Fix spotless ratcheting on release branches (#1401)

For example, this fixes an issue where an empty module turns into ` \n`.

Closes https://github.com/apple/pkl/issues/1348

---------

Co-authored-by: Jen Basch <jbasch94@gmail.com>

.github/index.pkl

@@ -196,3 +196,27 @@ release {
       }
     } |> toWorkflowJobs
 }
+
+output {
+  files {
+    [[true]] {
+      renderer {
+        converters {
+          ["jobs"] = (it: Mapping<String, Workflow.Job>) ->
+            it
+              .toMap()
+              .mapValues((name, job) ->
+                if (name.contains("linux") && !name.contains("alpine"))
+                  job
+                    .toMap()
+                    .put("container", new Dynamic {
+                      image = "redhat/ubi8:8.10"
+                    })
+                else
+                  job
+              )
+        }
+      }
+    }
+  }
+}

.github/jobs/BuildNativeJob.pkl

@@ -19,6 +19,15 @@ extraGradleArgs {
   }
 }
 
+preSteps {
+  when (os == "linux" && !musl) {
+    new {
+      name = "Install deps"
+      run = "dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en"
+    }
+  }
+}
+
 steps {
   when (musl) {
     new {
@@ -26,6 +35,14 @@ steps {
       run = read("../scripts/install_musl.sh").text
     }
   }
+  // workaround for https://github.com/actions/checkout/issues/1048
+  when (os == "linux" && !musl) {
+    new {
+      name = "Fix git ownership"
+      // language=bash
+      run = "git status || git config --system --add safe.directory $GITHUB_WORKSPACE"
+    }
+  }
   new {
     name = "gradle buildNative"
     shell = "bash"

.github/jobs/GradleJob.pkl

@@ -23,6 +23,8 @@ extraGradleArgs: Listing<String>
 
 steps: Listing<*Workflow.Step | Workflow.TypedStep>
 
+preSteps: Listing<*Workflow.Step | Workflow.TypedStep>
+
 /// The fetch depth to use when doing a git checkout.
 fetchDepth: Int?
 
@@ -69,6 +71,7 @@ fixed job {
         }
       }
   steps {
+    ...preSteps
     // full checkout (needed for spotless)
     new Common.Checkout {
       when (fetchDepth != null) {

.github/workflows/build.yml

@@ -198,6 +198,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -205,6 +207,8 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -226,6 +230,8 @@ jobs:
         name: test-results-html-pkl-cli-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-cli-macOS-aarch64-snapshot:
     if: github.repository_owner == 'apple'
     runs-on:
@@ -267,6 +273,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -274,6 +282,8 @@ jobs:
         distribution: temurin
         architecture: aarch64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -295,6 +305,8 @@ jobs:
         name: test-results-html-pkl-cli-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-cli-alpine-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:
@@ -476,6 +488,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -483,6 +497,8 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -504,6 +520,8 @@ jobs:
         name: test-results-html-pkl-doc-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-doc-macOS-aarch64-snapshot:
     if: github.repository_owner == 'apple'
     runs-on:
@@ -545,6 +563,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -552,6 +572,8 @@ jobs:
         distribution: temurin
         architecture: aarch64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -573,6 +595,8 @@ jobs:
         name: test-results-html-pkl-doc-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-doc-alpine-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:

.github/workflows/main.yml

@@ -197,6 +197,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -204,6 +206,8 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -225,6 +229,8 @@ jobs:
         name: test-results-html-pkl-cli-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-cli-macOS-aarch64-snapshot:
     if: github.repository_owner == 'apple'
     runs-on:
@@ -266,6 +272,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -273,6 +281,8 @@ jobs:
         distribution: temurin
         architecture: aarch64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -294,6 +304,8 @@ jobs:
         name: test-results-html-pkl-cli-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-cli-alpine-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:
@@ -475,6 +487,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -482,6 +496,8 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -503,6 +519,8 @@ jobs:
         name: test-results-html-pkl-doc-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-doc-macOS-aarch64-snapshot:
     if: github.repository_owner == 'apple'
     runs-on:
@@ -544,6 +562,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -551,6 +571,8 @@ jobs:
         distribution: temurin
         architecture: aarch64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -572,6 +594,8 @@ jobs:
         name: test-results-html-pkl-doc-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-doc-alpine-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:

.github/workflows/prb.yml

@@ -117,6 +117,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -124,6 +126,8 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -146,6 +150,8 @@ jobs:
         name: test-results-html-pkl-cli-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-cli-macOS-aarch64-snapshot:
     if: (contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-cli]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS-aarch64]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS-aarch64]')) && github.repository_owner == 'apple'
     runs-on:
@@ -189,6 +195,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -196,6 +204,8 @@ jobs:
         distribution: temurin
         architecture: aarch64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -218,6 +228,8 @@ jobs:
         name: test-results-html-pkl-cli-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-cli-alpine-linux-amd64-snapshot:
     if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-cli]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-cli-alpine-linux-amd64]')
     runs-on: ubuntu-latest
@@ -405,6 +417,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -412,6 +426,8 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -434,6 +450,8 @@ jobs:
         name: test-results-html-pkl-doc-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-doc-macOS-aarch64-snapshot:
     if: (contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-doc]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS-aarch64]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS-aarch64]')) && github.repository_owner == 'apple'
     runs-on:
@@ -477,6 +495,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -484,6 +504,8 @@ jobs:
         distribution: temurin
         architecture: aarch64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -506,6 +528,8 @@ jobs:
         name: test-results-html-pkl-doc-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-doc-alpine-linux-amd64-snapshot:
     if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-doc]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-doc-alpine-linux-amd64]')
     runs-on: ubuntu-latest

.github/workflows/release-branch.yml

@@ -197,6 +197,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -204,6 +206,8 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -225,6 +229,8 @@ jobs:
         name: test-results-html-pkl-cli-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-cli-macOS-aarch64-snapshot:
     if: github.repository_owner == 'apple'
     runs-on:
@@ -266,6 +272,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -273,6 +281,8 @@ jobs:
         distribution: temurin
         architecture: aarch64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
@@ -294,6 +304,8 @@ jobs:
         name: test-results-html-pkl-cli-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-cli-alpine-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:
@@ -475,6 +487,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -482,6 +496,8 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -503,6 +519,8 @@ jobs:
         name: test-results-html-pkl-doc-linux-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-doc-macOS-aarch64-snapshot:
     if: github.repository_owner == 'apple'
     runs-on:
@@ -544,6 +562,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -551,6 +571,8 @@ jobs:
         distribution: temurin
         architecture: aarch64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
@@ -572,6 +594,8 @@ jobs:
         name: test-results-html-pkl-doc-linux-aarch64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-doc-alpine-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:

.github/workflows/release.yml

@@ -197,6 +197,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -204,6 +206,8 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
@@ -225,6 +229,8 @@ jobs:
         name: test-results-html-pkl-cli-linux-amd64-release
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-cli-macOS-aarch64-release:
     if: github.repository_owner == 'apple'
     runs-on:
@@ -266,6 +272,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -273,6 +281,8 @@ jobs:
         distribution: temurin
         architecture: aarch64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
@@ -294,6 +304,8 @@ jobs:
         name: test-results-html-pkl-cli-linux-aarch64-release
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-cli-alpine-linux-amd64-release:
     runs-on: ubuntu-latest
     env:
@@ -475,6 +487,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -482,6 +496,8 @@ jobs:
         distribution: temurin
         architecture: x64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
@@ -503,6 +519,8 @@ jobs:
         name: test-results-html-pkl-doc-linux-amd64-release
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-doc-macOS-aarch64-release:
     if: github.repository_owner == 'apple'
     runs-on:
@@ -544,6 +562,8 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
     - uses: actions/checkout@v5
     - uses: actions/setup-java@v5
       with:
@@ -551,6 +571,8 @@ jobs:
         distribution: temurin
         architecture: aarch64
         cache: gradle
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory $GITHUB_WORKSPACE
     - name: gradle buildNative
       shell: bash
       run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
@@ -572,6 +594,8 @@ jobs:
         name: test-results-html-pkl-doc-linux-aarch64-release
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
   pkl-doc-alpine-linux-amd64-release:
     runs-on: ubuntu-latest
     env:

buildSrc/src/main/kotlin/pklAllProjects.gradle.kts

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -142,9 +142,17 @@ private fun KotlinGradleExtension.configureFormatter() {
 }
 
 val originalRemoteName = System.getenv("PKL_ORIGINAL_REMOTE_NAME") ?: "origin"
+// if we're running against a release branch (or a PR targeted at one), use that branch for
+// ratcheting
+// these env vars are set by GitHub actions:
+// https://docs.github.com/en/actions/reference/workflows-and-actions/variables#default-environment-variables
+val ratchetBranchName =
+  (System.getenv("GITHUB_BASE_REF") ?: System.getenv("GITHUB_REF_NAME"))?.let {
+    if (it.startsWith("release/")) it else null
+  } ?: "main"
 
 spotless {
-  ratchetFrom = "$originalRemoteName/main"
+  ratchetFrom = "$originalRemoteName/$ratchetBranchName"
 
   // When building root project, format buildSrc files too.
   // We need this because buildSrc is not a subproject of the root project, so a top-level

buildSrc/src/main/kotlin/pklNativeExecutable.gradle.kts

@@ -13,6 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+import java.lang.Runtime.Version
 import kotlin.io.path.createDirectories
 import kotlin.io.path.writeText
 import org.gradle.accessors.dm.LibrariesForLibs
@@ -135,7 +136,6 @@ val windowsExecutableAmd64 by
     mainClass = executableSpec.mainClass
     amd64()
     setClasspath()
-    extraNativeImageArgs.add("-Dfile.encoding=UTF-8")
   }
 
 val assembleNative by tasks.existing
@@ -167,13 +167,46 @@ val testStartNativeExecutable by
     }
   }
 
+val requiredGlibcVersion: Version = Version.parse("2.17")
+
+val checkGlibc by
+  tasks.registering {
+    enabled = buildInfo.os.isLinux && !buildInfo.musl
+    dependsOn(assembleNative)
+    doLast {
+      val exec =
+        providers.exec {
+          commandLine("objdump", "-T", assembleNative.get().outputs.files.singleFile)
+        }
+      val output = exec.standardOutput.asText.get()
+      val minimumGlibcVersion =
+        output
+          .split("\n")
+          .mapNotNull { line ->
+            val match = Regex("GLIBC_([.0-9]*)").find(line)
+            match?.groups[1]?.let { Version.parse(it.value) }
+          }
+          .maxOrNull()
+      if (minimumGlibcVersion == null) {
+        throw GradleException(
+          "Could not determine glibc version from executable. objdump output: $output"
+        )
+      }
+      if (minimumGlibcVersion > requiredGlibcVersion) {
+        throw GradleException(
+          "Incorrect glibc version. Found: $minimumGlibcVersion, required: $requiredGlibcVersion"
+        )
+      }
+    }
+  }
+
 // Expose underlying task's outputs
 private fun <T : Task> Task.wraps(other: TaskProvider<T>) {
   dependsOn(other)
   outputs.files(other)
 }
 
-val testNative by tasks.existing { dependsOn(testStartNativeExecutable) }
+val testNative by tasks.existing { dependsOn(testStartNativeExecutable, checkGlibc) }
 
 val assembleNativeMacOsAarch64 by tasks.existing { wraps(macExecutableAarch64) }
 

docs/antora.yml

@@ -1,6 +1,6 @@
 name: main
 title: Main Project
-version: 0.30.1
+version: 0.30.2
 prerelease: false
 nav:
 - nav.adoc

docs/modules/ROOT/partials/component-attributes.adoc

@@ -3,7 +3,7 @@
 // the following attributes must be updated immediately before a release
 
 // pkl version corresponding to current git commit without -dev suffix or git hash
-:pkl-version-no-suffix: 0.30.1
+:pkl-version-no-suffix: 0.30.2
 // tells whether pkl version corresponding to current git commit
 // is a release version (:is-release-version: '') or dev version (:!is-release-version:)
 :is-release-version: ''

docs/modules/release-notes/pages/0.30.adoc

@@ -1,6 +1,6 @@
 = Pkl 0.30 Release Notes
 :version: 0.30
-:version-minor: 0.30.1
+:version-minor: 0.30.2
 :release-date: November 3rd, 2025
 
 :yaml-binary-scalar: https://yaml.org/type/binary.html

docs/modules/release-notes/pages/changelog.adoc

@@ -1,6 +1,24 @@
 = Changelog
 include::ROOT:partial$component-attributes.adoc[]
 
+[[release-0.30.2]]
+== 0.30.2 (2025-12-15)
+
+=== Fixes
+
+* Fixes formatting of blank files (https://github.com/apple/pkl/pull/1351[#1351]).
+* Fixes an issue where the `pkl format` CLI command adds an extra newline when writing formatted content to standard output (https://github.com/apple/pkl/issues/1346[#1346]).
+* Make linux executables link to glibc 2.17 (https://github.com/apple/pkl/pull/1352[#1352]).
+* Fix incorrect parsing of super expressions (https://github.com/apple/pkl/pull/1364[#1364]).
+
+=== Contributors ❤️
+
+Thank you to all the contributors for this release!
+
+* https://github.com/bioball[@bioball]
+* https://github.com/HT154[@HT154]
+* https://github.com/stackoverflow[@stackoverflow]
+
 [[release-0.30.1]]
 == 0.30.1 (2025-12-03)
 

gradle.properties

@@ -1,7 +1,7 @@
 # suppress inspection "UnusedProperty" for whole file
 
 group=org.pkl-lang
-version=0.30.1
+version=0.30.2
 
 # google-java-format requires jdk.compiler exports
 org.gradle.jvmargs= \

jbang-catalog.json

@@ -2,15 +2,15 @@
   "catalogs": {},
   "aliases": {
     "pkl": {
-      "script-ref": "org.pkl-lang:pkl-cli-java:0.30.1",
+      "script-ref": "org.pkl-lang:pkl-cli-java:0.30.2",
       "java-agents": []
     },
     "pkl-codegen-java": {
-      "script-ref": "org.pkl-lang:pkl-codegen-java:0.30.1",
+      "script-ref": "org.pkl-lang:pkl-codegen-java:0.30.2",
       "java-agents": []
     },
     "pkl-codegen-kotlin": {
-      "script-ref": "org.pkl-lang:pkl-codegen-kotlin:0.30.1",
+      "script-ref": "org.pkl-lang:pkl-codegen-kotlin:0.30.2",
       "java-agents": []
     }
   },

pkl-cli/src/main/kotlin/org/pkl/cli/CliFormatterCommand.kt

@@ -49,13 +49,13 @@ constructor(
     return Formatter().format(contents, grammarVersion)
   }
 
-  private fun writeErr(error: String) {
+  private fun writeErrLine(error: String) {
     errWriter.write(error)
     errWriter.appendLine()
     errWriter.flush()
   }
 
-  private fun write(message: String) {
+  private fun writeLine(message: String) {
     if (silent) return
     consoleWriter.write(message)
     consoleWriter.appendLine()
@@ -88,7 +88,7 @@ constructor(
       }
       ERROR -> {
         if (!silent) {
-          writeErr("An error occurred during formatting.")
+          writeErrLine("An error occurred during formatting.")
         }
         throw CliTestException("", status.status)
       }
@@ -113,7 +113,7 @@ constructor(
           status.update(FORMATTING_VIOLATION)
           if (diffNameOnly || overwrite) {
             // if `--diff-name-only` or `-w` is specified, only write file names
-            write(pathStr)
+            writeLine(pathStr)
           }
 
           if (overwrite) {
@@ -122,13 +122,14 @@ constructor(
         }
 
         if (!diffNameOnly && !overwrite) {
-          write(formatted)
+          consoleWriter.write(formatted)
+          consoleWriter.flush()
         }
       } catch (pe: GenericParserError) {
-        writeErr("Could not format `$pathStr`: $pe")
+        writeErrLine("Could not format `$pathStr`: $pe")
         status.update(ERROR)
       } catch (e: IOException) {
-        writeErr("IO error while reading `$pathStr`: ${e.message}")
+        writeErrLine("IO error while reading `$pathStr`: ${e.message}")
         status.update(ERROR)
       }
     }

pkl-cli/src/test/kotlin/org/pkl/cli/CliFormatterTest.kt

@@ -0,0 +1,47 @@
+/*
+ * Copyright © 2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.pkl.cli
+
+import java.nio.file.Path
+import kotlin.io.path.writeText
+import org.assertj.core.api.Assertions.assertThat
+import org.junit.jupiter.api.Test
+import org.junit.jupiter.api.io.TempDir
+import org.pkl.commons.cli.CliException
+import org.pkl.core.util.StringBuilderWriter
+import org.pkl.formatter.GrammarVersion
+
+class CliFormatterTest {
+  @Test
+  fun `no double newline when writing to stdout`(@TempDir tempDir: Path) {
+    val file = tempDir.resolve("foo.pkl").also { it.writeText("foo = 1") }
+    val sb = StringBuilder()
+    val writer = StringBuilderWriter(sb)
+    val cmd =
+      CliFormatterCommand(
+        listOf(file),
+        GrammarVersion.latest(),
+        overwrite = false,
+        diffNameOnly = false,
+        silent = false,
+        consoleWriter = writer,
+      )
+    try {
+      cmd.run()
+    } catch (_: CliException) {}
+    assertThat(sb.toString()).isEqualTo("foo = 1\n")
+  }
+}

pkl-core/src/main/java/org/pkl/core/runtime/VmLanguage.java

@@ -33,7 +33,7 @@ import org.pkl.parser.syntax.Module;
 @TruffleLanguage.Registration(
     id = "pkl",
     name = "Pkl",
-    version = "0.30.1",
+    version = "0.30.2",
     characterMimeTypes = VmLanguage.MIME_TYPE,
     contextPolicy = ContextPolicy.SHARED)
 public final class VmLanguage extends TruffleLanguage<VmContext> {

pkl-core/src/test/files/LanguageSnippetTests/input/parser/spread.pkl

@@ -0,0 +1,15 @@
+
+local baz = new Dynamic {}
+
+local foo = new Dynamic {
+  bar = 1
+}
+
+qux {
+  (foo) {
+    ...super.bar
+    (baz) {
+      qux = 1
+    }
+  }
+}

pkl-core/src/test/files/LanguageSnippetTests/output/parser/spread.pcf

@@ -0,0 +1,8 @@
+qux {
+  new {
+    bar = 1
+    new {
+      qux = 1
+    }
+  }
+}

pkl-formatter/src/main/kotlin/org/pkl/formatter/Builder.kt

@@ -1239,7 +1239,7 @@ internal class Builder(sourceText: String, private val grammarVersion: GrammarVe
     // skip semicolons
     val children = children.filter { !it.isSemicolon() }
     // short circuit
-    if (children.isEmpty()) return listOf(spaceOrLine())
+    if (children.isEmpty()) return emptyList()
     if (children.size == 1) return listOf(format(children[0]))
 
     val nodes = mutableListOf<FormatNode>()

pkl-formatter/src/test/kotlin/org/pkl/formatter/FormatterTest.kt

@@ -113,4 +113,11 @@ class FormatterTest {
 
     walkDir(outputDir)
   }
+
+  @Test
+  fun `whitespace only`() {
+    for (src in listOf(";;;", "\n", "\n\n\n", "\t")) {
+      assertThat(format(src)).isEqualTo("\n")
+    }
+  }
 }

pkl-parser/src/main/java/org/pkl/parser/Parser.java

@@ -973,7 +973,9 @@ public class Parser {
             if (lookahead == Token.DOT) {
               next();
               var identifier = parseIdentifier();
-              if (lookahead == Token.LPAREN) {
+              if (lookahead == Token.LPAREN
+                  && !precededBySemicolon
+                  && _lookahead.newLinesBetween == 0) {
                 var args = parseArgumentList();
                 yield new SuperAccessExpr(identifier, args, start.endWith(args.span()));
               } else {

stdlib/Benchmark.pkl

@@ -36,7 +36,7 @@
 ///
 /// Warning: Although this module is ready for initial use,
 /// benchmark results may be inaccurate or inconsistent.
-@ModuleInfo { minPklVersion = "0.30.1" }
+@ModuleInfo { minPklVersion = "0.30.2" }
 module pkl.Benchmark
 
 import "pkl:platform" as _platform

stdlib/DocPackageInfo.pkl

@@ -63,7 +63,7 @@
 /// @Deprecated { message = "Use `com.example.Birds.Parrot` instead" }
 /// amends "pkl:PackageInfo"
 /// ```
-@ModuleInfo { minPklVersion = "0.30.1" }
+@ModuleInfo { minPklVersion = "0.30.2" }
 module pkl.DocPackageInfo
 
 // used by doc comments

stdlib/DocsiteInfo.pkl

@@ -31,7 +31,7 @@
 ///
 /// title = "Title displayed in the header of each page"
 /// ```
-@ModuleInfo { minPklVersion = "0.30.1" }
+@ModuleInfo { minPklVersion = "0.30.2" }
 module pkl.DocsiteInfo
 
 import "pkl:reflect"

stdlib/EvaluatorSettings.pkl

@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//
 
 /// Common settings for Pkl's own evaluator.
-@ModuleInfo { minPklVersion = "0.30.1" }
+@ModuleInfo { minPklVersion = "0.30.2" }
 @Since { version = "0.26.0" }
 module pkl.EvaluatorSettings
 

stdlib/Project.pkl

@@ -64,7 +64,7 @@
 ///   value = project
 /// }
 /// ``` 
-@ModuleInfo { minPklVersion = "0.30.1" }
+@ModuleInfo { minPklVersion = "0.30.2" }
 module pkl.Project
 
 import "pkl:EvaluatorSettings" as EvaluatorSettingsModule

stdlib/analyze.pkl

@@ -19,7 +19,7 @@
 /// These tools differentiate from [pkl:reflect][reflect] in that they parse Pkl modules, but do not
 /// execute any code within these modules.
 @Since { version = "0.27.0" }
-@ModuleInfo { minPklVersion = "0.30.1" }
+@ModuleInfo { minPklVersion = "0.30.2" }
 module pkl.analyze
 
 // used by doc comments

stdlib/base.pkl

@@ -17,10 +17,12 @@
 /// Fundamental properties, methods, and classes for writing Pkl programs.
 ///
 /// Members of this module are automatically available in every Pkl module.
-@ModuleInfo { minPklVersion = "0.30.1" }
+@ModuleInfo { minPklVersion = "0.30.2" }
 module pkl.base
 
+// math import used for doc comments
 import "pkl:jsonnet"
+import "pkl:math"
 import "pkl:pklbinary"
 import "pkl:protobuf"
 import "pkl:xml"

stdlib/json.pkl

@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//
 
 /// A JSON parser.
-@ModuleInfo { minPklVersion = "0.30.1" }
+@ModuleInfo { minPklVersion = "0.30.2" }
 module pkl.json
 
 /// A JSON parser.

stdlib/jsonnet.pkl

@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//
 
 /// A [Jsonnet](https://jsonnet.org) renderer.
-@ModuleInfo { minPklVersion = "0.30.1" }
+@ModuleInfo { minPklVersion = "0.30.2" }
 module pkl.jsonnet
 
 /// Constructs an [ImportStr].

stdlib/math.pkl

@@ -18,7 +18,7 @@
 ///
 /// Note that some mathematical functions, such as `sign()`, `abs()`, and `round()`,
 /// are directly defined in classes [Number], [Int], and [Float].
-@ModuleInfo { minPklVersion = "0.30.1" }
+@ModuleInfo { minPklVersion = "0.30.2" }
 module pkl.math
 
 /// The minimum [Int] value: `-9223372036854775808`.

stdlib/pklbinary.pkl

@@ -28,7 +28,7 @@
 /// The `pkl-binary` format uses MessagePack encoding.
 /// Its specification is available at
 /// <https://pkl-lang.org/main/current/bindings-specification/binary-encoding.html>.
-@ModuleInfo { minPklVersion = "0.30.1" }
+@ModuleInfo { minPklVersion = "0.30.2" }
 module pkl.pklbinary
 
 /// Render values as `pkl-binary`.

stdlib/platform.pkl

@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//
 
 /// Information about the platform that the current program runs on.
-@ModuleInfo { minPklVersion = "0.30.1" }
+@ModuleInfo { minPklVersion = "0.30.2" }
 module pkl.platform
 
 /// The platform that the current program runs on.

stdlib/protobuf.pkl

@@ -16,7 +16,7 @@
 
 /// A renderer for [Protocol Buffers](https://developers.google.com/protocol-buffers).
 /// Note: This module is _experimental_ and not ready for production use.
-@ModuleInfo { minPklVersion = "0.30.1" }
+@ModuleInfo { minPklVersion = "0.30.2" }
 module pkl.protobuf
 
 import "pkl:reflect"

stdlib/reflect.pkl

@@ -26,7 +26,7 @@
 /// - Documentation generators (such as *Pkldoc*)
 /// - Code generators (such as *pkl-codegen-java* and *pkl-codegen-kotlin*)
 /// - Domain-specific schema validators
-@ModuleInfo { minPklVersion = "0.30.1" }
+@ModuleInfo { minPklVersion = "0.30.2" }
 module pkl.reflect
 
 import "pkl:base"

stdlib/release.pkl

@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//
 
 /// Information about the Pkl release that the current program runs on.
-@ModuleInfo { minPklVersion = "0.30.1" }
+@ModuleInfo { minPklVersion = "0.30.2" }
 module pkl.release
 
 import "pkl:semver"

stdlib/semver.pkl

@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//
 
 /// Parsing, comparison, and manipulation of [semantic version](https://semver.org/spec/v2.0.0.html) numbers.
-@ModuleInfo { minPklVersion = "0.30.1" }
+@ModuleInfo { minPklVersion = "0.30.2" }
 module pkl.semver
 
 /// Tells whether [version] is a valid semantic version number.

stdlib/settings.pkl

@@ -19,7 +19,7 @@
 /// Every settings file must amend this module.
 /// Unless CLI commands and build tool plugins are explicitly configured with a settings file,
 /// they will use `~/.pkl/settings.pkl` or the defaults specified in this module.
-@ModuleInfo { minPklVersion = "0.30.1" }
+@ModuleInfo { minPklVersion = "0.30.2" }
 module pkl.settings
 
 import "pkl:EvaluatorSettings"

stdlib/shell.pkl

@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//
 
 /// Utilities for generating shell scripts.
-@ModuleInfo { minPklVersion = "0.30.1" }
+@ModuleInfo { minPklVersion = "0.30.2" }
 module pkl.shell
 
 /// Escapes [str] by enclosing it in single quotes.

stdlib/test.pkl

@@ -18,7 +18,7 @@
 ///
 /// To write tests, amend this module and define [facts] or [examples] (or both).
 /// To run tests, evaluate the amended module.
-@ModuleInfo { minPklVersion = "0.30.1" }
+@ModuleInfo { minPklVersion = "0.30.2" }
 open module pkl.test
 
 /// Named groups of boolean expressions that are expected to evaluate to [true].

stdlib/xml.pkl

@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//
 
 /// An XML renderer.
-@ModuleInfo { minPklVersion = "0.30.1" }
+@ModuleInfo { minPklVersion = "0.30.2" }
 module pkl.xml
 
 /// Renders values as XML.

stdlib/yaml.pkl

@@ -15,7 +15,7 @@
 //===----------------------------------------------------------------------===//
 
 /// A YAML 1.2 compliant YAML parser.
-@ModuleInfo { minPklVersion = "0.30.1" }
+@ModuleInfo { minPklVersion = "0.30.2" }
 module pkl.yaml
 
 /// A YAML parser.