Programmatic Hayagriva writer (directory-as-library, phase 0)

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,6 +1,7 @@
 name: "Bug report"
 description: Create a report to help us improve
 type: Bug
+labels: ["status: needs-triage"]
 body:
   - type: markdown
     attributes:
@@ -14,7 +15,7 @@ body:
       label: JabRef version
       options:
         - "5.15 (latest release)"
-        - "6.0-alpha.6"
+        - "6.0-beta.1"
         - Latest development branch build (please note build date below)
         - Other (please describe below)
       description: The version as shown in the about dialog.

.github/ISSUE_TEMPLATE/suggestion-for-improvement.md

@@ -2,7 +2,7 @@
 name: Suggestion for improvement
 about: Suggest an enhancement
 title: ''
-labels: ''
+labels: 'status: needs-triage'
 type: 'feature'
 assignees: ''
 

.github/actions/merge-upstream-branch/action.yml

@@ -10,9 +10,9 @@ inputs:
     required: false
     default: "main"
   driver-revision:
-    description: "Commit of maven-flow/changelog-merge-driver to run (immutable pin; bump explicitly to pick up driver fixes)"
+    description: "Commit of changelog-merge-driver to run (immutable pin; bump explicitly to pick up driver fixes)"
     required: false
-    default: "4f9446a29a9e6b935b0fd710aa047f9ff03641ad"
+    default: "efd607a74d7dc52038e24d4a8994e3c27d6e6818"
 
 runs:
   using: "composite"
@@ -34,6 +34,8 @@ runs:
         path: ~/.jbang
         key: jbang-changelog-merge-driver-${{ inputs.driver-revision }}
 
+    # Runs the fix of https://github.com/maven-flow/changelog-merge-driver/pull/14 from its fork; switch back
+    # to maven-flow once that is merged.
     - name: Merge upstream/${{ inputs.base-branch }}
       shell: bash
       env:
@@ -45,13 +47,34 @@ runs:
         # The PR head may live in a fork; the base branch always comes from JabRef/jabref
         git remote add upstream "https://github.com/JabRef/jabref.git" || true
         git fetch upstream "$BASE_BRANCH"
-        jbang trust add https://github.com/maven-flow/changelog-merge-driver/
+        jbang trust add https://github.com/koppor/changelog-merge-driver/
         # Pinned to an immutable commit - never the repo's mutable HEAD/alias - since the
         # driver runs with a push-capable token in this job.
-        git config merge.changelog.driver "jbang https://github.com/maven-flow/changelog-merge-driver/blob/$DRIVER_REVISION/ChangelogMergeDriver.java %A %O %B --rebase"
+        git config merge.changelog.driver "jbang https://github.com/koppor/changelog-merge-driver/blob/$DRIVER_REVISION/ChangelogMergeDriver.java %A %O %B --rebase"
         # Overrides the checked-in "CHANGELOG.md merge=union" without dirtying the working tree
         echo "CHANGELOG.md merge=changelog" >> "$(git rev-parse --git-dir)/info/attributes"
         git config user.email "github-actions[bot]@users.noreply.github.com"
         git config user.name "github-actions[bot]"
+        before=$(git rev-parse HEAD)
         git merge --no-ff --no-edit "upstream/$BASE_BRANCH"
         git push origin "HEAD:refs/heads/$TARGET_BRANCH"
+
+        # Link the pushed commits in the run summary; the merge commit's full diff is large,
+        # so its CHANGELOG.md diff gets its own link (GitHub's file anchor is the SHA-256 of the path)
+        repo_url=$(git remote get-url origin)
+        repo_url=${repo_url%.git}
+        changelog_anchor=$(printf %s CHANGELOG.md | sha256sum | cut -d' ' -f1)
+        commits=$(git log --first-parent --format=%H "$before..HEAD")
+        {
+          if [ -z "$commits" ]; then
+            echo "No commit pushed."
+          else
+            echo "Commits:"
+            for c in $commits; do
+              echo "- $repo_url/commit/$c"
+              if ! git diff --quiet "$c^" "$c" -- CHANGELOG.md; then
+                echo "  - [CHANGELOG.md]($repo_url/commit/$c#diff-$changelog_anchor)"
+              fi
+            done
+          fi
+        } >> "$GITHUB_STEP_SUMMARY"

.github/actions/setup-gradle/action.yml

@@ -15,7 +15,7 @@ runs:
   using: composite
   steps:
     - name: Setup JDK
-      uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6
+      uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6
       with:
         java-version: ${{ inputs.javaVersion }}
         distribution: ${{ inputs.distribution }}

.github/workflows/automerge.yml

@@ -71,7 +71,8 @@ jobs:
         env:
           GH_TOKEN: ${{secrets.GH_TOKEN_JABREF_MACHINE_PR_APPROVE}}
       - name: Approve PR
-        if: steps.shouldrun.outputs.shouldrun == 'true'
+        # jabref-machine cannot approve its own PRs (ports); port-to-other-branch.yml approves those
+        if: steps.shouldrun.outputs.shouldrun == 'true' && github.event.pull_request.user.login != 'jabref-machine'
         # Guard: a push directly followed by adding the "automerge" label makes both this
         # workflow (live label query) and on-pr-labeled.yml approve — skip if an
         # un-dismissed approval by jabref-machine already exists.

.github/workflows/binaries.yml

@@ -566,8 +566,31 @@ jobs:
           echo "Link to PR: ${{ github.event.pull_request.html_url }}" >> _h5ai.header.md
           rsync -rt --chmod=Du=rwx,Dg=rx,Do=rx,Fu=rw,Fg=r,Fo=r --itemize-changes --stats --rsync-path="mkdir -p /var/www/builds.jabref.org/www/${{ steps.normalize.outputs.branch }} && rsync" -e 'ssh -p 9922 -i sshkey -o StrictHostKeyChecking=no' _h5ai.header.md jrrsync@build-upload.jabref.org:/var/www/builds.jabref.org/www/${{ steps.normalize.outputs.branch }}/
 
+  flatpak-channel:
+    runs-on: ubuntu-slim
+    outputs:
+      channel: ${{ steps.channel.outputs.channel }}
+    steps:
+      - name: Determine Flatpak channel
+        id: channel
+        shell: bash
+        run: |
+          channel=unsupported
+
+          if [[ "$GITHUB_REF" == "refs/heads/main" ]]; then
+            channel=nightly
+          elif [[ "$GITHUB_REF" == refs/tags/* ]]; then
+            if [[ "$GITHUB_REF_NAME" == *-beta* ]]; then
+              channel=beta
+            elif [[ "$GITHUB_REF_NAME" =~ ^v?[0-9]+(\.[0-9]+)+$ ]]; then
+              channel=stable
+            fi
+          fi
+
+          echo "channel=$channel" >> "$GITHUB_OUTPUT"
+
   build:
-    needs: [ compute-matrix, conditions, disk-space-check, pre-build ]
+    needs: [ compute-matrix, conditions, disk-space-check, flatpak-channel, pre-build ]
     strategy:
       fail-fast: false
       matrix:
@@ -879,6 +902,17 @@ jobs:
           subdir: ""
           secretsPresent: "${{ needs.conditions.outputs.secretspresent }}"
 
+      - name: Upload portable JabRef for Flatpak packaging
+        if: >
+          needs.conditions.outputs.should-build == 'true' &&
+          needs.flatpak-channel.outputs.channel != 'unsupported' &&
+          startsWith(matrix.os, 'ubuntu')
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: flatpak-source (${{ matrix.displayName }})
+          path: jabgui/build/packages/${{ matrix.os }}/JabRef-portable_linux${{ matrix.suffix }}.tar.gz
+          if-no-files-found: error
+
       - name: Upload jabgui and jabls-cli to GitHub workflow artifacts store for notarization (macOS)
         if: ${{ needs.conditions.outputs.should-build == 'true' && (startsWith(matrix.os, 'macos')) && (needs.conditions.outputs.should-notarize == 'true') }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -890,6 +924,97 @@ jobs:
             jabls-cli/build/packages/${{ matrix.os }}
           compression-level: 0 # no compression
 
+  flatpak:
+    needs: [ build, conditions, flatpak-channel, pre-build ]
+    if: needs.conditions.outputs.should-build == 'true' && needs.flatpak-channel.outputs.channel != 'unsupported'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: x86_64
+            os: ubuntu-22.04
+            displayName: linux-amd64
+            archive: JabRef-portable_linux.tar.gz
+            suffix: ''
+          - arch: aarch64
+            os: ubuntu-22.04-arm
+            displayName: linux-arm
+            archive: JabRef-portable_linux_arm64.tar.gz
+            suffix: _arm64
+    runs-on: ${{ matrix.os }}
+    name: ${{ matrix.displayName }} ${{ needs.flatpak-channel.outputs.channel }} Flatpak
+    container:
+      image: ghcr.io/flathub-infra/flatpak-github-actions:gnome-48
+      options: --privileged
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Download portable JabRef
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: flatpak-source (${{ matrix.displayName }})
+          path: flatpak
+
+      - name: Configure the manifest for the local portable archive
+        env:
+          ARCH: ${{ matrix.arch }}
+          ARCHIVE: ${{ matrix.archive }}
+        run: |
+          flatpak-builder --show-manifest flatpak/org.jabref.jabref.yaml | jq --arg arch "$ARCH" --arg archive "$ARCHIVE" '
+            .modules[0].sources |= map(
+              if .["only-arches"] == [$arch]
+              then del(.url, .sha256) + {"path": $archive}
+              else .
+              end
+            )
+          ' > flatpak/org.jabref.jabref.ci.json
+
+      - name: Build and upload Flatpak
+        uses: flatpak/flatpak-github-actions/flatpak-builder@79327416609af08178ad73b352877e51450790b3 # v6
+        with:
+          manifest-path: flatpak/org.jabref.jabref.ci.json
+          arch: ${{ matrix.arch }}
+          branch: ${{ needs.flatpak-channel.outputs.channel }}
+          bundle: JabRef-${{ needs.pre-build.outputs.Major }}.${{ needs.pre-build.outputs.Minor }}${{ matrix.suffix }}.flatpak
+          artifact-name: Flatpak bundle (${{ matrix.arch }})
+
+  upload-flatpak:
+    needs: [ conditions, disk-space-check, flatpak, pre-build ]
+    if: needs.conditions.outputs.upload-to-builds-jabref-org == 'true' && needs.disk-space-check.outputs.available == 'true'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: x86_64
+            displayName: linux-amd64
+            suffix: ''
+          - arch: aarch64
+            displayName: linux-arm
+            suffix: _arm64
+    runs-on: ubuntu-22.04
+    name: Upload ${{ matrix.displayName }} Flatpak to builds.jabref.org
+    steps:
+      - name: Download Flatpak bundle
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: Flatpak bundle (${{ matrix.arch }})
+          path: flatpak
+
+      - name: Set up SSH key
+        run: |
+          echo "${{ secrets.buildJabRefPrivateKey }}" > sshkey
+          chmod 600 sshkey
+
+      - name: Upload Flatpak bundle
+        shell: bash
+        run: |
+          rsync -rt --chmod=Du=rwx,Dg=rx,Do=rx,Fu=rw,Fg=r,Fo=r --itemize-changes --stats \
+            --rsync-path="mkdir -p /var/www/builds.jabref.org/www/${{ needs.pre-build.outputs.branch }}/${{ matrix.displayName }} && rsync" \
+            -e 'ssh -p 9922 -i sshkey -o StrictHostKeyChecking=no' \
+            flatpak/JabRef-${{ needs.pre-build.outputs.Major }}.${{ needs.pre-build.outputs.Minor }}${{ matrix.suffix }}.flatpak \
+            jrrsync@build-upload.jabref.org:/var/www/builds.jabref.org/www/${{ needs.pre-build.outputs.branch }}/${{ matrix.displayName }}/
+
   jabkit-native:
     needs: [ compute-matrix, conditions, disk-space-check, pre-build ]
     strategy:

.github/workflows/claude.yml

@@ -39,6 +39,6 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@5ccc3a35a6367cdb8e6fbd0728287467540ecfe2 # v1
+        uses: anthropics/claude-code-action@cfc3eb22bfed5c26ef66e3223c982af27e4524de # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

.github/workflows/dockerimages.yml

@@ -56,7 +56,7 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4
       - name: Fetch all history for all tags and branches
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -71,7 +71,7 @@ jobs:
         id: gitversion
         uses: gittools/actions/gitversion/execute@7417b1089e2c7de93510f1901d656ddf60bb024f # v4.7.0
       - name: Build and push
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
           push: >
             ${{

.github/workflows/gource.yml

@@ -21,9 +21,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - title: 'JabRef v6.0 (since alpha.6) | more information at contribute.jabref.org'
-            # Last alpha release 2026-02-20, but want to have some seconds before
-            start: '2026-02-14'
+          - title: 'JabRef v6.0 (since beta.1) | more information at contribute.jabref.org'
+            # Last beta release 2026-09-21, but want to have some seconds before
+            start: '2026-09-14'
             end: ''
             file: 'jabref-v6.0-dev.mp4'
 #          - title: 'JabRef v6.0-alpha2 | more information at contribute.jabref.org'

.github/workflows/junie.yml

@@ -30,6 +30,6 @@ jobs:
 
       - name: Run Junie
         id: junie
-        uses: JetBrains/junie-github-action@2f33c71d9d74cbbe1662bddeb0d1f6f59ea05b29 # v1.7.9
+        uses: JetBrains/junie-github-action@c49dfcdf95b75650b75a64b504673f05c89a9819 # v1.7.12
         with:
           junie_api_key: ${{ secrets.JUNIE_API_KEY }}

.github/workflows/latex.yml

@@ -29,7 +29,7 @@ jobs:
       - name: Check out code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Install TeX Live
-        uses: zauguin/install-texlive@f5e7d0b117035fff797d4392ea94131747e03d60 # v4
+        uses: zauguin/install-texlive@6671d0c62046c7e349fe154d5208fe746b07e037 # v4.4.0
         with:
           package_file: jablib/src/test/latex/Texlivefile
   check-latex:
@@ -88,7 +88,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install TeX Live
-        uses: zauguin/install-texlive@f5e7d0b117035fff797d4392ea94131747e03d60 # v4
+        uses: zauguin/install-texlive@6671d0c62046c7e349fe154d5208fe746b07e037 # v4.4.0
         with:
           package_file: jablib/src/test/latex/Texlivefile
 

.github/workflows/merge-main.yml

@@ -59,6 +59,15 @@ jobs:
           ref: ${{ steps.resolve.outputs.branch }}
           token: ${{ secrets.GH_TOKEN_JABREF_MACHINE_PR_APPROVE || github.token }}
 
+      - name: Link PR in summary
+        env:
+          PR_NUMBER: ${{ inputs.pr || github.event.pull_request.number }}
+        run: |
+          {
+            echo "PR: https://github.com/${{ github.repository }}/pull/$PR_NUMBER"
+            echo
+          } >> "$GITHUB_STEP_SUMMARY"
+
       # Pushes the merge commit back to the PR branch (the reason this workflow exists).
       # "$/" resolves the action from this workflow's own commit, not from the workspace -
       # the workspace holds the PR head (possibly a fork), whose copy of the action must

.github/workflows/on-issue-comment.yml

@@ -12,8 +12,16 @@ jobs:
       contents: read
       issues: write
     steps:
+      - name: Decline self-assignment of untriaged issues
+        id: untriaged
+        if: "${{ contains(github.event.comment.body, '/assign-me') && contains(github.event.issue.labels.*.name, 'status: needs-triage') }}"
+        run: |
+          gh issue comment "${{ github.event.issue.html_url }}" --body "Hi @${{ github.event.comment.user.login }}, this issue needs triage by a maintainer first. Please wait until the \`status: needs-triage\` label is removed."
+        env:
+          GH_TOKEN: ${{ github.token }}
       - name: Assign the user or unassign stale assignments
         id: assign
+        if: ${{ steps.untriaged.outcome == 'skipped' }}
         uses: takanome-dev/assign-issue-action@fad4b83750f7df31e03c2a42e8f1880b0b4b3573 # edge
         with:
           github_token: '${{ secrets.GH_TOKEN_ASSIGN_ISSUE_ACTION  || github.token }}'

.github/workflows/on-issue-labeled.yml

@@ -162,7 +162,7 @@ jobs:
             echo "EOF"
           } >> "$GITHUB_OUTPUT"
       - name: Comment on issue
-        uses: thollander/actions-comment-pull-request@65f9e5c9a1f2cd378bd74b2e057c9736982a8e74 # v3
+        uses: thollander/actions-comment-pull-request@e4a76dd2b0a3c2027c3fd84147a67c22ee4c90fa # v3
         with:
           message: ${{ steps.wisdom.outputs.message }}
           comment-tag: ${{ env.LABEL }}

.github/workflows/on-pr-bug-linked.yml

@@ -67,7 +67,8 @@ jobs:
             fi
             # GitHub stores the type name in lower case ("bug") while the issue template writes "Bug"
             if [ "$labeled" = false ] && [ "${type,,}" = "bug" ]; then
-              gh pr edit "$PR_NUMBER" --add-label "dev: into-stable"
+              # `gh pr edit` queries fields that need the read:org scope, which the token lacks
+              gh api "repos/JabRef/jabref/issues/$PR_NUMBER/labels" -f "labels[]=dev: into-stable" > /dev/null
               echo "Added \`dev: into-stable\`" >> "$GITHUB_STEP_SUMMARY"
               labeled=true
             fi

.github/workflows/on-pr-labeled.yml

@@ -20,6 +20,8 @@ jobs:
       cancel-in-progress: false
     steps:
       - name: Approve PR
+        # jabref-machine cannot approve its own PRs (ports); port-to-other-branch.yml approves those
+        if: github.event.pull_request.user.login != 'jabref-machine'
         # Guard: automerge.yml (running for a push made just before the label was added)
         # queries labels live and may approve concurrently — skip if an un-dismissed
         # approval by jabref-machine already exists.

.github/workflows/on-pr-merge-queued.yml

@@ -17,7 +17,7 @@ jobs:
           ref="${GITHUB_REF_NAME}"
           if [[ "$ref" =~ ^gh-readonly-queue/[^/]+/pr-([0-9]+)- ]]; then
             pr="${BASH_REMATCH[1]}"
-            gh pr edit "$pr" --repo "$GITHUB_REPOSITORY" --remove-label "status: ready-for-review" --remote-label "status: awaiting-second-review" --add-label "status: to-be-merged"
+            gh pr edit "$pr" --repo "$GITHUB_REPOSITORY" --remove-label "status: ready-for-review" --remove-label "status: awaiting-second-review" --add-label "status: to-be-merged"
           else
             echo "Cannot extract PR number from ref: $ref" >&2
             exit 1