Fix super method call inside let expression (#1383)

Fixes #1309

The issue was that super calls were blocked inside let expressions
because:
1. The compiler's isClassMemberScope() check didn't skip over lambda
scopes created by let expressions
2. The runtime's findSupermethod() didn't traverse past VmFunction
owners to find the actual class prototype

Changes:
- SymbolTable.java: Updated isClassMemberScope() to skip lambda scopes
before checking if the parent is a class or module scope
- InvokeSuperMethodNode.java: Updated findSupermethod() to skip
VmFunction owners when looking for the class prototype

Added regression tests covering:
- Super method calls inside let expressions
- Super property access inside let expressions
- Nested let expressions with super calls

---------

Co-authored-by: Jen Basch <jbasch@apple.com>

.circleci/config.pkl

@@ -1,154 +0,0 @@
-//===----------------------------------------------------------------------===//
-// Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//===----------------------------------------------------------------------===// 
-// File gets rendered to .circleci/config.yml via git hook.
-amends ".../pkl-project-commons/packages/pkl.impl.circleci/PklCI.pkl"
-
-import "jobs/BuildNativeJob.pkl"
-import "jobs/GradleCheckJob.pkl"
-import "jobs/DeployJob.pkl"
-import "jobs/SimpleGradleJob.pkl"
-
-local prbJobs: Listing<String> = gradleCheckJobs.keys.toListing()
-
-local buildAndTestJobs = (prbJobs) {
-  "bench"
-//   "gradle-compatibility"
-  ...buildNativeJobs.keys.filter((it) -> it.endsWith("snapshot"))
-}
-
-local releaseJobs = (prbJobs) {
-  "bench"
-//   "gradle-compatibility"
-  ...buildNativeJobs.keys.filter((it) -> it.endsWith("release"))
-}
-
-prb {
-  jobs = prbJobs
-}
-
-main {
-  jobs {
-    ...buildAndTestJobs
-    new {
-      ["deploy-snapshot"] {
-        requires = buildAndTestJobs
-        context = "pkl-maven-release"
-      }
-    }
-  }
-}
-
-release {
-  jobs {
-    ...releaseJobs
-    // do GitHub release first because we can overwrite the tag.
-    // publishing to Maven Central is final.
-    new {
-      ["github-release"] {
-        requires = releaseJobs
-        context = "pkl-github-release"
-      }
-    }
-    new {
-      ["deploy-release"] {
-        requires { "github-release" }
-        context = "pkl-maven-release"
-      }
-    }
-  }
-}
-
-triggerDocsBuild = "both"
-
-triggerPackageDocsBuild = "release"
-
-local buildNativeJobs: Mapping<String, BuildNativeJob> = new {
-  for (_dist in List("release", "snapshot")) {
-    for (_arch in List("amd64", "aarch64")) {
-      for (_os in List("macOS", "linux")) {
-        ["pkl-cli-\(_os)-\(_arch)-\(_dist)"] {
-          arch = _arch 
-          os = _os
-          isRelease = _dist == "release"
-        }
-      }
-    }
-    ["pkl-cli-linux-alpine-amd64-\(_dist)"] {
-      arch = "amd64"
-      os = "linux"
-      musl = true
-      isRelease = _dist == "release"
-    }
-  }
-}
-
-local gradleCheckJobs: Mapping<String, GradleCheckJob> = new {
-  ["gradle-check-jdk11"] {
-    javaVersion = "11.0"
-    isRelease = false
-  }
-  ["gradle-check-jdk17"] {
-    javaVersion = "17.0"
-    isRelease = false
-  }
-}
-
-jobs {
-  for (jobName, job in buildNativeJobs) {
-    [jobName] = job.job
-  }
-  for (jobName, job in gradleCheckJobs) {
-    [jobName] = job.job
-  }
-  ["bench"] = new SimpleGradleJob { command = "bench:jmh" }.job
-  ["gradle-compatibility"] = new SimpleGradleJob {
-    name = "gradle compatibility"
-    command = #"""
-      :pkl-gradle:build \
-        :pkl-gradle:compatibilityTestReleases \
-        :pkl-gradle:compatibilityTestCandidate
-      """#
-  }.job
-  ["deploy-snapshot"] = new DeployJob {
-    command = "publishToSonatype"
-  }.job
-  ["deploy-release"] = new DeployJob {
-    isRelease = true
-    command = "publishToSonatype closeAndReleaseSonatypeStagingRepository"
-  }.job
-  ["github-release"] {
-    docker {
-      new {
-        image = "maniator/gh:v2.40.1"
-      }
-    }
-    steps {
-      new AttachWorkspaceStep { at = "." }
-      new RunStep {
-        name = "Publish release on GitHub"
-        command = #"""
-          gh release create "${CIRCLE_TAG}" \
-            --title "${CIRCLE_TAG}" \
-            --target "${CIRCLE_SHA1}" \
-            --verify-tag \
-            --notes "Release notes: https://pkl-lang.org/main/current/release-notes/changelog.html#release-${CIRCLE_TAG}" \
-            --repo "${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}" \
-            pkl-cli/build/executable/*
-          """#
-      }
-    }
-  }
-}

.circleci/config.yml

@@ -1,870 +0,0 @@
-# Generated from CircleCI.pkl. DO NOT EDIT.
-version: '2.1'
-orbs:
-  pr-approval: apple/pr-approval@0.1.0
-jobs:
-  pkl-cli-macOS-amd64-release:
-    steps:
-    - checkout
-    - run:
-        command: /usr/sbin/softwareupdate --install-rosetta --agree-to-license
-        name: Installing Rosetta 2
-    - run:
-        command: |-
-          export PATH=~/staticdeps/bin:$PATH
-          ./gradlew --info --stacktrace -DreleaseBuild=true pkl-cli:macExecutableAmd64 pkl-core:testMacExecutableAmd64
-        name: gradle buildNative
-    - persist_to_workspace:
-        root: '.'
-        paths:
-        - pkl-cli/build/executable/
-    - run:
-        command: |-
-          mkdir ~/test-results/
-          find . -type f -regex ".*/build/test-results/.*xml" -exec cp {} ~/test-results/ \;
-        name: Gather test results
-        when: always
-    - store_test_results:
-        path: ~/test-results
-    environment:
-      LANG: en_US.UTF-8
-    resource_class: macos.m1.large.gen1
-    macos:
-      xcode: 15.2.0
-  pkl-cli-linux-amd64-release:
-    steps:
-    - checkout
-    - restore_cache:
-        key: staticdeps-amd64
-        name: Restore static deps from cache
-    - run:
-        command: |-
-          sed -ie '/\[ol8_codeready_builder\]/,/^$/s/enabled=0/enabled=1/g' /etc/yum.repos.d/oracle-linux-ol8.repo \
-            && microdnf -y install util-linux tree coreutils-single findutils curl tar gzip git zlib-devel gcc-c++ make openssl glibc-langpack-en libstdc++-static \
-            && microdnf clean all \
-            && rm -rf /var/cache/dnf
-
-          # install jdk
-          curl -L \
-           https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.20.1%2B1/OpenJDK11U-jdk_x64_linux_hotspot_11.0.20.1_1.tar.gz -o /tmp/jdk.tar.gz
-
-          mkdir /jdk \
-            && cd /jdk \
-            && cat /tmp/jdk.tar.gz | tar --strip-components=1 -xzC .
-
-          mkdir -p ~/staticdeps/bin
-
-          cp /usr/lib/gcc/x86_64-redhat-linux/8/libstdc++.a ~/staticdeps
-
-          # install zlib
-          if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
-            curl -L https://github.com/madler/zlib/releases/download/v1.2.13/zlib-1.2.13.tar.gz -o /tmp/zlib.tar.gz
-
-            mkdir -p /tmp/dep_zlib-1.2.13 \
-            && cd /tmp/dep_zlib-1.2.13 \
-            && cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC . \
-            && echo "zlib-1.2.13: configure..." && ./configure --static --prefix="$HOME"/staticdeps > /dev/null \
-            && echo "zlib-1.2.13: make..." && make -s -j4 \
-            && echo "zlib-1.2.13: make install..." && make -s install \
-            && rm -rf /tmp/dep_zlib-1.2.13
-          fi
-
-          # install musl
-          if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
-            curl -L https://musl.libc.org/releases/musl-1.2.2.tar.gz -o /tmp/musl.tar.gz
-
-            mkdir -p /tmp/dep_musl-1.2.2 \
-            && cd /tmp/dep_musl-1.2.2 \
-            && cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC . \
-            && echo "musl-1.2.2: configure..." && ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null \
-            && echo "musl-1.2.2: make..." && make -s -j4 \
-            && echo "musl-1.2.2: make install..." && make -s install \
-            && rm -rf /tmp/dep_musl-1.2.2
-
-            # native-image expects to find an executable at this path.
-            ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
-          fi
-        name: Set up environment
-        shell: '#!/bin/bash -exo pipefail'
-    - save_cache:
-        paths:
-        - ~/staticdeps
-        key: staticdeps-amd64
-        name: Save statics deps to cache
-    - run:
-        command: |-
-          export PATH=~/staticdeps/bin:$PATH
-          ./gradlew --info --stacktrace -DreleaseBuild=true pkl-cli:linuxExecutableAmd64 pkl-core:testLinuxExecutableAmd64
-        name: gradle buildNative
-    - persist_to_workspace:
-        root: '.'
-        paths:
-        - pkl-cli/build/executable/
-    - run:
-        command: |-
-          mkdir ~/test-results/
-          find . -type f -regex ".*/build/test-results/.*xml" -exec cp {} ~/test-results/ \;
-        name: Gather test results
-        when: always
-    - store_test_results:
-        path: ~/test-results
-    environment:
-      LANG: en_US.UTF-8
-      JAVA_HOME: /jdk
-    resource_class: xlarge
-    docker:
-    - image: oraclelinux:8-slim
-  pkl-cli-macOS-aarch64-release:
-    steps:
-    - checkout
-    - run:
-        command: git apply patches/graalVm23.patch
-    - run:
-        command: |-
-          export PATH=~/staticdeps/bin:$PATH
-          ./gradlew --info --stacktrace -DreleaseBuild=true pkl-cli:macExecutableAarch64 pkl-core:testMacExecutableAarch64
-        name: gradle buildNative
-    - persist_to_workspace:
-        root: '.'
-        paths:
-        - pkl-cli/build/executable/
-    - run:
-        command: |-
-          mkdir ~/test-results/
-          find . -type f -regex ".*/build/test-results/.*xml" -exec cp {} ~/test-results/ \;
-        name: Gather test results
-        when: always
-    - store_test_results:
-        path: ~/test-results
-    environment:
-      LANG: en_US.UTF-8
-    resource_class: macos.m1.large.gen1
-    macos:
-      xcode: 15.2.0
-  pkl-cli-linux-aarch64-release:
-    steps:
-    - checkout
-    - restore_cache:
-        key: staticdeps-aarch64
-        name: Restore static deps from cache
-    - run:
-        command: |-
-          sed -ie '/\[ol8_codeready_builder\]/,/^$/s/enabled=0/enabled=1/g' /etc/yum.repos.d/oracle-linux-ol8.repo \
-            && microdnf -y install util-linux tree coreutils-single findutils curl tar gzip git zlib-devel gcc-c++ make openssl glibc-langpack-en libstdc++-static \
-            && microdnf clean all \
-            && rm -rf /var/cache/dnf
-
-          # install jdk
-          curl -L \
-           https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.20.1%2B1/OpenJDK11U-jdk_aarch64_linux_hotspot_11.0.20.1_1.tar.gz -o /tmp/jdk.tar.gz
-
-          mkdir /jdk \
-            && cd /jdk \
-            && cat /tmp/jdk.tar.gz | tar --strip-components=1 -xzC .
-
-          mkdir -p ~/staticdeps/bin
-
-          cp /usr/lib/gcc/aarch64-redhat-linux/8/libstdc++.a ~/staticdeps
-
-          # install zlib
-          if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
-            curl -L https://github.com/madler/zlib/releases/download/v1.2.13/zlib-1.2.13.tar.gz -o /tmp/zlib.tar.gz
-
-            mkdir -p /tmp/dep_zlib-1.2.13 \
-            && cd /tmp/dep_zlib-1.2.13 \
-            && cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC . \
-            && echo "zlib-1.2.13: configure..." && ./configure --static --prefix="$HOME"/staticdeps > /dev/null \
-            && echo "zlib-1.2.13: make..." && make -s -j4 \
-            && echo "zlib-1.2.13: make install..." && make -s install \
-            && rm -rf /tmp/dep_zlib-1.2.13
-          fi
-        name: Set up environment
-        shell: '#!/bin/bash -exo pipefail'
-    - save_cache:
-        paths:
-        - ~/staticdeps
-        key: staticdeps-aarch64
-        name: Save statics deps to cache
-    - run:
-        command: |-
-          export PATH=~/staticdeps/bin:$PATH
-          ./gradlew --info --stacktrace -DreleaseBuild=true pkl-cli:linuxExecutableAarch64 pkl-core:testLinuxExecutableAarch64
-        name: gradle buildNative
-    - persist_to_workspace:
-        root: '.'
-        paths:
-        - pkl-cli/build/executable/
-    - run:
-        command: |-
-          mkdir ~/test-results/
-          find . -type f -regex ".*/build/test-results/.*xml" -exec cp {} ~/test-results/ \;
-        name: Gather test results
-        when: always
-    - store_test_results:
-        path: ~/test-results
-    environment:
-      LANG: en_US.UTF-8
-      JAVA_HOME: /jdk
-    resource_class: arm.xlarge
-    docker:
-    - image: arm64v8/oraclelinux:8-slim
-  pkl-cli-linux-alpine-amd64-release:
-    steps:
-    - checkout
-    - restore_cache:
-        key: staticdeps-amd64
-        name: Restore static deps from cache
-    - run:
-        command: |-
-          sed -ie '/\[ol8_codeready_builder\]/,/^$/s/enabled=0/enabled=1/g' /etc/yum.repos.d/oracle-linux-ol8.repo \
-            && microdnf -y install util-linux tree coreutils-single findutils curl tar gzip git zlib-devel gcc-c++ make openssl glibc-langpack-en libstdc++-static \
-            && microdnf clean all \
-            && rm -rf /var/cache/dnf
-
-          # install jdk
-          curl -L \
-           https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.20.1%2B1/OpenJDK11U-jdk_x64_linux_hotspot_11.0.20.1_1.tar.gz -o /tmp/jdk.tar.gz
-
-          mkdir /jdk \
-            && cd /jdk \
-            && cat /tmp/jdk.tar.gz | tar --strip-components=1 -xzC .
-
-          mkdir -p ~/staticdeps/bin
-
-          cp /usr/lib/gcc/x86_64-redhat-linux/8/libstdc++.a ~/staticdeps
-
-          # install zlib
-          if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
-            curl -L https://github.com/madler/zlib/releases/download/v1.2.13/zlib-1.2.13.tar.gz -o /tmp/zlib.tar.gz
-
-            mkdir -p /tmp/dep_zlib-1.2.13 \
-            && cd /tmp/dep_zlib-1.2.13 \
-            && cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC . \
-            && echo "zlib-1.2.13: configure..." && ./configure --static --prefix="$HOME"/staticdeps > /dev/null \
-            && echo "zlib-1.2.13: make..." && make -s -j4 \
-            && echo "zlib-1.2.13: make install..." && make -s install \
-            && rm -rf /tmp/dep_zlib-1.2.13
-          fi
-
-          # install musl
-          if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
-            curl -L https://musl.libc.org/releases/musl-1.2.2.tar.gz -o /tmp/musl.tar.gz
-
-            mkdir -p /tmp/dep_musl-1.2.2 \
-            && cd /tmp/dep_musl-1.2.2 \
-            && cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC . \
-            && echo "musl-1.2.2: configure..." && ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null \
-            && echo "musl-1.2.2: make..." && make -s -j4 \
-            && echo "musl-1.2.2: make install..." && make -s install \
-            && rm -rf /tmp/dep_musl-1.2.2
-
-            # native-image expects to find an executable at this path.
-            ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
-          fi
-        name: Set up environment
-        shell: '#!/bin/bash -exo pipefail'
-    - save_cache:
-        paths:
-        - ~/staticdeps
-        key: staticdeps-amd64
-        name: Save statics deps to cache
-    - run:
-        command: |-
-          export PATH=~/staticdeps/bin:$PATH
-          ./gradlew --info --stacktrace -DreleaseBuild=true pkl-cli:alpineExecutableAmd64 pkl-core:testAlpineExecutableAmd64
-        name: gradle buildNative
-    - persist_to_workspace:
-        root: '.'
-        paths:
-        - pkl-cli/build/executable/
-    - run:
-        command: |-
-          mkdir ~/test-results/
-          find . -type f -regex ".*/build/test-results/.*xml" -exec cp {} ~/test-results/ \;
-        name: Gather test results
-        when: always
-    - store_test_results:
-        path: ~/test-results
-    environment:
-      LANG: en_US.UTF-8
-      JAVA_HOME: /jdk
-    resource_class: xlarge
-    docker:
-    - image: oraclelinux:8-slim
-  pkl-cli-macOS-amd64-snapshot:
-    steps:
-    - checkout
-    - run:
-        command: /usr/sbin/softwareupdate --install-rosetta --agree-to-license
-        name: Installing Rosetta 2
-    - run:
-        command: |-
-          export PATH=~/staticdeps/bin:$PATH
-          ./gradlew --info --stacktrace pkl-cli:macExecutableAmd64 pkl-core:testMacExecutableAmd64
-        name: gradle buildNative
-    - persist_to_workspace:
-        root: '.'
-        paths:
-        - pkl-cli/build/executable/
-    - run:
-        command: |-
-          mkdir ~/test-results/
-          find . -type f -regex ".*/build/test-results/.*xml" -exec cp {} ~/test-results/ \;
-        name: Gather test results
-        when: always
-    - store_test_results:
-        path: ~/test-results
-    environment:
-      LANG: en_US.UTF-8
-    resource_class: macos.m1.large.gen1
-    macos:
-      xcode: 15.2.0
-  pkl-cli-linux-amd64-snapshot:
-    steps:
-    - checkout
-    - restore_cache:
-        key: staticdeps-amd64
-        name: Restore static deps from cache
-    - run:
-        command: |-
-          sed -ie '/\[ol8_codeready_builder\]/,/^$/s/enabled=0/enabled=1/g' /etc/yum.repos.d/oracle-linux-ol8.repo \
-            && microdnf -y install util-linux tree coreutils-single findutils curl tar gzip git zlib-devel gcc-c++ make openssl glibc-langpack-en libstdc++-static \
-            && microdnf clean all \
-            && rm -rf /var/cache/dnf
-
-          # install jdk
-          curl -L \
-           https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.20.1%2B1/OpenJDK11U-jdk_x64_linux_hotspot_11.0.20.1_1.tar.gz -o /tmp/jdk.tar.gz
-
-          mkdir /jdk \
-            && cd /jdk \
-            && cat /tmp/jdk.tar.gz | tar --strip-components=1 -xzC .
-
-          mkdir -p ~/staticdeps/bin
-
-          cp /usr/lib/gcc/x86_64-redhat-linux/8/libstdc++.a ~/staticdeps
-
-          # install zlib
-          if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
-            curl -L https://github.com/madler/zlib/releases/download/v1.2.13/zlib-1.2.13.tar.gz -o /tmp/zlib.tar.gz
-
-            mkdir -p /tmp/dep_zlib-1.2.13 \
-            && cd /tmp/dep_zlib-1.2.13 \
-            && cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC . \
-            && echo "zlib-1.2.13: configure..." && ./configure --static --prefix="$HOME"/staticdeps > /dev/null \
-            && echo "zlib-1.2.13: make..." && make -s -j4 \
-            && echo "zlib-1.2.13: make install..." && make -s install \
-            && rm -rf /tmp/dep_zlib-1.2.13
-          fi
-
-          # install musl
-          if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
-            curl -L https://musl.libc.org/releases/musl-1.2.2.tar.gz -o /tmp/musl.tar.gz
-
-            mkdir -p /tmp/dep_musl-1.2.2 \
-            && cd /tmp/dep_musl-1.2.2 \
-            && cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC . \
-            && echo "musl-1.2.2: configure..." && ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null \
-            && echo "musl-1.2.2: make..." && make -s -j4 \
-            && echo "musl-1.2.2: make install..." && make -s install \
-            && rm -rf /tmp/dep_musl-1.2.2
-
-            # native-image expects to find an executable at this path.
-            ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
-          fi
-        name: Set up environment
-        shell: '#!/bin/bash -exo pipefail'
-    - save_cache:
-        paths:
-        - ~/staticdeps
-        key: staticdeps-amd64
-        name: Save statics deps to cache
-    - run:
-        command: |-
-          export PATH=~/staticdeps/bin:$PATH
-          ./gradlew --info --stacktrace pkl-cli:linuxExecutableAmd64 pkl-core:testLinuxExecutableAmd64
-        name: gradle buildNative
-    - persist_to_workspace:
-        root: '.'
-        paths:
-        - pkl-cli/build/executable/
-    - run:
-        command: |-
-          mkdir ~/test-results/
-          find . -type f -regex ".*/build/test-results/.*xml" -exec cp {} ~/test-results/ \;
-        name: Gather test results
-        when: always
-    - store_test_results:
-        path: ~/test-results
-    environment:
-      LANG: en_US.UTF-8
-      JAVA_HOME: /jdk
-    resource_class: xlarge
-    docker:
-    - image: oraclelinux:8-slim
-  pkl-cli-macOS-aarch64-snapshot:
-    steps:
-    - checkout
-    - run:
-        command: git apply patches/graalVm23.patch
-    - run:
-        command: |-
-          export PATH=~/staticdeps/bin:$PATH
-          ./gradlew --info --stacktrace pkl-cli:macExecutableAarch64 pkl-core:testMacExecutableAarch64
-        name: gradle buildNative
-    - persist_to_workspace:
-        root: '.'
-        paths:
-        - pkl-cli/build/executable/
-    - run:
-        command: |-
-          mkdir ~/test-results/
-          find . -type f -regex ".*/build/test-results/.*xml" -exec cp {} ~/test-results/ \;
-        name: Gather test results
-        when: always
-    - store_test_results:
-        path: ~/test-results
-    environment:
-      LANG: en_US.UTF-8
-    resource_class: macos.m1.large.gen1
-    macos:
-      xcode: 15.2.0
-  pkl-cli-linux-aarch64-snapshot:
-    steps:
-    - checkout
-    - restore_cache:
-        key: staticdeps-aarch64
-        name: Restore static deps from cache
-    - run:
-        command: |-
-          sed -ie '/\[ol8_codeready_builder\]/,/^$/s/enabled=0/enabled=1/g' /etc/yum.repos.d/oracle-linux-ol8.repo \
-            && microdnf -y install util-linux tree coreutils-single findutils curl tar gzip git zlib-devel gcc-c++ make openssl glibc-langpack-en libstdc++-static \
-            && microdnf clean all \
-            && rm -rf /var/cache/dnf
-
-          # install jdk
-          curl -L \
-           https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.20.1%2B1/OpenJDK11U-jdk_aarch64_linux_hotspot_11.0.20.1_1.tar.gz -o /tmp/jdk.tar.gz
-
-          mkdir /jdk \
-            && cd /jdk \
-            && cat /tmp/jdk.tar.gz | tar --strip-components=1 -xzC .
-
-          mkdir -p ~/staticdeps/bin
-
-          cp /usr/lib/gcc/aarch64-redhat-linux/8/libstdc++.a ~/staticdeps
-
-          # install zlib
-          if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
-            curl -L https://github.com/madler/zlib/releases/download/v1.2.13/zlib-1.2.13.tar.gz -o /tmp/zlib.tar.gz
-
-            mkdir -p /tmp/dep_zlib-1.2.13 \
-            && cd /tmp/dep_zlib-1.2.13 \
-            && cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC . \
-            && echo "zlib-1.2.13: configure..." && ./configure --static --prefix="$HOME"/staticdeps > /dev/null \
-            && echo "zlib-1.2.13: make..." && make -s -j4 \
-            && echo "zlib-1.2.13: make install..." && make -s install \
-            && rm -rf /tmp/dep_zlib-1.2.13
-          fi
-        name: Set up environment
-        shell: '#!/bin/bash -exo pipefail'
-    - save_cache:
-        paths:
-        - ~/staticdeps
-        key: staticdeps-aarch64
-        name: Save statics deps to cache
-    - run:
-        command: |-
-          export PATH=~/staticdeps/bin:$PATH
-          ./gradlew --info --stacktrace pkl-cli:linuxExecutableAarch64 pkl-core:testLinuxExecutableAarch64
-        name: gradle buildNative
-    - persist_to_workspace:
-        root: '.'
-        paths:
-        - pkl-cli/build/executable/
-    - run:
-        command: |-
-          mkdir ~/test-results/
-          find . -type f -regex ".*/build/test-results/.*xml" -exec cp {} ~/test-results/ \;
-        name: Gather test results
-        when: always
-    - store_test_results:
-        path: ~/test-results
-    environment:
-      LANG: en_US.UTF-8
-      JAVA_HOME: /jdk
-    resource_class: arm.xlarge
-    docker:
-    - image: arm64v8/oraclelinux:8-slim
-  pkl-cli-linux-alpine-amd64-snapshot:
-    steps:
-    - checkout
-    - restore_cache:
-        key: staticdeps-amd64
-        name: Restore static deps from cache
-    - run:
-        command: |-
-          sed -ie '/\[ol8_codeready_builder\]/,/^$/s/enabled=0/enabled=1/g' /etc/yum.repos.d/oracle-linux-ol8.repo \
-            && microdnf -y install util-linux tree coreutils-single findutils curl tar gzip git zlib-devel gcc-c++ make openssl glibc-langpack-en libstdc++-static \
-            && microdnf clean all \
-            && rm -rf /var/cache/dnf
-
-          # install jdk
-          curl -L \
-           https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.20.1%2B1/OpenJDK11U-jdk_x64_linux_hotspot_11.0.20.1_1.tar.gz -o /tmp/jdk.tar.gz
-
-          mkdir /jdk \
-            && cd /jdk \
-            && cat /tmp/jdk.tar.gz | tar --strip-components=1 -xzC .
-
-          mkdir -p ~/staticdeps/bin
-
-          cp /usr/lib/gcc/x86_64-redhat-linux/8/libstdc++.a ~/staticdeps
-
-          # install zlib
-          if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
-            curl -L https://github.com/madler/zlib/releases/download/v1.2.13/zlib-1.2.13.tar.gz -o /tmp/zlib.tar.gz
-
-            mkdir -p /tmp/dep_zlib-1.2.13 \
-            && cd /tmp/dep_zlib-1.2.13 \
-            && cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC . \
-            && echo "zlib-1.2.13: configure..." && ./configure --static --prefix="$HOME"/staticdeps > /dev/null \
-            && echo "zlib-1.2.13: make..." && make -s -j4 \
-            && echo "zlib-1.2.13: make install..." && make -s install \
-            && rm -rf /tmp/dep_zlib-1.2.13
-          fi
-
-          # install musl
-          if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
-            curl -L https://musl.libc.org/releases/musl-1.2.2.tar.gz -o /tmp/musl.tar.gz
-
-            mkdir -p /tmp/dep_musl-1.2.2 \
-            && cd /tmp/dep_musl-1.2.2 \
-            && cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC . \
-            && echo "musl-1.2.2: configure..." && ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null \
-            && echo "musl-1.2.2: make..." && make -s -j4 \
-            && echo "musl-1.2.2: make install..." && make -s install \
-            && rm -rf /tmp/dep_musl-1.2.2
-
-            # native-image expects to find an executable at this path.
-            ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
-          fi
-        name: Set up environment
-        shell: '#!/bin/bash -exo pipefail'
-    - save_cache:
-        paths:
-        - ~/staticdeps
-        key: staticdeps-amd64
-        name: Save statics deps to cache
-    - run:
-        command: |-
-          export PATH=~/staticdeps/bin:$PATH
-          ./gradlew --info --stacktrace pkl-cli:alpineExecutableAmd64 pkl-core:testAlpineExecutableAmd64
-        name: gradle buildNative
-    - persist_to_workspace:
-        root: '.'
-        paths:
-        - pkl-cli/build/executable/
-    - run:
-        command: |-
-          mkdir ~/test-results/
-          find . -type f -regex ".*/build/test-results/.*xml" -exec cp {} ~/test-results/ \;
-        name: Gather test results
-        when: always
-    - store_test_results:
-        path: ~/test-results
-    environment:
-      LANG: en_US.UTF-8
-      JAVA_HOME: /jdk
-    resource_class: xlarge
-    docker:
-    - image: oraclelinux:8-slim
-  gradle-check-jdk11:
-    steps:
-    - checkout
-    - run:
-        command: ./gradlew --info --stacktrace check
-        name: gradle check
-    - run:
-        command: |-
-          mkdir ~/test-results/
-          find . -type f -regex ".*/build/test-results/.*xml" -exec cp {} ~/test-results/ \;
-        name: Gather test results
-        when: always
-    - store_test_results:
-        path: ~/test-results
-    environment:
-      LANG: en_US.UTF-8
-    docker:
-    - image: cimg/openjdk:11.0
-  gradle-check-jdk17:
-    steps:
-    - checkout
-    - run:
-        command: ./gradlew --info --stacktrace check
-        name: gradle check
-    - run:
-        command: |-
-          mkdir ~/test-results/
-          find . -type f -regex ".*/build/test-results/.*xml" -exec cp {} ~/test-results/ \;
-        name: Gather test results
-        when: always
-    - store_test_results:
-        path: ~/test-results
-    environment:
-      LANG: en_US.UTF-8
-    docker:
-    - image: cimg/openjdk:17.0
-  bench:
-    steps:
-    - checkout
-    - run:
-        command: ./gradlew --info --stacktrace bench:jmh
-        name: bench:jmh
-    - run:
-        command: |-
-          mkdir ~/test-results/
-          find . -type f -regex ".*/build/test-results/.*xml" -exec cp {} ~/test-results/ \;
-        name: Gather test results
-        when: always
-    - store_test_results:
-        path: ~/test-results
-    environment:
-      LANG: en_US.UTF-8
-    docker:
-    - image: cimg/openjdk:11.0
-  gradle-compatibility:
-    steps:
-    - checkout
-    - run:
-        command: |-
-          ./gradlew --info --stacktrace :pkl-gradle:build \
-            :pkl-gradle:compatibilityTestReleases \
-            :pkl-gradle:compatibilityTestCandidate
-        name: gradle compatibility
-    - run:
-        command: |-
-          mkdir ~/test-results/
-          find . -type f -regex ".*/build/test-results/.*xml" -exec cp {} ~/test-results/ \;
-        name: Gather test results
-        when: always
-    - store_test_results:
-        path: ~/test-results
-    environment:
-      LANG: en_US.UTF-8
-    docker:
-    - image: cimg/openjdk:11.0
-  deploy-snapshot:
-    steps:
-    - checkout
-    - attach_workspace:
-        at: '.'
-    - run:
-        command: ./gradlew --info --stacktrace publishToSonatype
-    - run:
-        command: |-
-          mkdir ~/test-results/
-          find . -type f -regex ".*/build/test-results/.*xml" -exec cp {} ~/test-results/ \;
-        name: Gather test results
-        when: always
-    - store_test_results:
-        path: ~/test-results
-    environment:
-      LANG: en_US.UTF-8
-    docker:
-    - image: cimg/openjdk:11.0
-  deploy-release:
-    steps:
-    - checkout
-    - attach_workspace:
-        at: '.'
-    - run:
-        command: ./gradlew --info --stacktrace -DreleaseBuild=true publishToSonatype closeAndReleaseSonatypeStagingRepository
-    - run:
-        command: |-
-          mkdir ~/test-results/
-          find . -type f -regex ".*/build/test-results/.*xml" -exec cp {} ~/test-results/ \;
-        name: Gather test results
-        when: always
-    - store_test_results:
-        path: ~/test-results
-    environment:
-      LANG: en_US.UTF-8
-    docker:
-    - image: cimg/openjdk:11.0
-  github-release:
-    steps:
-    - attach_workspace:
-        at: '.'
-    - run:
-        command: |-
-          gh release create "${CIRCLE_TAG}" \
-            --title "${CIRCLE_TAG}" \
-            --target "${CIRCLE_SHA1}" \
-            --verify-tag \
-            --notes "Release notes: https://pkl-lang.org/main/current/release-notes/changelog.html#release-${CIRCLE_TAG}" \
-            --repo "${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}" \
-            pkl-cli/build/executable/*
-        name: Publish release on GitHub
-    docker:
-    - image: maniator/gh:v2.40.1
-  trigger-docsite-build:
-    steps:
-    - run:
-        command: |-
-          curl --location \
-            --request POST \
-            --header "Content-Type: application/json" \
-            -u "${CIRCLE_TOKEN}:" \
-            --data '{ "branch": "main" }' \
-            "https://circleci.com/api/v2/project/github/apple/pkl-lang.org/pipeline"
-        name: Triggering docsite build
-    docker:
-    - image: cimg/base:current
-  trigger-package-docs-build:
-    steps:
-    - run:
-        command: |-
-          curl --location \
-            --request POST \
-            --header "Content-Type: application/json" \
-            -u "${CIRCLE_TOKEN}:" \
-            --data '{ "branch": "main" }' \
-            "https://circleci.com/api/v2/project/github/apple/pkl-package-docs/pipeline"
-        name: Triggering docsite build
-    docker:
-    - image: cimg/base:current
-workflows:
-  prb:
-    jobs:
-    - hold:
-        type: approval
-    - pr-approval/authenticate:
-        context: pkl-pr-approval
-    - gradle-check-jdk11:
-        requires:
-        - hold
-        - pr-approval/authenticate
-    - gradle-check-jdk17:
-        requires:
-        - hold
-        - pr-approval/authenticate
-    when:
-      matches:
-        value: << pipeline.git.branch >>
-        pattern: ^pull/\d+(/head)?$
-  main:
-    jobs:
-    - gradle-check-jdk11
-    - gradle-check-jdk17
-    - bench
-    - pkl-cli-macOS-amd64-snapshot
-    - pkl-cli-linux-amd64-snapshot
-    - pkl-cli-macOS-aarch64-snapshot
-    - pkl-cli-linux-aarch64-snapshot
-    - pkl-cli-linux-alpine-amd64-snapshot
-    - deploy-snapshot:
-        requires:
-        - gradle-check-jdk11
-        - gradle-check-jdk17
-        - bench
-        - pkl-cli-macOS-amd64-snapshot
-        - pkl-cli-linux-amd64-snapshot
-        - pkl-cli-macOS-aarch64-snapshot
-        - pkl-cli-linux-aarch64-snapshot
-        - pkl-cli-linux-alpine-amd64-snapshot
-        context: pkl-maven-release
-    - trigger-docsite-build:
-        requires:
-        - deploy-snapshot
-        context:
-        - pkl-pr-approval
-    when:
-      equal:
-      - main
-      - << pipeline.git.branch >>
-  release:
-    jobs:
-    - gradle-check-jdk11:
-        filters:
-          branches:
-            ignore: /.*/
-          tags:
-            only: /^v?\d+\.\d+\.\d+$/
-    - gradle-check-jdk17:
-        filters:
-          branches:
-            ignore: /.*/
-          tags:
-            only: /^v?\d+\.\d+\.\d+$/
-    - bench:
-        filters:
-          branches:
-            ignore: /.*/
-          tags:
-            only: /^v?\d+\.\d+\.\d+$/
-    - pkl-cli-macOS-amd64-release:
-        filters:
-          branches:
-            ignore: /.*/
-          tags:
-            only: /^v?\d+\.\d+\.\d+$/
-    - pkl-cli-linux-amd64-release:
-        filters:
-          branches:
-            ignore: /.*/
-          tags:
-            only: /^v?\d+\.\d+\.\d+$/
-    - pkl-cli-macOS-aarch64-release:
-        filters:
-          branches:
-            ignore: /.*/
-          tags:
-            only: /^v?\d+\.\d+\.\d+$/
-    - pkl-cli-linux-aarch64-release:
-        filters:
-          branches:
-            ignore: /.*/
-          tags:
-            only: /^v?\d+\.\d+\.\d+$/
-    - pkl-cli-linux-alpine-amd64-release:
-        filters:
-          branches:
-            ignore: /.*/
-          tags:
-            only: /^v?\d+\.\d+\.\d+$/
-    - github-release:
-        requires:
-        - gradle-check-jdk11
-        - gradle-check-jdk17
-        - bench
-        - pkl-cli-macOS-amd64-release
-        - pkl-cli-linux-amd64-release
-        - pkl-cli-macOS-aarch64-release
-        - pkl-cli-linux-aarch64-release
-        - pkl-cli-linux-alpine-amd64-release
-        context: pkl-github-release
-        filters:
-          branches:
-            ignore: /.*/
-          tags:
-            only: /^v?\d+\.\d+\.\d+$/
-    - deploy-release:
-        requires:
-        - github-release
-        context: pkl-maven-release
-        filters:
-          branches:
-            ignore: /.*/
-          tags:
-            only: /^v?\d+\.\d+\.\d+$/
-    - trigger-package-docs-build:
-        requires:
-        - deploy-release
-        context:
-        - pkl-pr-approval
-        filters:
-          branches:
-            ignore: /.*/
-          tags:
-            only: /^v?\d+\.\d+\.\d+$/

.circleci/jobs/BuildNativeJob.pkl

@@ -1,167 +0,0 @@
-//===----------------------------------------------------------------------===//
-// Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//===----------------------------------------------------------------------===//
-/// Builds the native `pkl` CLI
-extends "GradleJob.pkl"
-
-// TODO(oss) replace these with package imports
-import ".../pkl-pantry/packages/com.circleci.v2/CircleCI.pkl"
-import ".../pkl-pantry/packages/pkl.experimental.uri/URI.pkl"
-
-/// The OS to run on
-os: "macOS"|"linux"
-
-/// The architecture to use
-arch: "amd64"|"aarch64"
-
-/// Whether to link to musl. Otherwise, links to glibc.
-musl: Boolean = false
-
-local setupLinuxEnvironment: CircleCI.RunStep =
-  let (jdkVersion = "11.0.20.1+1")
-  let (muslVersion = "1.2.2")
-  let (zlibVersion = "1.2.13")
-  let (jdkVersionEncoded = URI.encodeComponent(jdkVersion))
-  let (jdkVersionAlt = jdkVersion.replaceLast("+", "_"))
-  let (majorJdkVersion = jdkVersion.split(".").first)
-    new {
-      name = "Set up environment"
-      shell = "#!/bin/bash -exo pipefail"
-      command = new Listing {
-        #"""
-        sed -ie '/\[ol8_codeready_builder\]/,/^$/s/enabled=0/enabled=1/g' /etc/yum.repos.d/oracle-linux-ol8.repo \
-          && microdnf -y install util-linux tree coreutils-single findutils curl tar gzip git zlib-devel gcc-c++ make openssl glibc-langpack-en libstdc++-static \
-          && microdnf clean all \
-          && rm -rf /var/cache/dnf
-
-        # install jdk
-        curl -L \
-         https://github.com/adoptium/temurin\#(majorJdkVersion)-binaries/releases/download/jdk-\#(jdkVersionEncoded)/OpenJDK\#(majorJdkVersion)U-jdk_\#(if (arch == "amd64") "x64" else "aarch64")_linux_hotspot_\#(jdkVersionAlt).tar.gz -o /tmp/jdk.tar.gz
-
-        mkdir /jdk \
-          && cd /jdk \
-          && cat /tmp/jdk.tar.gz | tar --strip-components=1 -xzC .
-
-        mkdir -p ~/staticdeps/bin
-
-        cp /usr/lib/gcc/\#(if (arch == "amd64") "x86_64" else "aarch64")-redhat-linux/8/libstdc++.a ~/staticdeps
-
-        # install zlib
-        if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
-          curl -L https://github.com/madler/zlib/releases/download/v\#(zlibVersion)/zlib-\#(zlibVersion).tar.gz -o /tmp/zlib.tar.gz
-
-          mkdir -p /tmp/dep_zlib-\#(zlibVersion) \
-          && cd /tmp/dep_zlib-\#(zlibVersion) \
-          && cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC . \
-          && echo "zlib-\#(zlibVersion): configure..." && ./configure --static --prefix="$HOME"/staticdeps > /dev/null \
-          && echo "zlib-\#(zlibVersion): make..." && make -s -j4 \
-          && echo "zlib-\#(zlibVersion): make install..." && make -s install \
-          && rm -rf /tmp/dep_zlib-\#(zlibVersion)
-        fi
-        """#
-        // don't need musl on aarch because GraalVM only supports musl builds on x86
-        when (arch == "amd64") {
-            #"""
-            # install musl
-            if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
-              curl -L https://musl.libc.org/releases/musl-\#(muslVersion).tar.gz -o /tmp/musl.tar.gz
-
-              mkdir -p /tmp/dep_musl-\#(muslVersion) \
-              && cd /tmp/dep_musl-\#(muslVersion) \
-              && cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC . \
-              && echo "musl-\#(muslVersion): configure..." && ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null \
-              && echo "musl-\#(muslVersion): make..." && make -s -j4 \
-              && echo "musl-\#(muslVersion): make install..." && make -s install \
-              && rm -rf /tmp/dep_musl-\#(muslVersion)
-
-              # native-image expects to find an executable at this path.
-              ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
-            fi
-            """#
-        }
-      }.join("\n\n")
-    }
-
-steps {
-  when (os == "linux") {
-    new CircleCI.RestoreCacheStep {
-      name = "Restore static deps from cache"
-      key = "staticdeps-\(arch)"
-    }
-    setupLinuxEnvironment
-    new CircleCI.SaveCacheStep {
-      name = "Save statics deps to cache"
-      key = "staticdeps-\(arch)"
-      paths {
-        "~/staticdeps"
-      }
-    }
-  }
-  when (os == "macOS" && arch == "amd64") {
-    new CircleCI.RunStep {
-      name = "Installing Rosetta 2"
-      command = """
-        /usr/sbin/softwareupdate --install-rosetta --agree-to-license
-        """
-    }
-  }
-  // If building macOS/aarch64, we need to use GraalVM 23.
-  // We can't use GraalVM 23 for any other build because we need to support Java 11, which was
-  // dropped in GraalVM 23.
-  when (os == "macOS" && arch == "aarch64") {
-    new CircleCI.RunStep {
-      command = "git apply patches/graalVm23.patch"
-    }
-  }
-  new CircleCI.RunStep {
-    name = "gradle buildNative"
-    local _os =
-      if (os == "macOS") "mac"
-      else if (musl) "alpine"
-      else "linux"
-    local jobName = "\(_os)Executable\(arch.capitalize())"
-    command = #"""
-      export PATH=~/staticdeps/bin:$PATH
-      ./gradlew \#(module.gradleArgs) pkl-cli:\#(jobName) pkl-core:test\#(jobName.capitalize())
-      """#
-  }
-  new CircleCI.PersistToWorkspaceStep {
-    root = "."
-    paths {
-      "pkl-cli/build/executable/"
-    }
-  }
-}
-
-job {
-  when (os == "macOS") {
-    macos {
-      xcode = "15.2.0"
-    }
-    // Use M1 for all architectures. We build amd64/aarch64 based on the GraalVM version,
-    // which gets patched in via `git apply patches/graalVm23.patch`.
-    resource_class = "macos.m1.large.gen1"
-  } else {
-    docker {
-      new {
-        image = if (arch == "aarch64") "arm64v8/oraclelinux:8-slim" else "oraclelinux:8-slim"
-      }
-    }
-    environment {
-      ["JAVA_HOME"] = "/jdk"
-    }
-    resource_class = if (arch == "aarch64") "arm.xlarge" else "xlarge"
-  }
-}

.circleci/jobs/DeployJob.pkl

@@ -1,35 +0,0 @@
-//===----------------------------------------------------------------------===//
-// Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//===----------------------------------------------------------------------===//
-extends "GradleJob.pkl"
-
-import ".../pkl-pantry/packages/com.circleci.v2/CircleCI.pkl"
-
-local self = this
-
-command: String
-
-job {
-  docker {
-    new { image = "cimg/openjdk:11.0" }
-  }
-}
-
-steps {
-  new CircleCI.AttachWorkspaceStep { at = "." }
-  new CircleCI.RunStep {
-    command = "./gradlew \(self.gradleArgs) \(module.command)"
-  }
-}

.circleci/jobs/GradleCheckJob.pkl

@@ -1,35 +0,0 @@
-//===----------------------------------------------------------------------===//
-// Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//===----------------------------------------------------------------------===//
-extends "GradleJob.pkl"
-
-import ".../pkl-pantry/packages/com.circleci.v2/CircleCI.pkl"
-
-javaVersion: "11.0"|"17.0"
-
-steps {
-  new CircleCI.RunStep {
-    name = "gradle check"
-    command = "./gradlew \(module.gradleArgs) check"
-  }
-}
-
-job {
-  docker {
-    new {
-      image = "cimg/openjdk:\(javaVersion)"
-    }
-  }
-}

.circleci/jobs/GradleJob.pkl

@@ -1,53 +0,0 @@
-//===----------------------------------------------------------------------===//
-// Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//===----------------------------------------------------------------------===//
-abstract module GradleJob
-
-import ".../pkl-pantry/packages/com.circleci.v2/CircleCI.pkl"
-
-/// Whether this is a release build or not.
-isRelease: Boolean = false
-
-fixed gradleArgs = new Listing {
-  "--info"
-  "--stacktrace"
-  when (isRelease) {
-    "-DreleaseBuild=true"
-  }
-}.join(" ")
-
-steps: Listing<CircleCI.Step>
-
-job: CircleCI.Job = new {
-  environment {
-    ["LANG"] = "en_US.UTF-8"
-  }
-  steps {
-    "checkout"
-    ...module.steps
-    new CircleCI.RunStep {
-      // find all test results and write them to the home dir
-      name = "Gather test results"
-      command = """
-        mkdir ~/test-results/
-        find . -type f -regex ".*/build/test-results/.*xml" -exec cp {} ~/test-results/ \\;
-        """
-      `when` = "always"
-    }
-    new CircleCI.StoreTestResults {
-      path = "~/test-results"
-    }
-  }
-}

.circleci/jobs/SimpleGradleJob.pkl

@@ -1,37 +0,0 @@
-//===----------------------------------------------------------------------===//
-// Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//===----------------------------------------------------------------------===//
-extends "GradleJob.pkl"
-
-import ".../pkl-pantry/packages/com.circleci.v2/CircleCI.pkl"
-
-name: String = command
-
-command: String
-
-steps {
-  new CircleCI.RunStep {
-    name = module.name
-    command = """
-      ./gradlew \(module.gradleArgs) \(module.command)
-      """
-  }
-}
-
-job {
-  docker {
-    new { image = "cimg/openjdk:11.0" }
-  }
-}

.git-blame-ignore-revs

@@ -0,0 +1,2 @@
+# Auto-format Kotlin code
+816cd483c8adf4c04e14236c173a1dc6bd2579ea

.gitattributes

@@ -1,6 +1,17 @@
 # linguist-generated would suppress files in diffs
 **/src/test/files/** linguist-vendored
+.github/workflows/* linguist-generated
 
 /docs/** linguist-documentation
 
-*.pkl linguist-language=Groovy
+*.pcf linguist-language=Pkl
+PklProject linguist-language=Pkl
+
+* text eol=lf
+*.bat text eol=crlf
+
+*.gif binary
+*.jar binary
+*.woff2 binary
+*.pem binary
+*.png binary

.githooks/pre-commit

@@ -2,7 +2,7 @@
 
 files=`git diff --cached --name-status`
 
-if [[ $files =~ .circleci/config.pkl ]]; then
-  pkl eval .circleci/config.pkl -o .circleci/config.yml
-  git add .circleci/config.yml
+if [[ $files =~ .github/* ]]; then
+  pkl eval --project-dir .github/ -m .github .github/index.pkl
+  git add .github/workflows/
 fi

.github/PklProject

@@ -0,0 +1,10 @@
+amends "pkl:Project"
+
+dependencies {
+  ["pkl.impl.ghactions"] {
+    uri = "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.2.0"
+  }
+  ["gha"] {
+    uri = "package://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.2.0"
+  }
+}

.github/PklProject.deps.json

@@ -0,0 +1,33 @@
+{
+  "schemaVersion": 1,
+  "resolvedDependencies": {
+    "package://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1": {
+      "type": "remote",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.3.0",
+      "checksums": {
+        "sha256": "76174cb974310b3d952280b76ed224eb4ee6fd5419bf696ad9a66fba44bd427d"
+      }
+    },
+    "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1": {
+      "type": "remote",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.2.0",
+      "checksums": {
+        "sha256": "2f60e7167eab8728c4f60196fd5b6e9965723797528a859f36eb0ecbd2db2909"
+      }
+    },
+    "package://pkg.pkl-lang.org/pkl-pantry/pkl.experimental.deepToTyped@1": {
+      "type": "remote",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/pkl.experimental.deepToTyped@1.1.1",
+      "checksums": {
+        "sha256": "1e6e29b441ffdee2605d317f6543a4a604aab5af472b63f0c47d92a3b4b36f7f"
+      }
+    },
+    "package://pkg.pkl-lang.org/pkl-pantry/com.github.dependabot@1": {
+      "type": "remote",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/com.github.dependabot@1.0.0",
+      "checksums": {
+        "sha256": "02ef6f25bfca5b1d095db73ea15de79d2d2c6832ebcab61e6aba90554382abcb"
+      }
+    }
+  }
+}

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+- package-ecosystem: github-actions
+  directory: /
+  ignore:
+  - dependency-name: '*'
+    update-types:
+    - version-update:semver-major
+  schedule:
+    interval: weekly

.github/index.pkl

@@ -0,0 +1,198 @@
+amends "@pkl.impl.ghactions/PklCI.pkl"
+
+import "@gha/Workflow.pkl"
+
+import "jobs/BuildJavaExecutableJob.pkl"
+import "jobs/BuildNativeJob.pkl"
+import "jobs/DeployJob.pkl"
+import "jobs/GithubRelease.pkl"
+import "jobs/GradleJob.pkl"
+import "jobs/PklJob.pkl"
+import "jobs/SimpleGradleJob.pkl"
+
+triggerDocsBuild = "both"
+
+testReports {
+  junit {
+    "**/build/test-results/**/*.xml"
+  }
+  html {
+    "**/build/reports/tests/**/*"
+  }
+  excludeJobs {
+    "bench"
+    "github-release"
+    Regex("deploy-.*")
+  }
+}
+
+local baseGradleCheck: SimpleGradleJob = new {
+  isRelease = false
+  command = "check"
+  fetchDepth = 0
+}
+
+local gradleCheck = (baseGradleCheck) {
+  os = "linux"
+}
+
+local gradleCheckWindows = (baseGradleCheck) {
+  os = "windows"
+}
+
+local typealias PklJobs = Mapping<String, PklJob>
+
+local toWorkflowJobs: (PklJobs) -> Workflow.Jobs = (it) -> new Workflow.Jobs {
+  for (k, v in it) {
+    [k] = v.job
+  }
+}
+
+local gradleCheckJobs: PklJobs = new {
+  ["gradle-check"] = gradleCheck
+  ["gradle-check-windows"] = gradleCheckWindows
+}
+
+local buildNativeJobs: Mapping<String, BuildNativeJob> = new {
+  for (_dist in List("release", "snapshot")) {
+    for (_project in List("pkl-cli", "pkl-doc")) {
+      for (_arch in List("amd64", "aarch64")) {
+        for (_os in List("macOS", "linux")) {
+          ["\(_project)-\(_os)-\(_arch)-\(_dist)"] {
+            arch = _arch
+            os = _os
+            isRelease = _dist == "release"
+            project = _project
+          }
+        }
+      }
+      ["\(_project)-alpine-linux-amd64-\(_dist)"] {
+        arch = "amd64"
+        os = "linux"
+        musl = true
+        isRelease = _dist == "release"
+        project = _project
+      }
+      ["\(_project)-windows-amd64-\(_dist)"] {
+        arch = "amd64"
+        os = "windows"
+        isRelease = _dist == "release"
+        project = _project
+      }
+    }
+  }
+}
+
+local buildNativeSnapshots = buildNativeJobs.toMap().filter((key, _) -> key.endsWith("snapshot"))
+
+local buildNativeReleases = buildNativeJobs.toMap().filter((key, _) -> key.endsWith("release"))
+
+local benchmarkJob: SimpleGradleJob = new { command = "bench:jmh" }
+
+local gradleCompatibilityJob: SimpleGradleJob = new {
+  command = ":pkl-gradle:build :pkl-gradle:compatibilityTestReleases"
+  fetchDepth = 0
+}
+
+local buildJavaExecutableJob: BuildJavaExecutableJob = new {
+  fetchDepth = 0
+}
+
+local buildAndTestJobs: PklJobs = new {
+  ...gradleCheckJobs
+  ["bench"] = benchmarkJob
+  ["gradle-compatibility"] = gradleCompatibilityJob
+  ["java-executables-snapshot"] = (buildJavaExecutableJob) { isRelease = false }
+  ...buildNativeSnapshots
+}
+
+local releaseJobs: PklJobs = new {
+  ...gradleCheckJobs
+  ["bench"] = benchmarkJob
+  ["gradle-compatibility"] = gradleCompatibilityJob
+  ["java-executables-release"] = (buildJavaExecutableJob) { isRelease = true }
+  ...buildNativeReleases
+}
+
+// By default, just run ./gradlew check on linux.
+// Trigger other checks based on GitHub PR description. Examples:
+//
+//    * [windows]                     -- Test on Windows
+//    * [native]                      -- Test all native builds
+//    * [native-pkl-cli]              -- Test all pkl-cli os/arch pairs
+//    * [native-pkl-cli-macos]        -- Test pkl-cli on macOS
+prb {
+  local prbJobs: Mapping<String, GradleJob> = new {
+    ["gradle-check"] = gradleCheck
+    ["gradle-check-windows"] = (gradleCheckWindows) {
+      `if` = "contains(github.event.pull_request.body, '[windows]')"
+    }
+    for (jobName, job in buildNativeSnapshots) {
+      [jobName] = (job) {
+        local tags = new Listing {
+          "[native]"
+          "[native-\(job.project)]"
+          "[native-\(job.project)-\(job.os)]"
+          "[native-\(job.project)-\(job.os)-\(job.arch)]"
+          "[native-\(job.project)-\(job.os)-\(job.arch)]"
+          when (job.musl) {
+            "[native-\(job.project)-alpine-\(job.os)-\(job.arch)]"
+          }
+        }
+        `if` =
+          tags
+            .toList()
+            .map((it) -> "contains(github.event.pull_request.body, '\(it)')")
+            .join(" || ")
+      }
+    }
+  }
+  local prbJobs2 = (prbJobs) {
+    [[true]] {
+      // better SLA when not running on nightly
+      nightlyMacOS = false
+    }
+  }
+  jobs = prbJobs2 |> toWorkflowJobs
+}
+
+build {
+  jobs = buildAndTestJobs |> toWorkflowJobs
+}
+
+main {
+  jobs =
+    (buildAndTestJobs) {
+      ["deploy-snapshot"] = (
+        new DeployJob {
+          extraGradleArgs {
+            "--no-parallel"
+          }
+          command = "publishToSonatype"
+        }
+      ) {
+        needs = buildAndTestJobs.keys.toListing()
+      }
+    } |> toWorkflowJobs
+}
+
+releaseBranch {
+  jobs = releaseJobs |> toWorkflowJobs
+}
+
+release {
+  jobs =
+    (releaseJobs) {
+      ["deploy-release"] = (
+        new DeployJob {
+          isRelease = true
+          command = "publishToSonatype closeAndReleaseSonatypeStagingRepository"
+        }
+      ) {
+        needs = releaseJobs.keys.toListing()
+      }
+      ["github-release"] = new GithubRelease {
+        needs = "deploy-release"
+      }
+    } |> toWorkflowJobs
+}

.github/jobs/BuildJavaExecutableJob.pkl

@@ -0,0 +1,32 @@
+extends "GradleJob.pkl"
+
+import "@gha/catalog.pkl"
+
+// Keep this in sync with projects that build java executables
+local projects: List<String> = List("pkl-doc", "pkl-cli", "pkl-codegen-java", "pkl-codegen-kotlin")
+
+local command =
+  new Listing<String> {
+    "./gradlew"
+    module.gradleArgs
+    for (project in projects) {
+      // NOTE: `build` doesn't build native executables
+      "\(project):build"
+    }
+  }.join(" ")
+
+steps {
+  catalog.`actions/checkout@v6`
+  new {
+    name = "gradle build java executables"
+    shell = "bash"
+    run = command
+  }
+  (catalog.`actions/upload-artifact@v5`) {
+    name = "Upload executable artifacts"
+    with {
+      name = "executable-java"
+      path = "*/build/executable/**/*"
+    }
+  }
+}

.github/jobs/BuildNativeJob.pkl

@@ -0,0 +1,72 @@
+extends "GradleJob.pkl"
+
+import "@gha/catalog.pkl"
+import "@gha/context.pkl"
+
+/// Whether to link to musl. Otherwise, links to glibc.
+musl: Boolean(implies(module.os == "linux")) = false
+
+/// The Gradle project under which to generate the executable
+project: String
+
+extraGradleArgs {
+  when (os == "macOS" && arch == "amd64") {
+    "-Dpkl.targetArch=\(module.arch)"
+    "-Dpkl.native--native-compiler-path=\(context.github.workspace)/.github/scripts/cc_macos_amd64.sh"
+  }
+  when (musl) {
+    "-Dpkl.musl=true"
+  }
+}
+
+preSteps {
+  when (os == "linux" && !musl) {
+    new {
+      name = "Install deps"
+      run = "dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en"
+    }
+  }
+}
+
+steps {
+  when (musl) {
+    new {
+      name = "Install musl and zlib"
+      run = read("../scripts/install_musl.sh").text
+    }
+  }
+  // workaround for https://github.com/actions/checkout/issues/1048
+  when (os == "linux" && !musl) {
+    new {
+      name = "Fix git ownership"
+      // language=bash
+      run = "git status || git config --system --add safe.directory $GITHUB_WORKSPACE"
+    }
+  }
+  new {
+    name = "gradle buildNative"
+    shell = "bash"
+    run = "./gradlew \(module.gradleArgs) \(project):buildNative"
+  }
+  (catalog.`actions/upload-artifact@v5`) {
+    name = "Upload executable artifacts"
+    with {
+      name =
+        if (musl)
+          "executable-\(project)-alpine-\(module.os)-\(module.arch)"
+        else
+          "executable-\(project)-\(module.os)-\(module.arch)"
+      // Need to insert a wildcard to make actions/upload-artifact preserve the folder hierarchy.
+      // See https://github.com/actions/upload-artifact/issues/206
+      path = "\(project)*/build/executable/**/*"
+    }
+  }
+}
+
+fixed job {
+  when (os == "linux" && !musl) {
+    container {
+      image = "redhat/ubi8:8.10"
+    }
+  }
+}

.github/jobs/DeployJob.pkl

@@ -0,0 +1,31 @@
+extends "GradleJob.pkl"
+
+import "@gha/catalog.pkl"
+import "@gha/Workflow.pkl"
+import "@pkl.impl.ghactions/helpers.pkl"
+
+local self = this
+
+command: String
+
+arch = "amd64"
+
+os = "linux"
+
+steps {
+  catalog.`actions/checkout@v6`
+  (catalog.`actions/download-artifact@v6`) {
+    with {
+      pattern = "executable-**"
+      `merge-multiple` = true
+    }
+  }
+  new Workflow.Step {
+    run = "./gradlew \(self.gradleArgs) \(module.command)"
+  }
+    |> helpers.withMavenPublishSecrets
+}
+
+fixed job {
+  environment = "maven-release"
+}

.github/jobs/GithubRelease.pkl

@@ -0,0 +1,44 @@
+module GithubRelease
+
+extends "PklJob.pkl"
+
+import "@gha/catalog.pkl"
+import "@gha/context.pkl"
+
+fixed job {
+  `runs-on` = "ubuntu-latest"
+  permissions {
+    contents = "write"
+  }
+  needs = "deploy-release"
+  steps {
+    (catalog.`actions/download-artifact@v6`) {
+      with {
+        pattern = "executable-**"
+        `merge-multiple` = true
+      }
+    }
+    new {
+      name = "Publish release on GitHub"
+      env {
+        ["GH_TOKEN"] = context.github.token
+        ["TAG_NAME"] = context.github.refName
+        ["GIT_SHA"] = context.github.sha
+        ["GH_REPO"] = context.github.repository
+      }
+      // language=bash
+      run =
+        #"""
+        # exclude build_artifacts.txt from publish
+        rm -f */build/executable/*.build_artifacts.txt
+        find */build/executable/* -type d | xargs rm -rf
+        gh release create ${TAG_NAME} \
+          --title "${TAG_NAME}" \
+          --target "${GIT_SHA}" \
+          --verify-tag \
+          --notes "Release notes: https://pkl-lang.org/main/current/release-notes/changelog.html#release-${TAG_NAME}" \
+          */build/executable/*
+        """#
+    }
+  }
+}

.github/jobs/GradleJob.pkl

@@ -0,0 +1,96 @@
+abstract module GradleJob
+
+extends "PklJob.pkl"
+
+import "@gha/Workflow.pkl"
+import "@pkl.impl.ghactions/catalog.pkl"
+
+/// Whether this is a release build or not.
+isRelease: Boolean = false
+
+/// The architecture to use
+arch: "amd64" | "aarch64" = "amd64"
+
+/// The OS to run on.
+os: "macOS" | "linux" | "windows" = "linux"
+
+// TODO flip this to `true` when nightly macOS is available
+/// Whether to run on nightly macOS.
+nightlyMacOS: Boolean(implies(os == "macOS")) = false
+
+extraGradleArgs: Listing<String>
+
+steps: Listing<Workflow.Step>
+
+preSteps: Listing<Workflow.Step>
+
+/// The fetch depth to use when doing a git checkout.
+fetchDepth: Int?
+
+fixed gradleArgs =
+  new Listing {
+    "--info"
+    "--stacktrace"
+    "--no-daemon"
+    "-DpklMultiJdkTesting=true"
+    when (isRelease) {
+      "-DreleaseBuild=true"
+    }
+    ...extraGradleArgs
+  }.join(" ")
+
+fixed job {
+  env {
+    ["LANG"] = "en_US.UTF-8"
+    when (os == "windows") {
+      ["JAVA_HOME"] = "/jdk"
+    }
+  }
+  when (os == "macOS") {
+    `if` =
+      let (cond = "github.repository_owner == 'apple'")
+        if (super.`if` != null)
+          "(\(super.`if`)) && \(cond)"
+        else
+          cond
+  }
+  `runs-on` =
+    if (os == "linux" && arch == "amd64")
+      "ubuntu-latest"
+    else if (os == "linux" && arch == "aarch64")
+      "ubuntu-24.04-arm"
+    else if (os == "windows")
+      "windows-latest"
+    else
+      new Listing {
+        "self-hosted"
+        "macos"
+        when (nightlyMacOS) {
+          "nightly"
+        }
+      }
+  steps {
+    ...preSteps
+    // full checkout (needed for spotless)
+    (catalog.`actions/checkout@v6`) {
+      when (fetchDepth != null) {
+        with {
+          `fetch-depth` = fetchDepth
+        }
+      }
+    }
+    (catalog.`actions/setup-java@v5`) {
+      with {
+        `java-version` = "21"
+        distribution = "temurin"
+        architecture =
+          if (arch == "amd64")
+            "x64"
+          else
+            "aarch64"
+      }
+    }
+    catalog.`gradle/actions/setup-gradle@v5`
+    ...module.steps
+  }
+}

.github/jobs/PklJob.pkl

@@ -0,0 +1,29 @@
+abstract module PklJob
+
+extends "@pkl.impl.ghactions/jobs/PklJob.pkl"
+
+/// Identify any jobs that must complete successfully before this job will run.
+///
+/// It can be a string or array of strings.
+/// If a job fails or is skipped, all jobs that need it are skipped unless the jobs use a conditional expression that
+/// causes the job to continue.
+/// If a run contains a series of jobs that need each other, a failure or skip applies to all jobs in the dependency
+/// chain from the point of failure or skip onwards. If you would like a job to run even if a job it is dependent on
+/// did not succeed, use the `always()` conditional expression in `jobs.<job_id>.if`.
+///
+/// See: <https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idneeds>
+needs: (String | *Listing<String>)?
+
+/// A conditional to prevent a job from running unless a condition is met.
+///
+/// You can use any supported context and expression to create a conditional.
+/// For more information on which contexts are supported in this key, see
+/// [Contexts reference](https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#context-availability).
+@SourceCode { language = "GithubExpressionLanguage" }
+`if`: String?
+
+/// The underlying workflow job
+fixed job {
+  `if` = module.`if`
+  needs = module.needs
+}

.github/jobs/SimpleGradleJob.pkl

@@ -0,0 +1,18 @@
+extends "GradleJob.pkl"
+
+name: String = command
+
+command: String
+
+os = "linux"
+
+steps {
+  new {
+    name = module.name
+    shell = "bash"
+    run =
+      """
+      ./gradlew \(module.gradleArgs) \(module.command)
+      """
+  }
+}

.github/scripts/cc_macos_amd64.sh

@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+clang -arch x86_64 "$@"

.github/scripts/install_musl.sh

@@ -0,0 +1,71 @@
+set -e
+mkdir -p ~/staticdeps/
+
+ZLIB_VERSION="1.2.13"
+MUSL_VERSION="1.2.5"
+
+# install zlib
+if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
+  # Download zlib tarball and signature
+  curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" -o /tmp/zlib.tar.gz
+  curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz.asc" -o /tmp/zlib.tar.gz.asc
+
+  # Import zlib GPG key
+  gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 5ED46A6721D365587791E2AA783FCD8E58BCAFBA
+
+  # Verify GPG signature
+  echo "Verifying zlib GPG signature..."
+  gpg --verify /tmp/zlib.tar.gz.asc /tmp/zlib.tar.gz
+
+  mkdir -p "/tmp/dep_zlib-${ZLIB_VERSION}"
+  cd "/tmp/dep_zlib-${ZLIB_VERSION}"
+  # shellcheck disable=SC2002
+  cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC .
+
+  echo "zlib-${ZLIB_VERSION}: configure..." 
+  ./configure --static --prefix="$HOME"/staticdeps > /dev/null
+
+  echo "zlib-${ZLIB_VERSION}: make..." 
+  make -s -j4
+
+  echo "zlib-${ZLIB_VERSION}: make install..." 
+  make -s install
+
+  rm -rf /tmp/dep_zlib-${ZLIB_VERSION}
+fi
+
+# install musl
+if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
+  # Download musl tarball and signature
+  curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz" -o /tmp/musl.tar.gz
+  curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz.asc" -o /tmp/musl.tar.gz.asc
+
+  # Import musl GPG key
+  gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 836489290BB6B70F99FFDA0556BCDB593020450F
+
+  # Verify GPG signature
+  echo "Verifying musl GPG signature..."
+  gpg --verify /tmp/musl.tar.gz.asc /tmp/musl.tar.gz
+
+  mkdir -p "/tmp/dep_musl-${MUSL_VERSION}"
+  cd "/tmp/dep_musl-${MUSL_VERSION}"
+
+  # shellcheck disable=SC2002
+  cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC .
+
+  echo "musl-${MUSL_VERSION}: configure..." 
+  ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null
+
+  echo "musl-${MUSL_VERSION}: make..." 
+  make -s -j4
+
+  echo "musl-${MUSL_VERSION}: make install..." 
+  make -s install
+
+  rm -rf "/tmp/dep_musl-${MUSL_VERSION}"
+
+  # native-image expects to find an executable at this path.
+  ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
+fi
+
+echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"

.github/workflows/__lockfile__.yml

@@ -0,0 +1,33 @@
+#file: noinspection MandatoryParamsAbsent,UndefinedAction
+# This is a fake workflow that never runs.
+# It's used to pin actions to specific git SHAs when generating actual workflows.
+# It also gets updated by dependabot (see .github/dependabot.yml).
+# Generated from Workflow.pkl. DO NOT EDIT.
+name: __lockfile__
+'on':
+  push:
+    branches-ignore:
+    - '**'
+    tags-ignore:
+    - '**'
+jobs:
+  locks:
+    if: 'false'
+    runs-on: nothing
+    steps:
+    - name: EnricoMi/publish-unit-test-result-action@v2
+      uses: EnricoMi/publish-unit-test-result-action@27d65e188ec43221b20d26de30f4892fad91df2f # v2
+    - name: actions/checkout@v6
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+    - name: actions/create-github-app-token@v2
+      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
+    - name: actions/download-artifact@v6
+      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+    - name: actions/setup-java@v5
+      uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+    - name: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+    - name: dawidd6/action-download-artifact@v11
+      uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
+    - name: gradle/actions/setup-gradle@v5
+      uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5

.github/workflows/build.yml

@@ -0,0 +1,825 @@
+# Generated from Workflow.pkl. DO NOT EDIT.
+name: Build
+'on':
+  push:
+    branches-ignore:
+    - main
+    - release/*
+    tags-ignore:
+    - '**'
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+permissions:
+  contents: read
+jobs:
+  gradle-check:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: check
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-check
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-check
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  gradle-check-windows:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: check
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-check-windows
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-check-windows
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  bench:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: bench:jmh
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true bench:jmh
+  gradle-compatibility:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-compatibility
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-compatibility
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  java-executables-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - name: gradle build java executables
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-java
+        path: '*/build/executable/**/*'
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-java-executables-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-java-executables-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-macOS-amd64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-linux-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-cli-macOS-aarch64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-linux-aarch64-snapshot:
+    runs-on: ubuntu-24.04-arm
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-linux-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-linux-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-linux-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-cli-alpine-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Install musl and zlib
+      run: |
+        set -e
+        mkdir -p ~/staticdeps/
+
+        ZLIB_VERSION="1.2.13"
+        MUSL_VERSION="1.2.5"
+
+        # install zlib
+        if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
+          # Download zlib tarball and signature
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" -o /tmp/zlib.tar.gz
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz.asc" -o /tmp/zlib.tar.gz.asc
+
+          # Import zlib GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 5ED46A6721D365587791E2AA783FCD8E58BCAFBA
+
+          # Verify GPG signature
+          echo "Verifying zlib GPG signature..."
+          gpg --verify /tmp/zlib.tar.gz.asc /tmp/zlib.tar.gz
+
+          mkdir -p "/tmp/dep_zlib-${ZLIB_VERSION}"
+          cd "/tmp/dep_zlib-${ZLIB_VERSION}"
+          # shellcheck disable=SC2002
+          cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "zlib-${ZLIB_VERSION}: configure..." 
+          ./configure --static --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "zlib-${ZLIB_VERSION}: make..." 
+          make -s -j4
+
+          echo "zlib-${ZLIB_VERSION}: make install..." 
+          make -s install
+
+          rm -rf /tmp/dep_zlib-${ZLIB_VERSION}
+        fi
+
+        # install musl
+        if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
+          # Download musl tarball and signature
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz" -o /tmp/musl.tar.gz
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz.asc" -o /tmp/musl.tar.gz.asc
+
+          # Import musl GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 836489290BB6B70F99FFDA0556BCDB593020450F
+
+          # Verify GPG signature
+          echo "Verifying musl GPG signature..."
+          gpg --verify /tmp/musl.tar.gz.asc /tmp/musl.tar.gz
+
+          mkdir -p "/tmp/dep_musl-${MUSL_VERSION}"
+          cd "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # shellcheck disable=SC2002
+          cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "musl-${MUSL_VERSION}: configure..." 
+          ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "musl-${MUSL_VERSION}: make..." 
+          make -s -j4
+
+          echo "musl-${MUSL_VERSION}: make install..." 
+          make -s install
+
+          rm -rf "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # native-image expects to find an executable at this path.
+          ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
+        fi
+
+        echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-alpine-linux-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-alpine-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-alpine-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-windows-amd64-snapshot:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-windows-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-windows-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-windows-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-macOS-amd64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-linux-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-doc-macOS-aarch64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-linux-aarch64-snapshot:
+    runs-on: ubuntu-24.04-arm
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-linux-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-linux-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-linux-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-doc-alpine-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Install musl and zlib
+      run: |
+        set -e
+        mkdir -p ~/staticdeps/
+
+        ZLIB_VERSION="1.2.13"
+        MUSL_VERSION="1.2.5"
+
+        # install zlib
+        if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
+          # Download zlib tarball and signature
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" -o /tmp/zlib.tar.gz
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz.asc" -o /tmp/zlib.tar.gz.asc
+
+          # Import zlib GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 5ED46A6721D365587791E2AA783FCD8E58BCAFBA
+
+          # Verify GPG signature
+          echo "Verifying zlib GPG signature..."
+          gpg --verify /tmp/zlib.tar.gz.asc /tmp/zlib.tar.gz
+
+          mkdir -p "/tmp/dep_zlib-${ZLIB_VERSION}"
+          cd "/tmp/dep_zlib-${ZLIB_VERSION}"
+          # shellcheck disable=SC2002
+          cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "zlib-${ZLIB_VERSION}: configure..." 
+          ./configure --static --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "zlib-${ZLIB_VERSION}: make..." 
+          make -s -j4
+
+          echo "zlib-${ZLIB_VERSION}: make install..." 
+          make -s install
+
+          rm -rf /tmp/dep_zlib-${ZLIB_VERSION}
+        fi
+
+        # install musl
+        if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
+          # Download musl tarball and signature
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz" -o /tmp/musl.tar.gz
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz.asc" -o /tmp/musl.tar.gz.asc
+
+          # Import musl GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 836489290BB6B70F99FFDA0556BCDB593020450F
+
+          # Verify GPG signature
+          echo "Verifying musl GPG signature..."
+          gpg --verify /tmp/musl.tar.gz.asc /tmp/musl.tar.gz
+
+          mkdir -p "/tmp/dep_musl-${MUSL_VERSION}"
+          cd "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # shellcheck disable=SC2002
+          cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "musl-${MUSL_VERSION}: configure..." 
+          ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "musl-${MUSL_VERSION}: make..." 
+          make -s -j4
+
+          echo "musl-${MUSL_VERSION}: make install..." 
+          make -s install
+
+          rm -rf "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # native-image expects to find an executable at this path.
+          ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
+        fi
+
+        echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-alpine-linux-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-alpine-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-alpine-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-windows-amd64-snapshot:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-windows-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-windows-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-windows-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  publish-test-results:
+    if: '!cancelled()'
+    needs:
+    - gradle-check
+    - gradle-check-windows
+    - gradle-compatibility
+    - java-executables-snapshot
+    - pkl-cli-macOS-amd64-snapshot
+    - pkl-cli-linux-amd64-snapshot
+    - pkl-cli-macOS-aarch64-snapshot
+    - pkl-cli-linux-aarch64-snapshot
+    - pkl-cli-alpine-linux-amd64-snapshot
+    - pkl-cli-windows-amd64-snapshot
+    - pkl-doc-macOS-amd64-snapshot
+    - pkl-doc-linux-amd64-snapshot
+    - pkl-doc-macOS-aarch64-snapshot
+    - pkl-doc-linux-aarch64-snapshot
+    - pkl-doc-alpine-linux-amd64-snapshot
+    - pkl-doc-windows-amd64-snapshot
+    permissions:
+      checks: write
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+      with:
+        pattern: test-results-xml-*
+    - name: Publish test results
+      if: '!cancelled()'
+      uses: EnricoMi/publish-unit-test-result-action@27d65e188ec43221b20d26de30f4892fad91df2f # v2
+      with:
+        comment_mode: 'off'
+        files: test-results-xml-*/**/*.xml
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-publish-test-results
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore

.github/workflows/main.yml

@@ -0,0 +1,912 @@
+# Generated from Workflow.pkl. DO NOT EDIT.
+name: Build (main)
+'on':
+  push:
+    branches:
+    - main
+    tags-ignore:
+    - '**'
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+permissions:
+  contents: read
+jobs:
+  gradle-check:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: check
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-check
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-check
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  gradle-check-windows:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: check
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-check-windows
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-check-windows
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  bench:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: bench:jmh
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true bench:jmh
+  gradle-compatibility:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-compatibility
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-compatibility
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  java-executables-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - name: gradle build java executables
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-java
+        path: '*/build/executable/**/*'
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-java-executables-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-java-executables-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-macOS-amd64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-linux-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-cli-macOS-aarch64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-linux-aarch64-snapshot:
+    runs-on: ubuntu-24.04-arm
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-linux-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-linux-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-linux-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-cli-alpine-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Install musl and zlib
+      run: |
+        set -e
+        mkdir -p ~/staticdeps/
+
+        ZLIB_VERSION="1.2.13"
+        MUSL_VERSION="1.2.5"
+
+        # install zlib
+        if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
+          # Download zlib tarball and signature
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" -o /tmp/zlib.tar.gz
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz.asc" -o /tmp/zlib.tar.gz.asc
+
+          # Import zlib GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 5ED46A6721D365587791E2AA783FCD8E58BCAFBA
+
+          # Verify GPG signature
+          echo "Verifying zlib GPG signature..."
+          gpg --verify /tmp/zlib.tar.gz.asc /tmp/zlib.tar.gz
+
+          mkdir -p "/tmp/dep_zlib-${ZLIB_VERSION}"
+          cd "/tmp/dep_zlib-${ZLIB_VERSION}"
+          # shellcheck disable=SC2002
+          cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "zlib-${ZLIB_VERSION}: configure..." 
+          ./configure --static --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "zlib-${ZLIB_VERSION}: make..." 
+          make -s -j4
+
+          echo "zlib-${ZLIB_VERSION}: make install..." 
+          make -s install
+
+          rm -rf /tmp/dep_zlib-${ZLIB_VERSION}
+        fi
+
+        # install musl
+        if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
+          # Download musl tarball and signature
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz" -o /tmp/musl.tar.gz
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz.asc" -o /tmp/musl.tar.gz.asc
+
+          # Import musl GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 836489290BB6B70F99FFDA0556BCDB593020450F
+
+          # Verify GPG signature
+          echo "Verifying musl GPG signature..."
+          gpg --verify /tmp/musl.tar.gz.asc /tmp/musl.tar.gz
+
+          mkdir -p "/tmp/dep_musl-${MUSL_VERSION}"
+          cd "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # shellcheck disable=SC2002
+          cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "musl-${MUSL_VERSION}: configure..." 
+          ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "musl-${MUSL_VERSION}: make..." 
+          make -s -j4
+
+          echo "musl-${MUSL_VERSION}: make install..." 
+          make -s install
+
+          rm -rf "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # native-image expects to find an executable at this path.
+          ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
+        fi
+
+        echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-alpine-linux-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-alpine-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-alpine-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-windows-amd64-snapshot:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-windows-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-windows-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-windows-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-macOS-amd64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-linux-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-doc-macOS-aarch64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-linux-aarch64-snapshot:
+    runs-on: ubuntu-24.04-arm
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-linux-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-linux-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-linux-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-doc-alpine-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Install musl and zlib
+      run: |
+        set -e
+        mkdir -p ~/staticdeps/
+
+        ZLIB_VERSION="1.2.13"
+        MUSL_VERSION="1.2.5"
+
+        # install zlib
+        if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
+          # Download zlib tarball and signature
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" -o /tmp/zlib.tar.gz
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz.asc" -o /tmp/zlib.tar.gz.asc
+
+          # Import zlib GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 5ED46A6721D365587791E2AA783FCD8E58BCAFBA
+
+          # Verify GPG signature
+          echo "Verifying zlib GPG signature..."
+          gpg --verify /tmp/zlib.tar.gz.asc /tmp/zlib.tar.gz
+
+          mkdir -p "/tmp/dep_zlib-${ZLIB_VERSION}"
+          cd "/tmp/dep_zlib-${ZLIB_VERSION}"
+          # shellcheck disable=SC2002
+          cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "zlib-${ZLIB_VERSION}: configure..." 
+          ./configure --static --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "zlib-${ZLIB_VERSION}: make..." 
+          make -s -j4
+
+          echo "zlib-${ZLIB_VERSION}: make install..." 
+          make -s install
+
+          rm -rf /tmp/dep_zlib-${ZLIB_VERSION}
+        fi
+
+        # install musl
+        if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
+          # Download musl tarball and signature
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz" -o /tmp/musl.tar.gz
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz.asc" -o /tmp/musl.tar.gz.asc
+
+          # Import musl GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 836489290BB6B70F99FFDA0556BCDB593020450F
+
+          # Verify GPG signature
+          echo "Verifying musl GPG signature..."
+          gpg --verify /tmp/musl.tar.gz.asc /tmp/musl.tar.gz
+
+          mkdir -p "/tmp/dep_musl-${MUSL_VERSION}"
+          cd "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # shellcheck disable=SC2002
+          cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "musl-${MUSL_VERSION}: configure..." 
+          ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "musl-${MUSL_VERSION}: make..." 
+          make -s -j4
+
+          echo "musl-${MUSL_VERSION}: make install..." 
+          make -s install
+
+          rm -rf "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # native-image expects to find an executable at this path.
+          ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
+        fi
+
+        echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-alpine-linux-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-alpine-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-alpine-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-windows-amd64-snapshot:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-windows-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-windows-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-windows-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  deploy-snapshot:
+    needs:
+    - gradle-check
+    - gradle-check-windows
+    - bench
+    - gradle-compatibility
+    - java-executables-snapshot
+    - pkl-cli-macOS-amd64-snapshot
+    - pkl-cli-linux-amd64-snapshot
+    - pkl-cli-macOS-aarch64-snapshot
+    - pkl-cli-linux-aarch64-snapshot
+    - pkl-cli-alpine-linux-amd64-snapshot
+    - pkl-cli-windows-amd64-snapshot
+    - pkl-doc-macOS-amd64-snapshot
+    - pkl-doc-linux-amd64-snapshot
+    - pkl-doc-macOS-aarch64-snapshot
+    - pkl-doc-linux-aarch64-snapshot
+    - pkl-doc-alpine-linux-amd64-snapshot
+    - pkl-doc-windows-amd64-snapshot
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    environment: maven-release
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+      with:
+        pattern: executable-**
+        merge-multiple: true
+    - env:
+        ORG_GRADLE_PROJECT_signingKeyId: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGKEYID }}
+        ORG_GRADLE_PROJECT_signingKey: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGKEY }}
+        ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGPASSWORD }}
+        ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.ORG_GRADLE_PROJECT_SONATYPEPASSWORD }}
+        ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.ORG_GRADLE_PROJECT_SONATYPEUSERNAME }}
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true --no-parallel publishToSonatype
+  publish-test-results:
+    if: '!cancelled()'
+    needs:
+    - gradle-check
+    - gradle-check-windows
+    - gradle-compatibility
+    - java-executables-snapshot
+    - pkl-cli-macOS-amd64-snapshot
+    - pkl-cli-linux-amd64-snapshot
+    - pkl-cli-macOS-aarch64-snapshot
+    - pkl-cli-linux-aarch64-snapshot
+    - pkl-cli-alpine-linux-amd64-snapshot
+    - pkl-cli-windows-amd64-snapshot
+    - pkl-doc-macOS-amd64-snapshot
+    - pkl-doc-linux-amd64-snapshot
+    - pkl-doc-macOS-aarch64-snapshot
+    - pkl-doc-linux-aarch64-snapshot
+    - pkl-doc-alpine-linux-amd64-snapshot
+    - pkl-doc-windows-amd64-snapshot
+    permissions:
+      checks: write
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+      with:
+        pattern: test-results-xml-*
+    - name: Publish test results
+      if: '!cancelled()'
+      uses: EnricoMi/publish-unit-test-result-action@27d65e188ec43221b20d26de30f4892fad91df2f # v2
+      with:
+        comment_mode: 'off'
+        files: test-results-xml-*/**/*.xml
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-publish-test-results
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  trigger-downstream-builds:
+    if: github.repository_owner == 'apple'
+    needs:
+    - gradle-check
+    - gradle-check-windows
+    - bench
+    - gradle-compatibility
+    - java-executables-snapshot
+    - pkl-cli-macOS-amd64-snapshot
+    - pkl-cli-linux-amd64-snapshot
+    - pkl-cli-macOS-aarch64-snapshot
+    - pkl-cli-linux-aarch64-snapshot
+    - pkl-cli-alpine-linux-amd64-snapshot
+    - pkl-cli-windows-amd64-snapshot
+    - pkl-doc-macOS-amd64-snapshot
+    - pkl-doc-linux-amd64-snapshot
+    - pkl-doc-macOS-aarch64-snapshot
+    - pkl-doc-linux-aarch64-snapshot
+    - pkl-doc-alpine-linux-amd64-snapshot
+    - pkl-doc-windows-amd64-snapshot
+    - deploy-snapshot
+    - publish-test-results
+    runs-on: ubuntu-latest
+    steps:
+    - name: Create app token
+      id: app-token
+      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
+      with:
+        app-id: ${{ secrets.PKL_CI_CLIENT_ID }}
+        private-key: ${{ secrets.PKL_CI }}
+        owner: ${{ github.repository_owner }}
+    - name: Trigger pkl-lang.org build
+      env:
+        GH_TOKEN: ${{ steps.app-token.outputs.token }}
+      run: |-
+        gh workflow run \
+          --repo apple/pkl-lang.org \
+          --ref main \
+          --field source_run="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+          main.yml

.github/workflows/prb.yml

@@ -0,0 +1,753 @@
+# Generated from Workflow.pkl. DO NOT EDIT.
+name: Pull Request
+'on':
+  pull_request: {}
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+jobs:
+  gradle-check:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: check
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-check
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-check
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  gradle-check-windows:
+    if: contains(github.event.pull_request.body, '[windows]')
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: check
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-check-windows
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-check-windows
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-macOS-amd64-snapshot:
+    if: (contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-cli]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS-amd64]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS-amd64]')) && github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-linux-amd64-snapshot:
+    if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-cli]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux-amd64]')
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-linux-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-cli-macOS-aarch64-snapshot:
+    if: (contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-cli]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS-aarch64]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS-aarch64]')) && github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-linux-aarch64-snapshot:
+    if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-cli]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux-aarch64]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux-aarch64]')
+    runs-on: ubuntu-24.04-arm
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-linux-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-linux-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-linux-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-cli-alpine-linux-amd64-snapshot:
+    if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-cli]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-cli-alpine-linux-amd64]')
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Install musl and zlib
+      run: |
+        set -e
+        mkdir -p ~/staticdeps/
+
+        ZLIB_VERSION="1.2.13"
+        MUSL_VERSION="1.2.5"
+
+        # install zlib
+        if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
+          # Download zlib tarball and signature
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" -o /tmp/zlib.tar.gz
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz.asc" -o /tmp/zlib.tar.gz.asc
+
+          # Import zlib GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 5ED46A6721D365587791E2AA783FCD8E58BCAFBA
+
+          # Verify GPG signature
+          echo "Verifying zlib GPG signature..."
+          gpg --verify /tmp/zlib.tar.gz.asc /tmp/zlib.tar.gz
+
+          mkdir -p "/tmp/dep_zlib-${ZLIB_VERSION}"
+          cd "/tmp/dep_zlib-${ZLIB_VERSION}"
+          # shellcheck disable=SC2002
+          cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "zlib-${ZLIB_VERSION}: configure..." 
+          ./configure --static --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "zlib-${ZLIB_VERSION}: make..." 
+          make -s -j4
+
+          echo "zlib-${ZLIB_VERSION}: make install..." 
+          make -s install
+
+          rm -rf /tmp/dep_zlib-${ZLIB_VERSION}
+        fi
+
+        # install musl
+        if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
+          # Download musl tarball and signature
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz" -o /tmp/musl.tar.gz
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz.asc" -o /tmp/musl.tar.gz.asc
+
+          # Import musl GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 836489290BB6B70F99FFDA0556BCDB593020450F
+
+          # Verify GPG signature
+          echo "Verifying musl GPG signature..."
+          gpg --verify /tmp/musl.tar.gz.asc /tmp/musl.tar.gz
+
+          mkdir -p "/tmp/dep_musl-${MUSL_VERSION}"
+          cd "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # shellcheck disable=SC2002
+          cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "musl-${MUSL_VERSION}: configure..." 
+          ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "musl-${MUSL_VERSION}: make..." 
+          make -s -j4
+
+          echo "musl-${MUSL_VERSION}: make install..." 
+          make -s install
+
+          rm -rf "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # native-image expects to find an executable at this path.
+          ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
+        fi
+
+        echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-alpine-linux-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-alpine-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-alpine-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-windows-amd64-snapshot:
+    if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-cli]') || contains(github.event.pull_request.body, '[native-pkl-cli-windows]') || contains(github.event.pull_request.body, '[native-pkl-cli-windows-amd64]') || contains(github.event.pull_request.body, '[native-pkl-cli-windows-amd64]')
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-windows-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-windows-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-windows-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-macOS-amd64-snapshot:
+    if: (contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-doc]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS-amd64]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS-amd64]')) && github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-linux-amd64-snapshot:
+    if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-doc]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux-amd64]')
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-linux-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-doc-macOS-aarch64-snapshot:
+    if: (contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-doc]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS-aarch64]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS-aarch64]')) && github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-linux-aarch64-snapshot:
+    if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-doc]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux-aarch64]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux-aarch64]')
+    runs-on: ubuntu-24.04-arm
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-linux-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-linux-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-linux-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-doc-alpine-linux-amd64-snapshot:
+    if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-doc]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-doc-alpine-linux-amd64]')
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Install musl and zlib
+      run: |
+        set -e
+        mkdir -p ~/staticdeps/
+
+        ZLIB_VERSION="1.2.13"
+        MUSL_VERSION="1.2.5"
+
+        # install zlib
+        if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
+          # Download zlib tarball and signature
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" -o /tmp/zlib.tar.gz
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz.asc" -o /tmp/zlib.tar.gz.asc
+
+          # Import zlib GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 5ED46A6721D365587791E2AA783FCD8E58BCAFBA
+
+          # Verify GPG signature
+          echo "Verifying zlib GPG signature..."
+          gpg --verify /tmp/zlib.tar.gz.asc /tmp/zlib.tar.gz
+
+          mkdir -p "/tmp/dep_zlib-${ZLIB_VERSION}"
+          cd "/tmp/dep_zlib-${ZLIB_VERSION}"
+          # shellcheck disable=SC2002
+          cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "zlib-${ZLIB_VERSION}: configure..." 
+          ./configure --static --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "zlib-${ZLIB_VERSION}: make..." 
+          make -s -j4
+
+          echo "zlib-${ZLIB_VERSION}: make install..." 
+          make -s install
+
+          rm -rf /tmp/dep_zlib-${ZLIB_VERSION}
+        fi
+
+        # install musl
+        if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
+          # Download musl tarball and signature
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz" -o /tmp/musl.tar.gz
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz.asc" -o /tmp/musl.tar.gz.asc
+
+          # Import musl GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 836489290BB6B70F99FFDA0556BCDB593020450F
+
+          # Verify GPG signature
+          echo "Verifying musl GPG signature..."
+          gpg --verify /tmp/musl.tar.gz.asc /tmp/musl.tar.gz
+
+          mkdir -p "/tmp/dep_musl-${MUSL_VERSION}"
+          cd "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # shellcheck disable=SC2002
+          cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "musl-${MUSL_VERSION}: configure..." 
+          ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "musl-${MUSL_VERSION}: make..." 
+          make -s -j4
+
+          echo "musl-${MUSL_VERSION}: make install..." 
+          make -s install
+
+          rm -rf "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # native-image expects to find an executable at this path.
+          ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
+        fi
+
+        echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-alpine-linux-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-alpine-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-alpine-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-windows-amd64-snapshot:
+    if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-doc]') || contains(github.event.pull_request.body, '[native-pkl-doc-windows]') || contains(github.event.pull_request.body, '[native-pkl-doc-windows-amd64]') || contains(github.event.pull_request.body, '[native-pkl-doc-windows-amd64]')
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-windows-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-windows-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-windows-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  upload-event-file:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Upload event file
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-event-file
+        path: ${{ github.event_path }}
+  check-pkl-github-actions:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - name: Setup Pkl
+      id: setup-pkl
+      env:
+        PKL_VERSION: 0.30.0
+        PKL_FILENAME: pkl
+        PKL_DOWNLOAD_URL: https://github.com/apple/pkl/releases/download/0.30.0/pkl-linux-amd64
+      shell: bash
+      run: |-
+        DIR="$(mktemp -d /tmp/pkl-$PKL_VERSION-XXXXXX)"
+        PKL_EXEC="$DIR/$PKL_FILENAME"
+        curl -sfL -o $PKL_EXEC "$PKL_DOWNLOAD_URL"
+        chmod +x $PKL_EXEC
+        echo "$DIR" >> "$GITHUB_PATH"
+        echo "pkl_exec=$PKL_EXEC" >> "$GITHUB_OUTPUT"
+    - shell: bash
+      run: pkl eval -m .github/ --project-dir .github/ .github/index.pkl
+    - name: check git status
+      shell: bash
+      run: |-
+        if [ -n "$(git status --porcelain)" ]; then
+          echo "Running pkl resulted in a diff! You likely need to run 'pkl eval' and commit the changes."
+          git diff --name-only
+          exit 1
+        fi

.github/workflows/release-branch.yml

@@ -0,0 +1,863 @@
+# Generated from Workflow.pkl. DO NOT EDIT.
+name: Build (release branch)
+'on':
+  push:
+    branches:
+    - release/*
+    tags-ignore:
+    - '**'
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+jobs:
+  gradle-check:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: check
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-check
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-check
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  gradle-check-windows:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: check
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-check-windows
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-check-windows
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  bench:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: bench:jmh
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true bench:jmh
+  gradle-compatibility:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-compatibility
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-compatibility
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  java-executables-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - name: gradle build java executables
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-java
+        path: '*/build/executable/**/*'
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-java-executables-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-java-executables-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-macOS-amd64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-linux-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-cli-macOS-aarch64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-linux-aarch64-snapshot:
+    runs-on: ubuntu-24.04-arm
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-linux-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-linux-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-linux-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-cli-alpine-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Install musl and zlib
+      run: |
+        set -e
+        mkdir -p ~/staticdeps/
+
+        ZLIB_VERSION="1.2.13"
+        MUSL_VERSION="1.2.5"
+
+        # install zlib
+        if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
+          # Download zlib tarball and signature
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" -o /tmp/zlib.tar.gz
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz.asc" -o /tmp/zlib.tar.gz.asc
+
+          # Import zlib GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 5ED46A6721D365587791E2AA783FCD8E58BCAFBA
+
+          # Verify GPG signature
+          echo "Verifying zlib GPG signature..."
+          gpg --verify /tmp/zlib.tar.gz.asc /tmp/zlib.tar.gz
+
+          mkdir -p "/tmp/dep_zlib-${ZLIB_VERSION}"
+          cd "/tmp/dep_zlib-${ZLIB_VERSION}"
+          # shellcheck disable=SC2002
+          cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "zlib-${ZLIB_VERSION}: configure..." 
+          ./configure --static --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "zlib-${ZLIB_VERSION}: make..." 
+          make -s -j4
+
+          echo "zlib-${ZLIB_VERSION}: make install..." 
+          make -s install
+
+          rm -rf /tmp/dep_zlib-${ZLIB_VERSION}
+        fi
+
+        # install musl
+        if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
+          # Download musl tarball and signature
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz" -o /tmp/musl.tar.gz
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz.asc" -o /tmp/musl.tar.gz.asc
+
+          # Import musl GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 836489290BB6B70F99FFDA0556BCDB593020450F
+
+          # Verify GPG signature
+          echo "Verifying musl GPG signature..."
+          gpg --verify /tmp/musl.tar.gz.asc /tmp/musl.tar.gz
+
+          mkdir -p "/tmp/dep_musl-${MUSL_VERSION}"
+          cd "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # shellcheck disable=SC2002
+          cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "musl-${MUSL_VERSION}: configure..." 
+          ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "musl-${MUSL_VERSION}: make..." 
+          make -s -j4
+
+          echo "musl-${MUSL_VERSION}: make install..." 
+          make -s install
+
+          rm -rf "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # native-image expects to find an executable at this path.
+          ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
+        fi
+
+        echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-alpine-linux-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-alpine-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-alpine-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-windows-amd64-snapshot:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-windows-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-windows-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-windows-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-macOS-amd64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-linux-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-doc-macOS-aarch64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-linux-aarch64-snapshot:
+    runs-on: ubuntu-24.04-arm
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-linux-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-linux-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-linux-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-doc-alpine-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Install musl and zlib
+      run: |
+        set -e
+        mkdir -p ~/staticdeps/
+
+        ZLIB_VERSION="1.2.13"
+        MUSL_VERSION="1.2.5"
+
+        # install zlib
+        if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
+          # Download zlib tarball and signature
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" -o /tmp/zlib.tar.gz
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz.asc" -o /tmp/zlib.tar.gz.asc
+
+          # Import zlib GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 5ED46A6721D365587791E2AA783FCD8E58BCAFBA
+
+          # Verify GPG signature
+          echo "Verifying zlib GPG signature..."
+          gpg --verify /tmp/zlib.tar.gz.asc /tmp/zlib.tar.gz
+
+          mkdir -p "/tmp/dep_zlib-${ZLIB_VERSION}"
+          cd "/tmp/dep_zlib-${ZLIB_VERSION}"
+          # shellcheck disable=SC2002
+          cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "zlib-${ZLIB_VERSION}: configure..." 
+          ./configure --static --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "zlib-${ZLIB_VERSION}: make..." 
+          make -s -j4
+
+          echo "zlib-${ZLIB_VERSION}: make install..." 
+          make -s install
+
+          rm -rf /tmp/dep_zlib-${ZLIB_VERSION}
+        fi
+
+        # install musl
+        if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
+          # Download musl tarball and signature
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz" -o /tmp/musl.tar.gz
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz.asc" -o /tmp/musl.tar.gz.asc
+
+          # Import musl GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 836489290BB6B70F99FFDA0556BCDB593020450F
+
+          # Verify GPG signature
+          echo "Verifying musl GPG signature..."
+          gpg --verify /tmp/musl.tar.gz.asc /tmp/musl.tar.gz
+
+          mkdir -p "/tmp/dep_musl-${MUSL_VERSION}"
+          cd "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # shellcheck disable=SC2002
+          cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "musl-${MUSL_VERSION}: configure..." 
+          ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "musl-${MUSL_VERSION}: make..." 
+          make -s -j4
+
+          echo "musl-${MUSL_VERSION}: make install..." 
+          make -s install
+
+          rm -rf "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # native-image expects to find an executable at this path.
+          ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
+        fi
+
+        echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-alpine-linux-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-alpine-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-alpine-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-windows-amd64-snapshot:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-windows-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-windows-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-windows-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  publish-test-results:
+    if: '!cancelled()'
+    needs:
+    - gradle-check
+    - gradle-check-windows
+    - gradle-compatibility
+    - java-executables-snapshot
+    - pkl-cli-macOS-amd64-snapshot
+    - pkl-cli-linux-amd64-snapshot
+    - pkl-cli-macOS-aarch64-snapshot
+    - pkl-cli-linux-aarch64-snapshot
+    - pkl-cli-alpine-linux-amd64-snapshot
+    - pkl-cli-windows-amd64-snapshot
+    - pkl-doc-macOS-amd64-snapshot
+    - pkl-doc-linux-amd64-snapshot
+    - pkl-doc-macOS-aarch64-snapshot
+    - pkl-doc-linux-aarch64-snapshot
+    - pkl-doc-alpine-linux-amd64-snapshot
+    - pkl-doc-windows-amd64-snapshot
+    permissions:
+      checks: write
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+      with:
+        pattern: test-results-xml-*
+    - name: Publish test results
+      if: '!cancelled()'
+      uses: EnricoMi/publish-unit-test-result-action@27d65e188ec43221b20d26de30f4892fad91df2f # v2
+      with:
+        comment_mode: 'off'
+        files: test-results-xml-*/**/*.xml
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-publish-test-results
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  trigger-downstream-builds:
+    if: github.repository_owner == 'apple'
+    needs:
+    - gradle-check
+    - gradle-check-windows
+    - bench
+    - gradle-compatibility
+    - java-executables-snapshot
+    - pkl-cli-macOS-amd64-snapshot
+    - pkl-cli-linux-amd64-snapshot
+    - pkl-cli-macOS-aarch64-snapshot
+    - pkl-cli-linux-aarch64-snapshot
+    - pkl-cli-alpine-linux-amd64-snapshot
+    - pkl-cli-windows-amd64-snapshot
+    - pkl-doc-macOS-amd64-snapshot
+    - pkl-doc-linux-amd64-snapshot
+    - pkl-doc-macOS-aarch64-snapshot
+    - pkl-doc-linux-aarch64-snapshot
+    - pkl-doc-alpine-linux-amd64-snapshot
+    - pkl-doc-windows-amd64-snapshot
+    - publish-test-results
+    runs-on: ubuntu-latest
+    steps:
+    - name: Create app token
+      id: app-token
+      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
+      with:
+        app-id: ${{ secrets.PKL_CI_CLIENT_ID }}
+        private-key: ${{ secrets.PKL_CI }}
+        owner: ${{ github.repository_owner }}
+    - name: Trigger pkl-lang.org build
+      env:
+        GH_TOKEN: ${{ steps.app-token.outputs.token }}
+      run: |-
+        gh workflow run \
+          --repo apple/pkl-lang.org \
+          --ref main \
+          --field source_run="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+          main.yml

.github/workflows/release.yml

@@ -0,0 +1,939 @@
+# Generated from Workflow.pkl. DO NOT EDIT.
+name: Release
+'on':
+  push:
+    branches-ignore:
+    - '**'
+    tags:
+    - '**'
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+permissions:
+  contents: read
+jobs:
+  gradle-check:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: check
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-check
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-check
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  gradle-check-windows:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: check
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-check-windows
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-check-windows
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  bench:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: bench:jmh
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true bench:jmh
+  gradle-compatibility:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-compatibility
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-compatibility
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  java-executables-release:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - name: gradle build java executables
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-java
+        path: '*/build/executable/**/*'
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-java-executables-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-java-executables-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-macOS-amd64-release:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-amd64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-amd64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-linux-amd64-release:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-linux-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-linux-amd64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-linux-amd64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-cli-macOS-aarch64-release:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-aarch64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-aarch64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-linux-aarch64-release:
+    runs-on: ubuntu-24.04-arm
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-linux-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-linux-aarch64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-linux-aarch64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-cli-alpine-linux-amd64-release:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Install musl and zlib
+      run: |
+        set -e
+        mkdir -p ~/staticdeps/
+
+        ZLIB_VERSION="1.2.13"
+        MUSL_VERSION="1.2.5"
+
+        # install zlib
+        if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
+          # Download zlib tarball and signature
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" -o /tmp/zlib.tar.gz
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz.asc" -o /tmp/zlib.tar.gz.asc
+
+          # Import zlib GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 5ED46A6721D365587791E2AA783FCD8E58BCAFBA
+
+          # Verify GPG signature
+          echo "Verifying zlib GPG signature..."
+          gpg --verify /tmp/zlib.tar.gz.asc /tmp/zlib.tar.gz
+
+          mkdir -p "/tmp/dep_zlib-${ZLIB_VERSION}"
+          cd "/tmp/dep_zlib-${ZLIB_VERSION}"
+          # shellcheck disable=SC2002
+          cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "zlib-${ZLIB_VERSION}: configure..." 
+          ./configure --static --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "zlib-${ZLIB_VERSION}: make..." 
+          make -s -j4
+
+          echo "zlib-${ZLIB_VERSION}: make install..." 
+          make -s install
+
+          rm -rf /tmp/dep_zlib-${ZLIB_VERSION}
+        fi
+
+        # install musl
+        if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
+          # Download musl tarball and signature
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz" -o /tmp/musl.tar.gz
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz.asc" -o /tmp/musl.tar.gz.asc
+
+          # Import musl GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 836489290BB6B70F99FFDA0556BCDB593020450F
+
+          # Verify GPG signature
+          echo "Verifying musl GPG signature..."
+          gpg --verify /tmp/musl.tar.gz.asc /tmp/musl.tar.gz
+
+          mkdir -p "/tmp/dep_musl-${MUSL_VERSION}"
+          cd "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # shellcheck disable=SC2002
+          cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "musl-${MUSL_VERSION}: configure..." 
+          ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "musl-${MUSL_VERSION}: make..." 
+          make -s -j4
+
+          echo "musl-${MUSL_VERSION}: make install..." 
+          make -s install
+
+          rm -rf "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # native-image expects to find an executable at this path.
+          ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
+        fi
+
+        echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.musl=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-alpine-linux-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-alpine-linux-amd64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-alpine-linux-amd64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-windows-amd64-release:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-windows-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-windows-amd64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-windows-amd64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-macOS-amd64-release:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.targetArch=amd64 -Dpkl.native--native-compiler-path=${{ github.workspace }}/.github/scripts/cc_macos_amd64.sh pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-amd64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-amd64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-linux-amd64-release:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-linux-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-linux-amd64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-linux-amd64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-doc-macOS-aarch64-release:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-aarch64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-aarch64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-linux-aarch64-release:
+    runs-on: ubuntu-24.04-arm
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-linux-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-linux-aarch64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-linux-aarch64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-doc-alpine-linux-amd64-release:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: Install musl and zlib
+      run: |
+        set -e
+        mkdir -p ~/staticdeps/
+
+        ZLIB_VERSION="1.2.13"
+        MUSL_VERSION="1.2.5"
+
+        # install zlib
+        if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
+          # Download zlib tarball and signature
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" -o /tmp/zlib.tar.gz
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz.asc" -o /tmp/zlib.tar.gz.asc
+
+          # Import zlib GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 5ED46A6721D365587791E2AA783FCD8E58BCAFBA
+
+          # Verify GPG signature
+          echo "Verifying zlib GPG signature..."
+          gpg --verify /tmp/zlib.tar.gz.asc /tmp/zlib.tar.gz
+
+          mkdir -p "/tmp/dep_zlib-${ZLIB_VERSION}"
+          cd "/tmp/dep_zlib-${ZLIB_VERSION}"
+          # shellcheck disable=SC2002
+          cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "zlib-${ZLIB_VERSION}: configure..." 
+          ./configure --static --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "zlib-${ZLIB_VERSION}: make..." 
+          make -s -j4
+
+          echo "zlib-${ZLIB_VERSION}: make install..." 
+          make -s install
+
+          rm -rf /tmp/dep_zlib-${ZLIB_VERSION}
+        fi
+
+        # install musl
+        if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
+          # Download musl tarball and signature
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz" -o /tmp/musl.tar.gz
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz.asc" -o /tmp/musl.tar.gz.asc
+
+          # Import musl GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 836489290BB6B70F99FFDA0556BCDB593020450F
+
+          # Verify GPG signature
+          echo "Verifying musl GPG signature..."
+          gpg --verify /tmp/musl.tar.gz.asc /tmp/musl.tar.gz
+
+          mkdir -p "/tmp/dep_musl-${MUSL_VERSION}"
+          cd "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # shellcheck disable=SC2002
+          cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "musl-${MUSL_VERSION}: configure..." 
+          ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "musl-${MUSL_VERSION}: make..." 
+          make -s -j4
+
+          echo "musl-${MUSL_VERSION}: make install..." 
+          make -s install
+
+          rm -rf "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # native-image expects to find an executable at this path.
+          ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
+        fi
+
+        echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.musl=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-alpine-linux-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-alpine-linux-amd64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-alpine-linux-amd64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-windows-amd64-release:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-windows-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-windows-amd64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-windows-amd64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  deploy-release:
+    needs:
+    - gradle-check
+    - gradle-check-windows
+    - bench
+    - gradle-compatibility
+    - java-executables-release
+    - pkl-cli-macOS-amd64-release
+    - pkl-cli-linux-amd64-release
+    - pkl-cli-macOS-aarch64-release
+    - pkl-cli-linux-aarch64-release
+    - pkl-cli-alpine-linux-amd64-release
+    - pkl-cli-windows-amd64-release
+    - pkl-doc-macOS-amd64-release
+    - pkl-doc-linux-amd64-release
+    - pkl-doc-macOS-aarch64-release
+    - pkl-doc-linux-aarch64-release
+    - pkl-doc-alpine-linux-amd64-release
+    - pkl-doc-windows-amd64-release
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    environment: maven-release
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5
+      with:
+        java-version: '21'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5
+      with: {}
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+      with:
+        pattern: executable-**
+        merge-multiple: true
+    - env:
+        ORG_GRADLE_PROJECT_signingKeyId: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGKEYID }}
+        ORG_GRADLE_PROJECT_signingKey: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGKEY }}
+        ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGPASSWORD }}
+        ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.ORG_GRADLE_PROJECT_SONATYPEPASSWORD }}
+        ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.ORG_GRADLE_PROJECT_SONATYPEUSERNAME }}
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true publishToSonatype closeAndReleaseSonatypeStagingRepository
+  github-release:
+    needs: deploy-release
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+      with:
+        pattern: executable-**
+        merge-multiple: true
+    - name: Publish release on GitHub
+      env:
+        GH_TOKEN: ${{ github.token }}
+        TAG_NAME: ${{ github.ref_name }}
+        GIT_SHA: ${{ github.sha }}
+        GH_REPO: ${{ github.repository }}
+      run: |-
+        # exclude build_artifacts.txt from publish
+        rm -f */build/executable/*.build_artifacts.txt
+        find */build/executable/* -type d | xargs rm -rf
+        gh release create ${TAG_NAME} \
+          --title "${TAG_NAME}" \
+          --target "${GIT_SHA}" \
+          --verify-tag \
+          --notes "Release notes: https://pkl-lang.org/main/current/release-notes/changelog.html#release-${TAG_NAME}" \
+          */build/executable/*
+  publish-test-results:
+    if: '!cancelled()'
+    needs:
+    - gradle-check
+    - gradle-check-windows
+    - gradle-compatibility
+    - java-executables-release
+    - pkl-cli-macOS-amd64-release
+    - pkl-cli-linux-amd64-release
+    - pkl-cli-macOS-aarch64-release
+    - pkl-cli-linux-aarch64-release
+    - pkl-cli-alpine-linux-amd64-release
+    - pkl-cli-windows-amd64-release
+    - pkl-doc-macOS-amd64-release
+    - pkl-doc-linux-amd64-release
+    - pkl-doc-macOS-aarch64-release
+    - pkl-doc-linux-aarch64-release
+    - pkl-doc-alpine-linux-amd64-release
+    - pkl-doc-windows-amd64-release
+    permissions:
+      checks: write
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+      with:
+        pattern: test-results-xml-*
+    - name: Publish test results
+      if: '!cancelled()'
+      uses: EnricoMi/publish-unit-test-result-action@27d65e188ec43221b20d26de30f4892fad91df2f # v2
+      with:
+        comment_mode: 'off'
+        files: test-results-xml-*/**/*.xml
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-publish-test-results
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  trigger-downstream-builds:
+    if: github.repository_owner == 'apple'
+    needs:
+    - gradle-check
+    - gradle-check-windows
+    - bench
+    - gradle-compatibility
+    - java-executables-release
+    - pkl-cli-macOS-amd64-release
+    - pkl-cli-linux-amd64-release
+    - pkl-cli-macOS-aarch64-release
+    - pkl-cli-linux-aarch64-release
+    - pkl-cli-alpine-linux-amd64-release
+    - pkl-cli-windows-amd64-release
+    - pkl-doc-macOS-amd64-release
+    - pkl-doc-linux-amd64-release
+    - pkl-doc-macOS-aarch64-release
+    - pkl-doc-linux-aarch64-release
+    - pkl-doc-alpine-linux-amd64-release
+    - pkl-doc-windows-amd64-release
+    - deploy-release
+    - github-release
+    - publish-test-results
+    runs-on: ubuntu-latest
+    steps:
+    - name: Create app token
+      id: app-token
+      uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
+      with:
+        app-id: ${{ secrets.PKL_CI_CLIENT_ID }}
+        private-key: ${{ secrets.PKL_CI }}
+        owner: ${{ github.repository_owner }}
+    - name: Trigger pkl-lang.org build
+      env:
+        GH_TOKEN: ${{ steps.app-token.outputs.token }}
+      run: |-
+        gh workflow run \
+          --repo apple/pkl-lang.org \
+          --ref main \
+          --field source_run="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+          main.yml

.github/workflows/test_report.yml

@@ -0,0 +1,34 @@
+# Generated from Workflow.pkl. DO NOT EDIT.
+name: PR Test Reports
+'on':
+  workflow_run:
+    types:
+    - completed
+    workflows:
+    - Pull Request
+permissions:
+  contents: read
+jobs:
+  test-results:
+    name: Test Results
+    if: github.event.workflow_run.conclusion == 'success' || github.event.workflow_run.conclusion == 'failure'
+    permissions:
+      actions: read
+      checks: write
+    runs-on: ubuntu-latest
+    steps:
+    - name: Download artifacts
+      uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
+      with:
+        path: artifacts
+        name: test-results-.*
+        name_is_regexp: true
+        run_id: ${{ github.event.workflow_run.id }}
+    - name: Publish test results
+      uses: EnricoMi/publish-unit-test-result-action@27d65e188ec43221b20d26de30f4892fad91df2f # v2
+      with:
+        commit: ${{ github.event.workflow_run.head_sha }}
+        comment_mode: 'off'
+        files: artifacts/**/*.xml
+        event_file: artifacts/test-results-event-file/event.json
+        event_name: ${{ github.event.workflow_run.event }}

.gitignore

@@ -5,15 +5,20 @@
 .gradle/
 build/
 generated/
+testgenerated/
 
 # IntelliJ
 .idea/
+!.idea/icon.svg
 !.idea/codestyles/
 !.idea/inspectionProfiles/
 !.idea/runConfigurations/
 !.idea/scopes/
 !.idea/vcs.xml
+.intellijPlatform/
 
-# :pkl-core:makeIntelliJAntlrPluginHappy
-gen/
-PklLexer.tokens
+.vscode/
+
+.pkl-lsp/
+
+.kotlin/

.idea/codeStyles/Project.xml

@@ -63,6 +63,7 @@
       </option>
       <option name="IMPORT_LAYOUT_TABLE">
         <value>
+          <package name="" withSubpackages="true" static="false" module="true" />
           <package name="" withSubpackages="true" static="true" />
           <emptyLine />
           <package name="" withSubpackages="true" static="false" />

.idea/inspectionProfiles/Project_Default.xml

@@ -15,6 +15,37 @@
     <inspection_tool class="FieldMayBeFinal" enabled="true" level="INFORMATION" enabled_by_default="true">
       <scope name="AllExceptTruffleAst" level="WARNING" enabled="true" />
     </inspection_tool>
+    <inspection_tool class="HttpUrlsUsage" enabled="true" level="WEAK WARNING" enabled_by_default="true">
+      <option name="ignoredUrls">
+        <list>
+          <option value="http://" />
+          <option value="http://0.0.0.0" />
+          <option value="http://127.0.0.1" />
+          <option value="http://activemq.apache.org/schema/" />
+          <option value="http://cxf.apache.org/schemas/" />
+          <option value="http://java.sun.com/" />
+          <option value="http://javafx.com/fxml" />
+          <option value="http://javafx.com/javafx/" />
+          <option value="http://json-schema.org/draft" />
+          <option value="http://localhost" />
+          <option value="http://maven.apache.org/POM/" />
+          <option value="http://maven.apache.org/xsd/" />
+          <option value="http://primefaces.org/ui" />
+          <option value="http://schema.cloudfoundry.org/spring/" />
+          <option value="http://schemas.xmlsoap.org/" />
+          <option value="http://tiles.apache.org/" />
+          <option value="http://www.ibm.com/webservices/xsd" />
+          <option value="http://www.jboss.com/xml/ns/" />
+          <option value="http://www.jboss.org/j2ee/schema/" />
+          <option value="http://www.springframework.org/schema/" />
+          <option value="http://www.springframework.org/security/tags" />
+          <option value="http://www.springframework.org/tags" />
+          <option value="http://www.thymeleaf.org" />
+          <option value="http://www.w3.org/" />
+          <option value="http://xmlns.jcp.org/" />
+        </list>
+      </option>
+    </inspection_tool>
     <inspection_tool class="JavadocBlankLines" enabled="false" level="WARNING" enabled_by_default="false" />
     <inspection_tool class="NullableProblems" enabled="true" level="WARNING" enabled_by_default="false">
       <scope name="AllExceptGenerated" level="WARNING" enabled="true">
@@ -43,4 +74,4 @@
       <option name="processComments" value="true" />
     </inspection_tool>
   </profile>
-</component>
+</component>

.idea/scopes/AllExceptTruffleAst.xml

@@ -1,3 +1,3 @@
 <component name="DependencyValidationManager">
-  <scope name="AllExceptTruffleAst" pattern="(src:*..*||test:*..*||lib:*..*)&amp;&amp;!src[pkl.pkl-core.main]:com.apple.pkl.core.ast..*&amp;&amp;!src[pkl.pkl-core.main]:com.apple.pkl.core.stdlib..*Nodes" />
+  <scope name="AllExceptTruffleAst" pattern="(src:*..*||test:*..*||lib:*..*)&amp;&amp;!src[pkl.pkl-core.main]:org.pkl.core.ast..*&amp;&amp;!src[pkl.pkl-core.main]:org.pkl.core.stdlib..*Nodes" />
 </component>

.java-version

@@ -1 +1 @@
-17.0
+21

.mailmap

@@ -0,0 +1,2 @@
+Jen Basch <421772+HT154@users.noreply.github.com>
+Jen Basch <jbasch@apple.com>

CODE_OF_CONDUCT.md

@@ -1,6 +1,6 @@
-== Code of Conduct
+## Code of Conduct
 
-=== Our Pledge
+### Our Pledge
 
 In the interest of fostering an open and welcoming environment, we as
 contributors and maintainers pledge to making participation in our
@@ -10,7 +10,7 @@ characteristics, gender identity and expression, level of experience,
 education, socio-economic status, nationality, personal appearance,
 race, religion, or sexual identity and orientation.
 
-=== Our Standards
+### Our Standards
 
 Examples of behavior that contributes to creating a positive environment
 include:
@@ -33,7 +33,7 @@ electronic address, without explicit permission
 * Other conduct which could reasonably be considered inappropriate in a
 professional setting
 
-=== Our Responsibilities
+### Our Responsibilities
 
 Project maintainers are responsible for clarifying the standards of
 acceptable behavior and are expected to take appropriate and fair
@@ -45,7 +45,7 @@ contributions that are not aligned to this Code of Conduct, or to ban
 temporarily or permanently any contributor for other behaviors that they
 deem inappropriate, threatening, offensive, or harmful.
 
-=== Scope
+### Scope
 
 This Code of Conduct applies within all project spaces, and it also
 applies when an individual is representing the project or its community
@@ -55,7 +55,7 @@ official social media account, or acting as an appointed representative
 at an online or offline event. Representation of a project may be
 further defined and clarified by project maintainers.
 
-=== Enforcement
+### Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may
 be reported by contacting the open source team at
@@ -70,9 +70,8 @@ Project maintainers who do not follow or enforce the Code of Conduct in
 good faith may face temporary or permanent repercussions as determined
 by other members of the project’s leadership.
 
-=== Attribution
+### Attribution
 
 This Code of Conduct is adapted from the
-https://www.contributor-covenant.org[Contributor Covenant], version 1.4,
-available at
-https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+[Contributor Covenant](https://www.contributor-covenant.org), version 1.4, 
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html

DEVELOPMENT.adoc

@@ -2,20 +2,22 @@
 :uri-gng: https://gng.dsun.org
 :uri-jenv: https://www.jenv.be
 :uri-intellij: https://www.jetbrains.com/idea/download/
-:uri-jdk: https://adoptopenjdk.net/releases.html
+:uri-native-prerequisites-linux: https://www.graalvm.org/latest/getting-started/linux/#prerequisites-for-native-image-on-linux
+:uri-native-prerequisites-windows: https://www.graalvm.org/latest/getting-started/windows/#prerequisites-for-native-image-on-windows
 
 == Setup
 
-. (mandatory) Install {uri-jdk}[OpenJDK 11 HotSpot] (as long as we support JDK11)
-. (mandatory) Setup Gradle on your system
-. (recommended) Install {uri-intellij}[IntelliJ IDEA 2023.x] +
+. (mandatory) Install a JDK (JDK 21+ required).
+. (recommended) Install {uri-intellij}[IntelliJ IDEA] +
 To import the project into IntelliJ, go to File->Open and select the project's root directory.
 If the project is opened but not imported, look for a popup in the lower right corner
 and click its "Import Gradle Project" link.
 . (recommended) Install {uri-gng}[gng] +
 _gng_ enables to run Gradle commands with `gw` (instead of `./gradlew`) from any subdirectory.
+. (recommended) Set up Git ignore-revs +
+`git config blame.ignoreRevsFile .git-blame-ignore-revs`
 . (recommended) Install {uri-jenv}[jenv] and plugins +
-_jenv_ use specific JDK versions in certain subdirectories. _Pkl_ comes with a `.java-version` file specifying JDK 17. +
+_jenv_ use specific JDK versions in certain subdirectories. _Pkl_ comes with a `.java-version` file specifying JDK 21. +
 Enable _jenv_ plugins for better handling by `gradle`:
 +
 [source,shell]
@@ -23,20 +25,38 @@ Enable _jenv_ plugins for better handling by `gradle`:
 jenv enable-plugin gradle
 jenv enable-plugin export
 ----
+. (optional) If you've named the original apple/pkl git repository something other than `origin`, set env var `PKL_ORIGINAL_REMOTE_NAME` to that name in your `.bashrc`, `.zshrc`, `config.fish` or however you manage your local environment.
++
+This will allow spotless to pick the correct starting branch when formatting source code files.
+Otherwise, you might see that _every_ file has its copyright year updated.
+
+=== Additional Linux Setup
+. (optional) To build the native executable (`./gradlew buildNative`),
+install {uri-native-prerequisites-linux}[Prerequisites For Native Image on Linux].
+
+=== Additional Windows Setup
+. (optional) Go to `System->For developers` and enable `Developer Mode`.
+Otherwise, some tests may fail due to insufficient file system privileges.
+. (optional) To build the native executable (`./gradlew buildNative`), 
+install {uri-native-prerequisites-windows}[Prerequisites For Native Image on Windows].
 
 == Common Build Commands
 
 [source,shell]
 ----
 gw clean
-gw test
-gw build         # build everything except native executables
-gw buildNative   # build macOS executable on macOS,
-                 # Linux and Alpine executables on Linux
-gw pkldoc        # generate standard library docs
+gw test                 # run all tests except native executable tests
+gw spotlessApply        # fix code formatting
+gw build                # build everything except native executables
+gw pkl-cli:testNative   # run native executable tests
+gw pkl-cli:buildNative  # build native executable for current platform
 
-pkl-cli/build/executable/jpkl                # run Java executable
-pkl-cli/build/executable/pkl-macos-amd64     # run Mac executable
+pkl-cli/build/executable/jpkl                   # run Java executable
+pkl-cli/build/executable/pkl-macos-aarch64      # run Mac executable
+pkl-cli/build/executable/pkl-macos-amd64        # run Intel Mac executable
+pkl-cli/build/executable/pkl-linux-amd64        # run Linux executable
+pkl-cli/build/executable/pkl-alpine-linux-amd64 # run Alpine Linux executable 
+pkl-cli/build/executable/pkl-windows-amd64.exe  # run Windows executable 
 ----
 
 == Update Gradle
@@ -62,16 +82,28 @@ based on version information from https://search.maven.org, https://plugins.grad
 
 * Truffle code generation is performed by Truffle's annotation processor, which runs as part of task `:pkl-core:compileJava`
 ** Output dir is `generated/truffle/`
-* ANTLR code generation is performed by task `:pkl-core:generateGrammarSource`
-** Output dir is `generated/antlr/`
+
+== Remote JVM Debugging
+
+To enable remote JVM debugging when running Gradle tasks (e.g. test), add the flag `-Djvmdebug=true`.
+This will listen on port 5005.
+
+Example: `./gradlew test -Djvmdebug=true`
+
+== Snippet Test Plugin
+
+There is an IntelliJ plugin meant for development on the Pkl project itself.
+This plugin provides a split pane window when viewing snippet tests such as LanguageSnippetTests and FormatterSnippetTests.
+
+To install:
+
+1. Run `./gradlew pkl-internal-intellij-plugin:buildPlugin`.
+2. Within IntelliJ, run the action "Install Plugin From Disk...".
+3. Select the zip file within `pkl-internal-intellij-plugin/build/distributions`.
 
 == Resources
 
-=== ANTLR
-
-* https://github.com/antlr/antlr4/blob/main/doc/index.md[Documentation]
-* https://groups.google.com/forum/#!forum/antlr-discussion[Forums]
-* https://github.com/mobileink/lab.clj.antlr/tree/main/doc[Some third-party docs]
+For automated build setup examples see our https://github.com/apple/pkl/blob/main/.github/[GitHub Actions] jobs like our https://github.com/apple/pkl/blob/main/.github/jobs/BuildNativeJob.pkl[BuildNativeJob.pkl], where we build Pkl automatically.
 
 === Truffle
 

MAINTAINERS.adoc

@@ -8,4 +8,5 @@ See link:CONTRIBUTING.adoc[] for general contribution guidelines.
 
 * https://github.com/bioball[Daniel Chao]
 * https://github.com/stackoverflow[Islon Scherer]
+* https://github.com/HT154[Jen Basch]
 * https://github.com/holzensp[Philip Hölzenspies]

NOTICE.txt

@@ -1,4 +1,4 @@
-Copyright © 2024 Apple Inc. and the Pkl project authors
+Copyright © 2024-2025 Apple Inc. and the Pkl project authors
 
 
 Portions of this software were originally based on 'SnakeYAML' developed by Andrey Somov.

README.adoc

@@ -1,4 +1,4 @@
-= Pkl
+= image:.idea/icon.svg[Pkl,30] Pkl 
 
 :uri-homepage: https://pkl-lang.org
 :uri-docs: {uri-homepage}/main/current
@@ -11,6 +11,8 @@
 :uri-pkl-examples: https://pkl-lang.org/main/current/examples.html
 :uri-installation: https://pkl-lang.org/main/current/pkl-cli/index.html#installation
 :uri-lang-reference: https://pkl-lang.org/main/current/language-reference/index.html
+:uri-ci-artifacts: https://s01.oss.sonatype.org/content/groups/public/org/pkl-lang/
+:uri-ci-pipeline: https://github.com/apple/pkl/actions
 
 A configuration as code language with rich validation and tooling.
 
@@ -34,3 +36,87 @@ We'd love to hear from you!
 
 * Create an {uri-github-issue}[issue]
 * Ask a question on {uri-github-discussions}[GitHub Discussions]
+
+== Development
+
+image:https://github.com/apple/pkl/actions/workflows/main.yml/badge.svg?style=svg["Build (main)", link="https://github.com/apple/pkl/actions/workflows/main.yml"]
+
+* link:CONTRIBUTING.adoc[] for tips on pull requests and filing issues
+* link:DEVELOPMENT.adoc[] for build instructions
+* {uri-ci-artifacts}[Sonatype Repository] for the artifacts/binaries built by our {uri-ci-pipeline}[CI pipelines] (and those of our other tools and packages repositories).
+
+== Pkl GitHub Repositories
+
+[%autowidth]
+|===
+|Name |Description
+
+|`apple/pkl`
+|A configuration as code language with rich validation and tooling.
+
+|https://github.com/apple/pkl-evolution[`apple/pkl-evolution`]
+|Suggested Pkl Improvements, Changes, or Enhancements (SPICEs)
+
+|https://github.com/apple/pkl-go[`apple/pkl-go`]
+|Pkl bindings for the Go programming language
+
+|https://github.com/apple/pkl-go-examples[`apple/pkl-go-examples`]
+|Examples for using Pkl within Go applications
+
+|https://github.com/apple/highlightjs-pkl[`apple/highlightjs-pkl`]
+|Highlight.js syntax highlighting for Pkl
+
+|https://github.com/apple/pkl-intellij[`apple/pkl-intellij`]
+|JetBrains editor plugins providing Pkl language support
+
+|https://github.com/apple/pkl-jvm-examples[`apple/pkl-jvm-examples`]
+|Examples for using Pkl within JVM applications
+
+|https://github.com/apple/pkl-k8s[`apple/pkl-k8s`]
+|Templates for using Pkl with Kubernetes
+
+|https://github.com/apple/pkl-k8s-examples[`apple/pkl-k8s-examples`]
+|Examples for using Pkl with Kubernetes
+
+|https://github.com/apple/pkl-lang.org[`apple/pkl-lang.org`]
+|The pkl-lang.org website
+
+|https://github.com/apple/pkl-lsp[`apple/pkl-lsp`]
+|Language server for Pkl, implementing the server-side of the Language Server Protocol
+
+|https://github.com/apple/pkl-neovim[`apple/pkl-neovim`]
+|Pkl language support for Neovim
+
+|https://github.com/apple/pkl-package-docs[`apple/pkl-package-docs`]
+|Documentation for Pkl packages
+
+|https://github.com/apple/pkl-pantry[`apple/pkl-pantry`]
+|Shared Pkl packages
+
+|https://github.com/apple/pkl-project-commons[`apple/pkl-project-commons`]
+|Utility libraries for Pkl
+
+|https://github.com/apple/pkl-readers[`apple/pkl-readers`]
+|Shared Pkl https://pkl-lang.org/main/current/language-reference/index.html#external-readers[external reader] tools
+
+|https://github.com/apple/pkl-spring[`apple/pkl-spring`]
+|Spring Boot extension for configuring Boot apps with Pkl
+
+|https://github.com/apple/pkl-swift[`apple/pkl-swift`]
+|Pkl bindings for the Swift programming language
+
+|https://github.com/apple/pkl-swift-examples[`apple/pkl-swift-examples`]
+|Examples for using Pkl within Swift applications
+
+|https://github.com/apple/pkl-vscode[`apple/pkl-vscode`]
+|Pkl language support for VS Code
+
+|https://github.com/apple/pkl.tmbundle[`apple/pkl.tmbundle`]
+|TextMate bundle for Pkl
+
+|https://github.com/apple/tree-sitter-pkl[`apple/tree-sitter-pkl`]
+|Tree-sitter parser for Pkl
+
+|https://github.com/apple/rules_pkl[`apple/rules_pkl`]
+|Bazel build rules for Pkl
+|===

SECURITY.md

@@ -1,13 +1,13 @@
-= Security
+# Security
 
 For the protection of our community, the Pkl team does not disclose, discuss, or confirm security issues until our investigation is complete and any necessary updates are generally available.
 
-== Reporting a security vulnerability
+## Reporting a security vulnerability
 
 If you have discovered a security vulnerability within the Pkl project, please report it to us.
 We welcome reports from everyone, including security researchers, developers, and users.
 
-Security vulnerabilities may be reported on the link:https://security.apple.com/submit[Report a vulnerability] form.
+Security vulnerabilities may be reported on the [Report a vulnerability](https://security.apple.com/submit) form.
 When submitting a vulnerability, select "Apple Devices and Software" as the affected platform, and "Open Source" as the affected area.
 
 For more information, see https://pkl-lang.org/security.html.

THIRD-PARTY-NOTICES.txt

@@ -26,18 +26,7 @@ Copyright © 2017 Square, Inc.
 Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License.You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
 
-4) ANTLR 4 Runtime (Optimized) (http://tunnelvisionlabs.com)
-POM License: The BSD License - http://www.antlr.org/license.html
-
-Copyright (c) 2012 Terence Parr and Sam Harwell
-All rights reserved.
-Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
-Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
-Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
-Neither the name of the author nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-5) GeantyRef (https://github.com/leangen/geantyref)
+4) GeantyRef (https://github.com/leangen/geantyref)
 Manifest license URL: https://www.apache.org/licenses/LICENSE-2.0
 
 POM License: Apache License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0
@@ -47,7 +36,7 @@ Copyright © 2017 Kaqqao
 Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License.You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
 
-6) commonmark-java core
+5) commonmark-java core
 POM License: The 2-Clause BSD License - https://opensource.org/licenses/BSD-2-Clause
 
 Embedded license: 
@@ -78,7 +67,7 @@ CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-7) commonmark-java extension for tables
+6) commonmark-java extension for tables
 POM License: The 2-Clause BSD License - https://opensource.org/licenses/BSD-2-Clause
 
 Embedded license: 
@@ -109,7 +98,7 @@ CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-8) jansi (http://fusesource.com/)
+7) jansi (http://fusesource.com/)
 Manifest license URL: https://www.apache.org/licenses/LICENSE-2.0
 
 POM License: Apache License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0
@@ -119,13 +108,13 @@ Copyright © Fusesource 2023
 Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License.You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
 
-9) Graal Sdk (https://github.com/oracle/graal)
+8) Graal Sdk (https://github.com/oracle/graal)
 POM License: Universal Permissive License, Version 1.0 - http://opensource.org/licenses/UPL
 
-10) Truffle API (http://openjdk.java.net/projects/graal)
+9) Truffle API (http://openjdk.java.net/projects/graal)
 POM License: Universal Permissive License, Version 1.0 - http://opensource.org/licenses/UPL
 
-11) IntelliJ IDEA Annotations (http://www.jetbrains.org)
+10) IntelliJ IDEA Annotations (http://www.jetbrains.org)
 POM License: Apache License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0
 
 The Apache License
@@ -133,7 +122,7 @@ Copyright © Jetbrains 2023
 Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License.You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
 
-12) kotlin-reflect (https://kotlinlang.org/)
+11) kotlin-reflect (https://kotlinlang.org/)
 POM License: Apache License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0
 
 The Apache License
@@ -141,7 +130,7 @@ Copyright © Wuseal 2018
 Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License.You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
 
-13) kotlin-stdlib (https://kotlinlang.org/)
+12) kotlin-stdlib (https://kotlinlang.org/)
 POM License: Apache License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0
 
 The Apache License
@@ -149,7 +138,7 @@ Copyright © 2010-2023 JetBrains s.r.o. and Kotlin Programming Language contribu
 Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License.You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
 
-14) kotlin-stdlib-common (https://kotlinlang.org/)
+13) kotlin-stdlib-common (https://kotlinlang.org/)
 POM License: Apache License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0
 
 The Apache License
@@ -157,7 +146,7 @@ Copyright © 2023 Kotlin Team
 Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License.You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
 
-15) kotlin-stdlib-jdk7 (https://kotlinlang.org/)
+14) kotlin-stdlib-jdk7 (https://kotlinlang.org/)
 POM License: Apache License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0
 
 The Apache License
@@ -165,7 +154,7 @@ Copyright © 2023 Kotlin Team
 Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License.You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
 
-16) kotlin-stdlib-jdk8 (https://kotlinlang.org/)
+15) kotlin-stdlib-jdk8 (https://kotlinlang.org/)
 POM License: Apache License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0
 
 The Apache License
@@ -173,7 +162,7 @@ Copyright © 2023 Kotlin Team
 Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License.You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
 
-17) kotlinx.html (https://github.com/Kotlin/kotlinx.html)
+16) kotlinx.html (https://github.com/Kotlin/kotlinx.html)
 POM License: Apache License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0
 
 The Apache License
@@ -181,7 +170,7 @@ Copyright © 2017 Yole
 Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License.You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
 
-18) kotlinx-serialization-core (https://github.com/Kotlin/kotlinx.serialization)
+17) kotlinx-serialization-core (https://github.com/Kotlin/kotlinx.serialization)
 POM License: Apache License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0
 
 The Apache License
@@ -189,7 +178,7 @@ The Apache License
 Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License.You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
 
-19) kotlinx-serialization-json (https://github.com/Kotlin/kotlinx.serialization)
+18) kotlinx-serialization-json (https://github.com/Kotlin/kotlinx.serialization)
 POM License: Apache License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0
 
 The Apache License
@@ -197,7 +186,7 @@ The Apache License
 Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License.You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
 
-20) JLine Reader
+19) JLine Reader
 Manifest license URL: https://opensource.org/licenses/BSD-3-Clause
 
 POM License: The 3-Clause BSD License - https://opensource.org/licenses/BSD-3-Clause
@@ -216,7 +205,7 @@ software without specific prior written permission.
 
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-21) JLine Terminal
+20) JLine Terminal
 Manifest license URL: https://opensource.org/licenses/BSD-3-Clause
 
 POM License: The 3-Clause BSD License - https://opensource.org/licenses/BSD-3-Clause
@@ -235,7 +224,7 @@ software without specific prior written permission.
 
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-22) JLine JANSI Terminal
+21) JLine JANSI Terminal
 Manifest license URL: https://opensource.org/licenses/BSD-3-Clause
 
 POM License: The 3-Clause BSD License - https://opensource.org/licenses/BSD-3-Clause
@@ -254,7 +243,7 @@ software without specific prior written permission.
 
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-23) msgpack-core (https://msgpack.org/)
+22) msgpack-core (https://msgpack.org/)
 POM License: Apache License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0
 
 The Apache License
@@ -262,7 +251,7 @@ Copyright © 2016 Sadayuki Furuhashi, Muga Nishizawa, Taro L. Saito, Mitsunori K
 Licensed under the Apache License, Version 2.0 (the “License”); you may not use this file except in compliance with the License.You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. 
 
-24) Paguro (https://github.com/GlenKPeterson/Paguro)
+23) Paguro (https://github.com/GlenKPeterson/Paguro)
 POM License: Apache License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0
 
 The Apache License
@@ -364,7 +353,7 @@ Everyone is permitted to copy and distribute copies of this Agreement, but in or
 
 This Agreement is governed by the laws of the State of New York and the intellectual property laws of the United States of America. No party to this Agreement will bring a legal action under this Agreement more than one year after the cause of action arose. Each party waives its rights to a jury trial in any resulting litigation.
 
-25) SnakeYAML Engine (http://www.snakeyaml.org)
+24) SnakeYAML Engine (http://www.snakeyaml.org)
 Manifest license URL: https://www.apache.org/licenses/LICENSE-2.0
 
 POM License: Apache License, Version 2.0 - https://www.apache.org/licenses/LICENSE-2.0

bench/bench.gradle.kts

@@ -1,31 +1,45 @@
+/*
+ * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 plugins {
   pklAllProjects
   pklJavaLibrary
-  pklGraalVm
   id("me.champeau.jmh")
 }
 
 val truffle: Configuration by configurations.creating
 val graal: Configuration by configurations.creating
 
-@Suppress("UnstableApiUsage")
 dependencies {
-  jmh(project(":pkl-core"))
-  // necessary because antlr4-runtime is declared as implementation dependency in pkl-core.gradle
-  jmh(libs.antlrRuntime)
+  jmh(projects.pklCore)
+  jmh(projects.pklCommonsTest)
+  jmh(projects.pklParser)
   truffle(libs.truffleApi)
   graal(libs.graalCompiler)
 }
 
 jmh {
-  //include = ["fib_class_java"]
-  //include = ["fib_class_constrained1", "fib_class_constrained2"]
+  // include = ["fib_class_java"]
+  // include = ["fib_class_constrained1", "fib_class_constrained2"]
   jmhVersion.set(libs.versions.jmh)
   // jvmArgsAppend = "-Dgraal.TruffleCompilationExceptionsAreFatal=true " +
   //  "-Dgraal.Dump=Truffle,TruffleTree -Dgraal.TraceTruffleCompilation=true " +
   //  "-Dgraal.TruffleFunctionInlining=false"
-  jvm.set("${buildInfo.graalVm.baseDir}/bin/java")
-  // see: https://docs.oracle.com/en/graalvm/enterprise/20/docs/graalvm-as-a-platform/implement-language/#disable-class-path-separation
+  jvm.set("${buildInfo.graalVmAmd64.baseDir}/bin/java")
+  // see:
+  // https://docs.oracle.com/en/graalvm/enterprise/20/docs/graalvm-as-a-platform/implement-language/#disable-class-path-separation
   jvmArgs.set(
     listOf(
       // one JVM arg per list element doesn't work, but the following does
@@ -33,16 +47,13 @@ jmh {
     )
   )
   includeTests.set(false)
-  //threads = Runtime.runtime.availableProcessors() / 2 + 1
-  //synchronizeIterations = false
+  // threads = Runtime.runtime.availableProcessors() / 2 + 1
+  // synchronizeIterations = false
 }
 
-tasks.named("jmh") {
-  dependsOn(":installGraalVm")
-}
+tasks.named("jmh") { dependsOn(":installGraalVmAmd64") }
 
 // Prevent this error which occurs when building in IntelliJ:
-// "Entry org/pkl/core/fib_class_typed.pkl is a duplicate but no duplicate handling strategy has been set."
-tasks.processJmhResources {
-  duplicatesStrategy = DuplicatesStrategy.EXCLUDE
-}
+// "Entry org/pkl/core/fib_class_typed.pkl is a duplicate but no duplicate handling strategy has
+// been set."
+tasks.processJmhResources { duplicatesStrategy = DuplicatesStrategy.EXCLUDE }

bench/gradle.lockfile

@@ -1,43 +1,69 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-com.tunnelvisionlabs:antlr4-runtime:4.9.0=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
-net.bytebuddy:byte-buddy:1.12.21=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-net.java.dev.jna:jna:5.6.0=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
+com.github.ben-manes.caffeine:caffeine:2.9.3=swiftExportClasspathResolvable
+com.google.errorprone:error_prone_annotations:2.28.0=swiftExportClasspathResolvable
+io.github.java-diff-utils:java-diff-utils:4.12=kotlinInternalAbiValidation
+io.opentelemetry:opentelemetry-api:1.41.0=swiftExportClasspathResolvable
+io.opentelemetry:opentelemetry-context:1.41.0=swiftExportClasspathResolvable
+net.bytebuddy:byte-buddy:1.17.7=jmh,jmhRuntimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 net.sf.jopt-simple:jopt-simple:5.0.4=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
-org.apache.commons:commons-math3:3.2=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
-org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeOnlyDependenciesMetadata
-org.assertj:assertj-core:3.24.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.graalvm.compiler:compiler:22.3.1=graal
-org.graalvm.sdk:graal-sdk:22.3.1=graal,jmh,jmhRuntimeClasspath,truffle
-org.graalvm.truffle:truffle-api:22.3.1=graal,jmh,jmhRuntimeClasspath,truffle
-org.jetbrains.intellij.deps:trove4j:1.0.20200330=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-compiler-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-daemon-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-klib-commonizer-embeddable:1.7.10=kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-reflect:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-script-runtime:1.7.10=kotlinCompilerClasspath,kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-scripting-common:1.7.10=kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
-org.jetbrains.kotlin:kotlin-scripting-compiler-embeddable:1.7.10=kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
-org.jetbrains.kotlin:kotlin-scripting-compiler-impl-embeddable:1.7.10=kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
-org.jetbrains.kotlin:kotlin-scripting-jvm:1.7.10=kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
-org.jetbrains.kotlin:kotlin-stdlib-common:1.7.10=kotlinCompilerClasspath,kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.7.10=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.7.10=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.jetbrains.kotlin:kotlin-stdlib:1.7.10=kotlinCompilerClasspath,kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.jetbrains:annotations:13.0=kotlinCompilerClasspath,kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.9.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-engine:5.9.3=testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-params:5.9.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.9.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.platform:junit-platform-engine:1.9.3=testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit:junit-bom:5.9.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.openjdk.jmh:jmh-core:1.36=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
-org.openjdk.jmh:jmh-generator-asm:1.36=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
-org.openjdk.jmh:jmh-generator-bytecode:1.36=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
-org.openjdk.jmh:jmh-generator-reflection:1.36=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
-org.opentest4j:opentest4j:1.2.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+org.apache.commons:commons-math3:3.6.1=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
+org.apiguardian:apiguardian-api:1.1.2=jmhCompileClasspath,jmhImplementationDependenciesMetadata,testCompileClasspath,testImplementationDependenciesMetadata
+org.assertj:assertj-core:3.27.6=jmh,jmhRuntimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.bouncycastle:bcpg-jdk18on:1.80=kotlinBouncyCastleConfiguration
+org.bouncycastle:bcpkix-jdk18on:1.80=kotlinBouncyCastleConfiguration
+org.bouncycastle:bcprov-jdk18on:1.80=kotlinBouncyCastleConfiguration
+org.bouncycastle:bcutil-jdk18on:1.80=kotlinBouncyCastleConfiguration
+org.checkerframework:checker-qual:3.43.0=swiftExportClasspathResolvable
+org.graalvm.compiler:compiler:25.0.0=graal
+org.graalvm.polyglot:polyglot:25.0.0=jmh,jmhRuntimeClasspath,truffle
+org.graalvm.sdk:collections:25.0.0=graal,jmh,jmhRuntimeClasspath,truffle
+org.graalvm.sdk:graal-sdk:25.0.0=jmh,jmhRuntimeClasspath
+org.graalvm.sdk:nativeimage:25.0.0=jmh,jmhRuntimeClasspath,truffle
+org.graalvm.sdk:word:25.0.0=graal,jmh,jmhRuntimeClasspath,truffle
+org.graalvm.truffle:truffle-api:25.0.0=jmh,jmhRuntimeClasspath,truffle
+org.graalvm.truffle:truffle-compiler:25.0.0=graal
+org.jetbrains.kotlin:abi-tools-api:2.2.20=kotlinInternalAbiValidation
+org.jetbrains.kotlin:abi-tools:2.2.20=kotlinInternalAbiValidation
+org.jetbrains.kotlin:kotlin-build-tools-api:2.2.20=kotlinBuildToolsApiClasspath
+org.jetbrains.kotlin:kotlin-build-tools-impl:2.2.20=kotlinBuildToolsApiClasspath
+org.jetbrains.kotlin:kotlin-compiler-embeddable:2.2.20=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinInternalAbiValidation,kotlinKlibCommonizerClasspath,swiftExportClasspathResolvable
+org.jetbrains.kotlin:kotlin-compiler-runner:2.2.20=kotlinBuildToolsApiClasspath
+org.jetbrains.kotlin:kotlin-daemon-client:2.2.20=kotlinBuildToolsApiClasspath
+org.jetbrains.kotlin:kotlin-daemon-embeddable:2.2.20=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinInternalAbiValidation,kotlinKlibCommonizerClasspath,swiftExportClasspathResolvable
+org.jetbrains.kotlin:kotlin-klib-commonizer-embeddable:2.2.20=kotlinKlibCommonizerClasspath
+org.jetbrains.kotlin:kotlin-metadata-jvm:2.2.20=kotlinInternalAbiValidation
+org.jetbrains.kotlin:kotlin-native-prebuilt:2.0.21=kotlinNativeBundleConfiguration
+org.jetbrains.kotlin:kotlin-reflect:2.2.20=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinInternalAbiValidation,kotlinKlibCommonizerClasspath,swiftExportClasspathResolvable
+org.jetbrains.kotlin:kotlin-script-runtime:2.2.20=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinInternalAbiValidation,kotlinKlibCommonizerClasspath,swiftExportClasspathResolvable
+org.jetbrains.kotlin:kotlin-scripting-common:2.2.20=kotlinBuildToolsApiClasspath,kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
+org.jetbrains.kotlin:kotlin-scripting-compiler-embeddable:2.2.20=kotlinBuildToolsApiClasspath,kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
+org.jetbrains.kotlin:kotlin-scripting-compiler-impl-embeddable:2.2.20=kotlinBuildToolsApiClasspath,kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
+org.jetbrains.kotlin:kotlin-scripting-jvm:2.2.20=kotlinBuildToolsApiClasspath,kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
+org.jetbrains.kotlin:kotlin-stdlib-jdk7:2.2.20=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.jetbrains.kotlin:kotlin-stdlib-jdk8:2.2.20=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.jetbrains.kotlin:kotlin-stdlib:2.2.20=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath,kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinInternalAbiValidation,kotlinKlibCommonizerClasspath,swiftExportClasspathResolvable,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.jetbrains.kotlin:swift-export-embeddable:2.2.20=swiftExportClasspathResolvable
+org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.8.0=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinInternalAbiValidation,kotlinKlibCommonizerClasspath,swiftExportClasspathResolvable
+org.jetbrains.kotlinx:kotlinx-serialization-bom:1.7.3=swiftExportClasspathResolvable
+org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:1.7.3=swiftExportClasspathResolvable
+org.jetbrains.kotlinx:kotlinx-serialization-core:1.7.3=swiftExportClasspathResolvable
+org.jetbrains:annotations:13.0=jmh,jmhCompileClasspath,jmhRuntimeClasspath,kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinInternalAbiValidation,kotlinKlibCommonizerClasspath,swiftExportClasspathResolvable,testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-api:5.14.0=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-engine:5.14.0=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-params:5.14.0=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.14.0=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.platform:junit-platform-engine:1.14.0=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath,testRuntimeClasspath
+org.junit.platform:junit-platform-launcher:1.14.0=testRuntimeClasspath
+org.junit:junit-bom:5.14.0=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.msgpack:msgpack-core:0.9.8=jmh,jmhRuntimeClasspath
+org.openjdk.jmh:jmh-core:1.37=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
+org.openjdk.jmh:jmh-generator-asm:1.37=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
+org.openjdk.jmh:jmh-generator-bytecode:1.37=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
+org.openjdk.jmh:jmh-generator-reflection:1.37=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
+org.opentest4j:opentest4j:1.3.0=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.organicdesign:Paguro:3.10.3=jmh,jmhRuntimeClasspath
 org.ow2.asm:asm:9.0=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
-org.snakeyaml:snakeyaml-engine:2.5=jmh,jmhRuntimeClasspath
-empty=annotationProcessor,apiDependenciesMetadata,archives,compile,compileClasspath,compileOnly,compileOnlyDependenciesMetadata,default,implementationDependenciesMetadata,intransitiveDependenciesMetadata,jmhAnnotationProcessor,jmhApiDependenciesMetadata,jmhCompile,jmhCompileOnly,jmhCompileOnlyDependenciesMetadata,jmhIntransitiveDependenciesMetadata,jmhKotlinScriptDef,jmhKotlinScriptDefExtensions,jmhRuntime,jmhRuntimeOnlyDependenciesMetadata,kotlinCompilerPluginClasspath,kotlinNativeCompilerPluginClasspath,kotlinScriptDef,kotlinScriptDefExtensions,runtime,runtimeClasspath,runtimeOnlyDependenciesMetadata,sourcesJar,testAnnotationProcessor,testApiDependenciesMetadata,testCompile,testCompileOnly,testCompileOnlyDependenciesMetadata,testIntransitiveDependenciesMetadata,testKotlinScriptDef,testKotlinScriptDefExtensions,testRuntime
+org.snakeyaml:snakeyaml-engine:2.10=jmh,jmhRuntimeClasspath
+empty=annotationProcessor,apiDependenciesMetadata,compileClasspath,compileOnlyDependenciesMetadata,implementationDependenciesMetadata,intransitiveDependenciesMetadata,jmhAnnotationProcessor,jmhApiDependenciesMetadata,jmhCompileOnlyDependenciesMetadata,jmhIntransitiveDependenciesMetadata,jmhKotlinScriptDefExtensions,kotlinCompilerPluginClasspath,kotlinNativeCompilerPluginClasspath,kotlinScriptDefExtensions,runtimeClasspath,sourcesJar,testAnnotationProcessor,testApiDependenciesMetadata,testCompileOnlyDependenciesMetadata,testIntransitiveDependenciesMetadata,testKotlinScriptDefExtensions

bench/src/jmh/java/org/pkl/core/Fibonacci.java

@@ -1,4 +1,4 @@
-/**
+/*
  * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");

bench/src/jmh/java/org/pkl/core/ListSort.java

@@ -1,5 +1,5 @@
-/**
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+/*
+ * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -23,6 +23,8 @@ import java.util.concurrent.TimeUnit;
 import org.openjdk.jmh.annotations.*;
 import org.openjdk.jmh.util.TempFile;
 import org.openjdk.jmh.util.TempFileManager;
+import org.pkl.core.evaluatorSettings.TraceMode;
+import org.pkl.core.http.HttpClient;
 import org.pkl.core.module.ModuleKeyFactories;
 import org.pkl.core.repl.ReplRequest;
 import org.pkl.core.repl.ReplResponse;
@@ -39,6 +41,7 @@ public class ListSort {
   private static final ReplServer repl =
       new ReplServer(
           SecurityManagers.defaultManager,
+          HttpClient.dummyClient(),
           Loggers.stdErr(),
           List.of(ModuleKeyFactories.standardLibrary),
           List.of(ResourceReaders.file()),
@@ -48,7 +51,9 @@ public class ListSort {
           null,
           null,
           IoUtils.getCurrentWorkingDir(),
-          StackFrameTransformers.defaultTransformer);
+          StackFrameTransformers.defaultTransformer,
+          false,
+          TraceMode.COMPACT);
   private static final List<Object> list = new ArrayList<>(100000);
 
   static {
@@ -109,10 +114,10 @@ public class ListSort {
                 // append `.length` to avoid rendering the list
                 new ReplRequest.Eval("sort", "nums.sortWith(cmp).length", false, false))
             .get(0);
-    if (!(response instanceof ReplResponse.EvalSuccess)) {
+    if (!(response instanceof ReplResponse.EvalSuccess success)) {
       throw new AssertionError(response);
     }
-    return ((ReplResponse.EvalSuccess) response).getResult();
+    return success.getResult();
   }
 
   // note that this is an uneven comparison

bench/src/jmh/java/org/pkl/core/parser/ParserBenchmark.java

@@ -1,5 +1,5 @@
-/**
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+/*
+ * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,8 +15,17 @@
  */
 package org.pkl.core.parser;
 
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.nio.file.Files;
 import java.util.concurrent.TimeUnit;
 import org.openjdk.jmh.annotations.*;
+import org.pkl.commons.test.FileTestUtils;
+import org.pkl.commons.test.FileTestUtilsKt;
+import org.pkl.core.Release;
+import org.pkl.core.util.IoUtils;
+import org.pkl.parser.Parser;
+import org.pkl.parser.ParserError;
 
 @SuppressWarnings("unused")
 @Warmup(iterations = 5, time = 2)
@@ -24,36 +33,33 @@ import org.openjdk.jmh.annotations.*;
 @OutputTimeUnit(TimeUnit.SECONDS)
 @Fork(1)
 public class ParserBenchmark {
-  // One-time execution of this code took ~10s until moving rule alternative
-  // for parenthesized expression after alternative for anonymous function.
   @Benchmark
-  public void run() {
-    new Parser()
-        .parseModule(
-            "a1 {\n"
-                + "  a2 {\n"
-                + "    a3 {\n"
-                + "      a4 {\n"
-                + "        a5 {\n"
-                + "          a6 {\n"
-                + "            a7 {\n"
-                + "              a8 {\n"
-                + "                a9 {\n"
-                + "                  a10 {\n"
-                + "                    a11 {\n"
-                + "                      a12 {\n"
-                + "                        a13 = map(map(map((x) -> 1)))\n"
-                + "                      }\n"
-                + "                    }\n"
-                + "                  }\n"
-                + "                }\n"
-                + "              }\n"
-                + "            }\n"
-                + "          }\n"
-                + "        }\n"
-                + "      }\n"
-                + "    }\n"
-                + "  }\n"
-                + "}");
+  public void parseStdlib() {
+    for (var stdlibModule : Release.current().standardLibrary().modules()) {
+      try {
+        var moduleSource =
+            IoUtils.readClassPathResourceAsString(
+                getClass(), "/org/pkl/core/stdlib/%s.pkl".formatted(stdlibModule.substring(4)));
+        new Parser().parseModule(moduleSource);
+      } catch (IOException e) {
+        throw new UncheckedIOException(e);
+      }
+    }
+  }
+
+  @Benchmark
+  public void parseSnippetTests() {
+    var snippetTestDir =
+        FileTestUtils.getRootProjectDir()
+            .resolve("pkl-core/src/test/files/LanguageSnippetTests/input");
+    for (var snippet : FileTestUtilsKt.listFilesRecursively(snippetTestDir)) {
+      try {
+        var moduleSource = Files.readString(snippet);
+        new Parser().parseModule(moduleSource);
+      } catch (IOException e) {
+        throw new UncheckedIOException(e);
+      } catch (ParserError ignore) {
+      }
+    }
   }
 }

build.gradle.kts

@@ -1,10 +1,22 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 // https://youtrack.jetbrains.com/issue/KTIJ-19369
-@file:Suppress("DSL_SCOPE_VIOLATION") 
-
 import org.jetbrains.gradle.ext.ActionDelegationConfig
 import org.jetbrains.gradle.ext.ActionDelegationConfig.TestRunner.PLATFORM
 import org.jetbrains.gradle.ext.ProjectSettings
-import org.jetbrains.gradle.ext.TaskTriggersConfig
 
 plugins {
   pklAllProjects
@@ -18,8 +30,8 @@ plugins {
 nexusPublishing {
   repositories {
     sonatype {
-      nexusUrl.set(uri("https://s01.oss.sonatype.org/service/local/"))
-      snapshotRepositoryUrl.set(uri("https://s01.oss.sonatype.org/content/repositories/snapshots/"))
+      nexusUrl.set(uri("https://ossrh-staging-api.central.sonatype.com/service/local/"))
+      snapshotRepositoryUrl.set(uri("https://central.sonatype.com/repository/maven-snapshots/"))
     }
   }
 }
@@ -33,22 +45,16 @@ idea {
         delegateBuildRunToGradle = true
         testRunner = PLATFORM
       }
-      configure<TaskTriggersConfig> {
-        afterSync(provider { project(":pkl-core").tasks.named("makeIntelliJAntlrPluginHappy") })
-      }
     }
   }
 }
 
-val clean by tasks.registering(Delete::class) {
-  delete(buildDir)
-}
+val clean by tasks.existing { delete(layout.buildDirectory) }
 
-val printVersion by tasks.registering {
-  doFirst { println(buildInfo.pklVersion) }
-}
+val printVersion by tasks.registering { doFirst { println(buildInfo.pklVersion) } }
 
-val message = """
+val message =
+  """
 ====
 Gradle version : ${gradle.gradleVersion}
 Java version   : ${System.getProperty("java.version")}
@@ -63,5 +69,7 @@ Git Commit ID          : ${buildInfo.commitId}
 ====
 """
 
-val formattedMessage = message.replace("\n====", "\n" + "=".repeat(message.lines().maxByOrNull { it.length }!!.length))
+val formattedMessage =
+  message.replace("\n====", "\n" + "=".repeat(message.lines().maxByOrNull { it.length }!!.length))
+
 logger.info(formattedMessage)

buildSrc/build.gradle.kts

@@ -1,17 +1,52 @@
+/*
+ * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import org.jetbrains.kotlin.gradle.dsl.JvmTarget
+
 plugins {
   `kotlin-dsl`
+  `jvm-toolchains`
 }
 
+// Keep this in sync with the constants in `BuildInfo.kt` (those are not addressable here).
+val toolchainVersion = 21
+
 dependencies {
   implementation(libs.downloadTaskPlugin)
   implementation(libs.spotlessPlugin)
-  implementation(libs.kotlinPlugin) {
-    exclude(module = "kotlin-android-extensions")
-  }
+  implementation(libs.kotlinPlugin) { exclude(module = "kotlin-android-extensions") }
   implementation(libs.shadowPlugin)
+
+  // fix from the Gradle team: makes version catalog symbols available in build scripts
+  // see here for more: https://github.com/gradle/gradle/issues/15383
+  implementation(files(libs.javaClass.superclass.protectionDomain.codeSource.location))
 }
 
 java {
-  sourceCompatibility = JavaVersion.VERSION_11
-  targetCompatibility = JavaVersion.VERSION_11
+  toolchain {
+    languageVersion = JavaLanguageVersion.of(toolchainVersion)
+    vendor = JvmVendorSpec.ADOPTIUM
+  }
+}
+
+tasks.withType<JavaCompile>().configureEach { options.release = toolchainVersion }
+
+kotlin {
+  jvmToolchain(toolchainVersion)
+  compilerOptions {
+    jvmTarget = JvmTarget.fromTarget(toolchainVersion.toString())
+    freeCompilerArgs.add("-Xjdk-release=$toolchainVersion")
+  }
 }

buildSrc/settings.gradle.kts

@@ -1,5 +1,22 @@
+/*
+ * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 @file:Suppress("UnstableApiUsage")
 
+rootProject.name = "buildSrc"
+
 pluginManagement {
   repositories {
     mavenCentral()
@@ -7,14 +24,12 @@ pluginManagement {
   }
 }
 
+plugins { id("org.gradle.toolchains.foojay-resolver-convention") }
+
 // makes ~/.gradle/init.gradle unnecessary and ~/.gradle/gradle.properties optional
 dependencyResolutionManagement {
   // use same version catalog as main build
-  versionCatalogs {
-    register("libs") {
-      from(files("../gradle/libs.versions.toml"))
-    }
-  }
+  versionCatalogs { register("libs") { from(files("../gradle/libs.versions.toml")) } }
 
   repositories {
     repositoriesMode.set(RepositoriesMode.PREFER_SETTINGS)

buildSrc/src/main/kotlin/BuildInfo.kt

@@ -1,81 +1,123 @@
+/*
+ * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 @file:Suppress("MemberVisibilityCanBePrivate")
 
 import java.io.File
 import org.gradle.api.Project
 import org.gradle.api.artifacts.VersionCatalog
 import org.gradle.api.artifacts.VersionCatalogsExtension
-import org.gradle.api.artifacts.VersionConstraint
-import org.gradle.kotlin.dsl.getByType
+import org.gradle.api.attributes.Category
+import org.gradle.api.provider.Provider
+import org.gradle.api.tasks.TaskProvider
+import org.gradle.api.tasks.testing.Test
+import org.gradle.internal.extensions.stdlib.capitalized
+import org.gradle.jvm.toolchain.*
+import org.gradle.kotlin.dsl.*
+import org.gradle.kotlin.dsl.support.serviceOf
+import org.gradle.process.CommandLineArgumentProvider
+
+/**
+ * JVM bytecode target; this is pinned at a reasonable version, because downstream JVM projects
+ * which consume Pkl will need a minimum Bytecode level at or above this one.
+ *
+ * Kotlin and Java need matching bytecode targets, so this is expressed as a build setting and
+ * constant default. To override, pass `-DpklJdkToolchain=X` to the Gradle command line, where X is
+ * a major Java version.
+ */
+const val PKL_JVM_TARGET_DEFAULT_MAXIMUM = 17
+
+/**
+ * The Pkl build requires JDK 21+ to build, because JDK 17 is no longer within the default set of
+ * supported JDKs for GraalVM. This is a build-time requirement, not a runtime requirement.
+ */
+const val PKL_JDK_VERSION_MIN = 21
+
+/**
+ * The JDK minimum is set to match the bytecode minimum, to guarantee that fat JARs work against the
+ * earliest supported bytecode target.
+ */
+const val PKL_TEST_JDK_MINIMUM = PKL_JVM_TARGET_DEFAULT_MAXIMUM
+
+/**
+ * Maximum JDK version which Pkl is tested with; this should be bumped when new JDK stable releases
+ * are issued. At the time of this writing, JDK 23 is the latest available release.
+ */
+const val PKL_TEST_JDK_MAXIMUM = 23
+
+/**
+ * Test the full suite of JDKs between [PKL_TEST_JDK_MINIMUM] and [PKL_TEST_JDK_MAXIMUM]; if this is
+ * set to `false` (or overridden on the command line), only LTS releases are tested by default.
+ */
+const val PKL_TEST_ALL_JDKS = false
 
 // `buildInfo` in main build scripts
 // `project.extensions.getByType<BuildInfo>()` in precompiled script plugins
-open class BuildInfo(project: Project) {
-  val self = this
-
-  inner class GraalVm {
+open class BuildInfo(private val project: Project) {
+  inner class GraalVm(val arch: String) {
     val homeDir: String by lazy {
       System.getenv("GRAALVM_HOME") ?: "${System.getProperty("user.home")}/.graalvm"
     }
 
-    val version: String by lazy {
-      libs.findVersion("graalVm").get().toString()
-    }
+    val version: String by lazy { libs.findVersion("graalVm").get().toString() }
 
-    val isGraal22: Boolean by lazy {
-      version.startsWith("22")
-    }
-
-    val arch by lazy {
-      if (os.isMacOsX && isGraal22) {
-        "amd64"
-      } else {
-        self.arch
-      }
-    }
+    val graalVmJdkVersion: String by lazy { libs.findVersion("graalVmJdkVersion").get().toString() }
 
     val osName: String by lazy {
       when {
-        os.isMacOsX && isGraal22 -> "darwin"
         os.isMacOsX -> "macos"
         os.isLinux -> "linux"
+        os.isWindows -> "windows"
         else -> throw RuntimeException("${os.familyName} is not supported.")
       }
     }
 
     val baseName: String by lazy {
-      if (graalVm.isGraal22) {
-        "graalvm-ce-java11-${osName}-${arch}-${version}"
-      } else {
-        "graalvm-jdk-${graalVM23JdkVersion}_${osName}-${arch}_bin"
-      }
-    }
-
-    val graalVM23JdkVersion: String by lazy {
-      libs.findVersion("graalVM23JdkVersion").get().requiredVersion
+      "graalvm-community-jdk-${graalVmJdkVersion}_${osName}-${arch}_bin"
     }
 
     val downloadUrl: String by lazy {
-      if (isGraal22) {
-        "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-" +
-          "${version}/$baseName.tar.gz"
-      } else {
-        val jdkMajor = graalVM23JdkVersion.takeWhile { it != '.' }
-        "https://download.oracle.com/graalvm/$jdkMajor/archive/$baseName.tar.gz"
-      }
+      val extension = if (os.isWindows) "zip" else "tar.gz"
+      "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-${graalVmJdkVersion}/$baseName.$extension"
     }
 
-    val installDir: File by lazy {
-      File(homeDir, baseName)
+    val downloadFile: File by lazy {
+      val extension = if (os.isWindows) "zip" else "tar.gz"
+      File(homeDir, "${baseName}.$extension")
     }
 
+    val installDir: File by lazy { File(homeDir, baseName) }
+
     val baseDir: String by lazy {
       if (os.isMacOsX) "$installDir/Contents/Home" else installDir.toString()
     }
   }
 
-  /**
-   * Same logic as [org.gradle.internal.os.OperatingSystem#arch], which is protected.
-   */
+  /** The target architecture to build, defaulting to the system architecture. */
+  val targetArch by lazy { System.getProperty("pkl.targetArch") ?: arch }
+
+  /** Tells if this is a cross-arch build (e.g. targeting amd64 when on an aarch64 machine). */
+  val isCrossArch by lazy { arch != targetArch }
+
+  /** Tells if cross-arch builds are supported on this machine. */
+  val isCrossArchSupported by lazy { os.isMacOsX }
+
+  /** Whether to build native executables using the musl toolchain or not. */
+  val musl: Boolean by lazy { java.lang.Boolean.getBoolean("pkl.musl") }
+
+  /** Same logic as [org.gradle.internal.os.OperatingSystem#arch], which is protected. */
   val arch: String by lazy {
     when (val arch = System.getProperty("os.arch")) {
       "x86" -> "i386"
@@ -85,14 +127,236 @@ open class BuildInfo(project: Project) {
     }
   }
 
-  val graalVm: GraalVm = GraalVm()
+  val graalVmAarch64: GraalVm = GraalVm("aarch64")
 
-  val isCiBuild: Boolean by lazy {
-    System.getenv("CI") != null
+  val graalVmAmd64: GraalVm = GraalVm("x64")
+
+  val isCiBuild: Boolean by lazy { System.getenv("CI") != null }
+
+  val isReleaseBuild: Boolean by lazy { java.lang.Boolean.getBoolean("releaseBuild") }
+
+  val isNativeArch: Boolean by lazy { java.lang.Boolean.getBoolean("nativeArch") }
+
+  val jvmTarget: Int by lazy {
+    System.getProperty("pklJvmTarget")?.toInt() ?: PKL_JVM_TARGET_DEFAULT_MAXIMUM
   }
 
-  val isReleaseBuild: Boolean by lazy {
-    java.lang.Boolean.getBoolean("releaseBuild")
+  // JPMS exports for Truffle; needed on some versions of Java, and transitively within some JARs.
+  private val jpmsExports =
+    arrayOf(
+      "org.graalvm.truffle/com.oracle.truffle.api.exception=ALL-UNNAMED",
+      "org.graalvm.truffle/com.oracle.truffle.api=ALL-UNNAMED",
+      "org.graalvm.truffle/com.oracle.truffle.api.nodes=ALL-UNNAMED",
+      "org.graalvm.truffle/com.oracle.truffle.api.source=ALL-UNNAMED",
+    )
+
+  // Extra JPMS modules forced onto the module path via `--add-modules` in some cases.
+  private val jpmsAddModules = arrayOf("jdk.unsupported")
+
+  // Formats `jpmsExports` for use in JAR manifest attributes.
+  val jpmsExportsForJarManifest: String by lazy {
+    jpmsExports.joinToString(" ") { it.substringBefore("=") }
+  }
+
+  // Formats `jpmsExports` for use on the command line with `--add-exports`.
+  val jpmsExportsForAddExportsFlags: Collection<String> by lazy {
+    jpmsExports.map { "--add-exports=$it" }
+  }
+
+  // Formats `jpmsAddModules` for use on the command line with `--add-modules`.
+  val jpmsAddModulesFlags: Collection<String> by lazy { jpmsAddModules.map { "--add-modules=$it" } }
+
+  // JVM properties to set during testing.
+  val testProperties =
+    mapOf<String, Any>(
+      // @TODO: this should be removed once pkl supports JPMS as a true Java Module.
+      "polyglotimpl.DisableClassPathIsolation" to true
+    )
+
+  val jdkVendor: JvmVendorSpec = JvmVendorSpec.ADOPTIUM
+
+  val jdkToolchainVersion: JavaLanguageVersion by lazy {
+    JavaLanguageVersion.of(System.getProperty("pklJdkToolchain")?.toInt() ?: PKL_JDK_VERSION_MIN)
+  }
+
+  val jdkTestFloor: JavaLanguageVersion by lazy { JavaLanguageVersion.of(PKL_TEST_JDK_MINIMUM) }
+
+  val jdkTestCeiling: JavaLanguageVersion by lazy { JavaLanguageVersion.of(PKL_TEST_JDK_MAXIMUM) }
+
+  val testAllJdks: Boolean by lazy {
+    // By default, Pkl is tested against LTS JDK releases within the bounds of `PKL_TEST_JDK_TARGET`
+    // and `PKL_TEST_JDK_MAXIMUM`. To test against the full suite of JDK versions, past and present,
+    // set `-DpklTestAllJdks=true` on the Gradle command line. This results in non-LTS releases, old
+    // releases, and "experimental releases" (newer than the toolchain version) being included in
+    // the default `check` suite.
+    System.getProperty("pklTestAllJdks")?.toBoolean() ?: PKL_TEST_ALL_JDKS
+  }
+
+  val testExperimentalJdks: Boolean by lazy {
+    System.getProperty("pklTestFutureJdks")?.toBoolean() ?: false
+  }
+
+  val testJdkVendors: Sequence<JvmVendorSpec> by lazy {
+    // By default, only OpenJDK is tested during multi-JDK testing. Flip `-DpklTestAllVendors=true`
+    // to additionally test against a suite of JDK vendors, including Azul, Oracle, and GraalVM.
+    when (System.getProperty("pklTestAllVendors")?.toBoolean()) {
+      true -> sequenceOf(JvmVendorSpec.ADOPTIUM, JvmVendorSpec.GRAAL_VM, JvmVendorSpec.ORACLE)
+      else -> sequenceOf(JvmVendorSpec.ADOPTIUM)
+    }
+  }
+
+  private val isArmWindows: Boolean
+    get() {
+      if (!os.isWindows) {
+        return false
+      }
+      // System.getProperty("os.arch") returns the architecture of the JVM, not the host OS.
+      val procArch = System.getenv("PROCESSOR_ARCHITECTURE")
+      return "ARM64".equals(procArch, ignoreCase = true)
+    }
+
+  // Assembles a collection of JDK versions which tests can be run against, considering ancillary
+  // parameters like `testAllJdks` and `testExperimentalJdks`.
+  val jdkTestRange: Collection<JavaLanguageVersion> by lazy {
+    if (isArmWindows) {
+      // Java toolchains does not work on ARM windows: https://github.com/gradle/gradle/issues/29807
+      // prevent creating tasks to test different JDKs if developing on a Windows ARM machine.
+      return@lazy listOf()
+    }
+    JavaVersionRange.inclusive(jdkTestFloor, jdkTestCeiling).toList()
+  }
+
+  val JavaLanguageVersion.isEnabled: Boolean
+    get() = isVersionEnabled(this)
+
+  fun isVersionEnabled(version: JavaLanguageVersion): Boolean {
+    return when {
+      testAllJdks -> true
+      multiJdkTesting -> JavaVersionRange.isLTS(version)
+      testExperimentalJdks -> version > jdkToolchainVersion
+      else -> false
+    }
+  }
+
+  private fun JavaToolchainSpec.pklJdkToolchain() {
+    languageVersion.set(jdkToolchainVersion)
+    vendor.set(jdkVendor)
+  }
+
+  private fun labelForVendor(vendor: JvmVendorSpec): String =
+    when (vendor) {
+      JvmVendorSpec.AZUL -> "Zulu"
+      JvmVendorSpec.GRAAL_VM -> "GraalVm"
+      JvmVendorSpec.ORACLE -> "Oracle"
+      JvmVendorSpec.ADOPTIUM -> "Adoptium"
+      else -> error("Unrecognized JDK vendor: $vendor")
+    }
+
+  private fun testNamer(baseName: () -> String): (JavaLanguageVersion, JvmVendorSpec?) -> String =
+    { jdkTarget, vendor ->
+      val targetToken =
+        when (vendor) {
+          null -> "Jdk${jdkTarget.asInt()}"
+          else -> "Jdk${jdkTarget.asInt()}${labelForVendor(vendor).capitalized()}"
+        }
+      if (jdkTarget > jdkToolchainVersion) {
+        // test targets above the toolchain target are considered "experimental".
+        "${baseName()}${targetToken}Experimental"
+      } else {
+        "${baseName()}${targetToken}"
+      }
+    }
+
+  @Suppress("UnstableApiUsage")
+  fun multiJdkTestingWith(
+    templateTask: TaskProvider<out Test>,
+    configurator: MultiJdkTestConfigurator = {},
+  ): Iterable<Provider<out Any>> =
+    with(project) {
+      val isMultiVendor = testJdkVendors.count() > 1
+      val baseNameProvider = { templateTask.get().name }
+      val namer = testNamer(baseNameProvider)
+      val applyConfig: MultiJdkTestConfigurator = { (version, jdk) ->
+        // 1) copy configurations from the template task
+        dependsOn(templateTask)
+        templateTask.get().let { template ->
+          classpath = template.classpath
+          testClassesDirs = template.testClassesDirs
+          jvmArgs.addAll(template.jvmArgs)
+          jvmArgumentProviders.addAll(template.jvmArgumentProviders)
+          forkEvery = template.forkEvery
+          maxParallelForks = template.maxParallelForks
+          minHeapSize = template.minHeapSize
+          maxHeapSize = template.maxHeapSize
+          exclude(template.excludes)
+          template.systemProperties.forEach { prop -> systemProperty(prop.key, prop.value) }
+        }
+
+        // 2) assign launcher
+        javaLauncher = jdk
+
+        // 3) dispatch the user's configurator
+        configurator(version to jdk)
+      }
+
+      serviceOf<JavaToolchainService>().let { toolchains ->
+        jdkTestRange
+          .flatMap { targetVersion ->
+            // multiply out by jdk vendor
+            testJdkVendors.map { vendor -> (targetVersion to vendor) }
+          }
+          .map { (jdkTarget, vendor) ->
+            if (jdkToolchainVersion == jdkTarget)
+              tasks.register(namer(jdkTarget, vendor)) {
+                // alias to `test`
+                dependsOn(templateTask)
+                group = Category.VERIFICATION
+                description =
+                  "Alias for regular '${baseNameProvider()}' task, on JDK ${jdkTarget.asInt()}"
+              }
+            else
+              tasks.register(namer(jdkTarget, vendor.takeIf { isMultiVendor }), Test::class) {
+                enabled = jdkTarget.isEnabled
+                group = Category.VERIFICATION
+                description = "Run tests against JDK ${jdkTarget.asInt()}"
+                applyConfig(jdkTarget to toolchains.launcherFor { languageVersion = jdkTarget })
+                // fix: on jdk17, we must force the polyglot module on to the modulepath
+                if (jdkTarget.asInt() == 17)
+                  jvmArgumentProviders.add(
+                    CommandLineArgumentProvider {
+                      buildList { listOf("--add-modules=org.graalvm.polyglot") }
+                    }
+                  )
+              }
+          }
+          .toList()
+      }
+    }
+
+  val javaCompiler: Provider<JavaCompiler> by lazy {
+    project.serviceOf<JavaToolchainService>().let { toolchainService ->
+      toolchainService.compilerFor { pklJdkToolchain() }
+    }
+  }
+
+  val javaTestLauncher: Provider<JavaLauncher> by lazy {
+    project.serviceOf<JavaToolchainService>().let { toolchainService ->
+      toolchainService.launcherFor { pklJdkToolchain() }
+    }
+  }
+
+  val multiJdkTesting: Boolean by lazy {
+    // Test Pkl against a full range of JDK versions, past and present, within the
+    // supported bounds of `PKL_TEST_JDK_TARGET` and `PKL_TEST_JDK_MAXIMUM`.
+    //
+    // In CI, this defaults to `true` to catch potential cross-JDK compat regressions or other bugs.
+    // In local dev, this defaults to `false` to speed up the build and reduce contributor load.
+    System.getProperty("pklMultiJdkTesting")?.toBoolean() ?: isCiBuild
+  }
+
+  val hasMuslToolchain: Boolean by lazy {
+    // see .github/scripts/install_musl.sh
+    File(System.getProperty("user.home"), "staticdeps/bin/x86_64-linux-musl-gcc").exists()
   }
 
   val os: org.gradle.internal.os.OperatingSystem by lazy {
@@ -101,19 +365,25 @@ open class BuildInfo(project: Project) {
 
   // could be `commitId: Provider<String> = project.provider { ... }`
   val commitId: String by lazy {
+    // allow -DcommitId=abc123 for build environments that don't have git.
+    System.getProperty("commitId").let { if (it != null) return@lazy it }
     // only run command once per build invocation
     if (project === project.rootProject) {
-      Runtime.getRuntime()
-        .exec("git rev-parse --short HEAD", arrayOf(), project.rootDir)
-        .inputStream.reader().readText().trim()
+      val process =
+        ProcessBuilder()
+          .command("git", "rev-parse", "--short", "HEAD")
+          .directory(project.rootDir)
+          .start()
+      process.waitFor().also { exitCode ->
+        if (exitCode == -1) throw RuntimeException(process.errorStream.reader().readText())
+      }
+      process.inputStream.reader().readText().trim()
     } else {
       project.rootProject.extensions.getByType(BuildInfo::class.java).commitId
     }
   }
 
-  val commitish: String by lazy {
-    if (isReleaseBuild) project.version.toString() else commitId
-  }
+  val commitish: String by lazy { if (isReleaseBuild) project.version.toString() else commitId }
 
   val pklVersion: String by lazy {
     if (isReleaseBuild) {
@@ -142,3 +412,7 @@ open class BuildInfo(project: Project) {
     }
   }
 }
+
+// Shape of a function which is applied to configure multi-JDK testing.
+private typealias MultiJdkTestConfigurator =
+  Test.(Pair<JavaLanguageVersion, Provider<JavaLauncher>>) -> Unit

buildSrc/src/main/kotlin/ExecutableJar.kt

@@ -1,3 +1,18 @@
+/*
+ * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 import org.gradle.api.DefaultTask
 import org.gradle.api.file.RegularFileProperty
 import org.gradle.api.provider.ListProperty
@@ -5,37 +20,47 @@ import org.gradle.api.tasks.Input
 import org.gradle.api.tasks.InputFile
 import org.gradle.api.tasks.OutputFile
 import org.gradle.api.tasks.TaskAction
-import org.gradle.kotlin.dsl.listProperty
 
 /**
- * Builds a self-contained Pkl CLI Jar that is directly executable on *nix
- * and executable with `java -jar` on Windows.
+ * Builds a self-contained Pkl CLI Jar that is directly executable on Windows, macOS, and Linux.
  *
  * For direct execution, the `java` command must be on the PATH.
  *
- * https://skife.org/java/unix/2011/06/20/really_executable_jars.html
+ * Technique borrowed from [Mill](https://mill-build.org/blog/5-executable-jars.html).
  */
-open class ExecutableJar : DefaultTask() {
-  @get:InputFile
-  val inJar: RegularFileProperty = project.objects.fileProperty()
+abstract class ExecutableJar : DefaultTask() {
+  @get:InputFile abstract val inJar: RegularFileProperty
 
-  @get:OutputFile
-  val outJar: RegularFileProperty = project.objects.fileProperty()
+  @get:OutputFile abstract val outJar: RegularFileProperty
 
-  @get:Input
-  val jvmArgs: ListProperty<String> = project.objects.listProperty()
+  @get:Input abstract val jvmArgs: ListProperty<String>
 
   @TaskAction
   fun buildJar() {
     val inFile = inJar.get().asFile
     val outFile = outJar.get().asFile
     val escapedJvmArgs = jvmArgs.get().joinToString(separator = " ") { "\"$it\"" }
-
-    val startScript = """
-      #!/bin/sh
-      exec java $escapedJvmArgs -jar $0 "$@"
-    """.trim().trimMargin() + "\n\n\n"
-
+    val unixStartScript =
+      """
+      @ 2>/dev/null # 2>nul & echo off & goto BOF
+      :
+      exec java $escapedJvmArgs -jar "$0" "$@"
+      exit
+      """
+        .trimIndent()
+    val windowsStartScript =
+      """
+      :BOF
+      setlocal
+      @echo off
+      java $escapedJvmArgs -jar "%~dpnx0" %*
+      endlocal
+      exit /B %errorlevel%
+      """
+        .trimIndent()
+        // need crlf endings for Windows portion of script
+        .replace("\n", "\r\n")
+    val startScript = unixStartScript + "\r\n" + windowsStartScript + "\r\n".repeat(3)
     outFile.outputStream().use { outStream ->
       startScript.byteInputStream().use { it.copyTo(outStream) }
       inFile.inputStream().use { it.copyTo(outStream) }

buildSrc/src/main/kotlin/ExecutableSpec.kt

@@ -0,0 +1,49 @@
+/*
+ * Copyright © 2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import org.gradle.api.provider.Property
+
+abstract class ExecutableSpec {
+  /** The main entrypoint Java class of the executable. */
+  abstract val mainClass: Property<String>
+
+  /**
+   * The name of the native executable.
+   *
+   * Not required if not building a native executable.
+   */
+  abstract val name: Property<String>
+
+  /** The name of the Java executable. */
+  abstract val javaName: Property<String>
+
+  /** The name of the executable that shows in the description when published to Maven. */
+  abstract val documentationName: Property<String>
+
+  /**
+   * The base name of the Maven publication.
+   *
+   * This becomes the base name of the Artifact ID, with the os and arch suffixed.
+   *
+   * For example, `pkl` becomes `pkl-macos-aarch` for the macOS/aarch64 variant.
+   */
+  abstract val publicationName: Property<String>
+
+  /** The name of the artifact ID for the Java executable. */
+  abstract val javaPublicationName: Property<String>
+
+  /** The website for this executable. */
+  abstract val website: Property<String>
+}

buildSrc/src/main/kotlin/GradlePluginTests.kt

@@ -1,7 +1,22 @@
+/*
+ * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 import org.gradle.util.GradleVersion
 
 open class GradlePluginTests {
   lateinit var minGradleVersion: GradleVersion
   lateinit var maxGradleVersion: GradleVersion
   var skippedGradleVersions: List<GradleVersion> = listOf()
-}
+}

buildSrc/src/main/kotlin/GradleVersionInfo.kt

@@ -1,6 +1,21 @@
-import java.net.URL
-import org.gradle.util.GradleVersion
+/*
+ * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 import groovy.json.JsonSlurper
+import java.net.URI
+import org.gradle.util.GradleVersion
 
 @Suppress("unused")
 class GradleVersionInfo(json: Map<String, Any>) {
@@ -38,31 +53,36 @@ class GradleVersionInfo(json: Map<String, Any>) {
   val wrapperChecksumUrl: String by json
 
   companion object {
-    private fun fetchAll(): List<GradleVersionInfo> = fetchMultiple("https://services.gradle.org/versions/all")
+    private fun fetchAll(): List<GradleVersionInfo> =
+      fetchMultiple("https://services.gradle.org/versions/all")
 
     fun fetchReleases(): List<GradleVersionInfo> = fetchAll().filter { it.isReleaseVersion }
 
-    fun fetchCurrent(): GradleVersionInfo = fetchSingle("https://services.gradle.org/versions/current")
+    fun fetchCurrent(): GradleVersionInfo =
+      fetchSingle("https://services.gradle.org/versions/current")
 
-    fun fetchRc(): GradleVersionInfo? = fetchSingleOrNull("https://services.gradle.org/versions/release-candidate")
+    fun fetchRc(): GradleVersionInfo? =
+      fetchSingleOrNull("https://services.gradle.org/versions/release-candidate")
 
-    fun fetchNightly(): GradleVersionInfo = fetchSingle("https://services.gradle.org/versions/nightly")
+    fun fetchNightly(): GradleVersionInfo =
+      fetchSingle("https://services.gradle.org/versions/nightly")
 
     private fun fetchSingle(url: String): GradleVersionInfo {
       @Suppress("UNCHECKED_CAST")
-      return GradleVersionInfo(JsonSlurper().parse(URL(url)) as Map<String, Any>)
+      return GradleVersionInfo(JsonSlurper().parse(URI(url).toURL()) as Map<String, Any>)
     }
 
     private fun fetchSingleOrNull(url: String): GradleVersionInfo? {
       @Suppress("UNCHECKED_CAST")
-      val json = JsonSlurper().parse(URL(url)) as Map<String, Any>
+      val json = JsonSlurper().parse(URI(url).toURL()) as Map<String, Any>
       return if (json.isEmpty()) null else GradleVersionInfo(json)
     }
 
     private fun fetchMultiple(url: String): List<GradleVersionInfo> {
       @Suppress("UNCHECKED_CAST")
-      return (JsonSlurper().parse(URL(url)) as List<Map<String, Any>>)
-        .map { GradleVersionInfo(it) }
+      return (JsonSlurper().parse(URI(url).toURL()) as List<Map<String, Any>>).map {
+        GradleVersionInfo(it)
+      }
     }
   }
 }

buildSrc/src/main/kotlin/HtmlValidator.kt

@@ -1,6 +1,21 @@
+/*
+ * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 import org.gradle.api.Project
 import org.gradle.api.file.FileCollection
 
 open class HtmlValidator(project: Project) {
   var sources: FileCollection = project.files()
-}
+}

buildSrc/src/main/kotlin/InstallGraalVm.kt

@@ -0,0 +1,91 @@
+/*
+ * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import java.nio.file.Files
+import java.nio.file.Paths
+import java.nio.file.StandardCopyOption
+import java.util.*
+import javax.inject.Inject
+import kotlin.io.path.createDirectories
+import org.gradle.api.DefaultTask
+import org.gradle.api.internal.file.FileOperations
+import org.gradle.api.provider.Property
+import org.gradle.api.tasks.Input
+import org.gradle.api.tasks.TaskAction
+import org.gradle.process.ExecOperations
+
+abstract class InstallGraalVm
+@Inject
+constructor(
+  private val fileOperations: FileOperations,
+  private val execOperations: ExecOperations,
+) : DefaultTask() {
+  @get:Input abstract val graalVm: Property<BuildInfo.GraalVm>
+
+  init {
+    @Suppress("LeakingThis") onlyIf("GraalVM not installed") { !graalVm.get().installDir.exists() }
+  }
+
+  @TaskAction
+  @Suppress("unused")
+  fun run() {
+    // minimize chance of corruption by extract-to-random-dir-and-flip-symlink
+    val distroDir = Paths.get(graalVm.get().homeDir, UUID.randomUUID().toString())
+    try {
+      distroDir.createDirectories()
+      println("Extracting ${graalVm.get().downloadFile} into $distroDir")
+      // faster and more reliable than Gradle's `copy { from tarTree() }`
+      execOperations.exec {
+        workingDir = distroDir.toFile()
+        executable = "tar"
+        args("--strip-components=1", "-xzf", graalVm.get().downloadFile)
+      }
+
+      val os = org.gradle.internal.os.OperatingSystem.current()
+      val distroBinDir =
+        if (os.isMacOsX) distroDir.resolve("Contents/Home/bin") else distroDir.resolve("bin")
+
+      println("Installing native-image into $distroDir")
+      val gvmVersionMajor =
+        requireNotNull(graalVm.get().version.split(".").first().toIntOrNull()) {
+          "Invalid GraalVM JDK version: ${graalVm.get().graalVmJdkVersion}"
+        }
+      if (gvmVersionMajor < 24) {
+        execOperations.exec {
+          val executableName = if (os.isWindows) "gu.cmd" else "gu"
+          executable = distroBinDir.resolve(executableName).toString()
+          args("install", "--no-progress", "native-image")
+        }
+      }
+
+      println("Creating symlink ${graalVm.get().installDir} for $distroDir")
+      val tempLink = Paths.get(graalVm.get().homeDir, UUID.randomUUID().toString())
+      Files.createSymbolicLink(tempLink, distroDir)
+      try {
+        Files.move(tempLink, graalVm.get().installDir.toPath(), StandardCopyOption.ATOMIC_MOVE)
+      } catch (e: Exception) {
+        try {
+          fileOperations.delete(tempLink.toFile())
+        } catch (ignored: Exception) {}
+        throw e
+      }
+    } catch (e: Exception) {
+      try {
+        fileOperations.delete(distroDir)
+      } catch (ignored: Exception) {}
+      throw e
+    }
+  }
+}

buildSrc/src/main/kotlin/JavaVersionRange.kt

@@ -0,0 +1,64 @@
+/*
+ * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+@file:Suppress("MemberVisibilityCanBePrivate")
+
+import java.util.*
+import org.gradle.jvm.toolchain.JavaLanguageVersion
+
+typealias JavaVersionPair = Pair<JavaLanguageVersion, JavaLanguageVersion>
+
+// All LTS releases.
+private val ltsReleases =
+  sortedSetOf(
+    JavaLanguageVersion.of(8),
+    JavaLanguageVersion.of(11),
+    JavaLanguageVersion.of(17),
+    JavaLanguageVersion.of(21),
+  )
+
+/** Describes an inclusive range of JVM versions, based on the [JavaLanguageVersion] type. */
+@JvmInline
+value class JavaVersionRange private constructor(private val bounds: JavaVersionPair) :
+  Iterable<JavaLanguageVersion> {
+  @Suppress("unused")
+  companion object {
+    fun isLTS(version: JavaLanguageVersion): Boolean = version in ltsReleases
+
+    fun inclusive(floor: JavaLanguageVersion, ceiling: JavaLanguageVersion): JavaVersionRange =
+      JavaVersionRange(floor to ceiling)
+
+    fun startingAt(floor: JavaLanguageVersion): JavaVersionRange =
+      inclusive(floor, JavaLanguageVersion.of(PKL_TEST_JDK_MAXIMUM))
+
+    fun upTo(ceiling: JavaLanguageVersion): JavaVersionRange =
+      inclusive(JavaLanguageVersion.of(PKL_TEST_JDK_MINIMUM), ceiling)
+  }
+
+  operator fun contains(version: JavaLanguageVersion): Boolean =
+    version >= bounds.first && version <= bounds.second
+
+  fun asSequence(): Sequence<JavaLanguageVersion> = sequence {
+    var current = bounds.first
+    while (current <= bounds.second) {
+      yield(current)
+      current = JavaLanguageVersion.of(current.asInt() + 1)
+    }
+  }
+
+  fun asSortedSet(): SortedSet<JavaLanguageVersion> = asSequence().toSortedSet()
+
+  override fun iterator(): Iterator<JavaLanguageVersion> = asSortedSet().iterator()
+}

buildSrc/src/main/kotlin/MergeSourcesJars.kt

@@ -1,3 +1,18 @@
+/*
+ * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 import java.io.File
 import java.util.regex.Matcher
 import java.util.regex.Pattern
@@ -15,21 +30,18 @@ import org.gradle.kotlin.dsl.listProperty
 import org.gradle.kotlin.dsl.mapProperty
 
 open class MergeSourcesJars : DefaultTask() {
-  @get:InputFiles
-  val inputJars: ConfigurableFileCollection = project.objects.fileCollection()
+  @get:InputFiles val inputJars: ConfigurableFileCollection = project.objects.fileCollection()
 
   @get:InputFiles
   val mergedBinaryJars: ConfigurableFileCollection = project.objects.fileCollection()
 
-  @get:Input
-  val relocatedPackages: MapProperty<String, String> = project.objects.mapProperty()
+  @get:Input val relocatedPackages: MapProperty<String, String> = project.objects.mapProperty()
 
   @get:Input
-  var sourceFileExtensions: ListProperty<String> = project.objects.listProperty<String>()
-    .convention(listOf(".java", ".kt"))
+  var sourceFileExtensions: ListProperty<String> =
+    project.objects.listProperty<String>().convention(listOf(".java", ".kt"))
 
-  @get:OutputFile
-  val outputJar: RegularFileProperty = project.objects.fileProperty()
+  @get:OutputFile val outputJar: RegularFileProperty = project.objects.fileProperty()
 
   @TaskAction
   @Suppress("unused")
@@ -38,12 +50,15 @@ open class MergeSourcesJars : DefaultTask() {
 
     val relocatedPkgs = relocatedPackages.get()
 
-    val relocatedPaths = relocatedPkgs.entries.associate { (key, value) -> toPath(key) to toPath(value) }
+    val relocatedPaths =
+      relocatedPkgs.entries.associate { (key, value) -> toPath(key) to toPath(value) }
 
     // use negative lookbehind to match any that don't precede with
     // a word or a period character. should catch most cases.
-    val importPattern = Pattern.compile("(?<!(\\w|\\.))(" +
-        relocatedPkgs.keys.joinToString("|") { it.replace(".", "\\.") } + ")")
+    val importPattern =
+      Pattern.compile(
+        "(?<!(\\w|\\.))(" + relocatedPkgs.keys.joinToString("|") { it.replace(".", "\\.") } + ")"
+      )
 
     val sourceFileExts = sourceFileExtensions.get()
 
@@ -55,7 +70,7 @@ open class MergeSourcesJars : DefaultTask() {
         val details = this
         if (details.isDirectory) return@visit
 
-        var path = details.relativePath.parent.pathString
+        var path = details.relativePath.parent!!.pathString
         val relocatedPath = relocatedPaths.keys.find { path.startsWith(it) }
         if (relocatedPath != null) {
           path = path.replace(relocatedPath, relocatedPaths.getValue(relocatedPath))
@@ -86,7 +101,7 @@ open class MergeSourcesJars : DefaultTask() {
       project.zipTree(jar).visit {
         val details = this
         if (details.isDirectory) return@visit // avoid adding empty dirs
-        result.add(details.relativePath.parent.pathString)
+        result.add(details.relativePath.parent!!.pathString)
       }
     }
     return result
@@ -96,7 +111,7 @@ open class MergeSourcesJars : DefaultTask() {
     relocatedPkgs: Map<String, String>,
     details: FileVisitDetails,
     sourceText: String,
-    importPattern: Pattern
+    importPattern: Pattern,
   ): String {
     val matcher = importPattern.matcher(sourceText)
     val buffer = StringBuffer()

buildSrc/src/main/kotlin/NativeImageBuild.kt

@@ -0,0 +1,169 @@
+/*
+ * Copyright © 2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import javax.inject.Inject
+import org.gradle.api.DefaultTask
+import org.gradle.api.file.ConfigurableFileCollection
+import org.gradle.api.provider.ListProperty
+import org.gradle.api.provider.Property
+import org.gradle.api.provider.Provider
+import org.gradle.api.services.BuildService
+import org.gradle.api.services.BuildServiceParameters
+import org.gradle.api.tasks.ClasspathNormalizer
+import org.gradle.api.tasks.Input
+import org.gradle.api.tasks.InputFiles
+import org.gradle.api.tasks.OutputFile
+import org.gradle.api.tasks.PathSensitivity
+import org.gradle.api.tasks.TaskAction
+import org.gradle.kotlin.dsl.registerIfAbsent
+import org.gradle.kotlin.dsl.withNormalizer
+import org.gradle.process.ExecOperations
+
+enum class Architecture {
+  AMD64,
+  AARCH64,
+}
+
+abstract class NativeImageBuildService : BuildService<BuildServiceParameters.None>
+
+abstract class NativeImageBuild : DefaultTask() {
+  @get:Input abstract val imageName: Property<String>
+
+  @get:Input abstract val extraNativeImageArgs: ListProperty<String>
+
+  @get:Input abstract val arch: Property<Architecture>
+
+  @get:Input abstract val mainClass: Property<String>
+
+  @get:InputFiles abstract val classpath: ConfigurableFileCollection
+
+  private val outputDir = project.layout.buildDirectory.dir("executable")
+
+  @get:OutputFile val outputFile = outputDir.flatMap { it.file(imageName) }
+
+  @get:Inject protected abstract val execOperations: ExecOperations
+
+  private val graalVm: Provider<BuildInfo.GraalVm> =
+    arch.map { a ->
+      when (a) {
+        Architecture.AMD64 -> buildInfo.graalVmAmd64
+        Architecture.AARCH64 -> buildInfo.graalVmAarch64
+      }
+    }
+
+  private val buildInfo: BuildInfo = project.extensions.getByType(BuildInfo::class.java)
+
+  private val nativeImageCommandName =
+    if (buildInfo.os.isWindows) "native-image.cmd" else "native-image"
+
+  private val nativeImageExecutable = graalVm.map { "${it.baseDir}/bin/$nativeImageCommandName" }
+
+  private val extraArgsFromProperties by lazy {
+    System.getProperties()
+      .filter { it.key.toString().startsWith("pkl.native") }
+      .map { "${it.key}=${it.value}".substring("pkl.native".length) }
+  }
+
+  private val buildService =
+    project.gradle.sharedServices.registerIfAbsent(
+      "nativeImageBuildService",
+      NativeImageBuildService::class,
+    ) {
+      maxParallelUsages.set(1)
+    }
+
+  init {
+    // ensure native-image builds run in serial (prevent `gw buildNative` from consuming all host
+    // CPU resources).
+    usesService(buildService)
+
+    group = "build"
+
+    inputs
+      .files(classpath)
+      .withPropertyName("runtimeClasspath")
+      .withNormalizer(ClasspathNormalizer::class)
+    inputs
+      .files(nativeImageExecutable)
+      .withPropertyName("graalVmNativeImage")
+      .withPathSensitivity(PathSensitivity.ABSOLUTE)
+  }
+
+  @TaskAction
+  protected fun run() {
+    execOperations.exec {
+      val exclusions =
+        listOf(buildInfo.libs.findLibrary("graalSdk").get()).map { it.get().module.name }
+
+      executable = nativeImageExecutable.get()
+      workingDir(outputDir)
+
+      args = buildList {
+        // must be emitted before any experimental options are used
+        add("-H:+UnlockExperimentalVMOptions")
+        // currently gives a deprecation warning, but we've been told
+        // that the "initialize everything at build time" *CLI* option is likely here to stay
+        add("--initialize-at-build-time=")
+        // needed for messagepack-java (see https://github.com/msgpack/msgpack-java/issues/600)
+        add("--initialize-at-run-time=org.msgpack.core.buffer.DirectBufferAccess")
+        add("--no-fallback")
+        add("-H:IncludeResources=org/pkl/core/stdlib/.*\\.pkl")
+        add("-H:IncludeResources=org/jline/utils/.*")
+        add("-H:IncludeResourceBundles=org.pkl.core.errorMessages")
+        add("-H:IncludeResourceBundles=org.pkl.parser.errorMessages")
+        add("-H:IncludeResources=org/pkl/commons/cli/PklCARoots.pem")
+        add("-H:Class=${mainClass.get()}")
+        add("-o")
+        add(imageName.get())
+        // the actual limit (currently) used by native-image is this number + 1400 (idea is to
+        // compensate for Truffle's own nodes)
+        add("-H:MaxRuntimeCompileMethods=1800")
+        add("-H:+EnforceMaxRuntimeCompileMethods")
+        add("--enable-url-protocols=http,https")
+        add("-H:+ReportExceptionStackTraces")
+        // disable automatic support for JVM CLI options (puts our main class in full control of
+        // argument parsing)
+        add("-H:-ParseRuntimeOptions")
+        // quick build mode: 40% faster compilation, 20% smaller (but presumably also slower)
+        // executable
+        if (!buildInfo.isReleaseBuild) {
+          add("-Ob")
+        }
+        if (buildInfo.isNativeArch) {
+          add("-march=native")
+        } else {
+          add("-march=compatibility")
+        }
+        // native-image rejects non-existing class path entries -> filter
+        add("--class-path")
+        val pathInput =
+          classpath.filter {
+            it.exists() && !exclusions.any { exclude -> it.name.contains(exclude) }
+          }
+        add(pathInput.asPath)
+        // make sure dev machine stays responsive (15% slowdown on my laptop)
+        val processors =
+          Runtime.getRuntime().availableProcessors() /
+            if (buildInfo.os.isMacOsX && !buildInfo.isCiBuild) 4 else 1
+        add("-J-XX:ActiveProcessorCount=${processors}")
+        // Pass through all `HOMEBREW_` prefixed environment variables to allow build with shimmed
+        // tools.
+        addAll(environment.keys.filter { it.startsWith("HOMEBREW_") }.map { "-E$it" })
+        addAll(extraNativeImageArgs.get())
+        addAll(extraArgsFromProperties)
+      }
+    }
+  }
+}

buildSrc/src/main/kotlin/PklFormatterSpotless.kt

@@ -0,0 +1,66 @@
+/*
+ * Copyright © 2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import com.diffplug.spotless.FormatterFunc
+import com.diffplug.spotless.FormatterStep
+import java.io.Serial
+import java.io.Serializable
+import java.net.URLClassLoader
+import org.gradle.api.artifacts.Configuration
+
+class PklFormatterStep(@Transient private val configuration: Configuration) : Serializable {
+  companion object {
+    @Serial private const val serialVersionUID: Long = 1L
+  }
+
+  fun create(): FormatterStep {
+    return FormatterStep.createLazy(
+      "pkl",
+      { PklFormatterStep(configuration) },
+      { PklFormatterFunc(configuration) },
+    )
+  }
+}
+
+class PklFormatterFunc(@Transient private val configuration: Configuration) :
+  FormatterFunc, Serializable {
+  companion object {
+    @Serial private const val serialVersionUID: Long = 1L
+  }
+
+  private val classLoader by lazy {
+    val urls = configuration.files.map { it.toURI().toURL() }
+    URLClassLoader(urls.toTypedArray())
+  }
+
+  private val formatterClass by lazy { classLoader.loadClass("org.pkl.formatter.Formatter") }
+
+  private val grammarVersionClass by lazy {
+    classLoader.loadClass("org.pkl.formatter.GrammarVersion")
+  }
+
+  private val grammarVersionLatestMethod by lazy { grammarVersionClass.getMethod("latest") }
+
+  private val formatMethod by lazy {
+    formatterClass.getMethod("format", String::class.java, grammarVersionClass)
+  }
+
+  private val formatterInstance by lazy { formatterClass.getConstructor().newInstance() }
+
+  override fun apply(input: String): String {
+    val latestGrammarVersion = grammarVersionLatestMethod(null)
+    return formatMethod(formatterInstance, input, latestGrammarVersion) as String
+  }
+}

buildSrc/src/main/kotlin/PklPublishing.kt

@@ -0,0 +1,147 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import java.nio.charset.StandardCharsets
+import java.util.Base64
+import org.gradle.api.Project
+import org.gradle.api.publish.PublishingExtension
+import org.gradle.api.publish.maven.MavenPublication
+import org.gradle.api.publish.maven.tasks.AbstractPublishToMaven
+import org.gradle.api.publish.maven.tasks.GenerateMavenPom
+import org.gradle.kotlin.dsl.*
+import org.gradle.plugins.signing.SigningExtension
+
+/** Configures common POM metadata (licenses, developers, SCM, etc.) for all Pkl publications. */
+fun Project.configurePklPomMetadata() {
+  extensions.configure<PublishingExtension> {
+    publications.withType<MavenPublication>().configureEach {
+      pom {
+        name.set(artifactId)
+        licenses {
+          license {
+            name.set("The Apache Software License, Version 2.0")
+            url.set("https://github.com/apple/pkl/blob/main/LICENSE.txt")
+          }
+        }
+        developers {
+          developer {
+            id.set("pkl-authors")
+            name.set("The Pkl Authors")
+            email.set("pkl-oss@group.apple.com")
+          }
+        }
+        scm {
+          connection.set("scm:git:git://github.com/apple/pkl.git")
+          developerConnection.set("scm:git:ssh://github.com/apple/pkl.git")
+          val buildInfo = extensions.getByType<BuildInfo>()
+          url.set("https://github.com/apple/pkl/tree/${buildInfo.commitish}")
+        }
+        issueManagement {
+          system.set("GitHub Issues")
+          url.set("https://github.com/apple/pkl/issues")
+        }
+        ciManagement {
+          system.set("GitHub Actions")
+          url.set("https://github.com/apple/pkl/actions")
+        }
+      }
+    }
+  }
+}
+
+/** Configures POM validation task to check for unresolved versions and snapshots in releases. */
+fun Project.configurePomValidation() {
+  val validatePom by
+    tasks.registering {
+      if (tasks.findByName("generatePomFileForLibraryPublication") == null) {
+        return@registering
+      }
+      val generatePomFileForLibraryPublication by tasks.existing(GenerateMavenPom::class)
+      val outputFile =
+        layout.buildDirectory.file("validatePom") // dummy output to satisfy up-to-date check
+
+      dependsOn(generatePomFileForLibraryPublication)
+      inputs.file(generatePomFileForLibraryPublication.get().destination)
+      outputs.file(outputFile)
+
+      doLast {
+        outputFile.get().asFile.delete()
+
+        val pomFile = generatePomFileForLibraryPublication.get().destination
+        assert(pomFile.exists())
+
+        val text = pomFile.readText()
+
+        run {
+          val unresolvedVersion = Regex("<version>.*[+,()\\[\\]].*</version>")
+          val matches = unresolvedVersion.findAll(text).toList()
+          if (matches.isNotEmpty()) {
+            throw org.gradle.api.GradleException(
+              """
+        Found unresolved version selector(s) in generated POM:
+        ${matches.joinToString("\n") { it.groupValues[0] }}
+      """
+                .trimIndent()
+            )
+          }
+        }
+
+        val buildInfo = project.extensions.getByType<BuildInfo>()
+        if (buildInfo.isReleaseBuild) {
+          val snapshotVersion = Regex("<version>.*-SNAPSHOT</version>")
+          val matches = snapshotVersion.findAll(text).toList()
+          if (matches.isNotEmpty()) {
+            throw org.gradle.api.GradleException(
+              """
+        Found snapshot version(s) in generated POM of Pkl release version:
+        ${matches.joinToString("\n") { it.groupValues[0] }}
+      """
+                .trimIndent()
+            )
+          }
+        }
+
+        outputFile.get().asFile.writeText("OK")
+      }
+    }
+
+  tasks.named("publish") { dependsOn(validatePom) }
+}
+
+/** Configures signing for Pkl publications. */
+fun Project.configurePklSigning() {
+  // Workaround for maven publish plugin not setting up dependencies correctly.
+  // Taken from https://github.com/gradle/gradle/issues/26091#issuecomment-1798137734
+  val dependsOnTasks = mutableListOf<String>()
+
+  tasks.withType<AbstractPublishToMaven>().configureEach {
+    dependsOnTasks.add(name.replace("publish", "sign").replaceAfter("Publication", ""))
+    dependsOn(dependsOnTasks)
+  }
+
+  extensions.configure<SigningExtension> {
+    // provided as env vars `ORG_GRADLE_PROJECT_signingKey` and
+    // `ORG_GRADLE_PROJECT_signingPassword` in CI.
+    val signingKey =
+      (findProperty("signingKey") as String?)?.let {
+        Base64.getDecoder().decode(it).toString(StandardCharsets.US_ASCII)
+      }
+    val signingPassword = findProperty("signingPassword") as String?
+    if (signingKey != null && signingPassword != null) {
+      useInMemoryPgpKeys(signingKey, signingPassword)
+    }
+    extensions.getByType<PublishingExtension>().publications.findByName("library")?.let { sign(it) }
+  }
+}

buildSrc/src/main/kotlin/ResolveSourcesJars.kt

@@ -1,3 +1,18 @@
+/*
+ * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 import org.gradle.api.DefaultTask
 import org.gradle.api.artifacts.Configuration
 import org.gradle.api.artifacts.result.ResolvedArtifactResult
@@ -12,27 +27,29 @@ import org.gradle.kotlin.dsl.property
 import org.gradle.language.base.artifact.SourcesArtifact
 
 open class ResolveSourcesJars : DefaultTask() {
-  @get:InputFiles
-  val configuration: Property<Configuration> = project.objects.property()
+  @get:InputFiles val configuration: Property<Configuration> = project.objects.property()
 
-  @get:OutputDirectory
-  val outputDir: DirectoryProperty = project.objects.directoryProperty()
+  @get:OutputDirectory val outputDir: DirectoryProperty = project.objects.directoryProperty()
 
   @TaskAction
   @Suppress("UnstableApiUsage", "unused")
   fun resolve() {
-    val componentIds = configuration.get().incoming.resolutionResult.allDependencies.map {
-      (it as ResolvedDependencyResult).selected.id
-    }
+    val componentIds =
+      configuration.get().incoming.resolutionResult.allDependencies.map {
+        (it as ResolvedDependencyResult).selected.id
+      }
 
-    val resolutionResult = project.dependencies.createArtifactResolutionQuery()
-      .forComponents(componentIds)
-      .withArtifacts(JvmLibrary::class.java, SourcesArtifact::class.java)
-      .execute()
+    val resolutionResult =
+      project.dependencies
+        .createArtifactResolutionQuery()
+        .forComponents(componentIds)
+        .withArtifacts(JvmLibrary::class.java, SourcesArtifact::class.java)
+        .execute()
 
-    val resolvedJars = resolutionResult.resolvedComponents
-      .flatMap { it.getArtifacts(SourcesArtifact::class.java) }
-      .map { (it as ResolvedArtifactResult).file }
+    val resolvedJars =
+      resolutionResult.resolvedComponents
+        .flatMap { it.getArtifacts(SourcesArtifact::class.java) }
+        .map { (it as ResolvedArtifactResult).file }
 
     // copying to an output dir because I don't know how else to describe task outputs
     project.sync {

buildSrc/src/main/kotlin/pklAllProjects.gradle.kts

@@ -1,10 +1,28 @@
-import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import com.diffplug.gradle.spotless.KotlinGradleExtension
+import org.gradle.accessors.dm.LibrariesForLibs
+import org.jetbrains.kotlin.gradle.dsl.JvmTarget
+import org.jetbrains.kotlin.gradle.tasks.KotlinJvmCompile
+
+plugins { id("com.diffplug.spotless") }
 
 val buildInfo = extensions.create<BuildInfo>("buildInfo", project)
 
-dependencyLocking {
-  lockAllConfigurations()
-}
+dependencyLocking { lockAllConfigurations() }
 
 configurations {
   val rejectedVersionSuffix = Regex("-alpha|-beta|-eap|-m|-rc|-snapshot", RegexOption.IGNORE_CASE)
@@ -13,8 +31,10 @@ configurations {
       componentSelection {
         all {
           if (rejectedVersionSuffix.containsMatchIn(candidate.version)) {
-            reject("Rejected dependency $candidate " +
-                "because it has a prelease version suffix matching `$rejectedVersionSuffix`.")
+            reject(
+              "Rejected dependency $candidate " +
+                "because it has a prelease version suffix matching `$rejectedVersionSuffix`."
+            )
           }
         }
       }
@@ -22,38 +42,35 @@ configurations {
   }
 }
 
-plugins.withType(JavaPlugin::class).configureEach {
-  val java = project.extensions.getByType<JavaPluginExtension>()
-  java.sourceCompatibility = JavaVersion.VERSION_11
-  java.targetCompatibility = JavaVersion.VERSION_11
+configurations.all {
+  resolutionStrategy.eachDependency {
+    if (requested.group == "org.jetbrains.kotlin") {
+      // prevent transitive deps from bumping Koltin version
+      useVersion(libs.versions.kotlin.get())
+    }
+  }
 }
 
-tasks.withType<KotlinCompile>().configureEach {
-  kotlinOptions {
-    jvmTarget = "11"
-    freeCompilerArgs = freeCompilerArgs + listOf("-Xjsr305=strict", "-Xjvm-default=all")
+plugins.withType(JavaPlugin::class).configureEach {
+  tasks.withType<JavaCompile>().configureEach { options.release = 17 }
+}
+
+tasks.withType<KotlinJvmCompile>().configureEach {
+  compilerOptions {
+    jvmTarget = JvmTarget.JVM_17
+    freeCompilerArgs.addAll("-Xjsr305=strict", "-Xjvm-default=all")
+    freeCompilerArgs.add("-Xjdk-release=17")
   }
 }
 
 plugins.withType(IdeaPlugin::class).configureEach {
-  val errorMessage = "Use IntelliJ Gradle import instead of running the `idea` task. See README for more information."
+  val errorMessage =
+    "Use IntelliJ Gradle import instead of running the `idea` task. See README for more information."
 
-  tasks.named("idea") {
-    doFirst {
-      throw GradleException(errorMessage)
-    }
-  }
-  tasks.named("ideaModule") {
-    doFirst {
-      throw GradleException(errorMessage)
-    }
-  }
+  tasks.named("idea") { doFirst { throw GradleException(errorMessage) } }
+  tasks.named("ideaModule") { doFirst { throw GradleException(errorMessage) } }
   if (project == rootProject) {
-    tasks.named("ideaProject") {
-      doFirst {
-        throw GradleException(errorMessage)
-      }
-    }
+    tasks.named("ideaProject") { doFirst { throw GradleException(errorMessage) } }
   }
 }
 
@@ -64,7 +81,7 @@ plugins.withType(MavenPublishPlugin::class).configureEach {
     repositories {
       maven {
         name = "projectLocal" // affects task names
-        url = uri("file:///$rootDir/build/m2")
+        url = rootDir.resolve("build/m2").toURI()
       }
     }
     // use resolved/locked (e.g., `1.15`)
@@ -72,11 +89,7 @@ plugins.withType(MavenPublishPlugin::class).configureEach {
     // dependency versions in generated POMs
     publications {
       withType(MavenPublication::class.java) {
-        versionMapping {
-          allVariants {
-            fromResolutionResult()
-          }
-        }
+        versionMapping { allVariants { fromResolutionResult() } }
       }
     }
   }
@@ -84,12 +97,80 @@ plugins.withType(MavenPublishPlugin::class).configureEach {
 
 // settings.gradle.kts sets `--write-locks`
 // if Gradle command line contains this task name
-val updateDependencyLocks by tasks.registering {
-  doLast {
-    configurations
-      .filter { it.isCanBeResolved }
-      .forEach { it.resolve() }
+val updateDependencyLocks by
+  tasks.registering {
+    doLast { configurations.filter { it.isCanBeResolved }.forEach { it.resolve() } }
+  }
+
+val allDependencies by tasks.registering(DependencyReportTask::class)
+
+tasks.withType(Test::class).configureEach {
+  System.getProperty("testReportsDir")?.let { reportsDir ->
+    reports.junitXml.outputLocation.set(file(reportsDir).resolve(project.name).resolve(name))
+  }
+  debugOptions {
+    enabled = System.getProperty("jvmdebug")?.toBoolean() ?: false
+    @Suppress("UnstableApiUsage")
+    host = "*"
+    port = 5005
+    suspend = true
+    server = true
   }
 }
 
-val allDependencies by tasks.registering(DependencyReportTask::class)
+tasks.withType(JavaExec::class).configureEach {
+  debugOptions {
+    enabled = System.getProperty("jvmdebug")?.toBoolean() ?: false
+    @Suppress("UnstableApiUsage")
+    host = "*"
+    port = 5005
+    suspend = true
+    server = true
+  }
+}
+
+// Version Catalog library symbols.
+private val libs = the<LibrariesForLibs>()
+
+private val licenseHeaderFile by lazy {
+  rootProject.file("buildSrc/src/main/resources/license-header.star-block.txt")
+}
+
+private fun KotlinGradleExtension.configureFormatter() {
+  ktfmt(libs.versions.ktfmt.get()).googleStyle()
+  licenseHeaderFile(licenseHeaderFile, "([a-zA-Z]|@file|//)")
+}
+
+val originalRemoteName = System.getenv("PKL_ORIGINAL_REMOTE_NAME") ?: "origin"
+// if we're running against a release branch (or a PR targeted at one), use that branch for
+// ratcheting
+// these env vars are set by GitHub actions:
+// https://docs.github.com/en/actions/reference/workflows-and-actions/variables#default-environment-variables
+val ratchetBranchName =
+  (System.getenv("GITHUB_BASE_REF") ?: System.getenv("GITHUB_REF_NAME"))?.let {
+    if (it.startsWith("release/")) it else null
+  } ?: "main"
+
+spotless {
+  ratchetFrom = "$originalRemoteName/$ratchetBranchName"
+
+  // When building root project, format buildSrc files too.
+  // We need this because buildSrc is not a subproject of the root project, so a top-level
+  // `spotlessApply` will not trigger `buildSrc:spotlessApply`.
+  if (project === rootProject) {
+    kotlinGradle {
+      configureFormatter()
+      target("*.kts", "buildSrc/*.kts", "buildSrc/src/*/kotlin/**/*.kts")
+    }
+    kotlin {
+      ktfmt(libs.versions.ktfmt.get()).googleStyle()
+      target("buildSrc/src/*/kotlin/**/*.kt")
+      licenseHeaderFile(licenseHeaderFile)
+    }
+  } else {
+    kotlinGradle {
+      configureFormatter()
+      target("*.kts")
+    }
+  }
+}

buildSrc/src/main/kotlin/pklFatJar.gradle.kts

@@ -1,6 +1,20 @@
+/*
+ * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 import org.gradle.api.GradleException
 import org.gradle.api.artifacts.Configuration
-import org.gradle.api.component.AdhocComponentWithVariants
 import org.gradle.api.publish.maven.MavenPublication
 import org.gradle.api.tasks.bundling.Jar
 import org.gradle.api.tasks.testing.Test
@@ -9,7 +23,7 @@ import org.gradle.kotlin.dsl.*
 plugins {
   `java-library`
   `maven-publish`
-  id("com.github.johnrengelman.shadow")
+  id("com.gradleup.shadow")
 }
 
 // make fat Jar available to other subprojects
@@ -18,45 +32,59 @@ val fatJarConfiguration: Configuration = configurations.create("fatJar")
 val fatJarPublication: MavenPublication = publishing.publications.create<MavenPublication>("fatJar")
 
 // ideally we'd configure this automatically based on project dependencies
-val firstPartySourcesJarsConfiguration: Configuration = configurations.create("firstPartySourcesJars")
+val firstPartySourcesJarsConfiguration: Configuration =
+  configurations.create("firstPartySourcesJars")
 
-val relocations = mapOf(
-  // pkl-core dependencies
-  "org.antlr.v4." to "org.pkl.thirdparty.antlr.v4.",
-  // https://github.com/oracle/graal/issues/1644 has been fixed,
-  // but native-image still fails when shading com.oracle.truffle 
-  //"com.oracle.truffle" to "org.pkl.thirdparty.truffle",
-  "org.graalvm." to "org.pkl.thirdparty.graalvm.",
-  "org.organicdesign.fp." to "org.pkl.thirdparty.paguro.",
-  "org.snakeyaml.engine." to "org.pkl.thirdparty.snakeyaml.engine.",
-  "org.msgpack." to "org.pkl.thirdparty.msgpack.",
-  "org.w3c.dom." to "org.pkl.thirdparty.w3c.dom",
-  "com.oracle.svm.core." to "org.pkl.thirdparty.svm.",
+val relocations =
+  mapOf(
+    // pkl-core dependencies
+    "org.organicdesign.fp." to "org.pkl.thirdparty.paguro.",
+    "org.snakeyaml.engine." to "org.pkl.thirdparty.snakeyaml.engine.",
+    "org.msgpack." to "org.pkl.thirdparty.msgpack.",
+    "org.w3c.dom." to "org.pkl.thirdparty.w3c.dom.",
+    "com.oracle.svm.core." to "org.pkl.thirdparty.svm.",
 
-  // pkl-cli dependencies
-  "org.jline." to "org.pkl.thirdparty.jline.",
-  "com.github.ajalt.clikt." to "org.pkl.thirdparty.clikt.",
-  "kotlin." to "org.pkl.thirdparty.kotlin.",
-  "kotlinx." to "org.pkl.thirdparty.kotlinx.",
-  "org.intellij." to "org.pkl.thirdparty.intellij.",
-  "org.fusesource.jansi." to "org.pkl.thirdparty.jansi",
-  "org.fusesource.hawtjni." to "org.pkl.thirdparty.hawtjni",
+    // pkl-cli dependencies
+    "org.jline." to "org.pkl.thirdparty.jline.",
+    "com.github.ajalt.clikt." to "org.pkl.thirdparty.clikt.",
+    "com.github.ajalt.colormath." to "org.pkl.thirdparty.colormath.",
+    "com.github.ajalt.mordant." to "org.pkl.thirdparty.mordant.",
+    "com.sun.jna." to "org.pkl.thirdparty.jna.",
+    "kotlin." to "org.pkl.thirdparty.kotlin.",
+    "kotlinx." to "org.pkl.thirdparty.kotlinx.",
+    "org.intellij." to "org.pkl.thirdparty.intellij.",
+    "org.fusesource.jansi." to "org.pkl.thirdparty.jansi.",
+    "org.fusesource.hawtjni." to "org.pkl.thirdparty.hawtjni.",
 
-  // pkl-doc dependencies
-  "org.commonmark." to "org.pkl.thirdparty.commonmark.",
-  "org.jetbrains." to "org.pkl.thirdparty.jetbrains.",
-  
-  // pkl-config-java dependencies
-  "io.leangen.geantyref." to "org.pkl.thirdparty.geantyref.",
+    // pkl-doc dependencies
+    "org.commonmark." to "org.pkl.thirdparty.commonmark.",
+    "org.jetbrains." to "org.pkl.thirdparty.jetbrains.",
+    "_COROUTINE." to "org.pkl.thirdparty.kotlinx._COROUTINE.",
 
-  // pkl-codegen-java dependencies
-  "com.squareup.javapoet." to "org.pkl.thirdparty.javapoet.",
+    // pkl-config-java dependencies
+    "io.leangen.geantyref." to "org.pkl.thirdparty.geantyref.",
 
-  // pkl-codegen-kotlin dependencies
-  "com.squareup.kotlinpoet." to "org.pkl.thirdparty.kotlinpoet.",
-)
+    // pkl-codegen-java dependencies
+    "com.palantir.javapoet." to "org.pkl.thirdparty.javapoet.",
 
-val nonRelocations = listOf("com/oracle/truffle/")
+    // pkl-codegen-kotlin dependencies
+    "com.squareup.kotlinpoet." to "org.pkl.thirdparty.kotlinpoet.",
+  )
+
+for ((key, value) in relocations) {
+  if (!key.endsWith(".")) {
+    throw GradleException(
+      "Invalid relocation `\"$key\" to \"$value\"`: `$key` should end with a dot"
+    )
+  }
+  if (!value.endsWith(".")) {
+    throw GradleException(
+      "Invalid relocation `\"$key\" to \"$value\"`: `$value` should end with a dot"
+    )
+  }
+}
+
+val nonRelocations = listOf("com/oracle/truffle/", "org/graalvm/")
 
 tasks.shadowJar {
   inputs.property("relocations", relocations)
@@ -65,12 +93,32 @@ tasks.shadowJar {
 
   configurations = listOf(project.configurations.runtimeClasspath.get())
 
+  addMultiReleaseAttribute = true
+
+  // not required at runtime / fat JARs can't be used in native-image builds anyway
+  exclude("org/pkl/cli/svm/**")
+
   exclude("META-INF/maven/**")
   exclude("META-INF/upgrade/**")
-  exclude("META-INF/versions/19/**")
 
-  // org.antlr.v4.runtime.misc.RuleDependencyProcessor
-  exclude("META-INF/services/javax.annotation.processing.Processor")
+  exclude("DebugProbesKt.bin")
+
+  val info = project.extensions.getByType<BuildInfo>()
+  val minimumJvmTarget = JavaVersion.toVersion(info.jvmTarget)
+
+  manifest.attributes(
+    // Certain exports need to be added to the Java modulepath for Java 17 to work properly with
+    // shaded JARs. See the following link for an explanation of this syntax:
+    // https://bugs.openjdk.org/browse/JDK-8335225
+    "Add-Exports" to info.jpmsExportsForJarManifest
+  )
+
+  // effectively, this results in calls excluding:
+  // `META-INF/versions/{18-25}/**`
+  // at the time of this writing; multi-release JARs beyond JDK 21 break the current
+  // version of the Shadow plugin, and aren't needed for Truffle's use by Pkl.
+  JavaVersionRange.startingAt(JavaLanguageVersion.of(minimumJvmTarget.majorVersion.toInt() + 1))
+    .forEach { exclude("META-INF/versions/${it.asInt()}/**") }
 
   exclude("module-info.*")
 
@@ -82,101 +130,93 @@ tasks.shadowJar {
   mergeServiceFiles()
 }
 
-// workaround for https://github.com/johnrengelman/shadow/issues/651
-components.withType(AdhocComponentWithVariants::class.java).forEach { c ->
-  c.withVariantsFromConfiguration(project.configurations.shadowRuntimeElements.get()) {
-    skip()
+shadow { addShadowVariantIntoJavaComponent = false }
+
+val testFatJar by
+  tasks.registering(Test::class) {
+    testClassesDirs = files(tasks.test.get().testClassesDirs)
+    classpath =
+      // compiled test classes
+      sourceSets.test.get().output +
+        // fat Jar
+        tasks.shadowJar.get().outputs.files +
+        // test-only dependencies
+        // (test dependencies that are also main dependencies must already be contained in fat Jar;
+        // to verify that, we don't want to include them here)
+        (configurations.testRuntimeClasspath.get() - configurations.runtimeClasspath.get())
   }
-}
 
-val testFatJar by tasks.registering(Test::class) {
-  testClassesDirs = files(tasks.test.get().testClassesDirs)
-  classpath =
-    // compiled test classes
-    sourceSets.test.get().output +
-      // fat Jar
-      tasks.shadowJar.get().outputs.files +
-      // test-only dependencies
-      // (test dependencies that are also main dependencies must already be contained in fat Jar;
-      // to verify that, we don't want to include them here)
-      (configurations.testRuntimeClasspath.get() - configurations.runtimeClasspath.get())
-}
+tasks.check { dependsOn(testFatJar) }
 
-tasks.check {
-  dependsOn(testFatJar)
-}
+val validateFatJar by
+  tasks.registering {
+    val outputFile = layout.buildDirectory.file("validateFatJar/result.txt")
+    inputs.files(tasks.shadowJar)
+    inputs.property("nonRelocations", nonRelocations)
+    outputs.file(outputFile)
 
-val validateFatJar by tasks.registering {
-  val outputFile = file("$buildDir/validateFatJar/result.txt")
-  inputs.files(tasks.shadowJar)
-  inputs.property("nonRelocations", nonRelocations)
-  outputs.file(outputFile)
-
-  doLast {
-    val unshadowedFiles = mutableListOf<String>()
-    zipTree(tasks.shadowJar.get().outputs.files.singleFile).visit {
-      val fileDetails = this
-      val path = fileDetails.relativePath.pathString
-      if (!(fileDetails.isDirectory ||
-          path.startsWith("org/pkl/") ||
-          path.startsWith("META-INF/") || 
-          nonRelocations.any { path.startsWith(it) })) {
-        // don't throw exception inside `visit` 
-        // as this gives a misleading "Could not expand ZIP" error message
-        unshadowedFiles.add(path)
+    doLast {
+      val unshadowedFiles = mutableListOf<String>()
+      zipTree(tasks.shadowJar.get().outputs.files.singleFile).visit {
+        val fileDetails = this
+        val path = fileDetails.relativePath.pathString
+        if (
+          !(fileDetails.isDirectory ||
+            path.startsWith("org/pkl/") ||
+            path.startsWith("META-INF/") ||
+            nonRelocations.any { path.startsWith(it) })
+        ) {
+          // don't throw exception inside `visit`
+          // as this gives a misleading "Could not expand ZIP" error message
+          unshadowedFiles.add(path)
+        }
+      }
+      if (unshadowedFiles.isEmpty()) {
+        outputFile.get().asFile.writeText("SUCCESS")
+      } else {
+        outputFile.get().asFile.writeText("FAILURE")
+        throw GradleException("Found unshadowed files:\n" + unshadowedFiles.joinToString("\n"))
       }
     }
-    if (unshadowedFiles.isEmpty()) {
-      outputFile.writeText("SUCCESS")
-    } else {
-      outputFile.writeText("FAILURE")
-      throw GradleException("Found unshadowed files:\n" + unshadowedFiles.joinToString("\n"))
-    }
   }
-}
-tasks.check {
-  dependsOn(validateFatJar)
-}
 
-val resolveSourcesJars by tasks.registering(ResolveSourcesJars::class) {
-  configuration.set(configurations.runtimeClasspath)
-  outputDir.set(project.file("$buildDir/resolveSourcesJars"))
-}
+tasks.check { dependsOn(validateFatJar) }
 
-val fatSourcesJar by tasks.registering(MergeSourcesJars::class) {
-  plugins.withId("pklJavaLibrary") {
-    inputJars.from(tasks.named("sourcesJar"))
+val resolveSourcesJars by
+  tasks.registering(ResolveSourcesJars::class) {
+    configuration.set(configurations.runtimeClasspath)
+    outputDir.set(layout.buildDirectory.dir("resolveSourcesJars"))
   }
-  inputJars.from(firstPartySourcesJarsConfiguration)
-  inputJars.from(resolveSourcesJars.map { fileTree(it.outputDir) })
 
-  mergedBinaryJars.from(tasks.shadowJar)
-  relocatedPackages.set(relocations)
-  outputJar.fileProvider(provider {
-    file(tasks.shadowJar.get().archiveFile.get().asFile.path.replace(".jar", "-sources.jar"))
-  })
-}
+val fatSourcesJar by
+  tasks.registering(MergeSourcesJars::class) {
+    plugins.withId("pklJavaLibrary") { inputJars.from(tasks.named("sourcesJar")) }
+    inputJars.from(firstPartySourcesJarsConfiguration)
+    inputJars.from(resolveSourcesJars.map { fileTree(it.outputDir) })
 
-artifacts {
-  add("fatJar", tasks.shadowJar)
-}
+    mergedBinaryJars.from(tasks.shadowJar)
+    relocatedPackages.set(relocations)
+    outputJar.fileProvider(
+      provider {
+        file(tasks.shadowJar.get().archiveFile.get().asFile.path.replace(".jar", "-sources.jar"))
+      }
+    )
+  }
+
+artifacts { add("fatJar", tasks.shadowJar) }
 
 publishing {
   publications {
     named<MavenPublication>("fatJar") {
-      project.shadow.component(this)
+      from(components["shadow"])
 
       // sources Jar is fat
-      artifact(fatSourcesJar.flatMap { it.outputJar.asFile }) {
-        classifier = "sources"
-      }
+      artifact(fatSourcesJar.flatMap { it.outputJar.asFile }) { classifier = "sources" }
 
       plugins.withId("pklJavaLibrary") {
         val javadocJar by tasks.existing(Jar::class)
         // Javadoc Jar is not fat (didn't invest effort)
-        artifact(javadocJar.flatMap { it.archiveFile }) {
-          classifier = "javadoc"
-        }
+        artifact(javadocJar.flatMap { it.archiveFile }) { classifier = "javadoc" }
       }
     }
   }

buildSrc/src/main/kotlin/pklGraalVm.gradle.kts

@@ -1,85 +1,74 @@
-import java.nio.file.*
-import java.util.UUID
+/*
+ * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 import de.undercouch.gradle.tasks.download.Download
 import de.undercouch.gradle.tasks.download.Verify
 
-plugins {
-  id("de.undercouch.download")
-}
+plugins { id("de.undercouch.download") }
 
 val buildInfo = project.extensions.getByType<BuildInfo>()
 
-val homeDir = buildInfo.graalVm.homeDir
-val baseName = buildInfo.graalVm.baseName
-val installDir = buildInfo.graalVm.installDir
-val downloadUrl = buildInfo.graalVm.downloadUrl
-val downloadFile = file(homeDir).resolve("$baseName.tar.gz")
-
 // tries to minimize chance of corruption by download-to-temp-file-and-move
-val downloadGraalVm by tasks.registering(Download::class) {
-  onlyIf {
-    !installDir.exists()
-  }
+val downloadGraalVmAarch64 by
+  tasks.registering(Download::class) { configureDownloadGraalVm(buildInfo.graalVmAarch64) }
 
-  src(downloadUrl)
-  dest(downloadFile)
+val downloadGraalVmAmd64 by
+  tasks.registering(Download::class) { configureDownloadGraalVm(buildInfo.graalVmAmd64) }
+
+fun Download.configureDownloadGraalVm(graalvm: BuildInfo.GraalVm) {
+  onlyIf { !graalvm.installDir.exists() }
+  doLast { println("Downloaded GraalVm to ${graalvm.downloadFile}") }
+
+  src(graalvm.downloadUrl)
+  dest(graalvm.downloadFile)
   overwrite(false)
   tempAndMove(true)
 }
 
-val verifyGraalVm by tasks.registering(Verify::class) {
-  onlyIf {
-    !installDir.exists()
+val verifyGraalVmAarch64 by
+  tasks.registering(Verify::class) {
+    configureVerifyGraalVm(buildInfo.graalVmAarch64)
+    dependsOn(downloadGraalVmAarch64)
   }
 
-  dependsOn(downloadGraalVm)
-  src(downloadFile)
-  checksum(buildInfo.libs.findVersion("graalVmSha256-${buildInfo.graalVm.osName}-${buildInfo.graalVm.arch}").get().toString())
+val verifyGraalVmAmd64 by
+  tasks.registering(Verify::class) {
+    configureVerifyGraalVm(buildInfo.graalVmAmd64)
+    dependsOn(downloadGraalVmAmd64)
+  }
+
+fun Verify.configureVerifyGraalVm(graalvm: BuildInfo.GraalVm) {
+  onlyIf { !graalvm.installDir.exists() }
+
+  src(graalvm.downloadFile)
+  checksum(
+    buildInfo.libs.findVersion("graalVmSha256-${graalvm.osName}-${graalvm.arch}").get().toString()
+  )
   algorithm("SHA-256")
 }
 
-// minimize chance of corruption by extract-to-random-dir-and-flip-symlink
-val installGraalVm by tasks.registering {
-  dependsOn(verifyGraalVm)
-
-  onlyIf {
-    !installDir.exists()
+@Suppress("unused")
+val installGraalVmAarch64 by
+  tasks.registering(InstallGraalVm::class) {
+    dependsOn(verifyGraalVmAarch64)
+    graalVm = buildInfo.graalVmAarch64
   }
 
-  doLast {
-    val distroDir = "$homeDir/${UUID.randomUUID()}"
-
-    try {
-      mkdir(distroDir)
-
-      println("Extracting $downloadFile into $distroDir")
-      // faster and more reliable than Gradle's `copy { from tarTree() }`
-      exec {
-        workingDir = file(distroDir)
-        executable = "tar"
-        args("--strip-components=1", "-xzf", downloadFile)
-      }
-
-      val distroBinDir = if (buildInfo.os.isMacOsX) "$distroDir/Contents/Home/bin" else "$distroDir/bin"
-
-      println("Installing native-image into $distroDir")
-      exec {
-        executable = "$distroBinDir/gu"
-        args("install", "--no-progress", "native-image")
-      }
-
-      println("Creating symlink $installDir for $distroDir")
-      val tempLink = Paths.get("$homeDir/${UUID.randomUUID()}")
-      Files.createSymbolicLink(tempLink, Paths.get(distroDir))
-      try {
-        Files.move(tempLink, installDir.toPath(), StandardCopyOption.ATOMIC_MOVE)
-      } catch (e: Exception) {
-        try { delete(tempLink.toFile()) } catch (ignored: Exception) {}
-        throw e
-      }
-    } catch (e: Exception) {
-      try { delete(distroDir) } catch (ignored: Exception) {}
-      throw e
-    }
+@Suppress("unused")
+val installGraalVmAmd64 by
+  tasks.registering(InstallGraalVm::class) {
+    dependsOn(verifyGraalVmAmd64)
+    graalVm = buildInfo.graalVmAmd64
   }
-}

buildSrc/src/main/kotlin/pklGradlePluginTest.gradle.kts

@@ -1,19 +1,19 @@
-/**
- * Allows to run Gradle plugin tests against different Gradle versions.
+/*
+ * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
  *
- * Adds a `compatibilityTestX` task for every Gradle version X
- * between `ext.minSupportedGradleVersion` and `ext.maxSupportedGradleVersion`
- * that is not in `ext.gradleVersionsExcludedFromTesting`.
- * The list of available Gradle versions is obtained from services.gradle.org.
- * Adds lifecycle tasks to test against multiple Gradle versions at once, for example all Gradle release versions.
- * Compatibility test tasks run the same tests and use the same task configuration as the project's `test` task.
- * They set system properties for the Gradle version and distribution URL to be used.
- * These properties are consumed by the `AbstractTest` class.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
  */
-
-plugins {
-  java
-}
+plugins { java }
 
 val gradlePluginTests = extensions.create<GradlePluginTests>("gradlePluginTests")
 
@@ -24,18 +24,26 @@ tasks.addRule("Pattern: compatibilityTest[All|Releases|Latest|Candidate|Nightly|
   when (val taskNameSuffix = matchResult.groupValues[1]) {
     "All" ->
       task("compatibilityTestAll") {
-        dependsOn("compatibilityTestReleases", "compatibilityTestCandidate", "compatibilityTestNightly")
+        dependsOn(
+          "compatibilityTestReleases",
+          "compatibilityTestCandidate",
+          "compatibilityTestNightly",
+        )
       }
     // releases in configured range
     "Releases" ->
       task("compatibilityTestReleases") {
         val versionInfos = GradleVersionInfo.fetchReleases()
-        val versionsToTestAgainst = versionInfos.filter { versionInfo ->
-          val v = versionInfo.gradleVersion
-          !versionInfo.broken &&
-              v in gradlePluginTests.minGradleVersion..gradlePluginTests.maxGradleVersion &&
-              v !in gradlePluginTests.skippedGradleVersions
-        }
+        val allVersions =
+          versionInfos
+            .filter { versionInfo ->
+              val v = versionInfo.gradleVersion
+              !versionInfo.broken &&
+                v in gradlePluginTests.minGradleVersion..gradlePluginTests.maxGradleVersion &&
+                v !in gradlePluginTests.skippedGradleVersions
+            }
+            .sortedBy { it.gradleVersion }
+        val versionsToTestAgainst = listOf(allVersions.first(), allVersions.last())
 
         dependsOn(versionsToTestAgainst.map { createCompatibilityTestTask(it) })
       }
@@ -45,8 +53,10 @@ tasks.addRule("Pattern: compatibilityTest[All|Releases|Latest|Candidate|Nightly|
         val versionInfo = GradleVersionInfo.fetchCurrent()
         if (versionInfo.version == gradle.gradleVersion) {
           doLast {
-            println("No new Gradle release available. " +
-                "(Run `gradlew test` to test against ${versionInfo.version}.)")
+            println(
+              "No new Gradle release available. " +
+                "(Run `gradlew test` to test against ${versionInfo.version}.)"
+            )
           }
         } else {
           dependsOn(createCompatibilityTestTask(versionInfo))
@@ -59,9 +69,7 @@ tasks.addRule("Pattern: compatibilityTest[All|Releases|Latest|Candidate|Nightly|
         if (versionInfo?.activeRc == true) {
           dependsOn(createCompatibilityTestTask(versionInfo))
         } else {
-          doLast {
-            println("No active Gradle release candidate available.")
-          }
+          doLast { println("No active Gradle release candidate available.") }
         }
       }
     // latest nightly
@@ -73,17 +81,17 @@ tasks.addRule("Pattern: compatibilityTest[All|Releases|Latest|Candidate|Nightly|
     // explicit version
     else ->
       createCompatibilityTestTask(
-          taskNameSuffix,
-          "https://services.gradle.org/distributions-snapshots/gradle-$taskNameSuffix-bin.zip"
+        taskNameSuffix,
+        "https://services.gradle.org/distributions-snapshots/gradle-$taskNameSuffix-bin.zip",
       )
   }
 }
 
-fun createCompatibilityTestTask(versionInfo: GradleVersionInfo): Task =
-    createCompatibilityTestTask(versionInfo.version, versionInfo.downloadUrl)
+fun createCompatibilityTestTask(versionInfo: GradleVersionInfo): TaskProvider<Test> =
+  createCompatibilityTestTask(versionInfo.version, versionInfo.downloadUrl)
 
-fun createCompatibilityTestTask(version: String, downloadUrl: String): Task {
-  return tasks.create("compatibilityTest$version", Test::class.java) {
+fun createCompatibilityTestTask(version: String, downloadUrl: String): TaskProvider<Test> {
+  return tasks.register("compatibilityTest$version", Test::class.java) {
     mustRunAfter(tasks.test)
 
     maxHeapSize = tasks.test.get().maxHeapSize

buildSrc/src/main/kotlin/pklHtmlValidator.gradle.kts

@@ -1,20 +1,33 @@
-plugins {
-  base
-}
+/*
+ * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+plugins { base }
 
 val htmlValidator = extensions.create<HtmlValidator>("htmlValidator", project)
 
 val buildInfo = project.extensions.getByType<BuildInfo>()
 
-val validatorConfiguration: Configuration = configurations.create("validator") {
-  resolutionStrategy.eachDependency {
-    if (requested.group == "log4j" && requested.name == "log4j") {
-      @Suppress("UnstableApiUsage")
-      useTarget(buildInfo.libs.findLibrary("log4j12Api").get())
-      because("mitigate critical security vulnerabilities")
+val validatorConfiguration: Configuration =
+  configurations.create("validator") {
+    resolutionStrategy.eachDependency {
+      if (requested.group == "log4j" && requested.name == "log4j") {
+        @Suppress("UnstableApiUsage") useTarget(buildInfo.libs.findLibrary("log4j12Api").get())
+        because("mitigate critical security vulnerabilities")
+      }
     }
   }
-}
 
 dependencies {
   @Suppress("UnstableApiUsage")
@@ -32,27 +45,29 @@ dependencies {
   }
 }
 
-val validateHtml by tasks.registering(JavaExec::class) {
-  val resultFile = file("$buildDir/validateHtml/result.txt")
-  inputs.files(htmlValidator.sources)
-  outputs.file(resultFile)
+val validateHtml by
+  tasks.registering(JavaExec::class) {
+    val resultFile = layout.buildDirectory.file("validateHtml/result.txt")
+    inputs.files(htmlValidator.sources)
+    outputs.file(resultFile)
 
-  classpath = validatorConfiguration
-  mainClass.set("nu.validator.client.SimpleCommandLineValidator")
-  args("--skip-non-html") // --also-check-css doesn't work (still checks css as html), so limit to html files
-  args("--filterpattern", "(.*)Consider adding “lang=(.*)")
-  args("--filterpattern", "(.*)Consider adding a “lang” attribute(.*)")
-  args("--filterpattern", "(.*)unrecognized media “amzn-kf8”(.*)") // kindle
-  // for debugging
-  // args "--verbose"
-  args(htmlValidator.sources)
+    classpath = validatorConfiguration
+    mainClass.set("nu.validator.client.SimpleCommandLineValidator")
+    args(
+      "--skip-non-html"
+    ) // --also-check-css doesn't work (still checks css as html), so limit to html files
+    args("--filterpattern", "(.*)Consider adding “lang=(.*)")
+    args("--filterpattern", "(.*)Consider adding a “lang” attribute(.*)")
+    args("--filterpattern", "(.*)unrecognized media “amzn-kf8”(.*)") // kindle
+    // for debugging
+    // args "--verbose"
+    args(htmlValidator.sources)
 
-  // write a basic result file s.t. gradle can consider task up-to-date
-  // writing a result file in case validation fails is not easily possible with JavaExec, but also not strictly necessary
-  doFirst { project.delete(resultFile) }
-  doLast { resultFile.writeText("Success.") }
-}
+    // write a basic result file s.t. gradle can consider task up-to-date
+    // writing a result file in case validation fails is not easily possible with JavaExec, but also
+    // not strictly necessary
+    doFirst { project.delete(resultFile) }
+    doLast { resultFile.get().asFile.writeText("Success.") }
+  }
 
-tasks.check {
-  dependsOn(validateHtml)
-}
+tasks.check { dependsOn(validateHtml) }

buildSrc/src/main/kotlin/pklJavaExecutable.gradle.kts

@@ -0,0 +1,131 @@
+/*
+ * Copyright © 2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import kotlin.io.path.createDirectories
+import kotlin.io.path.writeText
+import org.gradle.kotlin.dsl.support.serviceOf
+
+plugins {
+  id("pklJavaLibrary")
+  //  id("pklPublishLibrary")
+  id("com.gradleup.shadow")
+}
+
+val executableSpec = project.extensions.create("executable", ExecutableSpec::class.java)
+val buildInfo = project.extensions.getByType<BuildInfo>()
+
+val javaExecutable by
+  tasks.registering(ExecutableJar::class) {
+    group = "build"
+    dependsOn(tasks.jar)
+    inJar = tasks.shadowJar.flatMap { it.archiveFile }
+    val effectiveJavaName =
+      executableSpec.javaName.map { name -> if (buildInfo.os.isWindows) "$name.bat" else name }
+    outJar = layout.buildDirectory.dir("executable").flatMap { it.file(effectiveJavaName) }
+
+    // uncomment for debugging
+    // jvmArgs.addAll("-ea", "-agentlib:jdwp=transport=dt_socket,server=y,suspend=y,address=5005")
+  }
+
+fun Task.setupTestStartJavaExecutable(launcher: Provider<JavaLauncher>? = null) {
+  group = "verification"
+  dependsOn(javaExecutable)
+
+  // dummy output to satisfy up-to-date check
+  val outputFile = layout.buildDirectory.file("testStartJavaExecutable/$name")
+  outputs.file(outputFile)
+
+  val execOutput =
+    providers.exec {
+      val executablePath = javaExecutable.get().outputs.files.singleFile
+      if (launcher?.isPresent == true) {
+        commandLine(
+          launcher.get().executablePath.asFile.absolutePath,
+          "-jar",
+          executablePath.absolutePath,
+          "--version",
+        )
+      } else {
+        commandLine(executablePath.absolutePath, "--version")
+      }
+    }
+
+  doLast {
+    val outputText = execOutput.standardOutput.asText.get()
+    if (!outputText.contains(buildInfo.pklVersionNonUnique)) {
+      throw GradleException(
+        "Expected version output to contain current version (${buildInfo.pklVersionNonUnique}), but got '$outputText'"
+      )
+    }
+    outputFile.get().asFile.toPath().apply {
+      try {
+        parent.createDirectories()
+      } catch (ignored: java.nio.file.FileAlreadyExistsException) {}
+      writeText("OK")
+    }
+  }
+}
+
+val testStartJavaExecutable by tasks.registering { setupTestStartJavaExecutable() }
+
+// Setup `testStartJavaExecutable` tasks for multi-JDK testing.
+val testStartJavaExecutableOnOtherJdks =
+  buildInfo.jdkTestRange.map { jdkTarget ->
+    tasks.register("testStartJavaExecutableJdk${jdkTarget.asInt()}") {
+      enabled = buildInfo.isVersionEnabled(jdkTarget)
+      val toolChainService: JavaToolchainService = serviceOf()
+      val launcher = toolChainService.launcherFor { languageVersion = jdkTarget }
+      setupTestStartJavaExecutable(launcher)
+    }
+  }
+
+tasks.assemble { dependsOn(javaExecutable) }
+
+tasks.check {
+  dependsOn(testStartJavaExecutable)
+  dependsOn(testStartJavaExecutableOnOtherJdks)
+}
+
+// publishing {
+//  publications {
+//    // need to put in `afterEvaluate` because `artifactId` cannot be set lazily.
+//    project.afterEvaluate {
+//      register<MavenPublication>("javaExecutable") {
+//        artifactId = executableSpec.javaPublicationName.get()
+//
+//        artifact(javaExecutable.map { it.outputs.files.singleFile }) {
+//          classifier = null
+//          extension = "bin"
+//          builtBy(javaExecutable)
+//        }
+//
+//        pom {
+//          url = executableSpec.website
+//          description =
+//            executableSpec.documentationName.map { name ->
+//              """
+//            $name executable for Java.
+//            Can be executed directly, or with `java -jar <path/to/jpkl>`.
+//            Requires Java 17 or higher.
+//            """
+//                .trimIndent()
+//            }
+//        }
+//      }
+//    }
+//  }
+// }
+
+// signing { project.afterEvaluate { sign(publishing.publications["javaExecutable"]) } }

buildSrc/src/main/kotlin/pklJavaLibrary.gradle.kts

@@ -1,17 +1,47 @@
-@file:Suppress("HttpUrlsUsage")
+/*
+ * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+@file:Suppress("HttpUrlsUsage", "unused")
+
+import org.gradle.accessors.dm.LibrariesForLibs
 
 plugins {
   `java-library`
+  `jvm-toolchains`
+  `jvm-test-suite`
   id("pklKotlinTest")
   id("com.diffplug.spotless")
 }
 
 // make sources Jar available to other subprojects
-val sourcesJarConfiguration = configurations.register("sourcesJar")
+val sourcesJarConfiguration: Provider<Configuration> = configurations.register("sourcesJar")
+
+// Version Catalog library symbols.
+val libs = the<LibrariesForLibs>()
+
+// Build configuration.
+val info = project.extensions.getByType<BuildInfo>()
 
 java {
   withSourcesJar() // creates `sourcesJar` task
   withJavadocJar()
+
+  toolchain {
+    languageVersion = info.jdkToolchainVersion
+    vendor = info.jdkVendor
+  }
 }
 
 artifacts {
@@ -21,19 +51,26 @@ artifacts {
 
 spotless {
   java {
-    googleJavaFormat("1.15.0")
-    targetExclude("**/generated/**", "**/build/**")
+    googleJavaFormat(libs.versions.googleJavaFormat.get())
+    target("src/*/java/**/*.java")
+    licenseHeaderFile(rootProject.file("buildSrc/src/main/resources/license-header.star-block.txt"))
+  }
+  kotlin {
+    ktfmt(libs.versions.ktfmt.get()).googleStyle()
+    target("src/*/kotlin/**/*.kt")
     licenseHeaderFile(rootProject.file("buildSrc/src/main/resources/license-header.star-block.txt"))
   }
 }
 
-tasks.compileKotlin {
-  enabled = false
-}
+tasks.compileKotlin { enabled = false }
 
 tasks.jar {
   manifest {
-    attributes += mapOf("Automatic-Module-Name" to "org.${project.name.replace("-", ".")}")
+    attributes +=
+      mapOf(
+        "Automatic-Module-Name" to "org.${project.name.replace("-", ".")}",
+        "Add-Exports" to info.jpmsExportsForJarManifest,
+      )
   }
 }
 
@@ -44,16 +81,59 @@ tasks.javadoc {
   (options as StandardJavadocDocletOptions).addStringOption("Xdoclint:none", "-quiet")
 }
 
-val workAroundKotlinGradlePluginBug by tasks.registering {
-  doLast {
-    // Works around this problem, which sporadically appears and disappears in different subprojects:
-    // A problem was found with the configuration of task ':pkl-executor:compileJava' (type 'JavaCompile').
-    // > Directory '[...]/pkl/pkl-executor/build/classes/kotlin/main'
-    // specified for property 'compileKotlinOutputClasses' does not exist.
-    file("$buildDir/classes/kotlin/main").mkdirs()
+val workAroundKotlinGradlePluginBug by
+  tasks.registering {
+    doLast {
+      // Works around this problem, which sporadically appears and disappears in different
+      // subprojects:
+      // A problem was found with the configuration of task ':pkl-executor:compileJava' (type
+      // 'JavaCompile').
+      // > Directory '[...]/pkl/pkl-executor/build/classes/kotlin/main'
+      // specified for property 'compileKotlinOutputClasses' does not exist.
+      layout.buildDirectory.dir("classes/kotlin/main").get().asFile.mkdirs()
+    }
   }
-}
+
+val truffleJavacArgs =
+  listOf(
+    // TODO: determine correct limits for Truffle specializations
+    // (see https://graalvm.slack.com/archives/CNQSB2DHD/p1712380902746829)
+    "-Atruffle.dsl.SuppressWarnings=truffle-limit"
+  )
 
 tasks.compileJava {
+  javaCompiler = info.javaCompiler
   dependsOn(workAroundKotlinGradlePluginBug)
+  options.compilerArgs.addAll(truffleJavacArgs + info.jpmsAddModulesFlags)
 }
+
+tasks.withType<JavaCompile>().configureEach {
+  javaCompiler = info.javaCompiler
+  options.release = info.jvmTarget
+}
+
+tasks.withType<JavaExec>().configureEach { jvmArgs(info.jpmsAddModulesFlags) }
+
+fun Test.configureJdkTestTask(launcher: Provider<JavaLauncher>) {
+  useJUnitPlatform()
+  javaLauncher = launcher
+  systemProperties.putAll(info.testProperties)
+  jvmArgs.addAll(info.jpmsAddModulesFlags)
+}
+
+tasks.test { configureJdkTestTask(info.javaTestLauncher) }
+
+// Prepare test tasks for each JDK version which is within the test target suite for Pkl. Each task
+// uses a pinned JDK toolchain version, and is named for the major version which is tested.
+//
+// Test tasks configured in this manner are executed manually by name, e.g. `./gradlew testJdk11`,
+// and automatically as dependencies of `check`.
+//
+// We omit the current JDK from this list because it is already tested, in effect, by the default
+// `test` task.
+//
+// Pkl subprojects may elect to further configure these tasks as needed; by default, each task
+// inherits the configuration of the default `test` task (aside from an overridden launcher).
+val jdkTestTasks = info.multiJdkTestingWith(tasks.test) { (_, jdk) -> configureJdkTestTask(jdk) }
+
+tasks.check { dependsOn(jdkTestTasks) }

buildSrc/src/main/kotlin/pklKotlinLibrary.gradle.kts

@@ -1,11 +1,34 @@
+/*
+ * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import org.gradle.accessors.dm.LibrariesForLibs
+import org.jetbrains.kotlin.gradle.dsl.JvmTarget
+import org.jetbrains.kotlin.gradle.dsl.KotlinVersion
+import org.jetbrains.kotlin.gradle.tasks.KotlinJvmCompile
+
 plugins {
   id("pklJavaLibrary")
-
   kotlin("jvm")
 }
 
+// Build configuration.
 val buildInfo = project.extensions.getByType<BuildInfo>()
 
+// Version Catalog library symbols.
+val libs = the<LibrariesForLibs>()
+
 dependencies {
   // At least some of our kotlin APIs contain Kotlin stdlib types
   // that aren't compiled away by kotlinc (e.g., `kotlin.Function`).
@@ -19,10 +42,10 @@ tasks.compileKotlin {
   enabled = true // disabled by pklJavaLibrary
 }
 
-spotless {
-  kotlin {
-    ktfmt("0.44").googleStyle()
-    targetExclude("**/generated/**", "**/build/**")
-    licenseHeaderFile(rootProject.file("buildSrc/src/main/resources/license-header.star-block.txt"))
+tasks.withType<KotlinJvmCompile>().configureEach {
+  compilerOptions {
+    languageVersion = KotlinVersion.KOTLIN_2_1
+    jvmTarget = JvmTarget.fromTarget(buildInfo.jvmTarget.toString())
+    freeCompilerArgs.addAll("-Xjdk-release=${buildInfo.jvmTarget}")
   }
 }

buildSrc/src/main/kotlin/pklKotlinTest.gradle.kts

@@ -1,19 +1,39 @@
-import org.gradle.api.tasks.testing.logging.TestExceptionFormat
+/*
+ * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 import java.net.URI
+import org.gradle.accessors.dm.LibrariesForLibs
+import org.gradle.api.tasks.testing.logging.TestExceptionFormat
 
 plugins {
+  `jvm-test-suite`
   kotlin("jvm")
 }
 
 val buildInfo = project.extensions.getByType<BuildInfo>()
 
-dependencies {
-  testImplementation(buildInfo.libs.findLibrary("assertj").get())
-  testImplementation(buildInfo.libs.findLibrary("junitApi").get())
-  testImplementation(buildInfo.libs.findLibrary("junitParams").get())
-  testImplementation(buildInfo.libs.findLibrary("kotlinStdLib").get())
+val libs = the<LibrariesForLibs>()
 
-  testRuntimeOnly(buildInfo.libs.findLibrary("junitEngine").get())
+dependencies {
+  testImplementation(libs.assertj)
+  testImplementation(libs.junitApi)
+  testImplementation(libs.junitParams)
+  testImplementation(libs.kotlinStdLib)
+
+  testRuntimeOnly(libs.junitEngine)
+  testRuntimeOnly(libs.junitLauncher)
 }
 
 tasks.withType<Test>().configureEach {
@@ -24,34 +44,36 @@ tasks.withType<Test>().configureEach {
   // enable checking of stdlib return types
   systemProperty("org.pkl.testMode", "true")
 
-  reports.named("html") {
-    enabled = true
-  }
+  reports.named("html") { enabled = true }
 
-  testLogging {
-    exceptionFormat = TestExceptionFormat.FULL
-  }
+  testLogging { exceptionFormat = TestExceptionFormat.FULL }
 
-  addTestListener(object : TestListener {
-    override fun beforeSuite(suite: TestDescriptor) {}
-    override fun beforeTest(testDescriptor: TestDescriptor) {}
-    override fun afterTest(testDescriptor: TestDescriptor, result: TestResult) {}
+  addTestListener(
+    object : TestListener {
+      override fun beforeSuite(suite: TestDescriptor) {}
 
-    // print report link at end of task, not just at end of build
-    override fun afterSuite(descriptor: TestDescriptor, result: TestResult) {
-      if (descriptor.parent != null) return // only interested in overall result
+      override fun beforeTest(testDescriptor: TestDescriptor) {}
 
-      if (result.resultType == TestResult.ResultType.FAILURE) {
-        println("\nThere were failing tests. See the report at: ${fixFileUri(testTask.reports.html.entryPoint.toURI())}")
+      override fun afterTest(testDescriptor: TestDescriptor, result: TestResult) {}
+
+      // print report link at end of task, not just at end of build
+      override fun afterSuite(descriptor: TestDescriptor, result: TestResult) {
+        if (descriptor.parent != null) return // only interested in overall result
+
+        if (result.resultType == TestResult.ResultType.FAILURE) {
+          println(
+            "\nThere were failing tests. See the report at: ${fixFileUri(testTask.reports.html.entryPoint.toURI())}"
+          )
+        }
+      }
+
+      // makes links clickable on macOS
+      private fun fixFileUri(uri: URI): URI {
+        if ("file" == uri.scheme && !uri.schemeSpecificPart.startsWith("//")) {
+          return URI.create("file://" + uri.schemeSpecificPart)
+        }
+        return uri
       }
     }
-
-    // makes links clickable on macOS
-    private fun fixFileUri(uri: URI): URI {
-      if ("file" == uri.scheme && !uri.schemeSpecificPart.startsWith("//")) {
-        return URI.create("file://" + uri.schemeSpecificPart)
-      }
-      return uri
-    }
-  })
+  )
 }

buildSrc/src/main/kotlin/pklNativeBuild.gradle.kts

@@ -1,7 +0,0 @@
-val assembleNative by tasks.registering {}
-
-val checkNative by tasks.registering {}
-
-val buildNative by tasks.registering {
-  dependsOn(assembleNative, checkNative)
-}

buildSrc/src/main/kotlin/pklNativeExecutable.gradle.kts

@@ -0,0 +1,341 @@
+/*
+ * Copyright © 2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import java.lang.Runtime.Version
+import kotlin.io.path.createDirectories
+import kotlin.io.path.writeText
+import org.gradle.accessors.dm.LibrariesForLibs
+
+plugins {
+  id("pklGraalVm")
+  id("pklJavaLibrary")
+  id("pklNativeLifecycle")
+  id("pklPublishLibrary")
+  id("com.gradleup.shadow")
+}
+
+// assumes that `pklJavaExecutable` is also applied
+val executableSpec = project.extensions.getByType<ExecutableSpec>()
+val buildInfo = project.extensions.getByType<BuildInfo>()
+
+val stagedMacAmd64Executable: Configuration by configurations.creating
+val stagedMacAarch64Executable: Configuration by configurations.creating
+val stagedLinuxAmd64Executable: Configuration by configurations.creating
+val stagedLinuxAarch64Executable: Configuration by configurations.creating
+val stagedAlpineLinuxAmd64Executable: Configuration by configurations.creating
+val stagedWindowsAmd64Executable: Configuration by configurations.creating
+
+val nativeImageClasspath by
+  configurations.creating {
+    extendsFrom(configurations.runtimeClasspath.get())
+    // Ensure native-image version uses GraalVM C SDKs instead of Java FFI or JNA
+    // (comes from artifact `mordant-jvm-graal-ffi`).
+    exclude("com.github.ajalt.mordant", "mordant-jvm-ffm")
+    exclude("com.github.ajalt.mordant", "mordant-jvm-ffm-jvm")
+    exclude("com.github.ajalt.mordant", "mordant-jvm-jna")
+    exclude("com.github.ajalt.mordant", "mordant-jvm-jna-jvm")
+  }
+
+val libs = the<LibrariesForLibs>()
+
+dependencies {
+  fun executableFile(suffix: String) =
+    files(
+      layout.buildDirectory.dir("executable").map { dir ->
+        dir.file(executableSpec.name.map { "$it-$suffix" })
+      }
+    )
+  nativeImageClasspath(libs.truffleRuntime)
+  nativeImageClasspath(libs.graalSdk)
+
+  stagedMacAarch64Executable(executableFile("macos-aarch64"))
+  stagedMacAmd64Executable(executableFile("macos-amd64"))
+  stagedLinuxAmd64Executable(executableFile("linux-amd64"))
+  stagedLinuxAarch64Executable(executableFile("linux-aarch64"))
+  stagedAlpineLinuxAmd64Executable(executableFile("alpine-linux-amd64"))
+  stagedWindowsAmd64Executable(executableFile("windows-amd64.exe"))
+}
+
+private fun NativeImageBuild.amd64() {
+  arch = Architecture.AMD64
+  dependsOn(":installGraalVmAmd64")
+}
+
+private fun NativeImageBuild.aarch64() {
+  arch = Architecture.AARCH64
+  dependsOn(":installGraalVmAarch64")
+}
+
+private fun NativeImageBuild.setClasspath() {
+  classpath.from(sourceSets.main.map { it.output })
+  classpath.from(
+    project(":pkl-commons-cli").extensions.getByType(SourceSetContainer::class)["svm"].output
+  )
+  classpath.from(nativeImageClasspath)
+}
+
+val macExecutableAmd64 by
+  tasks.registering(NativeImageBuild::class) {
+    imageName = executableSpec.name.map { "$it-macos-amd64" }
+    mainClass = executableSpec.mainClass
+    amd64()
+    setClasspath()
+  }
+
+val macExecutableAarch64 by
+  tasks.registering(NativeImageBuild::class) {
+    imageName = executableSpec.name.map { "$it-macos-aarch64" }
+    mainClass = executableSpec.mainClass
+    aarch64()
+    setClasspath()
+  }
+
+val linuxExecutableAmd64 by
+  tasks.registering(NativeImageBuild::class) {
+    imageName = executableSpec.name.map { "$it-linux-amd64" }
+    mainClass = executableSpec.mainClass
+    amd64()
+    setClasspath()
+  }
+
+val linuxExecutableAarch64 by
+  tasks.registering(NativeImageBuild::class) {
+    imageName = executableSpec.name.map { "$it-linux-aarch64" }
+    mainClass = executableSpec.mainClass
+    aarch64()
+    setClasspath()
+    // Ensure compatibility for kernels with page size set to 4k, 16k and 64k
+    // (e.g. Raspberry Pi 5, Asahi Linux)
+    extraNativeImageArgs.add("-H:PageSize=65536")
+  }
+
+val alpineExecutableAmd64 by
+  tasks.registering(NativeImageBuild::class) {
+    imageName = executableSpec.name.map { "$it-alpine-linux-amd64" }
+    mainClass = executableSpec.mainClass
+    amd64()
+    setClasspath()
+    extraNativeImageArgs.addAll(listOf("--static", "--libc=musl"))
+  }
+
+val windowsExecutableAmd64 by
+  tasks.registering(NativeImageBuild::class) {
+    imageName = executableSpec.name.map { "$it-windows-amd64" }
+    mainClass = executableSpec.mainClass
+    amd64()
+    setClasspath()
+  }
+
+val assembleNative by tasks.existing
+
+val testStartNativeExecutable by
+  tasks.registering {
+    dependsOn(assembleNative)
+
+    // dummy file for up-to-date checking
+    val outputFile = project.layout.buildDirectory.file("testStartNativeExecutable/output.txt")
+    outputs.file(outputFile)
+
+    val execOutput =
+      providers.exec { commandLine(assembleNative.get().outputs.files.singleFile, "--version") }
+
+    doLast {
+      val outputText = execOutput.standardOutput.asText.get()
+      if (!outputText.contains(buildInfo.pklVersionNonUnique)) {
+        throw GradleException(
+          "Expected version output to contain current version (${buildInfo.pklVersionNonUnique}), but got '$outputText'"
+        )
+      }
+      outputFile.get().asFile.toPath().apply {
+        try {
+          parent.createDirectories()
+        } catch (ignored: java.nio.file.FileAlreadyExistsException) {}
+        writeText("OK")
+      }
+    }
+  }
+
+val requiredGlibcVersion: Version = Version.parse("2.17")
+
+val checkGlibc by
+  tasks.registering {
+    enabled = buildInfo.os.isLinux && !buildInfo.musl
+    dependsOn(assembleNative)
+    doLast {
+      val exec =
+        providers.exec {
+          commandLine("objdump", "-T", assembleNative.get().outputs.files.singleFile)
+        }
+      val output = exec.standardOutput.asText.get()
+      val minimumGlibcVersion =
+        output
+          .split("\n")
+          .mapNotNull { line ->
+            val match = Regex("GLIBC_([.0-9]*)").find(line)
+            match?.groups[1]?.let { Version.parse(it.value) }
+          }
+          .maxOrNull()
+      if (minimumGlibcVersion == null) {
+        throw GradleException(
+          "Could not determine glibc version from executable. objdump output: $output"
+        )
+      }
+      if (minimumGlibcVersion > requiredGlibcVersion) {
+        throw GradleException(
+          "Incorrect glibc version. Found: $minimumGlibcVersion, required: $requiredGlibcVersion"
+        )
+      }
+    }
+  }
+
+// Expose underlying task's outputs
+private fun <T : Task> Task.wraps(other: TaskProvider<T>) {
+  dependsOn(other)
+  outputs.files(other)
+}
+
+val testNative by tasks.existing { dependsOn(testStartNativeExecutable, checkGlibc) }
+
+val assembleNativeMacOsAarch64 by tasks.existing { wraps(macExecutableAarch64) }
+
+val assembleNativeMacOsAmd64 by tasks.existing { wraps(macExecutableAmd64) }
+
+val assembleNativeLinuxAarch64 by tasks.existing { wraps(linuxExecutableAarch64) }
+
+val assembleNativeLinuxAmd64 by tasks.existing { wraps(linuxExecutableAmd64) }
+
+val assembleNativeAlpineLinuxAmd64 by tasks.existing { wraps(alpineExecutableAmd64) }
+
+val assembleNativeWindowsAmd64 by tasks.existing { wraps(windowsExecutableAmd64) }
+
+publishing {
+  publications {
+    // need to put in `afterEvaluate` because `artifactId` cannot be set lazily.
+    project.afterEvaluate {
+      create<MavenPublication>("macExecutableAmd64") {
+        artifactId = "${executableSpec.publicationName.get()}-macos-amd64"
+        artifact(stagedMacAmd64Executable.singleFile) {
+          classifier = null
+          extension = "bin"
+          builtBy(stagedMacAmd64Executable)
+        }
+        pom {
+          name = "${executableSpec.publicationName.get()}-macos-amd64"
+          url = executableSpec.website
+          description =
+            executableSpec.documentationName.map { name ->
+              "Native $name executable for macOS/amd64."
+            }
+        }
+      }
+
+      create<MavenPublication>("macExecutableAarch64") {
+        artifactId = "${executableSpec.publicationName.get()}-macos-aarch64"
+        artifact(stagedMacAarch64Executable.singleFile) {
+          classifier = null
+          extension = "bin"
+          builtBy(stagedMacAarch64Executable)
+        }
+        pom {
+          name = "${executableSpec.publicationName.get()}-macos-aarch64"
+          url = executableSpec.website
+          description =
+            executableSpec.documentationName.map { name ->
+              "Native $name executable for macOS/aarch64."
+            }
+        }
+      }
+
+      create<MavenPublication>("linuxExecutableAmd64") {
+        artifactId = "${executableSpec.publicationName.get()}-linux-amd64"
+        artifact(stagedLinuxAmd64Executable.singleFile) {
+          classifier = null
+          extension = "bin"
+          builtBy(stagedLinuxAmd64Executable)
+        }
+        pom {
+          name = "${executableSpec.publicationName.get()}-linux-amd64"
+          url = executableSpec.website
+          description =
+            executableSpec.documentationName.map { name ->
+              "Native $name executable for linux/amd64."
+            }
+        }
+      }
+
+      create<MavenPublication>("linuxExecutableAarch64") {
+        artifactId = "${executableSpec.publicationName.get()}-linux-aarch64"
+        artifact(stagedLinuxAarch64Executable.singleFile) {
+          classifier = null
+          extension = "bin"
+          builtBy(stagedLinuxAarch64Executable)
+        }
+        pom {
+          name = "${executableSpec.publicationName.get()}-linux-aarch64"
+          url = executableSpec.website
+          description =
+            executableSpec.documentationName.map { name ->
+              "Native $name executable for linux/aarch64."
+            }
+        }
+      }
+
+      create<MavenPublication>("alpineLinuxExecutableAmd64") {
+        artifactId = "${executableSpec.publicationName.get()}-alpine-linux-amd64"
+        artifact(stagedAlpineLinuxAmd64Executable.singleFile) {
+          classifier = null
+          extension = "bin"
+          builtBy(stagedAlpineLinuxAmd64Executable)
+        }
+        pom {
+          name = "${executableSpec.publicationName.get()}-alpine-linux-amd64"
+          url = executableSpec.website
+          description =
+            executableSpec.documentationName.map { name ->
+              "Native $name executable for linux/amd64 and statically linked to musl."
+            }
+        }
+      }
+
+      create<MavenPublication>("windowsExecutableAmd64") {
+        artifactId = "${executableSpec.publicationName.get()}-windows-amd64"
+        artifact(stagedWindowsAmd64Executable.singleFile) {
+          classifier = null
+          extension = "exe"
+          builtBy(stagedWindowsAmd64Executable)
+        }
+        pom {
+          name = "${executableSpec.publicationName.get()}-windows-amd64"
+          url = executableSpec.website
+          description =
+            executableSpec.documentationName.map { name ->
+              "Native $name executable for windows/amd64."
+            }
+        }
+      }
+    }
+  }
+}
+
+signing {
+  project.afterEvaluate {
+    sign(publishing.publications["linuxExecutableAarch64"])
+    sign(publishing.publications["linuxExecutableAmd64"])
+    sign(publishing.publications["macExecutableAarch64"])
+    sign(publishing.publications["macExecutableAmd64"])
+    sign(publishing.publications["alpineLinuxExecutableAmd64"])
+    sign(publishing.publications["windowsExecutableAmd64"])
+  }
+}

buildSrc/src/main/kotlin/pklNativeLifecycle.gradle.kts

@@ -0,0 +1,128 @@
+/*
+ * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+val assembleNativeMacOsAarch64 by tasks.registering { group = "build" }
+
+val assembleNativeMacOsAmd64 by tasks.registering { group = "build" }
+
+val assembleNativeLinuxAarch64 by tasks.registering { group = "build" }
+
+val assembleNativeLinuxAmd64 by tasks.registering { group = "build" }
+
+val assembleNativeAlpineLinuxAmd64 by tasks.registering { group = "build" }
+
+val assembleNativeWindowsAmd64 by tasks.registering { group = "build" }
+
+val testNativeMacOsAarch64 by tasks.registering { group = "verification" }
+
+val testNativeMacOsAmd64 by tasks.registering { group = "verification" }
+
+val testNativeLinuxAarch64 by tasks.registering { group = "verification" }
+
+val testNativeLinuxAmd64 by tasks.registering { group = "verification" }
+
+val testNativeAlpineLinuxAmd64 by tasks.registering { group = "verification" }
+
+val testNativeWindowsAmd64 by tasks.registering { group = "verification" }
+
+val buildInfo = project.extensions.getByType<BuildInfo>()
+
+private fun <T : Task> Task.wraps(other: TaskProvider<T>) {
+  dependsOn(other)
+  outputs.files(other)
+}
+
+val assembleNative by
+  tasks.registering {
+    group = "build"
+
+    if (!buildInfo.isCrossArchSupported && buildInfo.isCrossArch) {
+      throw GradleException("Cross-arch builds are not supported on ${buildInfo.os.name}")
+    }
+
+    when {
+      buildInfo.os.isMacOsX && buildInfo.targetArch == "aarch64" -> {
+        wraps(assembleNativeMacOsAarch64)
+      }
+      buildInfo.os.isMacOsX && buildInfo.targetArch == "amd64" -> {
+        wraps(assembleNativeMacOsAmd64)
+      }
+      buildInfo.os.isLinux && buildInfo.targetArch == "aarch64" -> {
+        wraps(assembleNativeLinuxAarch64)
+      }
+      buildInfo.os.isLinux && buildInfo.targetArch == "amd64" -> {
+        if (buildInfo.musl) wraps(assembleNativeAlpineLinuxAmd64)
+        else wraps(assembleNativeLinuxAmd64)
+      }
+      buildInfo.os.isWindows && buildInfo.targetArch == "amd64" -> {
+        wraps(assembleNativeWindowsAmd64)
+      }
+      else -> {
+        doLast {
+          throw GradleException(
+            "Cannot build targeting ${buildInfo.os.name}/${buildInfo.targetArch} with musl=${buildInfo.musl}"
+          )
+        }
+      }
+    }
+  }
+
+val testNative by
+  tasks.registering {
+    group = "verification"
+    dependsOn(assembleNative)
+
+    if (!buildInfo.isCrossArchSupported && buildInfo.isCrossArch) {
+      throw GradleException("Cross-arch builds are not supported on ${buildInfo.os.name}")
+    }
+
+    when {
+      buildInfo.os.isMacOsX && buildInfo.targetArch == "aarch64" -> {
+        dependsOn(testNativeMacOsAarch64)
+      }
+      buildInfo.os.isMacOsX && buildInfo.targetArch == "amd64" -> {
+        dependsOn(testNativeMacOsAmd64)
+      }
+      buildInfo.os.isLinux && buildInfo.targetArch == "aarch64" -> {
+        dependsOn(testNativeLinuxAarch64)
+      }
+      buildInfo.os.isLinux && buildInfo.targetArch == "amd64" -> {
+        if (buildInfo.musl) dependsOn(testNativeAlpineLinuxAmd64)
+        else dependsOn(testNativeLinuxAmd64)
+      }
+      buildInfo.os.isWindows && buildInfo.targetArch == "amd64" -> {
+        dependsOn(testNativeWindowsAmd64)
+      }
+      else -> {
+        doLast {
+          throw GradleException(
+            "Cannot build targeting ${buildInfo.os.name}/${buildInfo.targetArch} with musl=${buildInfo.musl}"
+          )
+        }
+      }
+    }
+  }
+
+val checkNative by
+  tasks.registering {
+    group = "verification"
+    dependsOn(testNative)
+  }
+
+val buildNative by
+  tasks.registering {
+    group = "build"
+    dependsOn(checkNative)
+  }

buildSrc/src/main/kotlin/pklPublishLibrary.gradle.kts

@@ -1,7 +1,18 @@
-import org.gradle.api.publish.maven.tasks.GenerateMavenPom
-import java.nio.charset.StandardCharsets
-import java.util.Base64
-
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 plugins {
   `maven-publish`
   signing
@@ -10,107 +21,16 @@ plugins {
 publishing {
   publications {
     components.findByName("java")?.let { javaComponent ->
-      create<MavenPublication>("library") {
-        from(javaComponent)
-      }
-    }
-    withType<MavenPublication>().configureEach {
-      pom {
-        name.set(artifactId)
-        licenses {
-          license {
-            name.set("The Apache Software License, Version 2.0")
-            url.set("https://github.com/apple/pkl/blob/main/LICENSE.txt")
-          }
-        }
-        developers {
-          developer {
-            id.set("pkl-authors")
-            name.set("The Pkl Authors")
-            email.set("pkl-oss@group.apple.com")
-          }
-        }
-        scm {
-          connection.set("scm:git:git://github.com/apple/pkl.git")
-          developerConnection.set("scm:git:ssh://github.com/apple/pkl.git")
-          val buildInfo = project.extensions.getByType<BuildInfo>()
-          url.set("https://github.com/apple/pkl/tree/${buildInfo.commitish}")
-        }
-        issueManagement {
-          system.set("GitHub Issues")
-          url.set("https://github.com/apple/pkl/issues")
-        }
-        ciManagement {
-          system.set("Circle CI")
-          url.set("https://app.circleci.com/pipelines/github/apple/pkl")
-        }
-      }
+      create<MavenPublication>("library") { from(javaComponent) }
     }
   }
 }
 
-val validatePom by tasks.registering {
-  val generatePomFileForLibraryPublication by tasks.existing(GenerateMavenPom::class)
-  val outputFile = file("$buildDir/validatePom") // dummy output to satisfy up-to-date check
+configurePklPomMetadata()
 
-  dependsOn(generatePomFileForLibraryPublication)
-  inputs.file(generatePomFileForLibraryPublication.get().destination)
-  outputs.file(outputFile)
+configurePomValidation()
 
-  doLast {
-    outputFile.delete()
-
-    val pomFile = generatePomFileForLibraryPublication.get().destination
-    assert(pomFile.exists())
-
-    val text = pomFile.readText()
-
-    run {
-      val unresolvedVersion = Regex("<version>.*[+,()\\[\\]].*</version>")
-      val matches = unresolvedVersion.findAll(text).toList()
-      if (matches.isNotEmpty()) {
-        throw GradleException(
-          """
-        Found unresolved version selector(s) in generated POM:
-        ${matches.joinToString("\n") { it.groupValues[0] }}
-      """.trimIndent()
-        )
-      }
-    }
-
-    val buildInfo = project.extensions.getByType<BuildInfo>()
-    if (buildInfo.isReleaseBuild) {
-      val snapshotVersion = Regex("<version>.*-SNAPSHOT</version>")
-      val matches = snapshotVersion.findAll(text).toList()
-      if (matches.isNotEmpty()) {
-        throw GradleException(
-          """
-        Found snapshot version(s) in generated POM of Pkl release version:
-        ${matches.joinToString("\n") { it.groupValues[0] }}
-      """.trimIndent()
-        )
-      }
-    }
-
-    outputFile.writeText("OK")
-  }
-}
-
-tasks.publish {
-  dependsOn(validatePom)
-}
-
-signing {
-  // provided as env vars `ORG_GRADLE_PROJECT_signingKey` and `ORG_GRADLE_PROJECT_signingPassword`
-  // in CI.
-  val signingKey = (findProperty("signingKey") as String?)
-    ?.let { Base64.getDecoder().decode(it).toString(StandardCharsets.US_ASCII) }
-  val signingPassword = findProperty("signingPassword") as String?
-  if (signingKey != null && signingPassword != null) {
-    useInMemoryPgpKeys(signingKey, signingPassword)
-  }
-  publishing.publications.findByName("library")?.let { sign(it) }
-}
+configurePklSigning()
 
 artifacts {
   project.tasks.findByName("javadocJar")?.let { archives(it) }

buildSrc/src/main/kotlin/pklSpotlessFormat.gradle.kts

@@ -0,0 +1,39 @@
+/*
+ * Copyright © 2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+plugins { id("com.diffplug.spotless") }
+
+val pklFormatter by configurations.creating
+
+dependencies { pklFormatter(rootProject.project("pkl-formatter")) }
+
+spotless {
+  format("pkl") {
+    target("**/*.pkl")
+    addStep(PklFormatterStep(pklFormatter).create())
+    licenseHeaderFile(
+      rootProject.file("buildSrc/src/main/resources/license-header.line-comment.txt"),
+      "/// ",
+    )
+    // disable ratcheting for Pkl sources
+    // make any change to pkl-formatter reformat the stdlib
+    ratchetFrom = null
+  }
+}
+
+for (taskName in
+  listOf("spotlessPkl", "spotlessPklApply", "spotlessPklCheck", "spotlessPklDiagnose")) {
+  tasks.named(taskName) { dependsOn(":pkl-formatter:assemble") }
+}

buildSrc/src/main/resources/license-header.line-comment.txt

@@ -1,5 +1,5 @@
 //===----------------------------------------------------------------------===//
-// Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+// Copyright © $YEAR Apple Inc. and the Pkl project authors. All rights reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.

buildSrc/src/main/resources/license-header.star-block.txt

@@ -1,5 +1,5 @@
-/**
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+/*
+ * Copyright © $YEAR Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

docs/antora.yml

@@ -1,6 +1,6 @@
 name: main
 title: Main Project
-version: 0.25.0
-prerelease: false
+version: 0.31.0-dev
+prerelease: true
 nav:
 - nav.adoc

docs/docs.gradle.kts

@@ -1,3 +1,18 @@
+/*
+ * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 import org.jetbrains.kotlin.gradle.dsl.KotlinJvmProjectExtension
 
 plugins {
@@ -10,26 +25,25 @@ sourceSets {
     java {
       srcDir(file("modules/pkl-core/examples"))
       srcDir(file("modules/pkl-config-java/examples"))
+      srcDir(file("modules/java-binding/examples"))
     }
-    val kotlin = project.extensions
-      .getByType<KotlinJvmProjectExtension>()
-      .sourceSets[name]
-      .kotlin
-    kotlin.srcDir(file("modules/pkl-config-kotlin/examples"))
+    val kotlin = project.extensions.getByType<KotlinJvmProjectExtension>().sourceSets[name].kotlin
+    kotlin.srcDir(file("modules/kotlin-binding/examples"))
   }
 }
 
 dependencies {
-  testImplementation(project(":pkl-core"))
-  testImplementation(project(":pkl-config-java"))
-  testImplementation(project(":pkl-config-kotlin"))
-  testImplementation(project(":pkl-commons-test"))
+  testImplementation(projects.pklCore)
+  testImplementation(projects.pklConfigJava)
+  testImplementation(projects.pklConfigKotlin)
+  testImplementation(projects.pklCommonsTest)
+  testImplementation(projects.pklParser)
   testImplementation(libs.junitEngine)
-  testImplementation(libs.antlrRuntime)
 }
 
 tasks.test {
-  inputs.files(fileTree("modules").matching {
-    include("**/pages/*.adoc")
-  })
+  inputs
+    .files(fileTree("modules").matching { include("**/pages/*.adoc") })
+    .withPropertyName("asciiDocFiles")
+    .withPathSensitivity(PathSensitivity.RELATIVE)
 }

docs/gradle.lockfile

@@ -1,36 +1,61 @@
 # This is a Gradle generated file for dependency locking.
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
-com.tunnelvisionlabs:antlr4-runtime:4.9.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-io.leangen.geantyref:geantyref:1.3.14=testRuntimeClasspath
-net.bytebuddy:byte-buddy:1.12.21=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-net.java.dev.jna:jna:5.6.0=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
-org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeOnlyDependenciesMetadata
-org.assertj:assertj-core:3.24.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.graalvm.sdk:graal-sdk:22.3.1=testRuntimeClasspath
-org.graalvm.truffle:truffle-api:22.3.1=testRuntimeClasspath
-org.jetbrains.intellij.deps:trove4j:1.0.20200330=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-compiler-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-daemon-embeddable:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-klib-commonizer-embeddable:1.7.10=kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-reflect:1.7.10=kotlinCompilerClasspath,kotlinKlibCommonizerClasspath,testRuntimeClasspath
-org.jetbrains.kotlin:kotlin-script-runtime:1.7.10=kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-scripting-common:1.7.10=kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
-org.jetbrains.kotlin:kotlin-scripting-compiler-embeddable:1.7.10=kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
-org.jetbrains.kotlin:kotlin-scripting-compiler-impl-embeddable:1.7.10=kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
-org.jetbrains.kotlin:kotlin-scripting-jvm:1.7.10=kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
-org.jetbrains.kotlin:kotlin-stdlib-common:1.7.10=kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.7.10=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.7.10=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.jetbrains.kotlin:kotlin-stdlib:1.7.10=kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.jetbrains:annotations:13.0=kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.9.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-engine:5.9.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.jupiter:junit-jupiter-params:5.9.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.9.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit.platform:junit-platform-engine:1.9.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.junit:junit-bom:5.9.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
-org.opentest4j:opentest4j:1.2.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath,testRuntimeOnlyDependenciesMetadata
+com.github.ben-manes.caffeine:caffeine:2.9.3=swiftExportClasspathResolvable
+com.google.errorprone:error_prone_annotations:2.28.0=swiftExportClasspathResolvable
+io.github.java-diff-utils:java-diff-utils:4.12=kotlinInternalAbiValidation
+io.leangen.geantyref:geantyref:1.3.16=testRuntimeClasspath
+io.opentelemetry:opentelemetry-api:1.41.0=swiftExportClasspathResolvable
+io.opentelemetry:opentelemetry-context:1.41.0=swiftExportClasspathResolvable
+net.bytebuddy:byte-buddy:1.17.7=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath,testImplementationDependenciesMetadata
+org.assertj:assertj-core:3.27.6=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.bouncycastle:bcpg-jdk18on:1.80=kotlinBouncyCastleConfiguration
+org.bouncycastle:bcpkix-jdk18on:1.80=kotlinBouncyCastleConfiguration
+org.bouncycastle:bcprov-jdk18on:1.80=kotlinBouncyCastleConfiguration
+org.bouncycastle:bcutil-jdk18on:1.80=kotlinBouncyCastleConfiguration
+org.checkerframework:checker-qual:3.43.0=swiftExportClasspathResolvable
+org.graalvm.polyglot:polyglot:25.0.0=testRuntimeClasspath
+org.graalvm.sdk:collections:25.0.0=testRuntimeClasspath
+org.graalvm.sdk:graal-sdk:25.0.0=testRuntimeClasspath
+org.graalvm.sdk:nativeimage:25.0.0=testRuntimeClasspath
+org.graalvm.sdk:word:25.0.0=testRuntimeClasspath
+org.graalvm.truffle:truffle-api:25.0.0=testRuntimeClasspath
+org.jetbrains.kotlin:abi-tools-api:2.2.20=kotlinInternalAbiValidation
+org.jetbrains.kotlin:abi-tools:2.2.20=kotlinInternalAbiValidation
+org.jetbrains.kotlin:kotlin-build-tools-api:2.2.20=kotlinBuildToolsApiClasspath
+org.jetbrains.kotlin:kotlin-build-tools-impl:2.2.20=kotlinBuildToolsApiClasspath
+org.jetbrains.kotlin:kotlin-compiler-embeddable:2.2.20=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinInternalAbiValidation,kotlinKlibCommonizerClasspath,swiftExportClasspathResolvable
+org.jetbrains.kotlin:kotlin-compiler-runner:2.2.20=kotlinBuildToolsApiClasspath
+org.jetbrains.kotlin:kotlin-daemon-client:2.2.20=kotlinBuildToolsApiClasspath
+org.jetbrains.kotlin:kotlin-daemon-embeddable:2.2.20=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinInternalAbiValidation,kotlinKlibCommonizerClasspath,swiftExportClasspathResolvable
+org.jetbrains.kotlin:kotlin-klib-commonizer-embeddable:2.2.20=kotlinKlibCommonizerClasspath
+org.jetbrains.kotlin:kotlin-metadata-jvm:2.2.20=kotlinInternalAbiValidation
+org.jetbrains.kotlin:kotlin-native-prebuilt:2.0.21=kotlinNativeBundleConfiguration
+org.jetbrains.kotlin:kotlin-reflect:2.2.20=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinInternalAbiValidation,kotlinKlibCommonizerClasspath,swiftExportClasspathResolvable,testRuntimeClasspath
+org.jetbrains.kotlin:kotlin-script-runtime:2.2.20=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinInternalAbiValidation,kotlinKlibCommonizerClasspath,swiftExportClasspathResolvable
+org.jetbrains.kotlin:kotlin-scripting-common:2.2.20=kotlinBuildToolsApiClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
+org.jetbrains.kotlin:kotlin-scripting-compiler-embeddable:2.2.20=kotlinBuildToolsApiClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
+org.jetbrains.kotlin:kotlin-scripting-compiler-impl-embeddable:2.2.20=kotlinBuildToolsApiClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
+org.jetbrains.kotlin:kotlin-scripting-jvm:2.2.20=kotlinBuildToolsApiClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
+org.jetbrains.kotlin:kotlin-stdlib-jdk7:2.2.20=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.jetbrains.kotlin:kotlin-stdlib-jdk8:2.2.20=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.jetbrains.kotlin:kotlin-stdlib:2.2.20=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinInternalAbiValidation,kotlinKlibCommonizerClasspath,swiftExportClasspathResolvable,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.jetbrains.kotlin:swift-export-embeddable:2.2.20=swiftExportClasspathResolvable
+org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.8.0=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinInternalAbiValidation,kotlinKlibCommonizerClasspath,swiftExportClasspathResolvable
+org.jetbrains.kotlinx:kotlinx-serialization-bom:1.7.3=swiftExportClasspathResolvable
+org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:1.7.3=swiftExportClasspathResolvable
+org.jetbrains.kotlinx:kotlinx-serialization-core:1.7.3=swiftExportClasspathResolvable
+org.jetbrains:annotations:13.0=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinInternalAbiValidation,kotlinKlibCommonizerClasspath,swiftExportClasspathResolvable,testCompileClasspath,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-api:5.14.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-engine:5.14.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.jupiter:junit-jupiter-params:5.14.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.platform:junit-platform-commons:1.14.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.platform:junit-platform-engine:1.14.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.junit.platform:junit-platform-launcher:1.14.0=testRuntimeClasspath
+org.junit:junit-bom:5.14.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
+org.msgpack:msgpack-core:0.9.8=testRuntimeClasspath
+org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 org.organicdesign:Paguro:3.10.3=testRuntimeClasspath
-org.snakeyaml:snakeyaml-engine:2.5=testRuntimeClasspath
-empty=annotationProcessor,apiDependenciesMetadata,archives,compile,compileClasspath,compileOnly,compileOnlyDependenciesMetadata,default,implementationDependenciesMetadata,intransitiveDependenciesMetadata,kotlinCompilerPluginClasspath,kotlinNativeCompilerPluginClasspath,kotlinScriptDef,kotlinScriptDefExtensions,runtime,runtimeClasspath,runtimeOnlyDependenciesMetadata,testAnnotationProcessor,testApiDependenciesMetadata,testCompile,testCompileOnly,testCompileOnlyDependenciesMetadata,testIntransitiveDependenciesMetadata,testKotlinScriptDef,testKotlinScriptDefExtensions,testRuntime
+org.snakeyaml:snakeyaml-engine:2.10=testRuntimeClasspath
+empty=annotationProcessor,apiDependenciesMetadata,compileClasspath,compileOnlyDependenciesMetadata,implementationDependenciesMetadata,intransitiveDependenciesMetadata,kotlinCompilerPluginClasspath,kotlinNativeCompilerPluginClasspath,kotlinScriptDefExtensions,runtimeClasspath,testAnnotationProcessor,testApiDependenciesMetadata,testCompileOnlyDependenciesMetadata,testIntransitiveDependenciesMetadata,testKotlinScriptDefExtensions

docs/modules/ROOT/pages/evolution-and-roadmap.adoc

@@ -0,0 +1,20 @@
+= Evolution and Roadmap
+
+:uri-pkl-roadmap: https://github.com/orgs/apple/projects/12/views/1
+:uri-pkl-evolution: https://github.com/apple/pkl-evolution
+
+== Evolution
+
+Sometimes, a change to Pkl is large enough that it makes sense to create a proposal for the change so that it can be discussed in detail and vetted.
+
+Pkl has a process for managing such designs in a repository called {uri-pkl-evolution}[Pkl Evolution].
+
+== Roadmap
+
+To discover what might be coming in future versions, reference the {uri-pkl-roadmap}[Pkl Roadmap] project on GitHub.
+
+The roadmap describes estimates.
+The Pkl team aims to cut a release in February, June, and October of each year.
+If an item is not complete by the release cutoff date, the roadmap item may be bumped to the next release.
+
+Additionally, as priorities change, it is possible that items can be moved around or backlogged.

docs/modules/ROOT/pages/index.adoc

@@ -1,7 +1,10 @@
 = User Manual
 include::../partials/component-attributes.adoc[]
 
-Quick Links: xref:pkl-cli:index.adoc#installation[Installation] | xref:language-reference:index.adoc[Language Reference]
+Quick Links:
+xref:pkl-cli:index.adoc#installation[Installation] 
+| xref:language-reference:index.adoc[Language Reference]
+| https://pkl-lang.org/package-docs/pkl/current/index.html[Standard Library]
 
 Pkl -- pronounced _Pickle_ -- is an embeddable configuration language which provides rich support for data templating and validation.
 It can be used from the command line, integrated in a build pipeline, or embedded in a program.

docs/modules/ROOT/pages/language-bindings.adoc

@@ -4,3 +4,6 @@
 * xref:kotlin-binding:index.adoc[Kotlin]
 * xref:swift:ROOT:index.adoc[Swift]
 * xref:go:ROOT:index.adoc[Go]
+* xref:bindings-specification:index.adoc[Specification]
+** xref:bindings-specification:message-passing-api.adoc[Message Passing API]
+** xref:bindings-specification:binary-encoding.adoc[Pkl Binary Encoding]

docs/modules/ROOT/partials/component-attributes.adoc

@@ -3,10 +3,10 @@
 // the following attributes must be updated immediately before a release
 
 // pkl version corresponding to current git commit without -dev suffix or git hash
-:pkl-version-no-suffix: 0.25.0
+:pkl-version-no-suffix: 0.31.0
 // tells whether pkl version corresponding to current git commit
 // is a release version (:is-release-version: '') or dev version (:!is-release-version:)
-:is-release-version: ''
+:!is-release-version:
 
 // the remaining attributes do not need to be updated regularly
 
@@ -21,9 +21,14 @@ ifdef::is-release-version[]
 :pkl-artifact-version: {pkl-version}
 endif::[]
 
-:uri-maven-docsite: https://central.sonatype.com/
+:uri-maven-docsite: https://central.sonatype.com
 
-:uri-sonatype: https://s01.oss.sonatype.org/service/local/repositories/snapshots/content/
+:uri-snapshot-repo: https://central.sonatype.com/repository/maven-snapshots
+
+:uri-maven-repo: https://central.sonatype.com/repository/maven-snapshots
+ifdef::is-release-version[]
+:uri-maven-repo: https://repo1.maven.org/maven2
+endif::[]
 
 :symbolic-version-name: latest
 ifdef::is-release-version[]
@@ -34,10 +39,9 @@ endif::[]
 :uri-pkl-stdlib-docs: {uri-pkl-stdlib-docs-base}/{pkl-version}
 :uri-pkl-stdlib-docs-index: {uri-pkl-stdlib-docs}/
 
-// TODO(oss): check these links when we have tags
 :github-branch: main
 ifdef::is-release-version[]
-:github-branch: v{pkl-version-no-suffix}
+:github-branch: {pkl-version-no-suffix}
 endif::[]
 :uri-github-tree: https://github.com/apple/pkl/tree/{github-branch}
 :uri-pkl-stdlib-sources: {uri-github-tree}/stdlib
@@ -62,3 +66,95 @@ endif::[]
 :uri-config-java-example: {uri-pkl-examples-tree}/config-java
 :uri-config-kotlin-example: {uri-pkl-examples-tree}/config-kotlin
 :uri-pkldoc-example: {uri-pkl-examples-tree}/pkldoc
+
+:uri-stdlib-baseModule: {uri-pkl-stdlib-docs}/base
+:uri-stdlib-analyzeModule: {uri-pkl-stdlib-docs}/analyze
+:uri-stdlib-jsonnetModule: {uri-pkl-stdlib-docs}/jsonnet
+:uri-stdlib-reflectModule: {uri-pkl-stdlib-docs}/reflect
+:uri-stdlib-mathModule: {uri-pkl-stdlib-docs}/math
+:uri-stdlib-xmlModule: {uri-pkl-stdlib-docs}/xml
+:uri-stdlib-protobufModule: {uri-pkl-stdlib-docs}/protobuf
+:uri-stdlib-pklbinaryModule: {uri-pkl-stdlib-docs}/pklbinary
+:uri-stdlib-yamlModule: {uri-pkl-stdlib-docs}/yaml
+:uri-stdlib-YamlParser: {uri-stdlib-yamlModule}/Parser
+:uri-stdlib-evaluatorSettingsModule: {uri-pkl-stdlib-docs}/EvaluatorSettings
+:uri-stdlib-evaluatorSettingsHttpClass: {uri-stdlib-evaluatorSettingsModule}/Http
+:uri-stdlib-Boolean: {uri-stdlib-baseModule}/Boolean
+:uri-stdlib-xor: {uri-stdlib-baseModule}/Boolean#xor()
+:uri-stdlib-implies: {uri-stdlib-baseModule}/Boolean#implies()
+:uri-stdlib-Any: {uri-stdlib-baseModule}/Any
+:uri-stdlib-String: {uri-stdlib-baseModule}/String
+:uri-stdlib-Collection: {uri-stdlib-baseModule}/Collection
+:uri-stdlib-StringToInt: {uri-stdlib-baseModule}/String#toInt()
+:uri-stdlib-Int: {uri-stdlib-baseModule}/Int
+:uri-stdlib-Float: {uri-stdlib-baseModule}/Float
+:uri-stdlib-Number: {uri-stdlib-baseModule}/Number
+:uri-stdlib-NaN: {uri-stdlib-baseModule}/#NaN
+:uri-stdlib-Infinity: {uri-stdlib-baseModule}/#Infinity
+:uri-stdlib-isBetween: {uri-stdlib-baseModule}/Number#isBetween
+:uri-stdlib-isFinite: {uri-stdlib-baseModule}/Number#isFinite
+:uri-stdlib-Int8: {uri-stdlib-baseModule}/#Int8
+:uri-stdlib-Int16: {uri-stdlib-baseModule}/#Int16
+:uri-stdlib-Int32: {uri-stdlib-baseModule}/#Int32
+:uri-stdlib-UInt8: {uri-stdlib-baseModule}/#UInt8
+:uri-stdlib-UInt16: {uri-stdlib-baseModule}/#UInt16
+:uri-stdlib-UInt32: {uri-stdlib-baseModule}/#UInt32
+:uri-stdlib-UInt: {uri-stdlib-baseModule}/#UInt
+:uri-stdlib-Uri: {uri-stdlib-baseModule}/#Uri
+:uri-stdlib-matches: {uri-stdlib-baseModule}/String#matches()
+:uri-stdlib-Null: {uri-stdlib-baseModule}/Null
+:uri-stdlib-ifNonNull: {uri-stdlib-baseModule}/Null#ifNonNull()
+:uri-stdlib-List: {uri-stdlib-baseModule}/List
+:uri-stdlib-Set: {uri-stdlib-baseModule}/Set
+:uri-stdlib-Map: {uri-stdlib-baseModule}/Map
+:uri-stdlib-Listing: {uri-stdlib-baseModule}/Listing
+:uri-stdlib-Listing-default: {uri-stdlib-baseModule}/Listing#default
+:uri-stdlib-Listing-isDistinct: {uri-stdlib-baseModule}/Listing#isDistinct
+:uri-stdlib-Listing-isDistinctBy: {uri-stdlib-baseModule}/Listing#isDistinctBy()
+:uri-stdlib-Mapping: {uri-stdlib-baseModule}/Mapping
+:uri-stdlib-Mapping-default: {uri-stdlib-baseModule}/Mapping#default
+:uri-stdlib-Duration: {uri-stdlib-baseModule}/Duration
+:uri-stdlib-Duration-value: {uri-stdlib-baseModule}/Duration#value
+:uri-stdlib-Duration-unit: {uri-stdlib-baseModule}/Duration#unit
+:uri-stdlib-DurationUnit: {uri-stdlib-baseModule}/#DurationUnit
+:uri-stdlib-DataSize: {uri-stdlib-baseModule}/DataSize
+:uri-stdlib-DataSize-value: {uri-stdlib-baseModule}/DataSize#value
+:uri-stdlib-DataSize-unit: {uri-stdlib-baseModule}/DataSize#unit
+:uri-stdlib-DataSizeUnit: {uri-stdlib-baseModule}/#DataSizeUnit
+:uri-stdlib-Dynamic: {uri-stdlib-baseModule}/Dynamic
+:uri-stdlib-Dynamic-toTyped: {uri-stdlib-baseModule}/Dynamic#toTyped()
+:uri-stdlib-Typed: {uri-stdlib-baseModule}/Typed
+:uri-stdlib-Regex: {uri-stdlib-baseModule}/Regex
+:uri-stdlib-Regex-method: {uri-stdlib-baseModule}/#Regex()
+:uri-stdlib-Regex-match: {uri-stdlib-baseModule}/Regex#match
+:uri-stdlib-RegexMatch: {uri-stdlib-baseModule}/RegexMatch
+:uri-stdlib-Pair: {uri-stdlib-baseModule}/Pair
+:uri-stdlib-IntSeq: {uri-stdlib-baseModule}/IntSeq
+:uri-stdlib-Class: {uri-stdlib-baseModule}/Class
+:uri-stdlib-TypeAlias: {uri-stdlib-baseModule}/TypeAlias
+:uri-stdlib-Deprecated: {uri-stdlib-baseModule}/Deprecated
+:uri-stdlib-BaseValueRenderer: {uri-stdlib-baseModule}/BaseValueRenderer
+:uri-stdlib-ValueRenderer: {uri-stdlib-baseModule}/ValueRenderer
+:uri-stdlib-BytesRenderer: {uri-stdlib-baseModule}/BytesRenderer
+:uri-stdlib-YamlRenderer: {uri-stdlib-baseModule}/YamlRenderer
+:uri-stdlib-PcfRenderer-converters: {uri-stdlib-baseModule}/PcfRenderer#converters
+:uri-stdlib-Function: {uri-stdlib-baseModule}/Function
+:uri-stdlib-Function0: {uri-stdlib-baseModule}/Function0
+:uri-stdlib-Function1: {uri-stdlib-baseModule}/Function1
+:uri-stdlib-Function1-apply: {uri-stdlib-baseModule}/Function1#apply()
+:uri-stdlib-Function2: {uri-stdlib-baseModule}/Function2
+:uri-stdlib-Function3: {uri-stdlib-baseModule}/Function3
+:uri-stdlib-Function4: {uri-stdlib-baseModule}/Function4
+:uri-stdlib-Function5: {uri-stdlib-baseModule}/Function5
+:uri-stdlib-Bytes: {uri-stdlib-baseModule}/Bytes
+:uri-stdlib-Resource: {uri-stdlib-baseModule}/Resource
+:uri-stdlib-outputFiles: {uri-stdlib-baseModule}/ModuleOutput#files
+:uri-stdlib-FileOutput: {uri-stdlib-baseModule}/FileOutput
+
+:uri-messagepack: https://msgpack.org/index.html
+:uri-messagepack-spec: https://github.com/msgpack/msgpack/blob/master/spec.md
+
+:uri-pkl-roadmap: https://github.com/orgs/apple/projects/12/views/1
+
+// TODO: figure out what the correct URL should be
+:uri-sonatype-snapshot-download: https://s01.oss.sonatype.org/service/local/artifact/maven/redirect?r=snapshots&g=org.pkl-lang&v={pkl-artifact-version}

docs/modules/bindings-specification/pages/binary-encoding.adoc

@@ -0,0 +1,235 @@
+= `pkl-binary` Encoding
+include::ROOT:partial$component-attributes.adoc[]
+include::partial$component-attributes.adoc[]
+
+:uri-pkl-core-Evaluator: {uri-pkl-core-main-sources}/Evaluator.java
+
+Pkl values can be encoded into a binary format called "pkl-binary".
+This format is a lossless serialization of the underlying Pkl values.
+
+Pkl code can be rendered into this format using the {uri-stdlib-pklbinaryModule}[pkl:pklbinary] standard library module.
+
+Alternatively, many language bindings also provide methods to evaluate into `pkl-binary`, such as the `evaluateExpressionPklBinary` method in link:{uri-pkl-core-Evaluator}[org.pkl.core.Evaluator].
+
+The binary format is uses link:{uri-messagepack}[MessagePack] encoding.
+
+== Primitives
+
+All Pkl primitives turn into their respective MessagePack primitive.
+
+|===
+|Pkl Type|MessagePack format
+
+|link:{uri-stdlib-Int}[Int]
+|link:{uri-messagepack-int}[int]
+
+|link:{uri-stdlib-Float}[Float]
+|link:{uri-messagepack-float}[float]
+
+|link:{uri-stdlib-String}[String]
+|link:{uri-messagepack-str}[string]
+
+|link:{uri-stdlib-Boolean}[Boolean]
+|link:{uri-messagepack-bool}[bool]
+
+|link:{uri-stdlib-Null}[Null]
+|link:{uri-messagepack-nil}[nil]
+|===
+
+NOTE: Pkl integers are encoded into the smallest int type that the number will fit into.
+For example, value `8` gets encoded as MessagePack `int8` format.
+
+== Non-primitives
+
+All non-primitive values are encoded as MessagePack arrays.
+The first slot of the array designates the value's type.
+The remaining slots have fixed meanings depending on the type.
+Additional slots may be added to types in future Pkl releases. Decoders *must* be designed to defensively discard values beyond the number of known slots for a type or provide meaningful error messages.
+
+The array's length is the number of slots that are filled. For example, xref:{uri-stdlib-List}[List] is encoded as an MessagePack array with two elements.
+
+|===
+|Pkl type |Slot 1 2+|Slot 2 2+|Slot 3 2+|Slot 4
+
+||code |type |description |type |description |type |description
+
+|link:{uri-stdlib-Typed}[Typed], link:{uri-stdlib-Dynamic}[Dynamic]
+|`0x01`
+|link:{uri-messagepack-str}[str]
+|<<type-name-encoding,Class name>>
+|link:{uri-messagepack-str}[str]
+|Enclosing module URI
+|link:{uri-messagepack-array}[array]
+|Array of <<object-members,object members>>
+
+|link:{uri-stdlib-Map}[Map]
+|`0x02`
+|link:{uri-messagepack-map}[map]
+|Map of `<value>` to `<value>`
+|
+|
+|
+|
+
+|link:{uri-stdlib-Mapping}[Mapping]
+|`0x03`
+|link:{uri-messagepack-map}[map]
+|Map of `<value>` to `<value>`
+|
+|
+|
+|
+
+|link:{uri-stdlib-List}[List]
+|`0x04`
+|link:{uri-messagepack-array}[array]
+|Array of `<value>`
+|
+|
+|
+|
+
+|link:{uri-stdlib-Listing}[Listing]
+|`0x05`
+|link:{uri-messagepack-array}[array]
+|Array of `<value>`
+|
+|
+|
+|
+
+|link:{uri-stdlib-Set}[Set]
+|`0x06`
+|link:{uri-messagepack-array}[array]
+|Array of `<value>`
+|
+|
+|
+|
+
+|link:{uri-stdlib-Duration}[Duration]
+|`0x07`
+|{uri-messagepack-float}[float64]
+|Duration value
+|link:{uri-messagepack-str}[str]
+|link:{uri-stdlib-DurationUnit}[Duration unit] (`"ns"`, `"ms"`, etc.)
+|
+|
+
+|link:{uri-stdlib-DataSize}[DataSize]
+|`0x08`
+|link:{uri-messagepack-float}[float64]
+|Value (float64)
+|link:{uri-messagepack-str}[str]
+|link:{uri-stdlib-DataSizeUnit}[DataSize unit] (`"b"`, `"kb"`, etc.)
+|
+|
+
+|link:{uri-stdlib-Pair}[Pair]
+|`0x09`
+|`<value>`
+|First value
+|`<value>`
+|Second value
+|
+|
+
+|link:{uri-stdlib-IntSeq}[IntSeq]
+|`0x0A`
+|link:{uri-messagepack-int}[int]
+|Start
+|link:{uri-messagepack-int}[int]
+|End
+|link:{uri-messagepack-int}[int]
+|Step
+
+|link:{uri-stdlib-Regex}[Regex]
+|`0x0B`
+|link:{uri-messagepack-str}[str]
+|Regex string representation
+|
+|
+|
+|
+
+|link:{uri-stdlib-Class}[Class]
+|`0x0C`
+|link:{uri-messagepack-str}[str]
+|<<type-name-encoding,Class name>>
+|link:{uri-messagepack-str}[str]
+|Module URI
+|
+|
+
+|link:{uri-stdlib-TypeAlias}[TypeAlias]
+|`0x0D`
+|link:{uri-messagepack-str}[str]
+|<<type-name-encoding,TypeAlias name>>
+|link:{uri-messagepack-str}[str]
+|Module URI
+|
+|
+
+|link:{uri-stdlib-Function}[Function]
+|`0x0E`
+|
+|
+|
+|
+|
+|
+
+|link:{uri-stdlib-Bytes}[Bytes]
+|`0x0F`
+|link:{uri-messagepack-bin}[bin]
+|Binary contents
+|
+|
+|
+|
+|===
+
+[[type-name-encoding]]
+[NOTE]
+====
+Type names have specific encoding rules:
+
+* When the module URI is `pkl:base`:
+** If the type name is `ModuleClass`, this type represents the module class of `pkl:base`.
+** Otherwise, the type name corresponds to a type in `pkl:base`.
+* For all other module URIs:
+** When the type name contains `\#`, the string after the `#` character corresponds to a type in that module. The string before the `#` is the name of the module.
+** Otherwise, the type name is the name of the module and represents the class of the module.
+====
+
+[[object-members]]
+== Object Members
+
+Like non-primitive values, object members are encoded as MessagePack arrays, where the first slot designates the value's type.
+
+|===
+|Member type |Slot 1 2+|Slot 2 2+|Slot 3
+
+| |code |type |description |type |description
+
+|Property
+|`0x10`
+|link:{uri-messagepack-str}[str]
+|key
+|`<value>`
+|property value
+
+|Entry
+|`0x11`
+|`<value>`
+|entry key
+|`<value>`
+|entry value
+
+|Element
+|`0x12`
+|link:{uri-messagepack-int}[int]
+|index
+|`<value>`
+|element value
+|===

docs/modules/bindings-specification/pages/index.adoc

@@ -0,0 +1,173 @@
+= Language Binding Specification
+
+:uri-pkl-go-github: https://github.com/apple/pkl-go
+:uri-pkl-swift-github: https://github.com/apple/pkl-swift
+
+Pkl can be embedded within any host application.
+The host application has access to low level controls.
+It is able to manage the lifecycle of evaluators, as well as provide custom modules and resources to Pkl.
+
+Currently, Pkl must be embedded as a child process, by shelling out to the CLI using the xref:pkl-cli:index.adoc#command-server[`pkl server`] command. In the future, a C library will also be provided.
+
+When embedded, communication between a host application and Pkl happens via message passing.
+The message passing specification can be found in xref:message-passing-api.adoc[].
+
+For examples of language bindings in practice, review the link:{uri-pkl-go-github}[pkl-go], or the link:{uri-pkl-swift-github}[pkl-swift] codebases.
+
+NOTE: Pkl's Java and Kotlin libraries binds to Pkl directly, and do not use message passing.
+
+== Features of a language binding
+
+A language binding for Pkl should generally have the following components:
+
+. A client that spawns `pkl server`, and talks to it using message passing.
+. A deserializer that turns xref:binary-encoding.adoc[pkl binary encoding] into a structure in the host language.
+. A code generator that transforms Pkl schemas into schemas written in the host language.
+  The code generator is mostly written in Pkl, with a lightweight executable that acts as the glue layer.
+  For examples of code generators, consult link:{uri-pkl-go-github}/tree/main/codegen[pkl-go] and link:{uri-pkl-swift-github}/tree/main/codegen[pkl-swift].
+
+== Sample flow
+
+Here is a sample flow for evaluating a module with the following contents:
+
+.\file:///path/to/myModule.pkl
+[source,{pkl}]
+----
+module MyModule
+
+theModules = import*("customfs:/*.pkl")
+----
+
+. Client sends xref:message-passing-api.adoc#create-evaluator-request[Create Evaluator Request], including `customfs` as a custom module reader.
++
+[source,json]
+----
+[
+  0x20,
+  {
+    "requestId": 135,
+    "allowedModules": ["pkl:", "repl:", "file:", "customfs:"],
+    "clientModuleReaders": [
+      {
+        "scheme": "customfs",
+        "hasHierarchicalUris": true,
+        "isGlobbable": true,
+        "isLocal": true
+      }
+    ]
+  }
+]
+----
+. Server sends xref:message-passing-api.adoc#create-evaluator-response[Create Evaluator Response], with an evaluator id.
++
+[source,json]
+----
+[
+  0x21,
+  {
+    "requestId": 135,
+    "evaluatorId": -135901
+  }
+]
+----
+. Client sends xref:message-passing-api.adoc#evaluate-request[Evaluate Request], providing the module's URI.
++
+[source,json]
+----
+[
+  0x23,
+  {
+    "requestId": 9805131,
+    "evaluatorId": -13901,
+    "moduleUri": "file:///path/to/myModule.pkl"
+  }
+]
+----
+. During evaluation, server evaluates `import*("customfs:/*.pkl")`, and sends xref:message-passing-api.adoc#list-modules-request[List Modules Request].
++
+[source,json]
+----
+[
+  0x2c,
+  {
+    "requestId": -6478924,
+    "evaluatorId": -13901,
+    "uri": "customfs:/"
+  }
+]
+----
+. Client responds with xref:message-passing-api.adoc#list-modules-response[List Modules Response].
+In our pretend scenario, there is only one file; `foo.pkl`.
++
+[source,json]
+----
+[
+  0x2d,
+  {
+    "requestId": -6478924,
+    "evaluatorId": -13901,
+    "pathElements": [
+      {
+        "name": "foo.pkl",
+        "isDirectory": false
+      }
+    ]
+  }
+]
+----
+. Server sends xref:message-passing-api.adoc#read-module-request[Read Module Request] to read `foo.pkl`.
++
+[source,json]
+----
+[
+  0x28,
+  {
+    "requestId": 36408291,
+    "evaluatorId": -13901,
+    "uri": "customfs:/foo.pkl"
+  }
+]
+----
+. Client responds with the module's contents
++
+[source,json]
+----
+[
+  0x29,
+  {
+    "requestId": 36408291,
+    "evaluatorId": -13901,
+    "contents": "foo = 1"
+  }
+]
+----
+. Server finishes evaluation, and responds with the xref:message-passing-api.adoc#evaluate-response[Evaluate Response].
++
+[source,json]
+----
+[
+  0x24,
+  {
+    "requestId": 9805131,
+    "evaluatorId": -13901,
+    "result": <pkl binary value>
+  }
+]
+----
+. Client sends xref:message-passing-api.adoc#close-evaluator[Close Evaluator].
++
+[source,json]
+----
+[
+  0x22,
+  {
+    "evaluatorId": -13901
+  }
+]
+----
+
+== Debug logs
+
+Set the env var `PKL_DEBUG=1` to enable more verbose logging from Pkl.
+It is recommended that clients also use this environment variable to enable debug logs of their own.
+

docs/modules/bindings-specification/pages/message-passing-api.adoc

@@ -0,0 +1,691 @@
+= Message Passing API
+
+include::ROOT:partial$component-attributes.adoc[]
+include::partial$component-attributes.adoc[]
+
+All messages are encoded in link:{uri-messagepack}[MessagePack], as an array with two elements.
+
+The first element of the array is a code that designates the message's type, encoded as an int.
+The second element of the array is the message body, encoded as a map.
+
+Messages are passed between the _client_ and the _server_.
+When hosting Pkl (for example, the Swift application when using pkl-swift), the _client_ is the host program and the _server_ is the entity that provides controls for interacting with Pkl.
+When implementing an xref:language-reference:index.adoc#external-readers[external reader], the _client_ is the external reader process and the _server_ is the Pkl evaluator.
+
+For example, in JSON representation:
+
+[source,json]
+----
+[
+  1,                           // <1>
+  { "someKey": "someValue" }   // <2>
+]
+----
+<1> Code indicating message type
+<2> Message body
+
+== Message types
+
+[[client-message]]
+=== Client Message
+A message passed from the client to the server.
+
+[[server-message]]
+=== Server Message
+A message passed from the server to the client.
+
+[[request-message]]
+=== Request Message
+A message sent with a `requestId` value.
+The `requestId` should be a unique number at the time of message send.
+The other side is expected to respond with a <<response-message>> with the same `requestId`.
+
+[[response-message]]
+=== Response Message
+A message that is the response to a <<request-message>>.
+It contains the same `requestId` of the request message.
+
+[[one-way-message]]
+=== One Way Message
+
+A fire-and-forget message where no response is expected.
+
+== Messages
+
+All messages have their schema described in Pkl.
+A nullable type means that the property should be omitted (as opposed to the property's value being `nil`).
+
+[[create-evaluator-request]]
+=== Create Evaluator Request
+
+Code: `0x20` +
+Type: <<client-message,Client>> <<request-message,Request>>
+
+Create an evaluator with the provided evaluator settings.
+Upon creating the evaluator, the server sends back a <<create-evaluator-response>> message.
+
+Schema:
+[source,pkl]
+----
+/// A number identifying this request
+requestId: Int
+
+/// Regex patterns to determine which modules are allowed for import.
+///
+/// API version of the CLI's `--allowed-modules` flag
+allowedModules: Listing<String>?
+
+/// Regex patterns to determine which resources are allowed to be read.
+///
+/// API version of the CLI's `--allowed-resources` flag
+allowedResources: Listing<String>?
+
+/// Register client-side module readers.
+clientModuleReaders: Listing<ClientModuleReader>?
+
+/// Register client-side resource readers.
+clientResourceReaders: Listing<ClientResourceReader>?
+
+/// Directories, ZIP archives, or JAR archives
+/// to search when resolving `modulepath:` URIs.
+///
+/// API version of the CLI's `--module-path` flag.
+modulePaths: Listing<String>?
+
+/// Environment variable to set.
+///
+/// API version of the CLI's `--env-var` flag.
+env: Mapping<String, String>?
+
+/// External properties to set.
+///
+/// API version of the CLI's `--properties` flag.
+properties: Mapping<String, String>?
+
+/// Duration, in seconds, after which evaluation of a source module will be timed out.
+///
+/// API version of the CLI's `--timeout` flag.
+timeoutSeconds: Int?
+
+/// Restricts access to file-based modules and resources to those located under the root directory.
+rootDir: String?
+
+/// The cache directory for storing packages.
+cacheDir: String?
+
+/// The format to generate.
+///
+/// This sets the `pkl.outputFormat` external property.
+outputFormat: String?
+
+/// The project dependency settings.
+project: Project?
+
+/// Configuration of outgoing HTTP(s) requests.
+///
+/// Added in Pkl 0.26.0.
+http: Http?
+
+class ClientResourceReader {
+  /// The URI scheme this reader is responsible for reading.
+  scheme: String
+
+  /// Tells whether the path part of this URI has a
+  /// [hier-part](https://datatracker.ietf.org/doc/html/rfc3986#section-3).
+  ///
+  /// An example of a hierarchical URI is `file:///path/to/my/file`, where
+  /// `/path/to/my/file` designates a nested path through the `/` character.
+  ///
+  /// An example of a non-hierarchical URI is `pkl.base`, where the `base` does not denote
+  /// any form of hierarchy.
+  hasHierarchicalUris: Boolean
+
+  /// Tells whether this reader supports globbing.
+  isGlobbable: Boolean
+}
+
+class ClientModuleReader {
+  /// The URI scheme this reader is responsible for reading.
+  scheme: String
+
+  /// Tells whether the path part of this URI has a
+  /// [hier-part](https://datatracker.ietf.org/doc/html/rfc3986#section-3).
+  ///
+  /// An example of a hierarchical URI is `file:///path/to/my/file`, where
+  /// `/path/to/my/file` designates a nested path through the `/` character.
+  ///
+  /// An example of a non-hierarchical URI is `pkl.base`, where the `base` does not denote
+  /// any form of hierarchy.
+  hasHierarchicalUris: Boolean
+
+  /// Tells whether this reader supports globbing.
+  isGlobbable: Boolean
+
+  /// Tells whether the module is local to the system.
+  ///
+  /// A local resource that [hasHierarchicalUris] supports triple-dot imports.
+  isLocal: Boolean
+}
+
+class Project {
+  type: "local"
+
+  /// The canonical URI of this project's package
+  packageUri: String?
+
+  /// The URI pointing to the location of the project file.
+  projectFileUri: String
+
+  /// The dependencies of this project.
+  dependencies: Mapping<String, Project|RemoteDependency>
+}
+
+class RemoteDependency {
+  type: "remote"
+
+  /// The canonical URI of this dependency
+  packageUri: String?
+
+  /// The checksums of this remote dependency
+  checksums: Checksums?
+}
+
+class Checksums {
+  /// The sha-256 checksum of this dependency's metadata.
+  sha256: String
+}
+
+class Http {
+  /// PEM format certificates to trust when making HTTP requests.
+  ///
+  /// If [null], Pkl will trust its own built-in certificates.
+  caCertificates: Bytes? // <1>
+
+  /// Configuration of the HTTP proxy to use.
+  ///
+  /// If [null], uses the operating system's proxy configuration.
+  proxy: Proxy?
+
+  /// HTTP rewrites, from source prefix to target prefix.
+  ///
+  /// Each rewrite must start with `http://` or `https://`, and must end with `/`.
+  rewrites: Mapping<String, String>?
+}
+
+/// Settings that control how Pkl talks to HTTP proxies.
+class Proxy {
+  /// The proxy to use for HTTP(S) connections.
+  ///
+  /// At the moment, only HTTP proxies are supported.
+  ///
+  /// Example:
+  /// ```
+  /// address = "http://my.proxy.example.com:5080"
+  /// ```
+  address: Uri(startsWith("http://"))?
+
+  /// Hosts to which all connections should bypass a proxy.
+  ///
+  /// Values can be either hostnames, or IP addresses.
+  /// IP addresses can optionally be provided using [CIDR notation](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_notation).
+  ///
+  /// The only wildcard is `"*"`, which disables all proxying.
+  ///
+  /// A hostname matches all subdomains.
+  /// For example, `example.com` matches `foo.example.com`, but not `fooexample.com`.
+  /// A hostname that is prefixed with a dot matches the hostname itself,
+  /// so `.example.com` matches `example.com`.
+  ///
+  /// Optionally, a port can be specified.
+  /// If a port is omitted, all ports are matched.
+  ///
+  /// Example:
+  ///
+  /// ```
+  /// noProxy {
+  ///   "127.0.0.1"
+  ///   "169.254.0.0/16"
+  ///   "example.com"
+  ///   "localhost:5050"
+  /// }
+  /// ```
+  noProxy: Listing<String>(isDistinct)
+}
+----
+<1> link:{uri-messagepack-bin}[bin format]
+
+Example:
+[source,json5]
+----
+[
+  0x20,
+  {
+    "requestId": 193501,
+    "allowedModules": ["pkl:", "repl:"],
+    "allowedResources": ["file:", "package:", "projectpackage:"]
+  }
+]
+----
+
+[[create-evaluator-response]]
+=== Create Evaluator Response
+
+Code: `0x21` +
+Type: <<server-message,Server>> <<response-message,Response>>
+
+The response for a <<create-evaluator-request>>.
+If the evaluator was created successfully, `evaluatorId` is set. Otherwise, `error` is set to the resulting error.
+
+[source,pkl]
+----
+/// A number identifying this request
+requestId: Int
+
+/// A number identifying the created evaluator.
+evaluatorId: Int?
+
+/// A message detailing why the evaluator was not created.
+error: String?
+----
+
+[[close-evaluator]]
+=== Close Evaluator
+
+Code: `0x22` +
+Type: <<client-message,Client>> <<one-way-message,One Way>>
+
+Tells the Pkl server to close an evaluator, releasing any resources it may be holding.
+
+[source,pkl]
+----
+/// A number identifying this evaluator.
+evaluatorId: Int
+----
+
+[[evaluate-request]]
+=== Evaluate Request
+
+Code: `0x23` +
+Type: <<client-message,Client>> <<request-message,Request>>
+
+Evaluate a module.
+
+[source,pkl]
+----
+/// A number identifying this request
+requestId: Int
+
+/// A number identifying this evaluator.
+evaluatorId: Int
+
+/// The absolute URI of the module to be evaluated.
+moduleUri: String
+
+/// The module's contents.
+///
+/// If [null], Pkl will load the module at runtime.
+moduleText: String?
+
+/// The Pkl expression to be evaluated within the module.
+///
+/// If [null], evaluates the whole module.
+expr: String?
+----
+
+[[evaluate-response]]
+=== Evaluate Response
+
+Code: `0x24` +
+Type: <<server-message,Server>> <<response-message,Response>>
+
+The server's response to <<evaluate-request>>.
+If the evaluation is successful, the response is the Pkl value encoded in xref:binary-encoding.adoc[binary encoding].
+
+[source,pkl]
+----
+/// The requestId of the Evaluate request
+requestId: Int
+
+/// A number identifying this evaluator.
+evaluatorId: Int
+
+/// The evaluation contents, if successful.
+result: Bytes? // <1>
+
+/// A message detailing why evaluation failed.
+error: String?
+----
+<1> xref:binary-encoding.adoc[Pkl Binary Encoding] in link:{uri-messagepack-bin}[bin format]
+
+[[log]]
+=== Log
+
+Code: `0x25` +
+Type: <<server-message,Server>> <<one-way-message,One Way>>
+
+Tells the client to emit a log message, during the execution of a Pkl program.
+A log can occur through a xref:language-reference:index.adoc#debugging[trace()] expression, or through a warning (for example, when encountering a link:{uri-stdlib-Deprecated}[Deprecated] value.)
+
+[source,pkl]
+----
+/// A number identifying this evaluator.
+evaluatorId: Int
+
+/// A number identifying the log level.
+///
+/// - 0: trace
+/// - 1: warn
+level: Int(this == 0 || this == 1)
+
+/// The message to be logged
+message: String
+
+/// A string representing the source location within Pkl code producing this log output.
+frameUri: String
+----
+
+[[read-resource-request]]
+=== Read Resource Request
+
+Code: `0x26` +
+Type: <<server-message,Server>> <<request-message,Request>>
+
+Read a resource at the given URI.
+This message occurs when a read expression (`read`/`read?`/`read*`) is encountered within a program, and its scheme matches a client resource reader.
+
+[source,pkl]
+----
+/// A number identifying this request.
+requestId: Int
+
+/// A number identifying this evaluator.
+evaluatorId: Int
+
+/// The URI of the resource.
+uri: String
+----
+
+[[read-resource-response]]
+=== Read Resource Response
+
+Code: `0x27` +
+Type: <<client-message,Client>> <<response-message,Response>>
+
+The response to <<read-resource-request>>.
+If successful, `contents` is set.
+Otherwise, `error` is set.
+
+If neither is set, `contents` defaults to an empty byte array.
+
+[source,pkl]
+----
+/// A number identifying this request.
+requestId: Int
+
+/// A number identifying this evaluator.
+evaluatorId: Int
+
+/// The contents of the resource.
+contents: Bytes? // <1>
+
+/// The description of the error that occurred when reading this resource.
+error: String?
+----
+<1> MessagePack's link:https://github.com/msgpack/msgpack/blob/master/spec.md#bin-format-family[bin format family]
+
+[[read-module-request]]
+=== Read Module Request
+
+Code: `0x28` +
+Type: <<server-message,Server>> <<request-message,Request>>
+
+Read a module at the given URI.
+This message occurs during the evaluation of an import statement or expression (`import`/`import*`), when a scheme matches a client module reader.
+
+[source,pkl]
+----
+/// A number identifying this request.
+requestId: Int
+
+/// A number identifying this evaluator.
+evaluatorId: Int
+
+/// The URI of the module.
+uri: String
+----
+
+[[read-module-response]]
+=== Read Module Response
+
+Code: `0x29` +
+Type: <<client-message,Client>> <<response-message,Response>>
+
+The response to <<read-module-request>>.
+If successful, `contents` is set.
+Otherwise, `error` is set.
+
+If neither is set, `contents` defaults to an empty string.
+
+[source,pkl]
+----
+/// A number identifying this request.
+requestId: Int
+
+/// A number identifying this evaluator.
+evaluatorId: Int
+
+/// The string contents of the module.
+contents: String?
+
+/// The description of the error that occurred when reading this resource.
+error: String?
+----
+
+[[list-resources-request]]
+=== List Resources Request
+
+Code: `0x2a` +
+Type: <<server-message,Server>> <<request-message,Request>>
+
+List resources at the specified base path.
+This message occurs during the evaluation of a xref:language-reference:index.adoc#globbed-reads[globbed read], when a scheme matches a client resource reader's scheme.
+
+If the resource reader does not have hierarchical URIs, `dummy` is used as the path, and the response is expected to contain all resource elements for that scheme.
+
+[source,pkl]
+----
+/// A number identifying this request.
+requestId: Int
+
+/// A number identifying this evaluator.
+evaluatorId: Int
+
+/// The base URI to list resources.
+uri: String
+----
+
+[[list-resources-response]]
+=== List Resources Response
+
+Code: `0x2b` +
+Type: <<client-message,Client>> <<response-message,Response>>
+
+The response to <<list-resources-request>>.
+If successful, `pathElements` is set.
+Otherwise, `error` is set.
+
+If neither are set, `pathElements` default to an empty list.
+
+[source,pkl]
+----
+/// A number identifying this request.
+requestId: Int
+
+/// A number identifying this evaluator.
+evaluatorId: Int
+
+/// The elements at the provided base path.
+pathElements: Listing<PathElement>?
+
+/// The description of the error that occurred when listing elements.
+error: String?
+
+class PathElement {
+  /// The name of the element at this path
+  name: String
+
+  /// Tells whether the element is a directory.
+  isDirectory: Boolean
+}
+----
+
+[[list-modules-request]]
+=== List Modules Request
+
+Code: `0x2c` +
+Type: <<server-message,Server>> <<request-message,Request>>
+
+List modules at the specified base path.
+This message occurs during the evaluation of a xref:language-reference:index.adoc#globbed-imports[globbed import], when a scheme matches a client resource reader's scheme.
+
+If the module reader does not have hierarchical URIs, `dummy` is used as the path, and the response is expected to contain all module elements for that scheme.
+
+[source,pkl]
+----
+/// A number identifying this request.
+requestId: Int
+
+/// A number identifying this evaluator.
+evaluatorId: Int
+
+/// The base URI to list modules.
+uri: String
+----
+
+[[list-modules-response]]
+=== List Modules Response
+
+Code: `0x2d` +
+Type: <<client-message,Client>> <<response-message,Response>>
+
+The response to <<list-modules-request>>.
+If successful, `pathElements` is set.
+Otherwise, `error` is set.
+
+If neither are set, `pathElements` default to an empty list.
+
+[source,pkl]
+----
+/// A number identifying this request.
+requestId: Int
+
+/// A number identifying this evaluator.
+evaluatorId: Int
+
+/// The elements at the provided base path.
+pathElements: Listing<PathElement>?
+
+/// The description of the error that occurred when listing elements.
+error: String?
+
+class PathElement {
+  /// The name of the element at this path
+  name: String
+
+  /// Tells whether the element is a directory.
+  isDirectory: Boolean
+}
+----
+
+[[initialize-module-reader-request]]
+=== Initialize Module Reader Request
+
+Code: `0x2e` +
+Type: <<server-message,Server>> <<request-message,Request>>
+
+Initialize an xref:language-reference:index.adoc#external-readers[External Module Reader].
+This message is sent to external reader processes the first time a module scheme it is registered for is read.
+
+[source,pkl]
+----
+/// A number identifying this request.
+requestId: Int
+
+/// The module scheme to initialize.
+scheme: String
+----
+
+[[initialize-module-reader-response]]
+=== Initialize Module Reader Response
+
+Code: `0x2f` +
+Type: <<client-message,Client>> <<response-message,Response>>
+
+Return the requested external module reader specification.
+The `spec` field should be set to `null` when the external process does not implement the requested module scheme.
+
+[source,pkl]
+----
+/// A number identifying this request.
+requestId: Int
+
+/// Client-side module reader spec.
+///
+/// Null when the external process does not implement the requested module scheme.
+spec: ClientModuleReader?
+----
+
+`ClientModuleReader` is defined above by <<create-evaluator-request,Create Evaluator Request>>.
+
+[[initialize-resource-reader-request]]
+=== Initialize Resource Reader Request
+
+Code: `0x30` +
+Type: <<server-message,Server>> <<request-message,Request>>
+
+Initialize an xref:language-reference:index.adoc#external-readers[External Resource Reader].
+This message is sent to external reader processes the first time a resource scheme it is registered for is read.
+
+[source,pkl]
+----
+/// A number identifying this request.
+requestId: Int
+
+/// The resource scheme to initialize.
+scheme: String
+----
+
+[[initialize-resource-reader-response]]
+=== Initialize Resource Reader Response
+
+Code: `0x31` +
+Type: <<client-message,Client>> <<response-message,Response>>
+
+Return the requested external resource reader specification.
+The `spec` field should be set to `null` when the external process does not implement the requested resource scheme.
+
+[source,pkl]
+----
+/// A number identifying this request.
+requestId: Int
+
+/// Client-side resource reader spec.
+///
+/// Null when the external process does not implement the requested resource scheme.
+spec: ClientResourceReader?
+----
+
+`ClientResourceReader` is defined above by <<create-evaluator-request,Create Evaluator Request>>. 
+
+[[close-external-process]]
+=== Close External Process
+
+Code: `0x32` +
+Type: <<server-message,Server>> <<one-way-message,One Way>> 
+
+Initiate graceful shutdown of the external reader process.
+
+[source,pkl]
+----
+/// This message has no properties.
+----

docs/modules/bindings-specification/partials/component-attributes.adoc

@@ -0,0 +1,9 @@
+:uri-github-binary-encoding-snippet-tests: {uri-github-tree}/pkl-server/src/test/files/SnippetTests
+:uri-messagepack-bool: {uri-messagepack-spec}#bool-format-family
+:uri-messagepack-int: {uri-messagepack-spec}#int-format-family
+:uri-messagepack-float: {uri-messagepack-spec}#float-format-family
+:uri-messagepack-str: {uri-messagepack-spec}#str-format-family
+:uri-messagepack-bin: {uri-messagepack-spec}#bin-format-family
+:uri-messagepack-array: {uri-messagepack-spec}#array-format-family
+:uri-messagepack-map: {uri-messagepack-spec}#map-format-family
+:uri-messagepack-nil: {uri-messagepack-spec}#nil-format

docs/modules/introduction/pages/comparison.adoc

@@ -13,14 +13,14 @@ Also, Pkl's strong and weak points in comparison to other configuration language
 [[static-config-formats]]
 == Pkl vs. Static Config Formats
 
-Static configuration formats such as JSON, YAML, and XML work reasonably well for simple configuration needs.
+Static configuration formats such as JSON, YAML, TOML, and XML work reasonably well for simple configuration needs.
 However, they do have some shortcomings, including:
 
 . They are not very human-friendly to read and write. (JSON, XML)
-. They do not provide a way to split a large file into multiple smaller ones. (JSON, YAML)
-. They offer no way or very limited ways to abstract over repetitive configuration. (JSON, YAML, XML)
-. They do not offer standardized or widely available schema validators. (JSON, YAML)
-. They offer little or no schema-aware tooling. (JSON, YAML)
+. They do not provide a way to split a large file into multiple smaller ones. (JSON, YAML, TOML)
+. They offer no way or very limited ways to abstract over repetitive configuration. (JSON, YAML, TOML, XML)
+. They do not offer standardized or widely available schema validators. (JSON, YAML, TOML)
+. They offer little or no schema-aware tooling. (JSON, YAML, TOML)
 
 Pkl addresses these shortcomings as follows:
 

docs/modules/introduction/pages/use-cases.adoc

@@ -22,7 +22,7 @@ At the same time, anyone configuring your application -- whether that's your use
 +
 At the time of writing, Pkl offers configuration libraries for the JVM runtime, Swift, and also for Golang.
 +
-We maintian the following libraries:
+We maintain the following libraries:
 +
 * xref:java-binding:pkl-config-java.adoc[pkl-config-java] for Java compatible languages
 * xref:kotlin-binding:pkl-config-kotlin.adoc[pkl-config-kotlin] for the {uri-kotlin-homepage}[Kotlin] language.

docs/modules/java-binding/examples/JavaConfigExample.java

@@ -1,18 +1,19 @@
 import org.pkl.config.java.Config;
 import org.pkl.config.java.ConfigEvaluator;
 import org.pkl.config.java.JavaType;
+import org.pkl.core.ModuleSource;
 import org.junit.jupiter.api.Test;
 
-@SuppressWarnings("unused")
-// the pkl/pkl-examples repo has a similar example
+@SuppressWarnings({"unused", "NewClassNamingConvention"})
+// the pkl-jvm-examples repo has a similar example
 public class JavaConfigExample {
   @Test
   public void usage() {
     // tag::usage[]
     Config config;
     try (var evaluator = ConfigEvaluator.preconfigured()) { // <1>
-      config = evaluator.evaluateText(
-        "pigeon { age = 5; diet = \"Seeds\" }"); // <2>
+      config = evaluator.evaluate(
+        ModuleSource.text("pigeon { age = 5; diet = new Listing { \"Seeds\" } }")); // <2>
     }
     var pigeon = config.get("pigeon"); // <3>
     var age = pigeon.get("age").as(int.class); // <4>

docs/modules/java-binding/pages/codegen.adoc

@@ -1,6 +1,12 @@
 = Java Code Generator
 include::ROOT:partial$component-attributes.adoc[]
-:uri-pkl-codgen-java-maven-module: {uri-maven-docsite}/artifact/org.pkl-lang/pkl-codegen-java
+:uri-pkl-codegen-java-maven-module: {uri-maven-docsite}/artifact/org.pkl-lang/pkl-codegen-java
+
+:uri-pkl-codegen-java-download: {uri-sonatype-snapshot-download}&a=pkl-cli-codegen-java&e=jar
+
+ifdef::is-release-version[]
+:uri-pkl-codegen-java-download: {github-releases}/pkl-codegen-java
+endif::[]
 
 The Java source code generator takes Pkl class definitions as an input, and generates corresponding Java classes with equally named properties.
 
@@ -23,11 +29,11 @@ See xref:pkl-gradle:index.adoc#installation[Installation] in the Gradle plugin c
 [[install-library]]
 === Java Library
 
-The `pkl-codegen-java` library is available {uri-pkl-codgen-java-maven-module}[from Maven Central].
-It requires Java 11 or higher.
+The `pkl-codegen-java` library is available {uri-pkl-codegen-java-maven-module}[from Maven Central].
+It requires Java 17 or higher.
 
 ifndef::is-release-version[]
-NOTE: Snapshots are published to repository `{uri-sonatype}`.
+NOTE: Snapshots are published to repository `{uri-snapshot-repo}`.
 endif::[]
 
 ==== Gradle
@@ -36,36 +42,42 @@ To use the library in a Gradle project, declare the following dependency:
 
 [tabs]
 ====
-Groovy::
-+
-.build.gradle
-[source,groovy,subs="+attributes"]
-----
-dependencies {
-  compile "org.pkl-lang:pkl-codegen-java:{pkl-artifact-version}"
-}
-
-ifndef::is-release-build[]
-repositories {
-  maven { url "{uri-sonatype}" }
-}
-endif::[]
-----
-
 Kotlin::
 +
 .build.gradle.kts
 [source,kotlin,subs="+attributes"]
 ----
 dependencies {
-  compile("org.pkl-lang:pkl-codegen-java:{pkl-artifact-version}")
+  implementation("org.pkl-lang:pkl-codegen-java:{pkl-artifact-version}")
 }
 
-ifndef::is-release-build[]
 repositories {
-  maven { url = uri("{uri-sonatype}") }
-}
+ifdef::is-release-version[]
+  mavenCentral()
 endif::[]
+ifndef::is-release-version[]
+  maven(url = "{uri-sonatype}")
+endif::[]
+}
+----
+
+Groovy::
++
+.build.gradle
+[source,groovy,subs="+attributes"]
+----
+dependencies {
+  implementation "org.pkl-lang:pkl-codegen-java:{pkl-artifact-version}"
+}
+
+repositories {
+ifdef::is-release-version[]
+  mavenCentral()
+endif::[]
+ifndef::is-release-version[]
+  maven { url "{uri-sonatype}" }
+endif::[]
+}
 ----
 ====
 
@@ -82,7 +94,7 @@ To use the library in a Maven project, declare the following dependency:
     <artifactId>pkl-codegen-java</artifactId>
     <version>{pkl-artifact-version}</version>
   </dependency>
-ifndef::is-release-build[]
+ifndef::is-release-version[]
   <repositories>
     <repository>
       <id>sonatype-s01</id>
@@ -97,8 +109,41 @@ endif::[]
 [[install-cli]]
 === CLI
 
-The CLI is bundled with the Java library.
-As we do not currently ship the CLI as a self-contained Jar, we recommend to provision it with a Maven compatible build tool as shown in <<install-library>>.
+The CLI is available as a Java executable.
+
+It works on multiple platforms, and requires a Java 17 (or higher) runtime on the system path.
+
+To download:
+
+[tabs]
+====
+macOS/Linux::
++
+[source,shell]
+[subs="+attributes"]
+----
+curl -L -o pkl-codegen-java '{uri-pkl-codegen-java-download}'
+chmod +x pkl-codegen-java
+./pkl-codegen-java --version
+----
+
+Windows::
++
+[source,PowerShell]
+[subs="+attributes"]
+----
+Invoke-WebRequest '{uri-pkl-codegen-java-download}' -OutFile pkl-codegen-java.bat
+.\pkl-codegen-java --version
+----
+====
+
+This should print something similar to:
+
+[source,shell]
+[subs="+attributes"]
+----
+pkl-codegen-java {pkl-version} (macOS 14.2, Java 17.0.10)
+----
 
 [[codegen-java-usage]]
 == Usage
@@ -117,10 +162,7 @@ For more information, refer to the Javadoc documentation.
 
 === CLI
 
-As explained in <<install-cli,Installation>>, the CLI is bundled with the Java library.
-To run the CLI, execute the library Jar or its `org.pkl.codegen.java.Main` main class.
-
-*Synopsis:* `java -cp <classpath> -jar pkl-codegen-java.jar [<options>] <modules>`
+*Synopsis:* `pkl-codegen-java [<options>] <modules>`
 
 `<modules>`::
 The absolute or relative URIs of the modules to generate classes for.
@@ -139,30 +181,27 @@ Flag that indicates to generate private final fields and public getter methods i
 [%collapsible]
 ====
 Default: (flag not set) +
-Flag that indicates to generate Javadoc based on doc comments for Pkl modules, classes, and properties.
+Flag that indicates to preserve Pkl doc comments by generating corresponding Javadoc comments.
 ====
 
 .--params-annotation
 [%collapsible]
 ====
-Default: `org.pkl.config.java.mapper.Named` +
-Fully qualified name of the annotation to use on constructor parameters.
+Default: `none` if `--generate-spring-boot` is set, `org.pkl.config.java.mapper.Named` otherwise +
+Fully qualified name of the annotation type to use for annotating constructor parameters with their name. +
+The specified annotation type must have a `value` parameter of type `String` or the generated code may not compile.
+If set to `none`, constructor parameters are not annotated.
+Whether and how constructor parameters should be annotated depends on the library that instantiates the generated classes.
+For Spring Boot applications, and for users of `pkl-config-java` compiling the generated classes with `-parameters`, no annotation is required.
 ====
 
 .--non-null-annotation
 [%collapsible]
 ====
 Default: `org.pkl.config.java.mapper.NonNull` +
-Fully qualified named of the annotation class to use for non-null types. +
-This annotation is required to have `java.lang.annotation.ElementType.TYPE_USE` as a `@Target`
-or it may generate code that does not compile.
-====
-
-.--implement-serializable
-[%collapsible]
-====
-Default: (flag not set) +
-Whether to make generated classes implement `java.io.Serializable`.
+Fully qualified name of the annotation type to use for annotating non-null types. +
+The specified annotation type must be annotated with `@java.lang.annotation.Target(ElementType.TYPE_USE)`
+or the generated code may not compile.
 ====
 
 Common code generator options:
@@ -177,4 +216,4 @@ include::../../pkl-cli/partials/cli-common-options.adoc[]
 == Full Example
 
 For a ready-to-go example with full source code,
-see link:{uri-codegen-java-example}[codegen-java] in the _pkl/pkl-examples_ repository.
+see link:{uri-codegen-java-example}[codegen-java] in the _pkl-jvm-examples_ repository.

docs/modules/java-binding/pages/pkl-config-java.adoc

@@ -1,6 +1,6 @@
 = pkl-config-java Library
 include::ROOT:partial$component-attributes.adoc[]
-:uri-pkl-core-EvalException: {uri-pkl-core-main-sources}/EvalException.java
+:uri-pkl-core-PklException: {uri-pkl-core-main-sources}/PklException.java
 
 :uri-pkl-config-java-maven-module: {uri-maven-docsite}/artifact/org.pkl-lang/pkl-config-java-all
 :uri-pkl-config-java-main-sources: {uri-github-tree}/pkl-config-java/src/main/java/org/pkl/config/java
@@ -15,8 +15,7 @@ include::ROOT:partial$component-attributes.adoc[]
 :uri-pkl-config-java-ConverterFactories: {uri-pkl-config-java-main-sources}/mapper/ConverterFactories.java
 :uri-pkl-config-java-Converter: {uri-pkl-config-java-main-sources}/mapper/Converter.java
 :uri-pkl-config-java-ConverterFactory: {uri-pkl-config-java-main-sources}/mapper/ConverterFactory.java
-:uri-pkl-config-java-PObjectToObjectByCtorTestJava: {uri-pkl-config-java-test-sources}/mapper/PObjectToObjectByCtorTest.java
-:uri-pkl-config-java-PObjectToObjectByCtorTestPkl: {uri-pkl-config-java-test-resources}/mapper/PObjectToObjectByCtorTest.pkl
+:uri-pkl-config-java-PObjectToDataObjectTestJava: {uri-pkl-config-java-test-sources}/mapper/PObjectToDataObjectTest.java
 
 The _pkl-config-java_ library builds upon xref:pkl-core:index.adoc[pkl-core].
 It offers a higher-level API specifically designed for consuming application runtime configuration.
@@ -24,7 +23,7 @@ It offers a higher-level API specifically designed for consuming application run
 == Installation
 
 The _pkl-config-java_ library is available {uri-pkl-config-java-maven-module}[from Maven Central].
-It requires Java 11 or higher.
+It requires Java 17 or higher.
 
 === Gradle
 
@@ -32,34 +31,42 @@ To use the library in a Gradle project, declare the following dependency:
 
 [tabs]
 ====
-Groovy::
-+
-.build.gradle
-[source,groovy,subs="+attributes"]
-----
-dependencies {
-  compile "org.pkl-lang:pkl-config-java:{pkl-artifact-version}"
-}
-
-ifndef::is-release-build[]
-repositories {
-  maven { url "{uri-sonatype}" }
-}
-endif::[]
-----
-
 Kotlin::
 +
 .build.gradle.kts
 [source,kotlin,subs="+attributes"]
 ----
 dependencies {
-  compile("org.pkl-lang:pkl-config-java:{pkl-artifact-version}")
+  implementation("org.pkl-lang:pkl-config-java:{pkl-artifact-version}")
 }
 
-ifndef::is-release-build[]
 repositories {
-  maven { url = uri("{uri-sonatype}") }
+ifdef::is-release-version[]
+  mavenCentral()
+endif::[]
+ifndef::is-release-version[]
+  maven(url = "{uri-sonatype}")
+endif::[]
+}
+----
+
+Groovy::
++
+.build.gradle
+[source,groovy,subs="+attributes"]
+----
+dependencies {
+  implementation "org.pkl-lang:pkl-config-java:{pkl-artifact-version}"
+}
+
+ifdef::is-release-version[]
+repositories {
+  mavenCentral()
+}
+endif::[]
+ifndef::is-release-version[]
+repositories {
+  maven { url "{uri-sonatype}" }
 }
 endif::[]
 ----
@@ -80,7 +87,7 @@ To use the library in a Maven project, declare the following dependency:
     <artifactId>pkl-config-java</artifactId>
     <version>{pkl-artifact-version}</version>
   </dependency>
-ifndef::is-release-build[]
+ifndef::is-release-version[]
   <repositories>
     <repository>
       <id>sonatype-s01</id>
@@ -100,7 +107,7 @@ Unlike `pkl-config-java`, `pkl-config-java__-all__` is a fat Jar with renamed th
 
 The {uri-pkl-config-java-ConfigEvaluator}[`ConfigEvaluator`] class loads and evaluates Pkl modules.
 If evaluation succeeds, a {uri-pkl-config-java-Config}[`Config`] object is returned.
-Otherwise, an {uri-pkl-core-EvalException}[`EvalException`] with error details is thrown.
+Otherwise, a {uri-pkl-core-PklException}[`PklException`] with error details is thrown.
 
 The returned `Config` object represents the root of the Pkl configuration tree.
 Intermediate and leaf nodes are also represented as `Config` objects.
@@ -124,7 +131,7 @@ In this example, this is done with a try-with-resources statement.
 Note that objects returned by the evaluator remain valid after calling `close()`.
 <2> Evaluate the given text.
 Other `evaluate` methods read from files, URLs, and other sources.
-If evaluation fails, an {uri-pkl-core-EvalException}[`EvalException`] is thrown.
+If evaluation fails, an {uri-pkl-core-PklException}[`PklException`] is thrown.
 <3> Navigate from the config root to its `"pigeon"` child.
 <4> Navigate from `"pigeon"` to `"age"` and get the latter's value as an `int`.
 If conversion to the requested type fails, a `ConversionException` is thrown.
@@ -136,7 +143,7 @@ A `ConfigEvaluator` caches module sources and evaluation results.
 To clear the cache, for example to evaluate the same module again, close the evaluator and create a new one.
 
 For a ready-to-go example with full source code,
-see link:{uri-config-java-example}[config-java] in the _pkl/pkl-examples_ repository.
+see link:{uri-config-java-example}[config-java] in the _pkl-jvm-examples_ repository.
 
 [[object-mapping]]
 === Object Mapping
@@ -182,7 +189,7 @@ They need to be provided in one of the following ways:
 
 For a complete object mapping example, see:
 
-* {uri-pkl-config-java-PObjectToObjectByCtorTestJava}[`PObjectToObjectByCtorTest.java`]
+* {uri-pkl-config-java-PObjectToDataObjectTestJava}[`PObjectToDataObjectTest.java`]
 
 TIP: Together with xref:java-binding:codegen.adoc[code generation], object mapping provides a complete solution for consuming Pkl configuration as statically typed Java objects.
 Java code never drifts from the configuration structure defined in Pkl, and the entire configuration tree can be code-completed in Java IDEs.

docs/modules/java-binding/partials/cli-codegen-options.adoc

@@ -21,3 +21,64 @@ Relative paths are resolved against the working directory.
 Default: (not set) +
 Flag that indicates to generate config classes for use with Spring Boot.
 ====
+
+.--implement-serializable
+[%collapsible]
+====
+Default: (not set) +
+Flag that indicates to generate classes that implement `java.io.Serializable`.
+====
+
+.--add-generated-annotation
+[%collapsible]
+====
+Default: (not set) +
+Flag that indicates to add the `org.pkl.config.java.Generated` annotation to generated types.
+====
+
+.--rename
+[%collapsible]
+====
+Default: (none) +
+Example: `foo.=com.example.foo.` +
+Allows to change default class and package names (derived from Pkl module names) in the generated code.
+
+When you need the generated class or package names to be different from the default names derived from the Pkl module names, you can define a rename mapping, where the key is the original Pkl module name prefix, and the value is its replacement.
+When you do, the generated code's `package` declarations, class names, as well as file locations, will be modified according to this mapping.
+
+The prefixes are replaced literally, which means that dots at the end are important.
+If you want to rename packages only, in most cases, you must ensure that you have an ending dot on both sides of a mapping (except for an empty mapping, if you use it), otherwise you may get unexpected results:
+
+----
+// Assuming the following arguments:
+--rename com.foo.=x  // Dot on the left only
+--rename org.bar=y.  // Dot on the right only
+--rename net.baz=z   // No dots
+
+// The following renames will be made:
+"com.foo.bar" -> "xbar"       // Target prefix merged into the suffix
+"org.bar.baz" -> "y..baz"     // Double dot, invalid name
+"net.baz.qux" -> "z.qux"      // Looks okay, but...
+"net.bazqux"  -> "zqux"       // ...may cut the name in the middle.
+----
+
+When computing the appropriate target name, the longest matching prefix is used:
+
+----
+// Assuming the following arguments:
+--rename com.foo.Main=w.Main
+--rename com.foo.=x.
+--rename com.=y.
+--rename =z.
+
+// The following renames will be made:
+com.foo.Main -> w.Main
+com.foo.bar  -> x.bar
+com.baz.qux  -> y.baz.qux
+org.foo.bar  -> z.org.foo.bar
+----
+
+Repeat this option to define multiple mappings.
+Keys can be arbitrary strings, including an empty string.
+Values must be valid dot-separated fully qualified class name prefixes, possibly terminated by a dot.
+====

docs/modules/kotlin-binding/examples/KotlinConfigExample.kt

@@ -3,16 +3,17 @@
 import org.pkl.config.java.ConfigEvaluator
 import org.pkl.config.kotlin.forKotlin
 import org.pkl.config.kotlin.to
+import org.pkl.core.ModuleSource
 import org.junit.jupiter.api.Test
 
-// the pkl/pkl-examples repo has a similar example
+// the pkl-jvm-examples repo has a similar example
 class KotlinConfigExample {
   @Test
   fun usage() {
     // tag::usage[]
     val evaluator = ConfigEvaluator.preconfigured().forKotlin() // <1>
     val config = evaluator.use { // <2>
-      it.evaluateText("""pigeon { age = 5; diet = "Seeds" }""")
+      it.evaluate(ModuleSource.text("""pigeon { age = 5; diet = new Listing { "Seeds" } }"""))
     }
     val pigeon = config["pigeon"] // <3>
     val age = pigeon["age"].to<Int>() // <4>
@@ -25,7 +26,7 @@ class KotlinConfigExample {
     // tag::nullable[]
     val evaluator = ConfigEvaluator.preconfigured().forKotlin()
     val config = evaluator.use {
-      it.evaluateText("name = null") // <1>
+      it.evaluate(ModuleSource.text("name = null")) // <1>
     }
     val name = config["name"].to<String?>() // <2>
     // end::nullable[]

docs/modules/kotlin-binding/pages/codegen.adoc

@@ -1,6 +1,11 @@
 = Kotlin Code Generator
 include::ROOT:partial$component-attributes.adoc[]
 :uri-pkl-codegen-kotlin-maven-module: {uri-maven-docsite}/artifact/org.pkl-lang/pkl-codegen-kotlin
+:uri-pkl-codegen-kotlin-download: {uri-sonatype-snapshot-download}&a=pkl-cli-codegen-kotlin&e=jar
+
+ifdef::is-release-version[]
+:uri-pkl-codegen-kotlin-download: {github-releases}/pkl-codegen-kotlin
+endif::[]
 
 The Kotlin source code generator reads Pkl classes and generates corresponding Kotlin classes with equally named properties.
 
@@ -19,7 +24,7 @@ See xref:pkl-gradle:index.adoc#installation[Installation] in the Gradle plugin c
 === Java Library
 
 The `pkl-codegen-kotlin` library is available {uri-pkl-codegen-kotlin-maven-module}[from Maven Central].
-It requires Java 8 or higher and Kotlin 1.3 or higher.
+It requires Java 17 or higher and Kotlin 1.3 or higher.
 
 ==== Gradle
 
@@ -27,36 +32,42 @@ To use the library in a Gradle project, declare the following dependency:
 
 [tabs]
 ====
-Groovy::
-+
-.build.gradle
-[source,groovy,subs="+attributes"]
-----
-dependencies {
-  compile "org.pkl-lang:pkl-config-kotlin:{pkl-artifact-version}"
-}
-
-ifndef::is-release-build[]
-repositories {
-  maven { url "{uri-sonatype}" }
-}
-endif::[]
-----
-
 Kotlin::
 +
 .build.gradle.kts
 [source,kotlin,subs="+attributes"]
 ----
 dependencies {
-  compile("org.pkl-lang:pkl-config-kotlin:{pkl-artifact-version}")
+  implementation("org.pkl-lang:pkl-codegen-kotlin:{pkl-artifact-version}")
 }
 
-ifndef::is-release-build[]
 repositories {
-  maven { url = uri("{uri-sonatype}") }
-}
+ifdef::is-release-version[]
+  mavenCentral()
 endif::[]
+ifndef::is-release-version[]
+  maven(url = "{uri-sonatype}")
+endif::[]
+}
+----
+
+Groovy::
++
+.build.gradle
+[source,groovy,subs="+attributes"]
+----
+dependencies {
+  implementation "org.pkl-lang:pkl-codegen-kotlin:{pkl-artifact-version}"
+}
+
+repositories {
+ifdef::is-release-version[]
+  mavenCentral()
+endif::[]
+ifndef::is-release-version[]
+  maven { url "{uri-sonatype}" }
+endif::[]
+}
 ----
 ====
 
@@ -77,8 +88,41 @@ To use the library in a Maven project, declare the following dependency:
 [[install-cli]]
 === CLI
 
-The CLI is bundled with the library.
-As we do not currently ship the CLI as a self-contained Jar, we recommend to provision it with a Maven compatible build tool as shown in <<install-library>>.
+The CLI is available as a Java executable.
+
+It works on multiple platforms, and requires a Java 17 (or higher) runtime on the system path.
+
+To download:
+
+[tabs]
+====
+macOS/Linux::
++
+[source,shell]
+[subs="+attributes"]
+----
+curl -L -o pkl-codegen-kotlin '{uri-pkl-codegen-kotlin-download}'
+chmod +x pkl-codegen-kotlin
+./pkl-codegen-kotlin --version
+----
+
+Windows::
++
+[source,PowerShell]
+[subs="+attributes"]
+----
+Invoke-WebRequest '{uri-pkl-codegen-kotlin-download}' -OutFile pkl-codegen-kotlin.bat
+.\pkl-codegen-kotlin --version
+----
+====
+
+This should print something similar to:
+
+[source,shell]
+[subs="+attributes"]
+----
+pkl-codegen-kotlin {pkl-version} (macOS 14.2, Java 17.0.10)
+----
 
 [[usage]]
 == Usage
@@ -97,13 +141,10 @@ For more information, refer to the KDoc documentation.
 
 === CLI
 
-As mentioned in <<install-cli,Installation>>, the CLI is bundled with the library.
-To run the CLI, execute the library Jar or its `org.pkl.codegen.kotlin.Main` main class.
-
-*Synopsis:* `java -cp <classpath> -jar pkl-codegen-kotlin.jar [<options>] <modules>`
+*Synopsis:* `pkl-codegen-kotlin [<options>] <modules>`
 
 `<modules>`::
-The absolute or relative URIs of the modules to generate classe for.
+The absolute or relative URIs of the modules to generate classes for.
 Relative URIs are resolved against the working directory.
 
 ==== Options
@@ -112,7 +153,7 @@ Relative URIs are resolved against the working directory.
 [%collapsible]
 ====
 Default: (flag not set) +
-Flag that indicates to generate Kdoc based on doc comments for Pkl modules, classes, and properties.
+Flag that indicates to preserve Pkl doc comments by generating corresponding KDoc comments.
 ====
 
 Common code generator options:
@@ -127,4 +168,4 @@ include::../../pkl-cli/partials/cli-common-options.adoc[]
 == Full Example
 
 For a ready-to-go example with full source code,
-see link:{uri-codegen-kotlin-example}[codegen-kotlin] in the _pkl/pkl-examples_ repository.
+see link:{uri-codegen-kotlin-example}[codegen-kotlin] in the _pkl-jvm-examples_ repository.