Release

.config/pmd/java/ruleset.xml

@@ -141,6 +141,7 @@
 		</properties>
 	</rule>
 
+	<rule ref="category/java/errorprone.xml/AssertEqualsArgumentOrder"/>
 	<rule ref="category/java/errorprone.xml/AssignmentToNonFinalStatic"/>
 	<rule ref="category/java/errorprone.xml/AvoidDecimalLiteralsInBigDecimalConstructor"/>
 	<rule ref="category/java/errorprone.xml/AvoidMultipleUnaryOperators"/>

.github/actions/docker-image-cache/README.md

@@ -0,0 +1,7 @@
+# Composite GitHub Actions
+
+Example usage can be found in [`run-integration-tests.yml`](../../workflows/run-integration-tests.yml)
+
+## Notes
+* [Parallel execution](https://github.blog/changelog/2026-06-25-actions-steps-can-now-be-run-in-parallel/) is not yet available for composite actions
+  * Therefore `restore` and `setup-buildx` are currently split as it's recommended that they be implemented in parallel downstream

.github/actions/docker-image-cache/restore/README.md

@@ -0,0 +1 @@
+Restores previously downloaded images so that they don't need to be pulled

.github/actions/docker-image-cache/restore/action.yml

@@ -0,0 +1,47 @@
+name: 'Restore docker image cache'
+description: 'Restore and load docker image cache'
+# Based on https://github.com/actions/cache/blob/v6/restore/action.yml
+inputs:
+  key:
+    description: 'An explicit key for restoring the cache'
+    required: true
+  restore-keys:
+    description: 'An ordered multiline string listing the prefix-matched keys, that are used for restoring stale cache if no cache hit occurred for key. Note `cache-hit` returns false in this case.'
+    required: false
+  save-preinstalled-images:
+    description: 'Should pre-installed images be saved (not recommended)'
+    required: false
+outputs:
+  key:
+    description: 'Identical to the input - can be used to prevent copy pasting'
+    value: ${{ inputs.key }}
+  cache-hit:
+    description: 'A boolean value to indicate an exact match was found for the primary key'
+    value: ${{ steps.restore-docker-image-cache.outputs.cache-hit }}
+runs:
+  using: "composite"
+  steps:
+    # NOTE 2026-07-09 Parallel execution is not yet available for composite actions
+    # https://github.blog/changelog/2026-06-25-actions-steps-can-now-be-run-in-parallel/
+    - name: Restore docker image cache
+      uses: actions/cache/restore@v6
+      id: restore-docker-image-cache
+      with:
+        path: ~/.cache/docker/
+        key: ${{ inputs.key }}
+        restore-keys: ${{ inputs.restore-keys }}
+
+    - name: Load docker image cache
+      shell: bash
+      run: |
+        if [ "${{ inputs.save-preinstalled-images }}" != true ]; then
+          echo "Getting preinstalled images" && docker image ls
+          preinstalled_image_ids=$(docker images -q | sort)
+
+          echo "Storing preinstalled image ids" && echo $preinstalled_image_ids
+          mkdir -p ~/.cache/docker-preinstalled
+          printf "%s\n" "${preinstalled_image_ids[@]}" > ~/.cache/docker-preinstalled/ids-${{ github.run_id }}.txt
+        fi
+
+        echo "Importing cache"
+        docker load -i ~/.cache/docker/images.tar && echo "Restored docker image cache" && docker image ls || true

.github/actions/docker-image-cache/save/README.md

@@ -0,0 +1 @@
+Saves the pulled images into the cache

.github/actions/docker-image-cache/save/action.yml

@@ -0,0 +1,49 @@
+name: 'Save docker image cache'
+description: 'Save the docker image cache'
+# Based on https://github.com/actions/cache/blob/v6/restore/action.yml
+inputs:
+  key:
+    description: 'An explicit key for restoring the cache'
+    required: true
+  cache-hit:
+    description: 'A boolean value to indicate an exact match was found for the primary key'
+    required: false
+runs:
+  using: "composite"
+  steps:
+    - name: Create docker image cache
+      # Cache can't be saved when it's already present
+      if: inputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        echo "Images before pruning" && docker image ls
+        docker image prune -f
+        echo "Currently available images" && docker image ls
+
+        has_preinstalled_ids=false
+        if [ -f ~/.cache/docker-preinstalled/ids-${{ github.run_id }}.txt ]; then
+          echo && echo "Will NOT cache pre-installed images" && cat ~/.cache/docker-preinstalled/ids-${{ github.run_id }}.txt
+          has_preinstalled_ids=true
+        fi
+
+        echo && echo "Will NOT cache images" && docker image ls ${CI_CACHE_DOCKER_SAVE_IGNORE_FILTERS:--f="label=org.testcontainers.sessionId"}
+
+        mkdir -p ~/.cache/docker
+        image_ids_to_save=$(comm -23 <(docker images -q | sort) <(docker image ls -q ${CI_CACHE_DOCKER_SAVE_IGNORE_FILTERS:--f="label=org.testcontainers.sessionId"} | sort))
+        if [ "$has_preinstalled_ids" = true ]; then
+          image_ids_to_save=$(comm -23 <(echo "${image_ids_to_save[@]}") <(cat ~/.cache/docker-preinstalled/ids-${{ github.run_id }}.txt || echo ""))
+        fi
+        echo && echo "Saving image ids" && echo $image_ids_to_save
+        docker save $image_ids_to_save -o ~/.cache/docker/images.tar || true
+
+        ls -lha ~/.cache/docker
+        if [ "$has_preinstalled_ids" = true ]; then
+          rm -f ~/.cache/docker-preinstalled/ids-${{ github.run_id }}.txt || true
+        fi
+
+    - name: Save docker image cache
+      if: inputs.cache-hit != 'true'
+      uses: actions/cache/save@v6
+      with:
+        path: ~/.cache/docker/
+        key: ${{ inputs.key }}

.github/actions/docker-image-cache/setup-buildx/README.md

@@ -0,0 +1 @@
+Set's up the buildx worker and returns [required environment variables](https://docs.docker.com/build/cache/backends/gha/#authentication) for the buildx build.

.github/actions/docker-image-cache/setup-buildx/action.yml

@@ -0,0 +1,23 @@
+name: 'Setup buildx'
+description: 'Setup buildx'
+outputs:
+  ACTIONS_RUNTIME_TOKEN:
+    value: ${{ steps.actions-vars.outputs.ACTIONS_RUNTIME_TOKEN }}
+  ACTIONS_RESULTS_URL:
+    value: ${{ steps.actions-vars.outputs.ACTIONS_RESULTS_URL }}
+runs:
+  using: "composite"
+  steps:
+    # These are required for caching 
+    # https://docs.docker.com/build/cache/backends/gha/#authentication
+    - name: Get Actions Runtime credentials
+      if: runner.os != 'Windows'
+      id: actions-vars
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      with:
+        script: |
+          core.setOutput('ACTIONS_RUNTIME_TOKEN', process.env['ACTIONS_RUNTIME_TOKEN'])
+          core.setOutput('ACTIONS_RESULTS_URL', process.env['ACTIONS_RESULTS_URL'])
+
+    - uses: docker/setup-buildx-action@v4
+      if: runner.os != 'Windows'

.github/workflows/broken-links.yml

@@ -19,7 +19,7 @@ jobs:
 
       - name: Link Checker
         id: lychee
-        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2
+        uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2
         with:
           args: "--verbose --no-progress './**/*.md'"
           fail: false # Don't fail on broken links, create an issue instead

.github/workflows/check-build.yml

@@ -28,7 +28,7 @@ jobs:
     timeout-minutes: 30
     strategy:
       matrix:
-        java: [21, 25]
+        java: [25]
         distribution: [temurin]
     steps:
     - uses: actions/checkout@v7
@@ -74,7 +74,7 @@ jobs:
     timeout-minutes: 15
     strategy:
       matrix:
-        java: [21]
+        java: [25]
         distribution: [temurin]
     steps:
     - uses: actions/checkout@v7
@@ -110,7 +110,7 @@ jobs:
     timeout-minutes: 15
     strategy:
       matrix:
-        java: [21]
+        java: [25]
         distribution: [temurin]
     steps:
     - uses: actions/checkout@v7

.github/workflows/release.yml

@@ -20,7 +20,7 @@ jobs:
     - name: Set up JDK
       uses: actions/setup-java@v5
       with:
-        java-version: '21'
+        java-version: '25'
         distribution: 'temurin'
 
     # Try to reuse existing cache from check-build
@@ -125,7 +125,7 @@ jobs:
       uses: actions/setup-java@v5
       with: # running setup-java overwrites the settings.xml
         distribution: 'temurin'
-        java-version: '21'
+        java-version: '25'
         server-id: github-central
         server-password: PACKAGES_CENTRAL_TOKEN
         gpg-passphrase: MAVEN_GPG_PASSPHRASE
@@ -147,7 +147,7 @@ jobs:
       uses: actions/setup-java@v5
       with: # running setup-java again overwrites the settings.xml
         distribution: 'temurin'
-        java-version: '21'
+        java-version: '25'
         server-id: sonatype-central-portal
         server-username: MAVEN_CENTRAL_USERNAME
         server-password: MAVEN_CENTRAL_TOKEN
@@ -182,7 +182,7 @@ jobs:
     - name: Setup - Java
       uses: actions/setup-java@v5
       with:
-        java-version: '21'
+        java-version: '25'
         distribution: 'temurin'
 
     # Try to reuse existing cache from check-build