch upstream "$BASE_BRANCH" --unshallow
 
           # Find merge base commit to diff against
-          BASE_COMMIT=$(git merge-base HEAD upstream/$BASE_BRANCH)
+          BASE_COMMIT=$(git merge-base HEAD "upstream/$BASE_BRANCH")
           echo "Using merge base for comparison: $BASE_COMMIT"
           echo "Last 3 commits up to merge base:"
-          git log --oneline -n 3 $BASE_COMMIT
+          git log --oneline -n 3 "$BASE_COMMIT"
           echo "Last 3 commits up to PR head:"
           git log --oneline -n 3 HEAD
 
           echo "Diff:"
-          if git diff --exit-code --name-only $BASE_COMMIT HEAD -- ${{ env.CHANGE_LOG_FILE }}; then
-            echo "Change log file:${{ env.CHANGE_LOG_FILE }} does not contains an entry corresponding to changes introduced in PR. Please add a changelog entry."
-            gh pr comment ${{ github.event.number }} --body "This PR does not have an entry in lucene/CHANGES.txt. Consider adding one. If the PR doesn't need a changelog entry, then add the skip-changelog label to it and you will stop receiving this reminder on future updates to the PR."
+          if git diff --exit-code --name-only "$BASE_COMMIT" HEAD -- "$CHANGE_LOG_FILE"; then
+            echo "Change log file:$CHANGE_LOG_FILE does not contains an entry corresponding to changes introduced in PR. Please add a changelog entry."
+            gh pr comment "$PR_NUMBER" --body "This PR does not have an entry in lucene/CHANGES.txt. Consider adding one. If the PR doesn't need a changelog entry, then add the skip-changelog label to it and you will stop receiving this reminder on future updates to the PR."
             exit 0
           else
-            echo "${{ env.CHANGE_LOG_FILE }} contains change log entry. Proceeding with next steps."
+            echo "$CHANGE_LOG_FILE contains change log entry. Proceeding with next steps."
           fi
 
 
@@ -72,8 +69,8 @@ jobs:
           # git diff header pattern -> "@@ -15,0 +16,4 @@"
           # try to extract the line number at which new entry is added, here it's line number 16
           echo "Diff:"
-          git diff --unified=0 $BASE_COMMIT HEAD -- ${{ env.CHANGE_LOG_FILE }}
-          diff=$(git diff --unified=0 $BASE_COMMIT HEAD -- ${{ env.CHANGE_LOG_FILE }})
+          git diff --unified=0 "$BASE_COMMIT" HEAD -- "$CHANGE_LOG_FILE"
+          diff=$(git diff --unified=0 "$BASE_COMMIT" HEAD -- "$CHANGE_LOG_FILE")
           lucene_version=""
           diff_header_pattern="@@ -[0-9]+,?[0-9]* \+([0-9]*),?[0-9]* @@"
           if [[ $diff =~ $diff_header_pattern ]]; then
@@ -88,17 +85,17 @@ jobs:
                   lucene_version="${BASH_REMATCH[1]}"
                 fi
                 if [[ $current_line_number -ge $new_entry_line_number ]]; then
-                  echo "Reached the line number at which new entry is added in ${{ env.CHANGE_LOG_FILE }}"
+                  echo "Reached the line number at which new entry is added in $CHANGE_LOG_FILE"
                   break
                 fi
-            done < ${{ env.CHANGE_LOG_FILE }}
+            done < "$CHANGE_LOG_FILE"
             if [[ -z $lucene_version ]]; then
               echo "Could not find Lucene version in the change log entry. Please add the Lucene version in the change log entry."
               exit 0
             fi
             echo "Found corresponding Lucene version: ${lucene_version} based on change log entry. Proceeding with next steps."
           else
-            echo "Could not find the line number at which new entry is added in ${{ env.CHANGE_LOG_FILE }}"
+            echo "Could not find the line number at which new entry is added in $CHANGE_LOG_FILE"
             exit 0
           fi
 
@@ -120,4 +117,12 @@ jobs:
             exit 0
           fi
           echo "Adding/Updating milestone for the PR to:${lucene_version}"
-          gh pr edit ${{ github.event.number }} --milestone "${lucene_version}"
+          gh pr edit "$PR_NUMBER" --milestone "${lucene_version}"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ISSUE: ${{ github.event.issue.html_url }}
+          PR_NUMBER: ${{ github.event.number }}
+          BASE_REPO: ${{ github.repository }}
+          BASE_BRANCH: ${{ github.event.pull_request.base.ref }}
+          SKIP_CHANGELOG_LABEL: skip-changelog
+          CHANGE_LOG_FILE: lucene/CHANGES.txt