Upgrade to GraalVM 25.1.3, drop macOS Intel builds (#1769)

This fixes a regression where local members cannot be seen by the
expression evaluator.

Because variable are now parse-time resolved, this builds a truffle node
by first constructing a synthetic module of all defined local members,
and calls AstBuilder on this synthetic module first.

.git-blame-ignore-revs

@@ -1,2 +1,4 @@
 # Auto-format Kotlin code
 816cd483c8adf4c04e14236c173a1dc6bd2579ea
+# Format Kotlin code again
+2b3603b544bae2ad87374b65afaf8ac018216261

.github/PklProject

@@ -2,7 +2,7 @@ amends "pkl:Project"
 
 dependencies {
   ["pkl.impl.ghactions"] {
-    uri = "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.6.0"
+    uri = "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.8.2"
   }
   ["gha"] {
     uri = "package://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.4.0"

.github/PklProject.deps.json

@@ -3,37 +3,37 @@
   "resolvedDependencies": {
     "package://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1": {
       "type": "remote",
-      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.4.0",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.9.0",
       "checksums": {
-        "sha256": "e0b9a9f71071d6101e9d764c069b2ec4a597d5315cb6e4c265b3f0d90c2b482c"
+        "sha256": "5947924cf94fae9d8cdca42ade3f86db2675842cab7254214e7c0e281ddb6908"
       }
     },
     "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1": {
       "type": "remote",
-      "uri": "projectpackage://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.6.0",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.8.2",
       "checksums": {
-        "sha256": "fbc3c456ea468a0fe6baa9b3d30167259ac04e721a41a10fe82d2970026f0b1d"
+        "sha256": "12cca6326806ec37abc790a6707b6d907b4f8ba97628f2bc7fb327b5a6f68b49"
       }
     },
     "package://pkg.pkl-lang.org/pkl-pantry/pkl.experimental.deepToTyped@1": {
       "type": "remote",
-      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/pkl.experimental.deepToTyped@1.2.0",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/pkl.experimental.deepToTyped@1.2.1",
       "checksums": {
-        "sha256": "84c7feb391f4ac273a99dc89b8fd51dbcd21dbda4ce640f6908527f83acdd4d6"
+        "sha256": "6e752d1e84aff24c3a1801658f27f12af70840c39b3fe7bac509c8178d566d25"
       }
     },
     "package://pkg.pkl-lang.org/pkl-pantry/pkl.github.dependabotManagedActions@1": {
       "type": "remote",
-      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/pkl.github.dependabotManagedActions@1.1.0",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/pkl.github.dependabotManagedActions@1.1.9",
       "checksums": {
-        "sha256": "025fac778f2c5f75c8229fa4ec0f49ebdb99a61affe9aae489fefd8fccd92faa"
+        "sha256": "467b91559f31ad7401c78d3df9569b5ec7aa4e1b49209f9f22d02bd72971e0bd"
       }
     },
     "package://pkg.pkl-lang.org/pkl-pantry/com.github.dependabot@1": {
       "type": "remote",
-      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/com.github.dependabot@1.0.1",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/com.github.dependabot@1.0.4",
       "checksums": {
-        "sha256": "0a4fe9b0983716ec49fb060b9e5e83f8c365eb899d517123b43134416a9574b6"
+        "sha256": "c7391119f946d7761d0ca0cc358ed8fe2bdfc691411087ccac89637bd96fec4a"
       }
     }
   }

.github/codeql.pkl

@@ -1,67 +0,0 @@
-amends "@gha/Workflow.pkl"
-
-import "@gha/catalog.pkl"
-
-on {
-  push {
-    branches {
-      "main"
-    }
-  }
-  pull_request {}
-  schedule {
-    // Run at 01:38 on Saturday
-    new { cron = "38 1 * * 6" }
-  }
-}
-
-local class CodeQLScan {
-  language: String
-
-  `build-mode`: String
-}
-
-local scans: Listing<CodeQLScan> = new {
-  new {
-    language = "actions"
-    `build-mode` = "none"
-  }
-  new {
-    language = "java-kotlin"
-    `build-mode` = "autobuild"
-  }
-  new {
-    language = "javascript-typescript"
-    `build-mode` = "none"
-  }
-}
-
-jobs {
-  for (scan in scans) {
-    ["analyze-\(scan.language)"] {
-      name = "Analyze (\(scan.language))"
-      `runs-on` = "ubuntu-latest"
-      permissions {
-        `security-events` = "write"
-      }
-      steps {
-        catalog.`actions/checkout@v6`
-        new {
-          name = "Initialize CodeQL"
-          uses = "github/codeql-action/init@v4"
-          with {
-            ["languages"] = scan.language
-            ["build-mode"] = scan.`build-mode`
-          }
-        }
-        new {
-          name = "Perform CodeQL Analysis"
-          uses = "github/codeql-action/analyze@v4"
-          with {
-            ["category"] = "/language:\(scan.language)"
-          }
-        }
-      }
-    }
-  }
-}

.github/dependabot.yml

@@ -10,9 +10,16 @@ updates:
   cooldown:
     default-days: 7
   directory: /
+  groups:
+    first-party:
+      patterns:
+      - actions/*
+    codeql:
+      patterns:
+      - github/codeql-action/*
   ignore:
   - dependency-name: '*'
     update-types:
     - version-update:semver-major
   schedule:
-    interval: weekly
+    interval: quarterly

.github/index.pkl

@@ -9,7 +9,6 @@ import "jobs/GithubRelease.pkl"
 import "jobs/GradleJob.pkl"
 import "jobs/PklJob.pkl"
 import "jobs/SimpleGradleJob.pkl"
-import "codeql.pkl"
 
 triggerDocsBuild = "both"
 
@@ -64,14 +63,18 @@ local buildNativeJobs: Mapping<String, BuildNativeJob> = new {
   for (_dist in List("release", "snapshot")) {
     for (_project in List("pkl-cli", "pkl-doc")) {
       for (_arch in List("amd64", "aarch64")) {
-        for (_os in List("macOS", "linux")) {
+        ["\(_project)-linux-\(_arch)-\(_dist)"] {
-          ["\(_project)-\(_os)-\(_arch)-\(_dist)"] {
           arch = _arch
-            os = _os
+          os = "linux"
           isRelease = _dist == "release"
           project = _project
         }
       }
+      ["\(_project)-macOS-aarch64-\(_dist)"] {
+        arch = "aarch64"
+        os = "macOS"
+        isRelease = _dist == "release"
+        project = _project
       }
       ["\(_project)-alpine-linux-amd64-\(_dist)"] {
         arch = "amd64"
@@ -241,7 +244,15 @@ dependabot {
   }
 }
 
-workflows {
+codeql {
-  // add codeql workflow to set of workflows
+  scans {
-  ["workflows/codeql.yml"] = codeql
+    new {
+      language = "java-kotlin"
+      buildMode = "autobuild"
+    }
+    new {
+      language = "javascript-typescript"
+      buildMode = "none"
+    }
+  }
 }

.github/jobs/BuildNativeJob.pkl

@@ -10,10 +10,6 @@ musl: Boolean(implies(module.os == "linux")) = false
 project: String
 
 extraGradleArgs {
-  when (os == "macOS" && arch == "amd64") {
-    "-Dpkl.targetArch=\(module.arch)"
-    #""-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh""#
-  }
   when (musl) {
     "-Dpkl.musl=true"
   }

.github/jobs/GradleJob.pkl

@@ -3,6 +3,7 @@ abstract module GradleJob
 extends "PklJob.pkl"
 
 import "@gha/Workflow.pkl"
+import "@gha/context.pkl"
 import "@pkl.impl.ghactions/catalog.pkl"
 
 /// Whether this is a release build or not.
@@ -29,8 +30,7 @@ fetchDepth: Int?
 
 fixed gradleArgs =
   new Listing {
-    "--info"
+    "$DEBUG_ARGS"
-    "--stacktrace"
     "--no-daemon"
     "-DpklMultiJdkTesting=true"
     when (isRelease) {
@@ -97,6 +97,20 @@ fixed job {
         }
       }
     }
+    new {
+      name = "Set DEBUG_ARGS env var"
+      env {
+        ["RUNNER_DEBUG"] = context.runner.debug
+      }
+      shell = "bash"
+      // language=bash
+      run =
+        """
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
+        """
+    }
     ...module.steps
   }
 }

.github/scripts/cc_macos_amd64.sh

@@ -1,2 +0,0 @@
-#!/usr/bin/env bash
-clang -arch x86_64 "$@"

.github/workflows/__lockfile__.yml

@@ -17,23 +17,23 @@ jobs:
     runs-on: nothing
     steps:
     - name: EnricoMi/publish-unit-test-result-action@v2
-      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
+      uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2
     - name: actions/checkout@v6
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
     - name: actions/create-github-app-token@v2
       uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
     - name: actions/download-artifact@v6
       uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
     - name: actions/setup-java@v5
-      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
     - name: actions/upload-artifact@v5
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
     - name: dawidd6/action-download-artifact@v11
       uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
     - name: github/codeql-action/analyze@v4
-      uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+      uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
     - name: github/codeql-action/init@v4
-      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+      uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
     - name: gradle/actions/dependency-submission@v6
       uses: gradle/actions/dependency-submission@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6
     - name: gradle/actions/setup-gradle@v5

.github/workflows/build.yml

@@ -19,20 +19,28 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: check
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -52,20 +60,28 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: check
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -84,38 +100,54 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: bench:jmh
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true bench:jmh
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true bench:jmh
   gradle-compatibility:
     runs-on: ubuntu-latest
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -134,23 +166,31 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
     - name: gradle build java executables
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -169,45 +209,6 @@ jobs:
         name: test-results-html-java-executables-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
-  pkl-cli-macOS-amd64-snapshot:
-    if: github.repository_owner == 'apple'
-    runs-on:
-    - self-hosted
-    - macos
-    env:
-      LANG: en_US.UTF-8
-    steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      with:
-        persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
-      with:
-        java-version: '25'
-        distribution: temurin
-        architecture: x64
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
-    - name: gradle buildNative
-      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
-    - name: Upload executable artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: executable-pkl-cli-macOS-amd64
-        path: pkl-cli*/build/executable/**/*
-    - name: Upload Test Result XML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-xml-pkl-cli-macOS-amd64-snapshot
-        path: '**/build/test-results/**/*.xml'
-    - name: Upload Test Result HTML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-html-pkl-cli-macOS-amd64-snapshot
-        path: '**/build/reports/tests/**/*'
-        if-no-files-found: ignore
   pkl-cli-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:
@@ -215,21 +216,29 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -250,45 +259,6 @@ jobs:
         if-no-files-found: ignore
     container:
       image: redhat/ubi8:8.10
-  pkl-cli-macOS-aarch64-snapshot:
-    if: github.repository_owner == 'apple'
-    runs-on:
-    - self-hosted
-    - macos
-    env:
-      LANG: en_US.UTF-8
-    steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      with:
-        persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
-      with:
-        java-version: '25'
-        distribution: temurin
-        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
-    - name: gradle buildNative
-      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
-    - name: Upload executable artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: executable-pkl-cli-macOS-aarch64
-        path: pkl-cli*/build/executable/**/*
-    - name: Upload Test Result XML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-xml-pkl-cli-macOS-aarch64-snapshot
-        path: '**/build/test-results/**/*.xml'
-    - name: Upload Test Result HTML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-html-pkl-cli-macOS-aarch64-snapshot
-        path: '**/build/reports/tests/**/*'
-        if-no-files-found: ignore
   pkl-cli-linux-aarch64-snapshot:
     runs-on: ubuntu-24.04-arm
     env:
@@ -296,21 +266,29 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -331,21 +309,76 @@ jobs:
         if-no-files-found: ignore
     container:
       image: redhat/ubi8:8.10
+  pkl-cli-macOS-aarch64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
   pkl-cli-alpine-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Install musl and zlib
       run: |
         set -e
@@ -421,7 +454,7 @@ jobs:
         echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -446,19 +479,27 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -477,45 +518,6 @@ jobs:
         name: test-results-html-pkl-cli-windows-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
-  pkl-doc-macOS-amd64-snapshot:
-    if: github.repository_owner == 'apple'
-    runs-on:
-    - self-hosted
-    - macos
-    env:
-      LANG: en_US.UTF-8
-    steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      with:
-        persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
-      with:
-        java-version: '25'
-        distribution: temurin
-        architecture: x64
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
-    - name: gradle buildNative
-      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
-    - name: Upload executable artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: executable-pkl-doc-macOS-amd64
-        path: pkl-doc*/build/executable/**/*
-    - name: Upload Test Result XML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-xml-pkl-doc-macOS-amd64-snapshot
-        path: '**/build/test-results/**/*.xml'
-    - name: Upload Test Result HTML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-html-pkl-doc-macOS-amd64-snapshot
-        path: '**/build/reports/tests/**/*'
-        if-no-files-found: ignore
   pkl-doc-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:
@@ -523,21 +525,29 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -558,45 +568,6 @@ jobs:
         if-no-files-found: ignore
     container:
       image: redhat/ubi8:8.10
-  pkl-doc-macOS-aarch64-snapshot:
-    if: github.repository_owner == 'apple'
-    runs-on:
-    - self-hosted
-    - macos
-    env:
-      LANG: en_US.UTF-8
-    steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      with:
-        persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
-      with:
-        java-version: '25'
-        distribution: temurin
-        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
-    - name: gradle buildNative
-      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
-    - name: Upload executable artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: executable-pkl-doc-macOS-aarch64
-        path: pkl-doc*/build/executable/**/*
-    - name: Upload Test Result XML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-xml-pkl-doc-macOS-aarch64-snapshot
-        path: '**/build/test-results/**/*.xml'
-    - name: Upload Test Result HTML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-html-pkl-doc-macOS-aarch64-snapshot
-        path: '**/build/reports/tests/**/*'
-        if-no-files-found: ignore
   pkl-doc-linux-aarch64-snapshot:
     runs-on: ubuntu-24.04-arm
     env:
@@ -604,21 +575,29 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -639,21 +618,76 @@ jobs:
         if-no-files-found: ignore
     container:
       image: redhat/ubi8:8.10
+  pkl-doc-macOS-aarch64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
   pkl-doc-alpine-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Install musl and zlib
       run: |
         set -e
@@ -729,7 +763,7 @@ jobs:
         echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -754,19 +788,27 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -792,16 +834,14 @@ jobs:
     - gradle-check-windows
     - gradle-compatibility
     - java-executables-snapshot
-    - pkl-cli-macOS-amd64-snapshot
     - pkl-cli-linux-amd64-snapshot
-    - pkl-cli-macOS-aarch64-snapshot
     - pkl-cli-linux-aarch64-snapshot
+    - pkl-cli-macOS-aarch64-snapshot
     - pkl-cli-alpine-linux-amd64-snapshot
     - pkl-cli-windows-amd64-snapshot
-    - pkl-doc-macOS-amd64-snapshot
     - pkl-doc-linux-amd64-snapshot
-    - pkl-doc-macOS-aarch64-snapshot
     - pkl-doc-linux-aarch64-snapshot
+    - pkl-doc-macOS-aarch64-snapshot
     - pkl-doc-alpine-linux-amd64-snapshot
     - pkl-doc-windows-amd64-snapshot
     permissions:
@@ -813,7 +853,7 @@ jobs:
         pattern: test-results-xml-*
     - name: Publish test results
       if: '!cancelled()'
-      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
+      uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2
       with:
         comment_mode: 'off'
         files: test-results-xml-*/**/*.xml

.github/workflows/codeql.yml

@@ -1,11 +1,13 @@
 # Generated from Workflow.pkl. DO NOT EDIT.
 'on':
-  pull_request: {}
+  pull_request:
+    branches:
+    - main
   push:
     branches:
     - main
   schedule:
-  - cron: 38 1 * * 6
+  - cron: 29 17 * * 4
 jobs:
   analyze-actions:
     name: Analyze (actions)
@@ -13,16 +15,15 @@ jobs:
       security-events: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - name: Initialize CodeQL
+    - uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
-      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
       with:
         languages: actions
         build-mode: none
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+      uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
       with:
         category: /language:actions
   analyze-java-kotlin:
@@ -31,16 +32,15 @@ jobs:
       security-events: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - name: Initialize CodeQL
+    - uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
-      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
       with:
         languages: java-kotlin
         build-mode: autobuild
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+      uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
       with:
         category: /language:java-kotlin
   analyze-javascript-typescript:
@@ -49,15 +49,14 @@ jobs:
       security-events: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - name: Initialize CodeQL
+    - uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
-      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
       with:
         languages: javascript-typescript
         build-mode: none
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+      uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
       with:
         category: /language:javascript-typescript

.github/workflows/main.yml

@@ -17,20 +17,28 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: check
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -50,20 +58,28 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: check
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -82,38 +98,54 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: bench:jmh
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true bench:jmh
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true bench:jmh
   gradle-compatibility:
     runs-on: ubuntu-latest
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -132,23 +164,31 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
     - name: gradle build java executables
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -167,45 +207,6 @@ jobs:
         name: test-results-html-java-executables-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
-  pkl-cli-macOS-amd64-snapshot:
-    if: github.repository_owner == 'apple'
-    runs-on:
-    - self-hosted
-    - macos
-    env:
-      LANG: en_US.UTF-8
-    steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      with:
-        persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
-      with:
-        java-version: '25'
-        distribution: temurin
-        architecture: x64
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
-    - name: gradle buildNative
-      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
-    - name: Upload executable artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: executable-pkl-cli-macOS-amd64
-        path: pkl-cli*/build/executable/**/*
-    - name: Upload Test Result XML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-xml-pkl-cli-macOS-amd64-snapshot
-        path: '**/build/test-results/**/*.xml'
-    - name: Upload Test Result HTML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-html-pkl-cli-macOS-amd64-snapshot
-        path: '**/build/reports/tests/**/*'
-        if-no-files-found: ignore
   pkl-cli-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:
@@ -213,21 +214,29 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -248,45 +257,6 @@ jobs:
         if-no-files-found: ignore
     container:
       image: redhat/ubi8:8.10
-  pkl-cli-macOS-aarch64-snapshot:
-    if: github.repository_owner == 'apple'
-    runs-on:
-    - self-hosted
-    - macos
-    env:
-      LANG: en_US.UTF-8
-    steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      with:
-        persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
-      with:
-        java-version: '25'
-        distribution: temurin
-        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
-    - name: gradle buildNative
-      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
-    - name: Upload executable artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: executable-pkl-cli-macOS-aarch64
-        path: pkl-cli*/build/executable/**/*
-    - name: Upload Test Result XML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-xml-pkl-cli-macOS-aarch64-snapshot
-        path: '**/build/test-results/**/*.xml'
-    - name: Upload Test Result HTML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-html-pkl-cli-macOS-aarch64-snapshot
-        path: '**/build/reports/tests/**/*'
-        if-no-files-found: ignore
   pkl-cli-linux-aarch64-snapshot:
     runs-on: ubuntu-24.04-arm
     env:
@@ -294,21 +264,29 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -329,21 +307,76 @@ jobs:
         if-no-files-found: ignore
     container:
       image: redhat/ubi8:8.10
+  pkl-cli-macOS-aarch64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
   pkl-cli-alpine-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Install musl and zlib
       run: |
         set -e
@@ -419,7 +452,7 @@ jobs:
         echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -444,19 +477,27 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -475,45 +516,6 @@ jobs:
         name: test-results-html-pkl-cli-windows-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
-  pkl-doc-macOS-amd64-snapshot:
-    if: github.repository_owner == 'apple'
-    runs-on:
-    - self-hosted
-    - macos
-    env:
-      LANG: en_US.UTF-8
-    steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      with:
-        persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
-      with:
-        java-version: '25'
-        distribution: temurin
-        architecture: x64
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
-    - name: gradle buildNative
-      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
-    - name: Upload executable artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: executable-pkl-doc-macOS-amd64
-        path: pkl-doc*/build/executable/**/*
-    - name: Upload Test Result XML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-xml-pkl-doc-macOS-amd64-snapshot
-        path: '**/build/test-results/**/*.xml'
-    - name: Upload Test Result HTML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-html-pkl-doc-macOS-amd64-snapshot
-        path: '**/build/reports/tests/**/*'
-        if-no-files-found: ignore
   pkl-doc-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:
@@ -521,21 +523,29 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -556,45 +566,6 @@ jobs:
         if-no-files-found: ignore
     container:
       image: redhat/ubi8:8.10
-  pkl-doc-macOS-aarch64-snapshot:
-    if: github.repository_owner == 'apple'
-    runs-on:
-    - self-hosted
-    - macos
-    env:
-      LANG: en_US.UTF-8
-    steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      with:
-        persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
-      with:
-        java-version: '25'
-        distribution: temurin
-        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
-    - name: gradle buildNative
-      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
-    - name: Upload executable artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: executable-pkl-doc-macOS-aarch64
-        path: pkl-doc*/build/executable/**/*
-    - name: Upload Test Result XML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-xml-pkl-doc-macOS-aarch64-snapshot
-        path: '**/build/test-results/**/*.xml'
-    - name: Upload Test Result HTML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-html-pkl-doc-macOS-aarch64-snapshot
-        path: '**/build/reports/tests/**/*'
-        if-no-files-found: ignore
   pkl-doc-linux-aarch64-snapshot:
     runs-on: ubuntu-24.04-arm
     env:
@@ -602,21 +573,29 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -637,21 +616,76 @@ jobs:
         if-no-files-found: ignore
     container:
       image: redhat/ubi8:8.10
+  pkl-doc-macOS-aarch64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
   pkl-doc-alpine-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Install musl and zlib
       run: |
         set -e
@@ -727,7 +761,7 @@ jobs:
         echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -752,19 +786,27 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -790,16 +832,14 @@ jobs:
     - bench
     - gradle-compatibility
     - java-executables-snapshot
-    - pkl-cli-macOS-amd64-snapshot
     - pkl-cli-linux-amd64-snapshot
-    - pkl-cli-macOS-aarch64-snapshot
     - pkl-cli-linux-aarch64-snapshot
+    - pkl-cli-macOS-aarch64-snapshot
     - pkl-cli-alpine-linux-amd64-snapshot
     - pkl-cli-windows-amd64-snapshot
-    - pkl-doc-macOS-amd64-snapshot
     - pkl-doc-linux-amd64-snapshot
-    - pkl-doc-macOS-aarch64-snapshot
     - pkl-doc-linux-aarch64-snapshot
+    - pkl-doc-macOS-aarch64-snapshot
     - pkl-doc-alpine-linux-amd64-snapshot
     - pkl-doc-windows-amd64-snapshot
     runs-on: ubuntu-latest
@@ -807,17 +847,25 @@ jobs:
       LANG: en_US.UTF-8
     environment: maven-release
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
     - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
@@ -830,16 +878,16 @@ jobs:
         ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGPASSWORD }}
         ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.ORG_GRADLE_PROJECT_SONATYPEPASSWORD }}
         ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.ORG_GRADLE_PROJECT_SONATYPEUSERNAME }}
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true --no-parallel publishToSonatype
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true --no-parallel publishToSonatype
   dependency-submission:
     permissions:
       contents: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -853,16 +901,14 @@ jobs:
     - gradle-check-windows
     - gradle-compatibility
     - java-executables-snapshot
-    - pkl-cli-macOS-amd64-snapshot
     - pkl-cli-linux-amd64-snapshot
-    - pkl-cli-macOS-aarch64-snapshot
     - pkl-cli-linux-aarch64-snapshot
+    - pkl-cli-macOS-aarch64-snapshot
     - pkl-cli-alpine-linux-amd64-snapshot
     - pkl-cli-windows-amd64-snapshot
-    - pkl-doc-macOS-amd64-snapshot
     - pkl-doc-linux-amd64-snapshot
-    - pkl-doc-macOS-aarch64-snapshot
     - pkl-doc-linux-aarch64-snapshot
+    - pkl-doc-macOS-aarch64-snapshot
     - pkl-doc-alpine-linux-amd64-snapshot
     - pkl-doc-windows-amd64-snapshot
     permissions:
@@ -874,7 +920,7 @@ jobs:
         pattern: test-results-xml-*
     - name: Publish test results
       if: '!cancelled()'
-      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
+      uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2
       with:
         comment_mode: 'off'
         files: test-results-xml-*/**/*.xml
@@ -893,16 +939,14 @@ jobs:
     - bench
     - gradle-compatibility
     - java-executables-snapshot
-    - pkl-cli-macOS-amd64-snapshot
     - pkl-cli-linux-amd64-snapshot
-    - pkl-cli-macOS-aarch64-snapshot
     - pkl-cli-linux-aarch64-snapshot
+    - pkl-cli-macOS-aarch64-snapshot
     - pkl-cli-alpine-linux-amd64-snapshot
     - pkl-cli-windows-amd64-snapshot
-    - pkl-doc-macOS-amd64-snapshot
     - pkl-doc-linux-amd64-snapshot
-    - pkl-doc-macOS-aarch64-snapshot
     - pkl-doc-linux-aarch64-snapshot
+    - pkl-doc-macOS-aarch64-snapshot
     - pkl-doc-alpine-linux-amd64-snapshot
     - pkl-doc-windows-amd64-snapshot
     - deploy-snapshot

.github/workflows/prb.yml

@@ -13,20 +13,28 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: check
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -48,20 +56,28 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: check
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -76,46 +92,6 @@ jobs:
         name: test-results-html-gradle-check-windows
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
-  pkl-cli-macOS-amd64-snapshot:
-    if: (contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-cli]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS-amd64]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS-amd64]')) && github.repository_owner == 'apple'
-    runs-on:
-    - self-hosted
-    - macos
-    env:
-      LANG: en_US.UTF-8
-    steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      with:
-        persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
-      with:
-        java-version: '25'
-        distribution: temurin
-        architecture: x64
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
-    - name: gradle buildNative
-      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
-    - name: Upload executable artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: executable-pkl-cli-macOS-amd64
-        path: pkl-cli*/build/executable/**/*
-    - name: Upload Test Result XML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-xml-pkl-cli-macOS-amd64-snapshot
-        path: '**/build/test-results/**/*.xml'
-        if-no-files-found: ignore
-    - name: Upload Test Result HTML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-html-pkl-cli-macOS-amd64-snapshot
-        path: '**/build/reports/tests/**/*'
-        if-no-files-found: ignore
   pkl-cli-linux-amd64-snapshot:
     if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-cli]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux-amd64]')
     runs-on: ubuntu-latest
@@ -124,21 +100,29 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -160,46 +144,6 @@ jobs:
         if-no-files-found: ignore
     container:
       image: redhat/ubi8:8.10
-  pkl-cli-macOS-aarch64-snapshot:
-    if: (contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-cli]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS-aarch64]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS-aarch64]')) && github.repository_owner == 'apple'
-    runs-on:
-    - self-hosted
-    - macos
-    env:
-      LANG: en_US.UTF-8
-    steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      with:
-        persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
-      with:
-        java-version: '25'
-        distribution: temurin
-        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
-    - name: gradle buildNative
-      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
-    - name: Upload executable artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: executable-pkl-cli-macOS-aarch64
-        path: pkl-cli*/build/executable/**/*
-    - name: Upload Test Result XML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-xml-pkl-cli-macOS-aarch64-snapshot
-        path: '**/build/test-results/**/*.xml'
-        if-no-files-found: ignore
-    - name: Upload Test Result HTML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-html-pkl-cli-macOS-aarch64-snapshot
-        path: '**/build/reports/tests/**/*'
-        if-no-files-found: ignore
   pkl-cli-linux-aarch64-snapshot:
     if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-cli]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux-aarch64]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux-aarch64]')
     runs-on: ubuntu-24.04-arm
@@ -208,21 +152,29 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -244,22 +196,78 @@ jobs:
         if-no-files-found: ignore
     container:
       image: redhat/ubi8:8.10
+  pkl-cli-macOS-aarch64-snapshot:
+    if: (contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-cli]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS-aarch64]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS-aarch64]')) && github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
   pkl-cli-alpine-linux-amd64-snapshot:
     if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-cli]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-cli-alpine-linux-amd64]')
     runs-on: ubuntu-latest
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Install musl and zlib
       run: |
         set -e
@@ -335,7 +343,7 @@ jobs:
         echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -362,19 +370,27 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -394,46 +410,6 @@ jobs:
         name: test-results-html-pkl-cli-windows-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
-  pkl-doc-macOS-amd64-snapshot:
-    if: (contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-doc]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS-amd64]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS-amd64]')) && github.repository_owner == 'apple'
-    runs-on:
-    - self-hosted
-    - macos
-    env:
-      LANG: en_US.UTF-8
-    steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      with:
-        persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
-      with:
-        java-version: '25'
-        distribution: temurin
-        architecture: x64
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
-    - name: gradle buildNative
-      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
-    - name: Upload executable artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: executable-pkl-doc-macOS-amd64
-        path: pkl-doc*/build/executable/**/*
-    - name: Upload Test Result XML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-xml-pkl-doc-macOS-amd64-snapshot
-        path: '**/build/test-results/**/*.xml'
-        if-no-files-found: ignore
-    - name: Upload Test Result HTML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-html-pkl-doc-macOS-amd64-snapshot
-        path: '**/build/reports/tests/**/*'
-        if-no-files-found: ignore
   pkl-doc-linux-amd64-snapshot:
     if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-doc]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux-amd64]')
     runs-on: ubuntu-latest
@@ -442,21 +418,29 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -478,46 +462,6 @@ jobs:
         if-no-files-found: ignore
     container:
       image: redhat/ubi8:8.10
-  pkl-doc-macOS-aarch64-snapshot:
-    if: (contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-doc]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS-aarch64]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS-aarch64]')) && github.repository_owner == 'apple'
-    runs-on:
-    - self-hosted
-    - macos
-    env:
-      LANG: en_US.UTF-8
-    steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      with:
-        persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
-      with:
-        java-version: '25'
-        distribution: temurin
-        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
-    - name: gradle buildNative
-      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
-    - name: Upload executable artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: executable-pkl-doc-macOS-aarch64
-        path: pkl-doc*/build/executable/**/*
-    - name: Upload Test Result XML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-xml-pkl-doc-macOS-aarch64-snapshot
-        path: '**/build/test-results/**/*.xml'
-        if-no-files-found: ignore
-    - name: Upload Test Result HTML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-html-pkl-doc-macOS-aarch64-snapshot
-        path: '**/build/reports/tests/**/*'
-        if-no-files-found: ignore
   pkl-doc-linux-aarch64-snapshot:
     if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-doc]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux-aarch64]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux-aarch64]')
     runs-on: ubuntu-24.04-arm
@@ -526,21 +470,29 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -562,22 +514,78 @@ jobs:
         if-no-files-found: ignore
     container:
       image: redhat/ubi8:8.10
+  pkl-doc-macOS-aarch64-snapshot:
+    if: (contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-doc]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS-aarch64]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS-aarch64]')) && github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
   pkl-doc-alpine-linux-amd64-snapshot:
     if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-doc]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-doc-alpine-linux-amd64]')
     runs-on: ubuntu-latest
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Install musl and zlib
       run: |
         set -e
@@ -653,7 +661,7 @@ jobs:
         echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -680,19 +688,27 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -712,6 +728,29 @@ jobs:
         name: test-results-html-pkl-doc-windows-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+  verdict:
+    if: always()
+    needs:
+    - check-pkl-github-actions
+    - gradle-check
+    - gradle-check-windows
+    - pkl-cli-linux-amd64-snapshot
+    - pkl-cli-linux-aarch64-snapshot
+    - pkl-cli-macOS-aarch64-snapshot
+    - pkl-cli-alpine-linux-amd64-snapshot
+    - pkl-cli-windows-amd64-snapshot
+    - pkl-doc-linux-amd64-snapshot
+    - pkl-doc-linux-aarch64-snapshot
+    - pkl-doc-macOS-aarch64-snapshot
+    - pkl-doc-alpine-linux-amd64-snapshot
+    - pkl-doc-windows-amd64-snapshot
+    runs-on: ubuntu-latest
+    steps:
+    - name: Failure verdict
+      if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+      run: |-
+        echo "Some of the required jobs are either failing or were cancelled"
+        exit 1
   upload-event-file:
     runs-on: ubuntu-latest
     steps:
@@ -724,7 +763,7 @@ jobs:
   check-pkl-github-actions:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
     - name: Setup Pkl

.github/workflows/release-branch.yml

@@ -17,20 +17,28 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: check
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -50,20 +58,28 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: check
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -82,38 +98,54 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: bench:jmh
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true bench:jmh
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true bench:jmh
   gradle-compatibility:
     runs-on: ubuntu-latest
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -132,23 +164,31 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
     - name: gradle build java executables
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -167,45 +207,6 @@ jobs:
         name: test-results-html-java-executables-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
-  pkl-cli-macOS-amd64-snapshot:
-    if: github.repository_owner == 'apple'
-    runs-on:
-    - self-hosted
-    - macos
-    env:
-      LANG: en_US.UTF-8
-    steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      with:
-        persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
-      with:
-        java-version: '25'
-        distribution: temurin
-        architecture: x64
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
-    - name: gradle buildNative
-      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
-    - name: Upload executable artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: executable-pkl-cli-macOS-amd64
-        path: pkl-cli*/build/executable/**/*
-    - name: Upload Test Result XML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-xml-pkl-cli-macOS-amd64-snapshot
-        path: '**/build/test-results/**/*.xml'
-    - name: Upload Test Result HTML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-html-pkl-cli-macOS-amd64-snapshot
-        path: '**/build/reports/tests/**/*'
-        if-no-files-found: ignore
   pkl-cli-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:
@@ -213,21 +214,29 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -248,45 +257,6 @@ jobs:
         if-no-files-found: ignore
     container:
       image: redhat/ubi8:8.10
-  pkl-cli-macOS-aarch64-snapshot:
-    if: github.repository_owner == 'apple'
-    runs-on:
-    - self-hosted
-    - macos
-    env:
-      LANG: en_US.UTF-8
-    steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      with:
-        persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
-      with:
-        java-version: '25'
-        distribution: temurin
-        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
-    - name: gradle buildNative
-      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
-    - name: Upload executable artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: executable-pkl-cli-macOS-aarch64
-        path: pkl-cli*/build/executable/**/*
-    - name: Upload Test Result XML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-xml-pkl-cli-macOS-aarch64-snapshot
-        path: '**/build/test-results/**/*.xml'
-    - name: Upload Test Result HTML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-html-pkl-cli-macOS-aarch64-snapshot
-        path: '**/build/reports/tests/**/*'
-        if-no-files-found: ignore
   pkl-cli-linux-aarch64-snapshot:
     runs-on: ubuntu-24.04-arm
     env:
@@ -294,21 +264,29 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -329,21 +307,76 @@ jobs:
         if-no-files-found: ignore
     container:
       image: redhat/ubi8:8.10
+  pkl-cli-macOS-aarch64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
   pkl-cli-alpine-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Install musl and zlib
       run: |
         set -e
@@ -419,7 +452,7 @@ jobs:
         echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -444,19 +477,27 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -475,45 +516,6 @@ jobs:
         name: test-results-html-pkl-cli-windows-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
-  pkl-doc-macOS-amd64-snapshot:
-    if: github.repository_owner == 'apple'
-    runs-on:
-    - self-hosted
-    - macos
-    env:
-      LANG: en_US.UTF-8
-    steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      with:
-        persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
-      with:
-        java-version: '25'
-        distribution: temurin
-        architecture: x64
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
-    - name: gradle buildNative
-      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
-    - name: Upload executable artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: executable-pkl-doc-macOS-amd64
-        path: pkl-doc*/build/executable/**/*
-    - name: Upload Test Result XML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-xml-pkl-doc-macOS-amd64-snapshot
-        path: '**/build/test-results/**/*.xml'
-    - name: Upload Test Result HTML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-html-pkl-doc-macOS-amd64-snapshot
-        path: '**/build/reports/tests/**/*'
-        if-no-files-found: ignore
   pkl-doc-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:
@@ -521,21 +523,29 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -556,45 +566,6 @@ jobs:
         if-no-files-found: ignore
     container:
       image: redhat/ubi8:8.10
-  pkl-doc-macOS-aarch64-snapshot:
-    if: github.repository_owner == 'apple'
-    runs-on:
-    - self-hosted
-    - macos
-    env:
-      LANG: en_US.UTF-8
-    steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      with:
-        persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
-      with:
-        java-version: '25'
-        distribution: temurin
-        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with: {}
-    - name: gradle buildNative
-      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
-    - name: Upload executable artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: executable-pkl-doc-macOS-aarch64
-        path: pkl-doc*/build/executable/**/*
-    - name: Upload Test Result XML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-xml-pkl-doc-macOS-aarch64-snapshot
-        path: '**/build/test-results/**/*.xml'
-    - name: Upload Test Result HTML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-html-pkl-doc-macOS-aarch64-snapshot
-        path: '**/build/reports/tests/**/*'
-        if-no-files-found: ignore
   pkl-doc-linux-aarch64-snapshot:
     runs-on: ubuntu-24.04-arm
     env:
@@ -602,21 +573,29 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -637,21 +616,76 @@ jobs:
         if-no-files-found: ignore
     container:
       image: redhat/ubi8:8.10
+  pkl-doc-macOS-aarch64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
   pkl-doc-alpine-linux-amd64-snapshot:
     runs-on: ubuntu-latest
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Install musl and zlib
       run: |
         set -e
@@ -727,7 +761,7 @@ jobs:
         echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -752,19 +786,27 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -790,16 +832,14 @@ jobs:
     - gradle-check-windows
     - gradle-compatibility
     - java-executables-snapshot
-    - pkl-cli-macOS-amd64-snapshot
     - pkl-cli-linux-amd64-snapshot
-    - pkl-cli-macOS-aarch64-snapshot
     - pkl-cli-linux-aarch64-snapshot
+    - pkl-cli-macOS-aarch64-snapshot
     - pkl-cli-alpine-linux-amd64-snapshot
     - pkl-cli-windows-amd64-snapshot
-    - pkl-doc-macOS-amd64-snapshot
     - pkl-doc-linux-amd64-snapshot
-    - pkl-doc-macOS-aarch64-snapshot
     - pkl-doc-linux-aarch64-snapshot
+    - pkl-doc-macOS-aarch64-snapshot
     - pkl-doc-alpine-linux-amd64-snapshot
     - pkl-doc-windows-amd64-snapshot
     permissions:
@@ -811,7 +851,7 @@ jobs:
         pattern: test-results-xml-*
     - name: Publish test results
       if: '!cancelled()'
-      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
+      uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2
       with:
         comment_mode: 'off'
         files: test-results-xml-*/**/*.xml
@@ -830,16 +870,14 @@ jobs:
     - bench
     - gradle-compatibility
     - java-executables-snapshot
-    - pkl-cli-macOS-amd64-snapshot
     - pkl-cli-linux-amd64-snapshot
-    - pkl-cli-macOS-aarch64-snapshot
     - pkl-cli-linux-aarch64-snapshot
+    - pkl-cli-macOS-aarch64-snapshot
     - pkl-cli-alpine-linux-amd64-snapshot
     - pkl-cli-windows-amd64-snapshot
-    - pkl-doc-macOS-amd64-snapshot
     - pkl-doc-linux-amd64-snapshot
-    - pkl-doc-macOS-aarch64-snapshot
     - pkl-doc-linux-aarch64-snapshot
+    - pkl-doc-macOS-aarch64-snapshot
     - pkl-doc-alpine-linux-amd64-snapshot
     - pkl-doc-windows-amd64-snapshot
     - publish-test-results

.github/workflows/release.yml

@@ -17,20 +17,28 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: check
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -50,20 +58,28 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: check
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -82,38 +98,54 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: bench:jmh
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true bench:jmh
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true bench:jmh
   gradle-compatibility:
     runs-on: ubuntu-latest
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -132,11 +164,11 @@ jobs:
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -144,12 +176,20 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
     - name: gradle build java executables
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -168,46 +208,6 @@ jobs:
         name: test-results-html-java-executables-release
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
-  pkl-cli-macOS-amd64-release:
-    if: github.repository_owner == 'apple'
-    runs-on:
-    - self-hosted
-    - macos
-    env:
-      LANG: en_US.UTF-8
-    steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      with:
-        persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
-      with:
-        java-version: '25'
-        distribution: temurin
-        architecture: x64
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with:
-        cache-disabled: true
-    - name: gradle buildNative
-      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
-    - name: Upload executable artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: executable-pkl-cli-macOS-amd64
-        path: pkl-cli*/build/executable/**/*
-    - name: Upload Test Result XML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-xml-pkl-cli-macOS-amd64-release
-        path: '**/build/test-results/**/*.xml'
-    - name: Upload Test Result HTML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-html-pkl-cli-macOS-amd64-release
-        path: '**/build/reports/tests/**/*'
-        if-no-files-found: ignore
   pkl-cli-linux-amd64-release:
     runs-on: ubuntu-latest
     env:
@@ -215,10 +215,10 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -226,11 +226,19 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -251,46 +259,6 @@ jobs:
         if-no-files-found: ignore
     container:
       image: redhat/ubi8:8.10
-  pkl-cli-macOS-aarch64-release:
-    if: github.repository_owner == 'apple'
-    runs-on:
-    - self-hosted
-    - macos
-    env:
-      LANG: en_US.UTF-8
-    steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      with:
-        persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
-      with:
-        java-version: '25'
-        distribution: temurin
-        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with:
-        cache-disabled: true
-    - name: gradle buildNative
-      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
-    - name: Upload executable artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: executable-pkl-cli-macOS-aarch64
-        path: pkl-cli*/build/executable/**/*
-    - name: Upload Test Result XML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-xml-pkl-cli-macOS-aarch64-release
-        path: '**/build/test-results/**/*.xml'
-    - name: Upload Test Result HTML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-html-pkl-cli-macOS-aarch64-release
-        path: '**/build/reports/tests/**/*'
-        if-no-files-found: ignore
   pkl-cli-linux-aarch64-release:
     runs-on: ubuntu-24.04-arm
     env:
@@ -298,10 +266,10 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -309,11 +277,19 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -334,15 +310,63 @@ jobs:
         if-no-files-found: ignore
     container:
       image: redhat/ubi8:8.10
+  pkl-cli-macOS-aarch64-release:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-aarch64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-aarch64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
   pkl-cli-alpine-linux-amd64-release:
     runs-on: ubuntu-latest
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -350,6 +374,14 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Install musl and zlib
       run: |
         set -e
@@ -425,7 +457,7 @@ jobs:
         echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.musl=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.musl=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -450,10 +482,10 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -461,9 +493,17 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -482,46 +522,6 @@ jobs:
         name: test-results-html-pkl-cli-windows-amd64-release
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
-  pkl-doc-macOS-amd64-release:
-    if: github.repository_owner == 'apple'
-    runs-on:
-    - self-hosted
-    - macos
-    env:
-      LANG: en_US.UTF-8
-    steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      with:
-        persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
-      with:
-        java-version: '25'
-        distribution: temurin
-        architecture: x64
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with:
-        cache-disabled: true
-    - name: gradle buildNative
-      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
-    - name: Upload executable artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: executable-pkl-doc-macOS-amd64
-        path: pkl-doc*/build/executable/**/*
-    - name: Upload Test Result XML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-xml-pkl-doc-macOS-amd64-release
-        path: '**/build/test-results/**/*.xml'
-    - name: Upload Test Result HTML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-html-pkl-doc-macOS-amd64-release
-        path: '**/build/reports/tests/**/*'
-        if-no-files-found: ignore
   pkl-doc-linux-amd64-release:
     runs-on: ubuntu-latest
     env:
@@ -529,10 +529,10 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -540,11 +540,19 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -565,46 +573,6 @@ jobs:
         if-no-files-found: ignore
     container:
       image: redhat/ubi8:8.10
-  pkl-doc-macOS-aarch64-release:
-    if: github.repository_owner == 'apple'
-    runs-on:
-    - self-hosted
-    - macos
-    env:
-      LANG: en_US.UTF-8
-    steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      with:
-        persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
-      with:
-        java-version: '25'
-        distribution: temurin
-        architecture: aarch64
-    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
-      with:
-        cache-disabled: true
-    - name: gradle buildNative
-      shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
-    - name: Upload executable artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: executable-pkl-doc-macOS-aarch64
-        path: pkl-doc*/build/executable/**/*
-    - name: Upload Test Result XML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-xml-pkl-doc-macOS-aarch64-release
-        path: '**/build/test-results/**/*.xml'
-    - name: Upload Test Result HTML
-      if: '!cancelled()'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      with:
-        name: test-results-html-pkl-doc-macOS-aarch64-release
-        path: '**/build/reports/tests/**/*'
-        if-no-files-found: ignore
   pkl-doc-linux-aarch64-release:
     runs-on: ubuntu-24.04-arm
     env:
@@ -612,10 +580,10 @@ jobs:
     steps:
     - name: Install deps
       run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -623,11 +591,19 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -648,15 +624,63 @@ jobs:
         if-no-files-found: ignore
     container:
       image: redhat/ubi8:8.10
+  pkl-doc-macOS-aarch64-release:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-aarch64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-aarch64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
   pkl-doc-alpine-linux-amd64-release:
     runs-on: ubuntu-latest
     env:
       LANG: en_US.UTF-8
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -664,6 +688,14 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Install musl and zlib
       run: |
         set -e
@@ -739,7 +771,7 @@ jobs:
         echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.musl=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.musl=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -764,10 +796,10 @@ jobs:
       LANG: en_US.UTF-8
       JAVA_HOME: /jdk
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -775,9 +807,17 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -803,16 +843,14 @@ jobs:
     - bench
     - gradle-compatibility
     - java-executables-release
-    - pkl-cli-macOS-amd64-release
     - pkl-cli-linux-amd64-release
-    - pkl-cli-macOS-aarch64-release
     - pkl-cli-linux-aarch64-release
+    - pkl-cli-macOS-aarch64-release
     - pkl-cli-alpine-linux-amd64-release
     - pkl-cli-windows-amd64-release
-    - pkl-doc-macOS-amd64-release
     - pkl-doc-linux-amd64-release
-    - pkl-doc-macOS-aarch64-release
     - pkl-doc-linux-aarch64-release
+    - pkl-doc-macOS-aarch64-release
     - pkl-doc-alpine-linux-amd64-release
     - pkl-doc-windows-amd64-release
     runs-on: ubuntu-latest
@@ -820,10 +858,10 @@ jobs:
       LANG: en_US.UTF-8
     environment: maven-release
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -831,7 +869,15 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
     - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
@@ -844,7 +890,7 @@ jobs:
         ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGPASSWORD }}
         ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.ORG_GRADLE_PROJECT_SONATYPEPASSWORD }}
         ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.ORG_GRADLE_PROJECT_SONATYPEUSERNAME }}
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true publishToSonatype closeAndReleaseSonatypeStagingRepository
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true publishToSonatype closeAndReleaseSonatypeStagingRepository
   github-release:
     needs: deploy-release
     permissions:
@@ -878,16 +924,14 @@ jobs:
     - gradle-check-windows
     - gradle-compatibility
     - java-executables-release
-    - pkl-cli-macOS-amd64-release
     - pkl-cli-linux-amd64-release
-    - pkl-cli-macOS-aarch64-release
     - pkl-cli-linux-aarch64-release
+    - pkl-cli-macOS-aarch64-release
     - pkl-cli-alpine-linux-amd64-release
     - pkl-cli-windows-amd64-release
-    - pkl-doc-macOS-amd64-release
     - pkl-doc-linux-amd64-release
-    - pkl-doc-macOS-aarch64-release
     - pkl-doc-linux-aarch64-release
+    - pkl-doc-macOS-aarch64-release
     - pkl-doc-alpine-linux-amd64-release
     - pkl-doc-windows-amd64-release
     permissions:
@@ -899,7 +943,7 @@ jobs:
         pattern: test-results-xml-*
     - name: Publish test results
       if: '!cancelled()'
-      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
+      uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2
       with:
         comment_mode: 'off'
         files: test-results-xml-*/**/*.xml
@@ -918,16 +962,14 @@ jobs:
     - bench
     - gradle-compatibility
     - java-executables-release
-    - pkl-cli-macOS-amd64-release
     - pkl-cli-linux-amd64-release
-    - pkl-cli-macOS-aarch64-release
     - pkl-cli-linux-aarch64-release
+    - pkl-cli-macOS-aarch64-release
     - pkl-cli-alpine-linux-amd64-release
     - pkl-cli-windows-amd64-release
-    - pkl-doc-macOS-amd64-release
     - pkl-doc-linux-amd64-release
-    - pkl-doc-macOS-aarch64-release
     - pkl-doc-linux-aarch64-release
+    - pkl-doc-macOS-aarch64-release
     - pkl-doc-alpine-linux-amd64-release
     - pkl-doc-windows-amd64-release
     - deploy-release

.github/workflows/test_report.yml

@@ -25,7 +25,7 @@ jobs:
         name_is_regexp: true
         run_id: ${{ github.event.workflow_run.id }}
     - name: Publish test results
-      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
+      uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2
       with:
         commit: ${{ github.event.workflow_run.head_sha }}
         comment_mode: 'off'

.idea/codeStyles/Project.xml

@@ -10,16 +10,6 @@
     <option name="INSERT_INNER_CLASS_IMPORTS" value="true" />
     <option name="CLASS_COUNT_TO_USE_IMPORT_ON_DEMAND" value="999" />
     <option name="NAMES_COUNT_TO_USE_IMPORT_ON_DEMAND" value="999" />
-    <option name="PACKAGES_TO_USE_IMPORT_ON_DEMAND">
-      <value />
-    </option>
-    <option name="IMPORT_LAYOUT_TABLE">
-      <value>
-        <package name="" withSubpackages="true" static="true" />
-        <emptyLine />
-        <package name="" withSubpackages="true" static="false" />
-      </value>
-    </option>
     <option name="RIGHT_MARGIN" value="100" />
     <option name="KEEP_BLANK_LINES_IN_CODE" value="1" />
     <option name="KEEP_CONTROL_STATEMENT_IN_ONE_LINE" value="false" />

.idea/inspectionProfiles/Project_Default.xml

@@ -27,12 +27,19 @@
                   <option name="searchContext" value="ANY" />
                   <option name="replacement" value="evaluatorSettings" />
                 </InspectionPattern>
+                <InspectionPattern>
+                  <option name="regExp" value="project\?\.resolvedEvaluatorSettings" />
+                  <option name="_fileType" value="Kotlin" />
+                  <option name="searchContext" value="ANY" />
+                  <option name="replacement" value="evaluatorSettings" />
+                </InspectionPattern>
               </list>
             </option>
           </RegExpInspectionConfiguration>
         </list>
       </option>
     </inspection_tool>
+    <inspection_tool class="FieldAccessNotGuarded" enabled="true" level="WARNING" enabled_by_default="true" />
     <inspection_tool class="FieldMayBeFinal" enabled="true" level="INFORMATION" enabled_by_default="true">
       <scope name="AllExceptTruffleAst" level="WARNING" enabled="true" />
     </inspection_tool>
@@ -94,6 +101,7 @@
       <option name="processLiterals" value="true" />
       <option name="processComments" value="true" />
     </inspection_tool>
+    <inspection_tool class="StringToUpperWithoutLocale" enabled="true" level="WARNING" enabled_by_default="true" editorAttributes="WARNING_ATTRIBUTES" />
     <inspection_tool class="dd497f47-d38f-3fab-9ed7-eabe699620c8" enabled="true" level="ERROR" enabled_by_default="true" editorAttributes="ERRORS_ATTRIBUTES" />
   </profile>
 </component>

DEVELOPMENT.adoc

@@ -53,7 +53,6 @@ gw pkl-cli:buildNative  # build native executable for current platform
 
 pkl-cli/build/executable/jpkl                   # run Java executable
 pkl-cli/build/executable/pkl-macos-aarch64      # run Mac executable
-pkl-cli/build/executable/pkl-macos-amd64        # run Intel Mac executable
 pkl-cli/build/executable/pkl-linux-amd64        # run Linux executable
 pkl-cli/build/executable/pkl-alpine-linux-amd64 # run Alpine Linux executable 
 pkl-cli/build/executable/pkl-windows-amd64.exe  # run Windows executable 

bench/bench.gradle.kts

@@ -19,8 +19,8 @@ plugins {
   id("me.champeau.jmh")
 }
 
-val truffle: Configuration by configurations.creating
+val truffle: Configuration = configurations.create("truffle")
-val graal: Configuration by configurations.creating
+val graal: Configuration = configurations.create("graal")
 
 dependencies {
   jmh(projects.pklCore)

build-logic/src/main/kotlin/BuildInfo.kt

@@ -24,6 +24,7 @@ import org.gradle.api.provider.Provider
 import org.gradle.api.tasks.TaskProvider
 import org.gradle.api.tasks.testing.Test
 import org.gradle.internal.extensions.stdlib.capitalized
+import org.gradle.internal.os.OperatingSystem
 import org.gradle.jvm.toolchain.*
 import org.gradle.kotlin.dsl.*
 import org.gradle.kotlin.dsl.support.serviceOf
@@ -70,31 +71,27 @@ const val PKL_TEST_ALL_JDKS = false
 // `buildInfo` in main build scripts
 // `project.extensions.getByType<BuildInfo>()` in precompiled script plugins
 open class BuildInfo(private val project: Project) {
-  inner class GraalVm(val arch: String) {
+  inner class GraalVm(
+    val osName: String,
+    val arch: String,
+    val version: String,
+    val graalJdkVersion: String,
+  ) {
     val homeDir: String by lazy {
       System.getenv("GRAALVM_HOME") ?: "${System.getProperty("user.home")}/.graalvm"
     }
-
-    val version: String by lazy { libs.findVersion("graalVm").get().toString() }
-
     val graalVmJdkVersion: String by lazy { libs.findVersion("graalVmJdkVersion").get().toString() }
 
-    val osName: String by lazy {
-      when {
-        os.isMacOsX -> "macos"
-        os.isLinux -> "linux"
-        os.isWindows -> "windows"
-        else -> throw RuntimeException("${os.familyName} is not supported.")
-      }
-    }
-
     val baseName: String by lazy {
       "graalvm-community-jdk-${graalVmJdkVersion}_${osName}-${arch}_bin"
     }
 
+    val graalMajorVersion: String = graalJdkVersion.split(".").first()
+
     val downloadUrl: String by lazy {
-      val extension = if (os.isWindows) "zip" else "tar.gz"
+      val ext = if (os.isWindows) "zip" else "tar.gz"
-      "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-${graalVmJdkVersion}/$baseName.$extension"
+      val platformArch = if (arch == "amd64") "x64" else arch
+      "https://github.com/graalvm/graalvm-ce-builds/releases/download/graal-$version/graalvm-community-jdk-${graalMajorVersion}i1-${graalJdkVersion}_${osName}-${platformArch}_bin.$ext"
     }
 
     val downloadFile: File by lazy {
@@ -131,9 +128,22 @@ open class BuildInfo(private val project: Project) {
     }
   }
 
-  val graalVmAarch64: GraalVm = GraalVm("aarch64")
+  val graalVmAarch64: GraalVm by lazy { createGraalVm("aarch64") }
 
-  val graalVmAmd64: GraalVm = GraalVm("x64")
+  val graalVmAmd64: GraalVm by lazy { createGraalVm("x64") }
+
+  private fun createGraalVm(arch: String): GraalVm {
+    val osName =
+      when {
+        os.isMacOsX -> "macos"
+        os.isLinux -> "linux"
+        os.isWindows -> "windows"
+        else -> throw RuntimeException("Unsupported OS for GraalVM: ${os.canonicalName}")
+      }
+    val version = libs.findVersion("graalVm").get().toString()
+    val graalJdkVersion = libs.findVersion("graalVmJdkVersion").get().toString()
+    return GraalVm(osName, arch, version, graalJdkVersion)
+  }
 
   val isCiBuild: Boolean by lazy { System.getenv("CI") != null }
 
@@ -368,9 +378,7 @@ open class BuildInfo(private val project: Project) {
     File(System.getProperty("user.home"), "staticdeps/bin/x86_64-linux-musl-gcc").exists()
   }
 
-  val os: org.gradle.internal.os.OperatingSystem by lazy {
+  val os: OperatingSystem by lazy { OperatingSystem.current() }
-    org.gradle.internal.os.OperatingSystem.current()
-  }
 
   // could be `commitId: Provider<String> = project.provider { ... }`
   val commitId: String by lazy {
@@ -425,3 +433,12 @@ open class BuildInfo(private val project: Project) {
 // Shape of a function which is applied to configure multi-JDK testing.
 private typealias MultiJdkTestConfigurator =
   Test.(Pair<JavaLanguageVersion, Provider<JavaLauncher>>) -> Unit
+
+private val OperatingSystem.canonicalName
+  get() =
+    when {
+      isMacOsX -> "macos"
+      isWindows -> "windows"
+      isLinux -> "linux"
+      else -> throw RuntimeException("Unsupported OS: $name")
+    }

build-logic/src/main/kotlin/ConfigureLateInitAnnotation.kt

@@ -0,0 +1,76 @@
+/*
+ * Copyright © 2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import groovy.util.Node
+import groovy.xml.XmlParser
+import groovy.xml.XmlUtil
+import org.gradle.api.DefaultTask
+import org.gradle.api.tasks.TaskAction
+
+abstract class ConfigureLateInitAnnotation : DefaultTask() {
+  private val miscXmlFile = project.rootProject.file(".idea/misc.xml")
+
+  init {
+    inputs.file(miscXmlFile)
+    outputs.file(miscXmlFile)
+  }
+
+  @TaskAction
+  fun run() {
+    val annotationName = "org.pkl.core.util.LateInit"
+
+    if (!miscXmlFile.exists()) {
+      miscXmlFile.writeText(
+        """
+        <?xml version="1.0" encoding="UTF-8"?>
+        <project version="4">
+        </project>
+        """
+          .trimIndent()
+          .trim()
+      )
+    }
+
+    val root = XmlParser().parse(miscXmlFile)
+
+    fun Node.childNodes() = children().filterIsInstance<Node>()
+
+    var entryPointsManager =
+      root.childNodes().find {
+        it.name() == "component" && it.attribute("name") == "EntryPointsManager"
+      }
+    if (entryPointsManager == null) {
+      entryPointsManager = root.appendNode("component", mapOf("name" to "EntryPointsManager"))
+    }
+
+    var writeAnnotations = entryPointsManager.childNodes().find { it.name() == "writeAnnotations" }
+    if (writeAnnotations == null) {
+      writeAnnotations = entryPointsManager.appendNode("writeAnnotations")
+    }
+
+    val alreadyExists =
+      writeAnnotations.childNodes().any {
+        it.name() == "writeAnnotation" && it.attribute("name") == annotationName
+      }
+
+    if (!alreadyExists) {
+      writeAnnotations.appendNode("writeAnnotation", mapOf("name" to annotationName))
+      miscXmlFile.writeText(XmlUtil.serialize(root))
+      logger.lifecycle("Updated .idea/misc.xml")
+    } else {
+      logger.info("$annotationName is already configured in .idea/misc.xml")
+    }
+  }
+}

build-logic/src/main/kotlin/InstallGraalVm.kt

@@ -13,10 +13,13 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+import java.nio.file.AtomicMoveNotSupportedException
 import java.nio.file.Files
+import java.nio.file.Path
 import java.nio.file.Paths
 import java.nio.file.StandardCopyOption
 import java.util.*
+import java.util.zip.ZipInputStream
 import javax.inject.Inject
 import kotlin.io.path.createDirectories
 import org.gradle.api.DefaultTask
@@ -41,19 +44,14 @@ constructor(
   @TaskAction
   @Suppress("unused")
   fun run() {
-    // minimize chance of corruption by extract-to-random-dir-and-flip-symlink
+    // minimize chance of corruption by extract-to-random-dir-and-publish
     val distroDir = Paths.get(graalVm.get().homeDir, UUID.randomUUID().toString())
     try {
       distroDir.createDirectories()
       println("Extracting ${graalVm.get().downloadFile} into $distroDir")
-      // faster and more reliable than Gradle's `copy { from tarTree() }`
-      execOperations.exec {
-        workingDir = distroDir.toFile()
-        executable = "tar"
-        args("--strip-components=1", "-xzf", graalVm.get().downloadFile)
-      }
-
       val os = org.gradle.internal.os.OperatingSystem.current()
+      if (os.isWindows) extractZip(distroDir) else extractTarGz(distroDir)
+
       val distroBinDir =
         if (os.isMacOsX) distroDir.resolve("Contents/Home/bin") else distroDir.resolve("bin")
 
@@ -70,17 +68,7 @@ constructor(
         }
       }
 
-      println("Creating symlink ${graalVm.get().installDir} for $distroDir")
+      publishInstallDir(distroDir, os)
-      val tempLink = Paths.get(graalVm.get().homeDir, UUID.randomUUID().toString())
-      Files.createSymbolicLink(tempLink, distroDir)
-      try {
-        Files.move(tempLink, graalVm.get().installDir.toPath(), StandardCopyOption.ATOMIC_MOVE)
-      } catch (e: Exception) {
-        try {
-          fileOperations.delete(tempLink.toFile())
-        } catch (ignored: Exception) {}
-        throw e
-      }
     } catch (e: Exception) {
       try {
         fileOperations.delete(distroDir)
@@ -88,4 +76,75 @@ constructor(
       throw e
     }
   }
+
+  private fun extractTarGz(distroDir: Path) {
+    // faster and more reliable than Gradle's `copy { from tarTree() }`
+    execOperations.exec {
+      workingDir = distroDir.toFile()
+      executable = "tar"
+      args("--strip-components=1", "-xzf", graalVm.get().downloadFile)
+    }
+  }
+
+  private fun extractZip(distroDir: Path) {
+    val targetDir = distroDir.toAbsolutePath().normalize()
+    ZipInputStream(graalVm.get().downloadFile.inputStream().buffered()).use { zipInput ->
+      var entry = zipInput.nextEntry
+      while (entry != null) {
+        try {
+          val strippedPath = stripFirstPathComponent(entry.name)
+          if (strippedPath != null) {
+            val target = targetDir.resolve(strippedPath).normalize()
+            require(target.startsWith(targetDir)) {
+              "GraalVM archive entry escapes destination directory: ${entry.name}"
+            }
+            if (entry.isDirectory) {
+              target.createDirectories()
+            } else {
+              target.parent?.createDirectories()
+              Files.copy(zipInput, target)
+            }
+          }
+        } finally {
+          zipInput.closeEntry()
+        }
+        entry = zipInput.nextEntry
+      }
+    }
+  }
+
+  private fun stripFirstPathComponent(path: String): String? {
+    val normalizedPath = path.replace('\\', '/').trimStart('/')
+    val separatorIndex = normalizedPath.indexOf('/')
+    if (separatorIndex == -1) return null
+    return normalizedPath.substring(separatorIndex + 1).takeIf { it.isNotEmpty() }
+  }
+
+  private fun publishInstallDir(distroDir: Path, os: org.gradle.internal.os.OperatingSystem) {
+    if (os.isWindows) {
+      println("Installing ${graalVm.get().installDir} from $distroDir")
+      moveAtomicallyOrRegularly(distroDir, graalVm.get().installDir.toPath())
+      return
+    }
+
+    println("Creating symlink ${graalVm.get().installDir} for $distroDir")
+    val tempLink = Paths.get(graalVm.get().homeDir, UUID.randomUUID().toString())
+    Files.createSymbolicLink(tempLink, distroDir)
+    try {
+      moveAtomicallyOrRegularly(tempLink, graalVm.get().installDir.toPath())
+    } catch (e: Exception) {
+      try {
+        fileOperations.delete(tempLink.toFile())
+      } catch (ignored: Exception) {}
+      throw e
+    }
+  }
+
+  private fun moveAtomicallyOrRegularly(source: Path, target: Path) {
+    try {
+      Files.move(source, target, StandardCopyOption.ATOMIC_MOVE)
+    } catch (e: AtomicMoveNotSupportedException) {
+      Files.move(source, target)
+    }
+  }
 }

build-logic/src/main/kotlin/PklPublishing.kt

@@ -63,11 +63,13 @@ fun Project.configurePklPomMetadata() {
 
 /** Configures POM validation task to check for unresolved versions and snapshots in releases. */
 fun Project.configurePomValidation() {
-  val validatePom by tasks.registering {
+  val validatePom =
+    tasks.register("validatePom") {
       if (tasks.findByName("generatePomFileForLibraryPublication") == null) {
-      return@registering
+        return@register
       }
-    val generatePomFileForLibraryPublication by tasks.existing(GenerateMavenPom::class)
+      val generatePomFileForLibraryPublication =
+        tasks.named<GenerateMavenPom>("generatePomFileForLibraryPublication")
       val outputFile =
         layout.buildDirectory.file("validatePom") // dummy output to satisfy up-to-date check
 

build-logic/src/main/kotlin/pklAllProjects.gradle.kts

@@ -79,7 +79,7 @@ plugins.withType(MavenPublishPlugin::class).configureEach {
   }
 }
 
-val allDependencies by tasks.registering(DependencyReportTask::class)
+val allDependencies = tasks.register<DependencyReportTask>("allDependencies")
 
 tasks.withType(Test::class).configureEach {
   System.getProperty("testReportsDir")?.let { reportsDir ->

build-logic/src/main/kotlin/pklFatJar.gradle.kts

@@ -132,8 +132,8 @@ tasks.shadowJar {
 
 shadow { addShadowVariantIntoJavaComponent = false }
 
-val testFatJar by
+val testFatJar =
-  tasks.registering(Test::class) {
+  tasks.register<Test>("testFatJar") {
     testClassesDirs = files(tasks.test.get().testClassesDirs)
     classpath =
       // compiled test classes
@@ -148,7 +148,8 @@ val testFatJar by
 
 tasks.check { dependsOn(testFatJar) }
 
-val validateFatJar by tasks.registering {
+val validateFatJar =
+  tasks.register("validateFatJar") {
     val outputFile = layout.buildDirectory.file("validateFatJar/result.txt")
     inputs.files(tasks.shadowJar)
     inputs.property("nonRelocations", nonRelocations)
@@ -177,18 +178,18 @@ val validateFatJar by tasks.registering {
         throw GradleException("Found unshadowed files:\n" + unshadowedFiles.joinToString("\n"))
       }
     }
-}
+  }
 
 tasks.check { dependsOn(validateFatJar) }
 
-val resolveSourcesJars by
+val resolveSourcesJars =
-  tasks.registering(ResolveSourcesJars::class) {
+  tasks.register<ResolveSourcesJars>("resolveSourcesJars") {
     configuration.set(configurations.runtimeClasspath)
     outputDir.set(layout.buildDirectory.dir("resolveSourcesJars"))
   }
 
-val fatSourcesJar by
+val fatSourcesJar =
-  tasks.registering(MergeSourcesJars::class) {
+  tasks.register<MergeSourcesJars>("fatSourcesJar") {
     plugins.withId("pklJavaLibrary") { inputJars.from(tasks.named("sourcesJar")) }
     inputJars.from(firstPartySourcesJarsConfiguration)
     inputJars.from(resolveSourcesJars.map { fileTree(it.outputDir) })
@@ -213,7 +214,7 @@ publishing {
       artifact(fatSourcesJar.flatMap { it.outputJar.asFile }) { classifier = "sources" }
 
       plugins.withId("pklJavaLibrary") {
-        val javadocJar by tasks.existing(Jar::class)
+        val javadocJar = tasks.named<Jar>("javadocJar")
         // Javadoc Jar is not fat (didn't invest effort)
         artifact(javadocJar.flatMap { it.archiveFile }) { classifier = "javadoc" }
       }

build-logic/src/main/kotlin/pklGraalVm.gradle.kts

@@ -21,11 +21,15 @@ plugins { id("de.undercouch.download") }
 val buildInfo = project.extensions.getByType<BuildInfo>()
 
 // tries to minimize chance of corruption by download-to-temp-file-and-move
-val downloadGraalVmAarch64 by
+val downloadGraalVmAarch64 =
-  tasks.registering(Download::class) { configureDownloadGraalVm(buildInfo.graalVmAarch64) }
+  tasks.register<Download>("downloadGraalVmAarch64") {
+    configureDownloadGraalVm(buildInfo.graalVmAarch64)
+  }
 
-val downloadGraalVmAmd64 by
+val downloadGraalVmAmd64 =
-  tasks.registering(Download::class) { configureDownloadGraalVm(buildInfo.graalVmAmd64) }
+  tasks.register<Download>("downloadGraalVmAmd64") {
+    configureDownloadGraalVm(buildInfo.graalVmAmd64)
+  }
 
 fun Download.configureDownloadGraalVm(graalvm: BuildInfo.GraalVm) {
   onlyIf { !graalvm.installDir.exists() }
@@ -37,14 +41,14 @@ fun Download.configureDownloadGraalVm(graalvm: BuildInfo.GraalVm) {
   tempAndMove(true)
 }
 
-val verifyGraalVmAarch64 by
+val verifyGraalVmAarch64 =
-  tasks.registering(Verify::class) {
+  tasks.register<Verify>("verifyGraalVmAarch64") {
     configureVerifyGraalVm(buildInfo.graalVmAarch64)
     dependsOn(downloadGraalVmAarch64)
   }
 
-val verifyGraalVmAmd64 by
+val verifyGraalVmAmd64 =
-  tasks.registering(Verify::class) {
+  tasks.register<Verify>("verifyGraalVmAmd64") {
     configureVerifyGraalVm(buildInfo.graalVmAmd64)
     dependsOn(downloadGraalVmAmd64)
   }
@@ -60,15 +64,15 @@ fun Verify.configureVerifyGraalVm(graalvm: BuildInfo.GraalVm) {
 }
 
 @Suppress("unused")
-val installGraalVmAarch64 by
+val installGraalVmAarch64 =
-  tasks.registering(InstallGraalVm::class) {
+  tasks.register<InstallGraalVm>("installGraalVmAarch64") {
     dependsOn(verifyGraalVmAarch64)
     graalVm = buildInfo.graalVmAarch64
   }
 
 @Suppress("unused")
-val installGraalVmAmd64 by
+val installGraalVmAmd64 =
-  tasks.registering(InstallGraalVm::class) {
+  tasks.register<InstallGraalVm>("installGraalVmAmd64") {
     dependsOn(verifyGraalVmAmd64)
     graalVm = buildInfo.graalVmAmd64
   }

build-logic/src/main/kotlin/pklHtmlValidator.gradle.kts

@@ -47,8 +47,8 @@ dependencies {
   }
 }
 
-val validateHtml by
+val validateHtml =
-  tasks.registering(JavaExec::class) {
+  tasks.register<JavaExec>("validateHtml") {
     val resultFile = layout.buildDirectory.file("validateHtml/result.txt")
     inputs.files(htmlValidator.sources)
     outputs.file(resultFile)

build-logic/src/main/kotlin/pklJSpecify.gradle.kts

@@ -13,6 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+import net.ltgt.gradle.errorprone.CheckSeverity
 import net.ltgt.gradle.errorprone.errorprone
 import net.ltgt.gradle.nullaway.nullaway
 import org.gradle.accessors.dm.LibrariesForLibs
@@ -36,6 +37,8 @@ nullaway { onlyNullMarked = true }
 
 tasks.withType<JavaCompile>().configureEach {
   options.errorprone.disableAllChecks = true
+  options.errorprone.check("StringCaseLocaleUsage", CheckSeverity.ERROR)
+  options.errorprone.check("GuardedBy", CheckSeverity.ERROR)
   options.errorprone.nullaway {
     error()
     onlyNullMarked = true

build-logic/src/main/kotlin/pklJavaExecutable.gradle.kts

@@ -26,8 +26,8 @@ plugins {
 val executableSpec = project.extensions.create("executable", ExecutableSpec::class.java)
 val buildInfo = project.extensions.getByType<BuildInfo>()
 
-val javaExecutable by
+val javaExecutable =
-  tasks.registering(ExecutableJar::class) {
+  tasks.register<ExecutableJar>("javaExecutable") {
     group = "build"
     dependsOn(tasks.jar)
     inJar = tasks.shadowJar.flatMap { it.archiveFile }
@@ -77,7 +77,8 @@ fun Task.setupTestStartJavaExecutable(launcher: Provider<JavaLauncher>? = null)
   }
 }
 
-val testStartJavaExecutable by tasks.registering { setupTestStartJavaExecutable() }
+val testStartJavaExecutable =
+  tasks.register("testStartJavaExecutable") { setupTestStartJavaExecutable() }
 
 // Setup `testStartJavaExecutable` tasks for multi-JDK testing.
 val testStartJavaExecutableOnOtherJdks =

build-logic/src/main/kotlin/pklKotlinBase.gradle.kts

@@ -44,7 +44,6 @@ kotlin {
     freeCompilerArgs.addAll(
       "-jvm-default=no-compatibility", // was: -Xjvm-default=all
       "-Xjdk-release=${buildInfo.jvmTarget}",
-      "-Xjsr305=strict",
     )
   }
 }

build-logic/src/main/kotlin/pklNativeExecutable.gradle.kts

@@ -30,14 +30,17 @@ plugins {
 val executableSpec = project.extensions.getByType<ExecutableSpec>()
 val buildInfo = project.extensions.getByType<BuildInfo>()
 
-val stagedMacAmd64Executable: Configuration by configurations.creating
+val stagedMacAarch64Executable: Configuration = configurations.create("stagedMacAarch64Executable")
-val stagedMacAarch64Executable: Configuration by configurations.creating
+val stagedLinuxAmd64Executable: Configuration = configurations.create("stagedLinuxAmd64Executable")
-val stagedLinuxAmd64Executable: Configuration by configurations.creating
+val stagedLinuxAarch64Executable: Configuration =
-val stagedLinuxAarch64Executable: Configuration by configurations.creating
+  configurations.create("stagedLinuxAarch64Executable")
-val stagedAlpineLinuxAmd64Executable: Configuration by configurations.creating
+val stagedAlpineLinuxAmd64Executable: Configuration =
-val stagedWindowsAmd64Executable: Configuration by configurations.creating
+  configurations.create("stagedAlpineLinuxAmd64Executable")
+val stagedWindowsAmd64Executable: Configuration =
+  configurations.create("stagedWindowsAmd64Executable")
 
-val nativeImageClasspath by configurations.creating {
+val nativeImageClasspath =
+  configurations.create("nativeImageClasspath") {
     extendsFrom(configurations.runtimeClasspath.get())
     // Ensure native-image version uses GraalVM C SDKs instead of Java FFI or JNA
     // (comes from artifact `mordant-jvm-graal-ffi`).
@@ -45,7 +48,7 @@ val nativeImageClasspath by configurations.creating {
     exclude("com.github.ajalt.mordant", "mordant-jvm-ffm-jvm")
     exclude("com.github.ajalt.mordant", "mordant-jvm-jna")
     exclude("com.github.ajalt.mordant", "mordant-jvm-jna-jvm")
-}
+  }
 
 val libs = the<LibrariesForLibs>()
 
@@ -60,7 +63,6 @@ dependencies {
   nativeImageClasspath(libs.graalSdk)
 
   stagedMacAarch64Executable(executableFile("macos-aarch64"))
-  stagedMacAmd64Executable(executableFile("macos-amd64"))
   stagedLinuxAmd64Executable(executableFile("linux-amd64"))
   stagedLinuxAarch64Executable(executableFile("linux-aarch64"))
   stagedAlpineLinuxAmd64Executable(executableFile("alpine-linux-amd64"))
@@ -85,32 +87,24 @@ private fun NativeImageBuild.setClasspath() {
   classpath.from(nativeImageClasspath)
 }
 
-val macExecutableAmd64 by
+val macExecutableAarch64 =
-  tasks.registering(NativeImageBuild::class) {
+  tasks.register<NativeImageBuild>("macExecutableAarch64") {
-    imageName = executableSpec.name.map { "$it-macos-amd64" }
-    mainClass = executableSpec.mainClass
-    amd64()
-    setClasspath()
-  }
-
-val macExecutableAarch64 by
-  tasks.registering(NativeImageBuild::class) {
     imageName = executableSpec.name.map { "$it-macos-aarch64" }
     mainClass = executableSpec.mainClass
     aarch64()
     setClasspath()
   }
 
-val linuxExecutableAmd64 by
+val linuxExecutableAmd64 =
-  tasks.registering(NativeImageBuild::class) {
+  tasks.register<NativeImageBuild>("linuxExecutableAmd64") {
     imageName = executableSpec.name.map { "$it-linux-amd64" }
     mainClass = executableSpec.mainClass
     amd64()
     setClasspath()
   }
 
-val linuxExecutableAarch64 by
+val linuxExecutableAarch64 =
-  tasks.registering(NativeImageBuild::class) {
+  tasks.register<NativeImageBuild>("linuxExecutableAarch64") {
     imageName = executableSpec.name.map { "$it-linux-aarch64" }
     mainClass = executableSpec.mainClass
     aarch64()
@@ -120,8 +114,8 @@ val linuxExecutableAarch64 by
     extraNativeImageArgs.add("-H:PageSize=65536")
   }
 
-val alpineExecutableAmd64 by
+val alpineExecutableAmd64 =
-  tasks.registering(NativeImageBuild::class) {
+  tasks.register<NativeImageBuild>("alpineExecutableAmd64") {
     imageName = executableSpec.name.map { "$it-alpine-linux-amd64" }
     mainClass = executableSpec.mainClass
     amd64()
@@ -129,17 +123,18 @@ val alpineExecutableAmd64 by
     extraNativeImageArgs.addAll(listOf("--static", "--libc=musl"))
   }
 
-val windowsExecutableAmd64 by
+val windowsExecutableAmd64 =
-  tasks.registering(NativeImageBuild::class) {
+  tasks.register<NativeImageBuild>("windowsExecutableAmd64") {
     imageName = executableSpec.name.map { "$it-windows-amd64" }
     mainClass = executableSpec.mainClass
     amd64()
     setClasspath()
   }
 
-val assembleNative by tasks.existing
+val assembleNative = tasks.named("assembleNative")
 
-val testStartNativeExecutable by tasks.registering {
+val testStartNativeExecutable =
+  tasks.register("testStartNativeExecutable") {
     dependsOn(assembleNative)
 
     // dummy file for up-to-date checking
@@ -164,11 +159,12 @@ val testStartNativeExecutable by tasks.registering {
         writeText("OK")
       }
     }
-}
+  }
 
 val requiredGlibcVersion: Version = Version.parse("2.17")
 
-val checkGlibc by tasks.registering {
+val checkGlibc =
+  tasks.register("checkGlibc") {
     enabled = buildInfo.os.isLinux && !buildInfo.musl
     dependsOn(assembleNative)
     doLast {
@@ -195,7 +191,7 @@ val checkGlibc by tasks.registering {
         )
       }
     }
-}
+  }
 
 // Expose underlying task's outputs
 private fun <T : Task> Task.wraps(other: TaskProvider<T>) {
@@ -203,41 +199,27 @@ private fun <T : Task> Task.wraps(other: TaskProvider<T>) {
   outputs.files(other)
 }
 
-val testNative by tasks.existing { dependsOn(testStartNativeExecutable, checkGlibc) }
+val testNative = tasks.named("testNative") { dependsOn(testStartNativeExecutable, checkGlibc) }
 
-val assembleNativeMacOsAarch64 by tasks.existing { wraps(macExecutableAarch64) }
+val assembleNativeMacOsAarch64 =
+  tasks.named("assembleNativeMacOsAarch64") { wraps(macExecutableAarch64) }
 
-val assembleNativeMacOsAmd64 by tasks.existing { wraps(macExecutableAmd64) }
+val assembleNativeLinuxAarch64 =
+  tasks.named("assembleNativeLinuxAarch64") { wraps(linuxExecutableAarch64) }
 
-val assembleNativeLinuxAarch64 by tasks.existing { wraps(linuxExecutableAarch64) }
+val assembleNativeLinuxAmd64 =
+  tasks.named("assembleNativeLinuxAmd64") { wraps(linuxExecutableAmd64) }
 
-val assembleNativeLinuxAmd64 by tasks.existing { wraps(linuxExecutableAmd64) }
+val assembleNativeAlpineLinuxAmd64 =
+  tasks.named("assembleNativeAlpineLinuxAmd64") { wraps(alpineExecutableAmd64) }
 
-val assembleNativeAlpineLinuxAmd64 by tasks.existing { wraps(alpineExecutableAmd64) }
+val assembleNativeWindowsAmd64 =
-
+  tasks.named("assembleNativeWindowsAmd64") { wraps(windowsExecutableAmd64) }
-val assembleNativeWindowsAmd64 by tasks.existing { wraps(windowsExecutableAmd64) }
 
 publishing {
   publications {
     // need to put in `afterEvaluate` because `artifactId` cannot be set lazily.
     project.afterEvaluate {
-      create<MavenPublication>("macExecutableAmd64") {
-        artifactId = "${executableSpec.publicationName.get()}-macos-amd64"
-        artifact(stagedMacAmd64Executable.singleFile) {
-          classifier = null
-          extension = "bin"
-          builtBy(stagedMacAmd64Executable)
-        }
-        pom {
-          name = "${executableSpec.publicationName.get()}-macos-amd64"
-          url = executableSpec.website
-          description =
-            executableSpec.documentationName.map { name ->
-              "Native $name executable for macOS/amd64."
-            }
-        }
-      }
-
       create<MavenPublication>("macExecutableAarch64") {
         artifactId = "${executableSpec.publicationName.get()}-macos-aarch64"
         artifact(stagedMacAarch64Executable.singleFile) {
@@ -331,7 +313,6 @@ signing {
     sign(publishing.publications["linuxExecutableAarch64"])
     sign(publishing.publications["linuxExecutableAmd64"])
     sign(publishing.publications["macExecutableAarch64"])
-    sign(publishing.publications["macExecutableAmd64"])
     sign(publishing.publications["alpineLinuxExecutableAmd64"])
     sign(publishing.publications["windowsExecutableAmd64"])
   }

build-logic/src/main/kotlin/pklNativeLifecycle.gradle.kts

@@ -13,29 +13,27 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-val assembleNativeMacOsAarch64 by tasks.registering { group = "build" }
+val assembleNativeMacOsAarch64 = tasks.register("assembleNativeMacOsAarch64") { group = "build" }
 
-val assembleNativeMacOsAmd64 by tasks.registering { group = "build" }
+val assembleNativeLinuxAarch64 = tasks.register("assembleNativeLinuxAarch64") { group = "build" }
 
-val assembleNativeLinuxAarch64 by tasks.registering { group = "build" }
+val assembleNativeLinuxAmd64 = tasks.register("assembleNativeLinuxAmd64") { group = "build" }
 
-val assembleNativeLinuxAmd64 by tasks.registering { group = "build" }
+val assembleNativeAlpineLinuxAmd64 =
+  tasks.register("assembleNativeAlpineLinuxAmd64") { group = "build" }
 
-val assembleNativeAlpineLinuxAmd64 by tasks.registering { group = "build" }
+val assembleNativeWindowsAmd64 = tasks.register("assembleNativeWindowsAmd64") { group = "build" }
 
-val assembleNativeWindowsAmd64 by tasks.registering { group = "build" }
+val testNativeMacOsAarch64 = tasks.register("testNativeMacOsAarch64") { group = "verification" }
 
-val testNativeMacOsAarch64 by tasks.registering { group = "verification" }
+val testNativeLinuxAarch64 = tasks.register("testNativeLinuxAarch64") { group = "verification" }
 
-val testNativeMacOsAmd64 by tasks.registering { group = "verification" }
+val testNativeLinuxAmd64 = tasks.register("testNativeLinuxAmd64") { group = "verification" }
 
-val testNativeLinuxAarch64 by tasks.registering { group = "verification" }
+val testNativeAlpineLinuxAmd64 =
+  tasks.register("testNativeAlpineLinuxAmd64") { group = "verification" }
 
-val testNativeLinuxAmd64 by tasks.registering { group = "verification" }
+val testNativeWindowsAmd64 = tasks.register("testNativeWindowsAmd64") { group = "verification" }
-
-val testNativeAlpineLinuxAmd64 by tasks.registering { group = "verification" }
-
-val testNativeWindowsAmd64 by tasks.registering { group = "verification" }
 
 val buildInfo = project.extensions.getByType<BuildInfo>()
 
@@ -44,7 +42,8 @@ private fun <T : Task> Task.wraps(other: TaskProvider<T>) {
   outputs.files(other)
 }
 
-val assembleNative by tasks.registering {
+val assembleNative =
+  tasks.register("assembleNative") {
     group = "build"
 
     if (!buildInfo.isCrossArchSupported && buildInfo.isCrossArch) {
@@ -55,14 +54,12 @@ val assembleNative by tasks.registering {
       buildInfo.os.isMacOsX && buildInfo.targetArch == "aarch64" -> {
         wraps(assembleNativeMacOsAarch64)
       }
-    buildInfo.os.isMacOsX && buildInfo.targetArch == "amd64" -> {
-      wraps(assembleNativeMacOsAmd64)
-    }
       buildInfo.os.isLinux && buildInfo.targetArch == "aarch64" -> {
         wraps(assembleNativeLinuxAarch64)
       }
       buildInfo.os.isLinux && buildInfo.targetArch == "amd64" -> {
-      if (buildInfo.musl) wraps(assembleNativeAlpineLinuxAmd64) else wraps(assembleNativeLinuxAmd64)
+        if (buildInfo.musl) wraps(assembleNativeAlpineLinuxAmd64)
+        else wraps(assembleNativeLinuxAmd64)
       }
       buildInfo.os.isWindows && buildInfo.targetArch == "amd64" -> {
         wraps(assembleNativeWindowsAmd64)
@@ -75,9 +72,10 @@ val assembleNative by tasks.registering {
         }
       }
     }
-}
+  }
 
-val testNative by tasks.registering {
+val testNative =
+  tasks.register("testNative") {
     group = "verification"
     dependsOn(assembleNative)
 
@@ -89,14 +87,12 @@ val testNative by tasks.registering {
       buildInfo.os.isMacOsX && buildInfo.targetArch == "aarch64" -> {
         dependsOn(testNativeMacOsAarch64)
       }
-    buildInfo.os.isMacOsX && buildInfo.targetArch == "amd64" -> {
-      dependsOn(testNativeMacOsAmd64)
-    }
       buildInfo.os.isLinux && buildInfo.targetArch == "aarch64" -> {
         dependsOn(testNativeLinuxAarch64)
       }
       buildInfo.os.isLinux && buildInfo.targetArch == "amd64" -> {
-      if (buildInfo.musl) dependsOn(testNativeAlpineLinuxAmd64) else dependsOn(testNativeLinuxAmd64)
+        if (buildInfo.musl) dependsOn(testNativeAlpineLinuxAmd64)
+        else dependsOn(testNativeLinuxAmd64)
       }
       buildInfo.os.isWindows && buildInfo.targetArch == "amd64" -> {
         dependsOn(testNativeWindowsAmd64)
@@ -109,14 +105,16 @@ val testNative by tasks.registering {
         }
       }
     }
-}
+  }
 
-val checkNative by tasks.registering {
+val checkNative =
+  tasks.register("checkNative") {
     group = "verification"
     dependsOn(testNative)
-}
+  }
 
-val buildNative by tasks.registering {
+val buildNative =
+  tasks.register("buildNative") {
     group = "build"
     dependsOn(checkNative)
-}
+  }

build-logic/src/main/kotlin/pklSpotlessFormat.gradle.kts

@@ -15,7 +15,7 @@
  */
 plugins { id("com.diffplug.spotless") }
 
-val pklFormatter by configurations.creating
+val pklFormatter = configurations.create("pklFormatter")
 
 dependencies { pklFormatter(rootProject.project("pkl-formatter")) }
 

build.gradle.kts

@@ -17,6 +17,7 @@
 import org.jetbrains.gradle.ext.ActionDelegationConfig
 import org.jetbrains.gradle.ext.ActionDelegationConfig.TestRunner.PLATFORM
 import org.jetbrains.gradle.ext.ProjectSettings
+import org.jetbrains.gradle.ext.taskTriggers
 
 plugins {
   id("pklAllProjects")
@@ -36,6 +37,9 @@ nexusPublishing {
   }
 }
 
+val configureLateInitAnnotation =
+  tasks.register<ConfigureLateInitAnnotation>("configureLateInitAnnotation")
+
 idea {
   project {
     this as ExtensionAware
@@ -45,13 +49,14 @@ idea {
         delegateBuildRunToGradle = true
         testRunner = PLATFORM
       }
+      taskTriggers.afterSync(configureLateInitAnnotation)
     }
   }
 }
 
-val clean by tasks.existing { delete(layout.buildDirectory) }
+val clean = tasks.named("clean") { delete(layout.buildDirectory) }
 
-val printVersion by tasks.registering { doFirst { println(buildInfo.pklVersion) } }
+val printVersion = tasks.register("printVersion") { doFirst { println(buildInfo.pklVersion) } }
 
 val message =
   """

docs/antora.yml

@@ -1,6 +1,6 @@
 name: main
 title: Main Project
-version: 0.32.0-dev
+version: 0.33.0-dev
 prerelease: true
 nav:
 - nav.adoc

docs/modules/ROOT/partials/component-attributes.adoc

@@ -3,7 +3,7 @@
 // the following attributes must be updated immediately before a release
 
 // pkl version corresponding to current git commit without -dev suffix or git hash
-:pkl-version-no-suffix: 0.32.0
+:pkl-version-no-suffix: 0.33.0
 // tells whether pkl version corresponding to current git commit
 // is a release version (:is-release-version: '') or dev version (:!is-release-version:)
 :!is-release-version:
@@ -69,6 +69,7 @@ endif::[]
 
 :uri-stdlib-baseModule: {uri-pkl-stdlib-docs}/base
 :uri-stdlib-CommandModule: {uri-pkl-stdlib-docs}/Command
+:uri-stdlib-refModule: {uri-pkl-stdlib-docs}/ref
 :uri-stdlib-analyzeModule: {uri-pkl-stdlib-docs}/analyze
 :uri-stdlib-jsonnetModule: {uri-pkl-stdlib-docs}/jsonnet
 :uri-stdlib-reflectModule: {uri-pkl-stdlib-docs}/reflect
@@ -78,8 +79,10 @@ endif::[]
 :uri-stdlib-pklbinaryModule: {uri-pkl-stdlib-docs}/pklbinary
 :uri-stdlib-yamlModule: {uri-pkl-stdlib-docs}/yaml
 :uri-stdlib-YamlParser: {uri-stdlib-yamlModule}/Parser
+:uri-stdlib-projectModule: {uri-pkl-stdlib-docs}/Project
 :uri-stdlib-evaluatorSettingsModule: {uri-pkl-stdlib-docs}/EvaluatorSettings
 :uri-stdlib-evaluatorSettingsHttpClass: {uri-stdlib-evaluatorSettingsModule}/Http
+:uri-stdlib-evaluatorSettingsExternalReaderClass: {uri-stdlib-evaluatorSettingsModule}/ExternalReader
 :uri-stdlib-Boolean: {uri-stdlib-baseModule}/Boolean
 :uri-stdlib-xor: {uri-stdlib-baseModule}/Boolean#xor()
 :uri-stdlib-implies: {uri-stdlib-baseModule}/Boolean#implies()
@@ -158,6 +161,8 @@ endif::[]
 :uri-stdlib-Command-CountedFlag: {uri-stdlib-CommandModule}/CountedFlag
 :uri-stdlib-Command-Argument: {uri-stdlib-CommandModule}/Argument
 :uri-stdlib-Command-Import: {uri-stdlib-CommandModule}/Import
+:uri-stdlib-ref-Reference: {uri-stdlib-baseModule}/Reference
+:uri-stdlib-ref-Access: {uri-stdlib-baseModule}/Access
 
 :uri-messagepack: https://msgpack.org/index.html
 :uri-messagepack-spec: https://github.com/msgpack/msgpack/blob/master/spec.md

docs/modules/bindings-specification/pages/binary-encoding.adoc

@@ -187,6 +187,15 @@ The array's length is the number of slots that are filled. For example, xref:{ur
 |
 |
 |
+
+|link:{uri-stdlib-ref-Reference}[Reference]
+|`0x20`
+|`<value>` (Typed)
+|Domain
+|`<value>`
+|Data
+|link:{uri-messagepack-array}[array]
+|Array of link:{uri-stdlib-ref-Access}[`pkl.ref#Access`] values
 |===
 
 [[type-name-encoding]]

docs/modules/bindings-specification/pages/message-passing-api.adoc

@@ -210,6 +210,11 @@ class Http {
   ///
   /// Each rewrite must start with `http://` or `https://`, and must end with `/`.
   rewrites: Mapping<String, String>?
+
+  /// HTTP headers.
+  /// Each entry key is a glob pattern that is matched against outbound request URLs.
+  /// Each value is a map of headers that is added to the matching request.
+  headers: Mapping<String, Mapping<String, Listing<String>>>?
 }
 
 /// Settings that control how Pkl talks to HTTP proxies.

docs/modules/java-binding/pages/codegen.adoc

@@ -56,7 +56,7 @@ ifdef::is-release-version[]
   mavenCentral()
 endif::[]
 ifndef::is-release-version[]
-  maven(url = "{uri-sonatype}")
+  maven(url = "{uri-snapshot-repo}")
 endif::[]
 }
 ----
@@ -75,7 +75,7 @@ ifdef::is-release-version[]
   mavenCentral()
 endif::[]
 ifndef::is-release-version[]
-  maven { url "{uri-sonatype}" }
+  maven { url "{uri-snapshot-repo}" }
 endif::[]
 }
 ----
@@ -99,9 +99,9 @@ ifndef::is-release-version[]
     <repository>
       <id>sonatype-s01</id>
       <name>Sonatype S01</name>
-      <url>{uri-sonatype}</url>
+      <url>{uri-snapshot-repo}</url>
     </repository>
-  </repositories>
+</repositories>
 endif::[]
 </project>
 ----
@@ -198,7 +198,7 @@ For Spring Boot applications, and for users of `pkl-config-java` compiling the g
 .--non-null-annotation
 [%collapsible]
 ====
-Default: `org.pkl.config.java.mapper.NonNull` +
+Default: `org.jspecify.annotations.NonNull` +
 Fully qualified name of the annotation type to use for annotating non-null types. +
 The specified annotation type must be annotated with `@java.lang.annotation.Target(ElementType.TYPE_USE)`
 or the generated code may not compile.

docs/modules/java-binding/pages/pkl-config-java.adoc

@@ -45,7 +45,7 @@ ifdef::is-release-version[]
   mavenCentral()
 endif::[]
 ifndef::is-release-version[]
-  maven(url = "{uri-sonatype}")
+  maven(url = "{uri-snapshot-repo}")
 endif::[]
 }
 ----
@@ -66,7 +66,7 @@ repositories {
 endif::[]
 ifndef::is-release-version[]
 repositories {
-  maven { url "{uri-sonatype}" }
+  maven { url "{uri-snapshot-repo}" }
 }
 endif::[]
 ----
@@ -92,7 +92,7 @@ ifndef::is-release-version[]
     <repository>
       <id>sonatype-s01</id>
       <name>Sonatype S01</name>
-      <url>{uri-sonatype}</url>
+      <url>{uri-snapshot-repo}</url>
     </repository>
   </repositories>
 endif::[]

docs/modules/kotlin-binding/pages/codegen.adoc

@@ -46,7 +46,7 @@ ifdef::is-release-version[]
   mavenCentral()
 endif::[]
 ifndef::is-release-version[]
-  maven(url = "{uri-sonatype}")
+  maven(url = "{uri-snapshot-repo}")
 endif::[]
 }
 ----
@@ -65,7 +65,7 @@ ifdef::is-release-version[]
   mavenCentral()
 endif::[]
 ifndef::is-release-version[]
-  maven { url "{uri-sonatype}" }
+  maven { url "{uri-snapshot-repo}" }
 endif::[]
 }
 ----

docs/modules/kotlin-binding/pages/pkl-config-kotlin.adoc

@@ -34,7 +34,7 @@ ifdef::is-release-version[]
   mavenCentral()
 endif::[]
 ifndef::is-release-version[]
-  maven(url = "{uri-sonatype}")
+  maven(url = "{uri-snapshot-repo}")
 endif::[]
 }
 ----
@@ -53,7 +53,7 @@ ifdef::is-release-version[]
   mavenCentral()
 endif::[]
 ifndef::is-release-version[]
-  maven { url "{uri-sonatype}" }
+  maven { url "{uri-snapshot-repo}" }
 endif::[]
 }
 ----
@@ -77,7 +77,7 @@ ifndef::is-release-version[]
     <repository>
       <id>sonatype-s01</id>
       <name>Sonatype S01</name>
-      <url>{uri-sonatype}</url>
+      <url>{uri-snapshot-repo}</url>
     </repository>
   </repositories>
 endif::[]

docs/modules/pkl-cli/pages/index.adoc

@@ -4,7 +4,6 @@ include::ROOT:partial$component-attributes.adoc[]
 :uri-mise: https://mise.jdx.dev
 :uri-winget: https://learn.microsoft.com/en-us/windows/package-manager/
 
-:uri-pkl-macos-amd64-download: {uri-sonatype-snapshot-download}&a=pkl-cli-macos-amd64&e=bin
 :uri-pkl-macos-aarch64-download: {uri-sonatype-snapshot-download}&a=pkl-cli-macos-aarch64&e=bin
 :uri-pkl-linux-amd64-download: {uri-sonatype-snapshot-download}&a=pkl-cli-linux-amd64&e=bin
 :uri-pkl-linux-aarch64-download: {uri-sonatype-snapshot-download}&a=pkl-cli-linux-aarch64&e=bin
@@ -13,7 +12,6 @@ include::ROOT:partial$component-attributes.adoc[]
 :uri-pkl-java-download: {uri-sonatype-snapshot-download}&a=pkl-cli-java&e=jar
 
 ifdef::is-release-version[]
-:uri-pkl-macos-amd64-download: {github-releases}/pkl-macos-amd64
 :uri-pkl-macos-aarch64-download: {github-releases}/pkl-macos-aarch64
 :uri-pkl-linux-amd64-download: {github-releases}/pkl-linux-amd64
 :uri-pkl-linux-aarch64-download: {github-releases}/pkl-linux-aarch64
@@ -36,7 +34,7 @@ For interactive development, the CLI includes a Read-Eval-Print Loop (REPL).
 
 The CLI comes in multiple flavors:
 
-* Native macOS executable for amd64 (tested on macOS 10.15)
+* Native macOS executable for aarch64 (tested on macOS 10.15)
 * Native Linux executable for amd64
 * Native Linux executable for aarch64
 * Native Alpine Linux executable for amd64 (cross-compiled and tested on Oracle Linux 8)
@@ -140,8 +138,6 @@ Development and release versions can be downloaded and installed manually.
 
 === macOS Executable
 
-On aarch64:
-
 [source,shell]
 [subs="+attributes"]
 ----
@@ -150,16 +146,6 @@ chmod +x pkl
 ./pkl --version
 ----
 
-On amd64:
-
-[source,shell]
-[subs="+attributes"]
-----
-curl -L -o pkl '{uri-pkl-macos-amd64-download}'
-chmod +x pkl
-./pkl --version
-----
-
 This should print something similar to:
 
 [source]
@@ -546,6 +532,15 @@ When enabled, test failures will show intermediate values in the assertion expre
 Use `--no-power-assertions` to disable this feature if you prefer simpler output.
 ====
 
+[[test-reporter]]
+.--test-reporter
+[%collapsible]
+====
+Default: `spec` +
+Example: `--test-reporter minimal` +
+Which test reporter to use for CLI output. Possible values are `spec` and `minimal`.
+====
+
 This command also takes <<common-options, common options>>.
 
 [[command-run]]
@@ -667,6 +662,14 @@ Force generation of expected examples. +
 The old expected files will be deleted if present.
 ====
 
+.--test-reporter
+[%collapsible]
+====
+Default: `spec` +
+Example: `--test-reporter minimal` +
+Which test reporter to use for CLI output. Possible values are `spec` and `minimal`.
+====
+
 This command also takes <<common-options,common options>>.
 
 [[command-project-resolve]]

docs/modules/pkl-cli/partials/cli-common-options.adoc

@@ -158,6 +158,23 @@ This option is commonly used to enable package mirroring.
 The above example will rewrite URL `\https://pkg.pkl-lang.org/pkl-k8s/k8s@1.0.0` to `\https://my.internal.mirror/pkl-k8s/k8s@1.0.0`.
 ====
 
+.--http-header
+[%collapsible]
+====
+Default: (none) +
+Example: `**=User-Agent: My User Agent` +
+
+Additional headers to add to outbound HTTP requests.
+
+The syntax is `<glob pattern>=<header name>:<header value>`, and any whitespace after the leading colon is trimmed.
+
+The glob pattern is used to match against the URLs of outbound HTTP calls, and the value is the header name and value to add.
+In the case of multiple matches, every header is added.
+
+To describe a prefix match, the `\\**` wildcard should be added to the pattern.
+For example, `https?://example.com/**` matches against every request to host `example.com`.
+====
+
 .--trace-mode
 [%collapsible]
 ====

docs/modules/pkl-core/pages/index.adoc

@@ -44,7 +44,7 @@ ifdef::is-release-version[]
   mavenCentral()
 endif::[]
 ifndef::is-release-version[]
-  maven(url = "{uri-sonatype}")
+  maven(url = "{uri-snapshot-repo}")
 endif::[]
 }
 ----
@@ -63,7 +63,7 @@ ifdef::is-release-version[]
   mavenCentral()
 endif::[]
 ifndef::is-release-version[]
-  maven { url "{uri-sonatype}" }
+  maven { url "{uri-snapshot-repo}" }
 endif::[]
 }
 ----
@@ -87,7 +87,7 @@ ifndef::is-release-version[]
     <repository>
       <id>sonatype-s01</id>
       <name>Sonatype S01</name>
-      <url>{uri-sonatype}</url>
+      <url>{uri-snapshot-repo}</url>
     </repository>
   </repositories>
 endif::[]

docs/modules/pkl-doc/pages/index.adoc

@@ -5,7 +5,6 @@ include::ROOT:partial$component-attributes.adoc[]
 :uri-DocPackageInfo: {uri-pkl-stdlib-docs}/DocPackageInfo/
 :uri-CliDocGenerator: {uri-pkl-doc-main-sources}/CliDocGenerator.kt
 :uri-DocGenerator: {uri-pkl-doc-main-sources}/DocGenerator.kt
-:uri-pkldoc-macos-amd64-download: {uri-sonatype-snapshot-download}&a=pkldoc-macos-amd64&e=bin
 :uri-pkldoc-macos-aarch64-download: {uri-sonatype-snapshot-download}&a=pkldoc-macos-aarch64&e=bin
 :uri-pkldoc-linux-amd64-download: {uri-sonatype-snapshot-download}&a=pkldoc-linux-amd64&e=bin
 :uri-pkldoc-linux-aarch64-download: {uri-sonatype-snapshot-download}&a=pkldoc-linux-aarch64&e=bin
@@ -14,7 +13,6 @@ include::ROOT:partial$component-attributes.adoc[]
 :uri-pkldoc-java-download: {uri-sonatype-snapshot-download}&a=pkldoc-java&e=jar
 
 ifdef::is-release-version[]
-:uri-pkldoc-macos-amd64-download: {github-releases}/pkldoc-macos-amd64
 :uri-pkldoc-macos-aarch64-download: {github-releases}/pkldoc-macos-aarch64
 :uri-pkldoc-linux-amd64-download: {github-releases}/pkldoc-linux-amd64
 :uri-pkldoc-linux-aarch64-download: {github-releases}/pkldoc-linux-aarch64
@@ -117,7 +115,7 @@ ifdef::is-release-version[]
   mavenCentral()
 endif::[]
 ifndef::is-release-version[]
-  maven(url = "{uri-sonatype}")
+  maven(url = "{uri-snapshot-repo}")
 endif::[]
 }
 ----
@@ -136,7 +134,7 @@ ifdef::is-release-version[]
   mavenCentral()
 endif::[]
 ifndef::is-release-version[]
-  maven { url "{uri-sonatype}" }
+  maven { url "{uri-snapshot-repo}" }
 endif::[]
 }
 ----
@@ -160,7 +158,7 @@ ifndef::is-release-version[]
     <repository>
       <id>sonatype-s01</id>
       <name>Sonatype S01</name>
-      <url>{uri-sonatype}</url>
+      <url>{uri-snapshot-repo}</url>
     </repository>
   </repositories>
 endif::[]
@@ -172,7 +170,7 @@ endif::[]
 
 The CLI comes in multiple flavors:
 
-* Native macOS executable for amd64 (tested on macOS 10.15)
+* Native macOS executable for aarch64 (tested on macOS 10.15)
 * Native Linux executable for amd64
 * Native Linux executable for aarch64
 * Native Alpine Linux executable for amd64 (cross-compiled and tested on Oracle Linux 8)
@@ -192,7 +190,6 @@ However, it requires a Java 17 (or higher) runtime on the system path, and has a
 Download links:
 
 * macOS aarch64: {uri-pkldoc-macos-aarch64-download}
-* macOS amd64: {uri-pkldoc-macos-amd64-download}
 * Linux aarch64: {uri-pkldoc-linux-aarch64-download}
 * Linux amd64: {uri-pkldoc-linux-amd64-download}
 * Alpine Linux amd64: {uri-pkldoc-alpine-download}
@@ -204,7 +201,7 @@ Download links:
 The Pkldoc tool is offered as Gradle plugin, Java library, and CLI.
 It can generate documentation either for modules directly, or generate documentation for _package uris_.
 
-The tool requires an argument of a module named _docsite-info.pkl_, that amends link:{uri-DocsiteInfo}[pkl.DocsiteInfo].
+The tool accepts an optional argument of a module named _docsite-info.pkl_, that amends link:{uri-DocsiteInfo}[pkl.DocsiteInfo].
 
 [discrete]
 ==== Generating documentation for modules directly

docs/modules/pkl-gradle/pages/index.adoc

@@ -51,7 +51,7 @@ ifdef::is-release-version[]
         mavenCentral()
 endif::[]
 ifndef::is-release-version[]
-        maven(url = "{uri-sonatype}")
+        maven(url = "{uri-snapshot-repo}")
 endif::[]
     }
 }
@@ -76,7 +76,7 @@ ifdef::is-release-version[]
         mavenCentral()
 endif::[]
 ifndef::is-release-version[]
-        maven { url "{uri-sonatype}" }
+        maven { url "{uri-snapshot-repo}" }
 endif::[]
     }
 }
@@ -322,6 +322,15 @@ Default: `false` +
 Whether to ignore expected example files and generate them again.
 ====
 
+[[test-reporter]]
+.testReporter: Property<String>
+[%collapsible]
+====
+Default: `"spec"` +
+Example: `reporter = "minimal"` +
+Which test reporter to use for CLI output. Possible values are `"spec"` and `"minimal"`.
+====
+
 [[power-assertions-test]]
 .powerAssertions: Property<Boolean>
 [%collapsible]
@@ -414,7 +423,7 @@ For Spring Boot applications, and for users of `pkl-config-java` compiling the g
 .nonNullAnnotation: Property<String>
 [%collapsible]
 ====
-Default: `"org.pkl.config.java.mapper.NonNull"` +
+Default: `"org.jspecify.annotations.NonNull"` +
 Example: `nonNullAnnotation = "org.project.MyAnnotation"` +
 Fully qualified name of the annotation type to use for annotating non-null types. +
 The specified annotation type must be annotated with `@java.lang.annotation.Target(ElementType.TYPE_USE)`
@@ -677,6 +686,14 @@ Default: `false` +
 Whether to ignore expected example files and generate them again.
 ====
 
+.testReporter: Property<String>
+[%collapsible]
+====
+Default: `"spec"` +
+Example: `reporter = "minimal"` +
+Which test reporter to use for CLI output. Possible values are `"spec"` and `"minimal"`.
+====
+
 Common properties:
 
 include::../partials/gradle-common-properties.adoc[]

docs/modules/pkl-gradle/partials/gradle-common-properties.adoc

@@ -119,6 +119,19 @@ This option is commonly used to enable package mirroring.
 The above example will rewrite URL `\https://pkg.pkl-lang.org/pkl-k8s/k8s@1.0.0` to `\https://my.internal.mirror/pkl-k8s/k8s@1.0.0`.
 ====
 
+.httpHeaders: MapProperty<String, Map<String, List<String>>>
+[%collapsible]
+====
+Default: `null` +
+Example: `httpHeaders = ["**": ["User-Agent": ["My User Agent"]]]` +
+Additional headers to add to outbound HTTP requests.
+The key is a glob pattern that is used to match against the URLs of outbound HTTP calls, and the value is the header name and values to add.
+Each header value becomes its own HTTP header.
+
+To describe a prefix match, the `\\**` wildcard should be added to the pattern.
+For example, `https?://example.com/**` matches against every request to host `example.com`.
+====
+
 .powerAssertions: Property<Boolean>
 [%collapsible]
 ====

docs/modules/release-notes/pages/0.32.adoc

@@ -1,60 +1,571 @@
-= Pkl 0.32.0 Release Notes
+= Pkl 0.32 Release Notes
 :version: 0.32
 :version-minor: 0.32.0
-:release-date: TBD
+:release-date: July 8th, 2026
 :version-next: 0.33
-:version-next-date: TBD
+:version-next-date: October 2026
 
 include::partial$intro.adoc[]
 
+NOTE: This is the final release that distributes binaries for macOS/amd64.
+
 == Highlights [small]#💖#
 
-News you don't want to miss.
+=== New data type: `Reference`
 
-.XXX
+This release introduces a new data type called `Reference` (https://github.com/apple/pkl/pull/1354[#1354], https://github.com/apple/pkl/pull/1691[#1691], https://github.com/apple/pkl/pull/1692[#1692], https://github.com/apple/pkl/pull/1693[#1693], https://github.com/apple/pkl/pull/1695[#1695]).
-[%collapsible]
+
+WARNING: This API is experimental. We are looking for feedback, and will aim to make this ready for production use in the next release.
+
+A reference represents something whose actual value is unknown to Pkl, but nevertheless its type is checked.
+The purpose of this data type is to improve how Pkl can be used to configure systems like GitHub Actions, Pulumi, Terraform, and more.
+
+For example, let's assume that some system accepts YAML configuration that looks like so:
+
+[source,yaml]
+----
+taskA:
+  uses: some-task
+
+taskB:
+  uses: some-other-task
+  input: '${ taskA.output.number }'
+----
+
+In terms of YAML, `'${ taskA.output.number }'` is just a string.
+However, semantically, it is an _expression_ in this target system, where `taskA.output.number` conveys some type.
+
+Today, the only way to treat these values in Pkl is to also describe these as strings.
+This introduces many shortcomings:
+
+1. It leaves users vulnerable to syntax errors in this system.
+2. It's hard to validate these beyond that they are a string.
+3. Pkl has no understanding of the relationship between `taskA` and `taskB`.
+
+With references, the above can be modeled in Pkl also as plain lookups:
+
+[source,pkl]
+----
+taskA {
+  uses = "some-task"
+}
+
+taskB {
+  name = "some-other-task"
+  input = taskA.output.number
+}
+----
+
+Library authors describe types as `ref.Reference<D, T>`, where `D` is the _domain_, and `T` is the _referent type_.
+
+[source,pkl]
+----
+import "pkl:ref"
+
+class MyDomain extends ref.Domain { // <1>
+  function renderReference(ref: ref.Reference<MyDomain, Any>): String =
+    "${ " + ref.getData() + "." + ref.getPath().join(".") + " }"
+}
+
+typealias MyReference<T> = ref.Reference<MyDomain, T> // <2>
+
+class MyTask {
+  input: MyReference<Number>  
+}
+----
+<1> References exist inside a domain. The domain defines how these references should be stringified.
+<2> A typealias can be used to improve ergonomics when declaring references that share the same domain.
+
+Pkl will check that type arguments match up:
+
+* The referent type must line up.
++
+`MyReference<Int>` is not assignable to `MyReference<String>`.
+* The domain must line up.
++
+`ref.Reference<MyDomain, Int>` is not assignable to `ref.Reference<OtherDomain, Int>`.
+
+Additionally, references give you synthetic members.
+
+[source,pkl]
+----
+class Bird {
+  name: String
+}
+
+bird: MyReference<Bird>
+
+birdName = bird.name // <1>
+----
+<1> Gives a `MyReference<String>`, because `class Bird` has property `name: String`
+
+The synthetic member contains metadata about the path that was used to access it (`.name` in this
+case).
+This can be used to stringify this reference in that target domain.
+
+To read more about references, consult the xref:language-reference:index.adoc#references[language reference].
+To read through the design decisions made, consult the https://github.com/apple/pkl-evolution/blob/main/spices/SPICE-0020-type-safe-deferred-references.adoc[SPICE].
+
+=== Custom HTTP Headers
+
+Pkl can now attach custom HTTP headers to outbound requests, making it possible to access private or authenticated resources (https://github.com/apple/pkl/pull/1196[#1196], https://github.com/apple/pkl/pull/1584[#1584]).
+
+For example, a CLI user can add an `Authorization` header either in settings.pkl, or the PklProject file:
+
+[tabs]
 ====
-XXX
+~/.pkl/settings.pkl::
++
+[source,pkl]
+----
+amends "pkl:settings"
+
+http {
+  headers {
+    ["https://my.private.server/**"] {
+      ["Authorization"] = "Bearer my-secret-token"
+    }
+  }
+}
+----
+
+PklProject::
++
+[source,pkl]
+----
+amends "pkl:Project"
+
+evaluatorSettings {
+  http {
+    headers {
+      ["https://my.private.server/**"] {
+        ["Authorization"] = "Bearer my-secret-token"
+      }
+    }
+  }
+}
+----
 ====
 
+Each key in `headers` is a glob pattern matched against the request URL.
+When a request is made, every matching pattern's headers are added to the request.
+
+Headers can also be configured in other ways:
+
+* In the pkl-gradle plugin
+* As a CLI flag
+* In the Java/Swift/Go/Kotlin evaluator APIs
+* In the pkl-executor API
+
+Header names must conform to RFC 7230 token syntax.
+Certain reserved names (e.g. `host`, `connection`, `content-length`) and prefixes (`proxy-`, `sec-`) are forbidden.
+
+Thank you to https://github.com/kyokuping[@kyokuping] for their contributions to this feature!
+
+To learn more, consult https://github.com/apple/pkl-evolution/blob/main/spices/SPICE-0022-http-headers.adoc[SPICE-0022].
+
 == Noteworthy [small]#🎶#
 
-Ready when you need them.
+=== Resolved evaluator settings
 
-.XXX
+PklProject files now resolve evaluator settings that are file paths (https://github.com/apple/pkl/pull/1394[#1394]).
-[%collapsible]
+
-====
+Some of the settings within `pkl:EvaluatorSettings` represent file paths.
-XXX
+However, these paths are resolved inconsistently:
-====
+
+* Pkl is inconsistent about what relative paths mean. `rootDir`, `moduleCacheDir`, and `modulePath` are relative to the project dir, while `ExternalReader.executable` is relative to the PWD. 
+* External readers defined in a PklProject have different behavior depending on the PWD.
+* The logic for resolving these paths is dependent on the caller, rather than Pkl.
+
+For CLI users, this means that the current working directory can affect how evaluator settings are loaded.
+
+In Pkl 0.32, these paths are resolved entirely within Pkl, and resolved against the enclosing directory.
+
+A new method `resolve()` is added to `pkl:EvaluatorSettings`, and a new property `resolvedEvaluatorSettings` is added to `pkl:Project`.
+Language bindings are expected to use `resolvedEvaluatorSettings` when configuring the evaluator.
+
+To read more about this change, consult https://github.com/apple/pkl-evolution/blob/main/spices/SPICE-0027-resolved-paths-in-pkl-evaluatorsettings.adoc[SPICE-0027].
+
+=== Line continuations in multiline strings
+
+When authoring multiline strings, it is now possible to use a _line continuation_ to break a single line's value over multiple lines (https://github.com/apple/pkl/pull/1507[#1507], https://github.com/apple/pkl/pull/1564[#1564]).
+
+These two string snippets are logically identical:
+
+[source,pkl]
+----
+str =
+  """
+  Although the Dodo is extinct, \
+  the species will be remembered.
+  """
+----
+
+[source%parsed,pkl]
+----
+str = "Although the Dodo is extinct, the species will be remembered."
+----
+
+To read more about this design, consult https://github.com/apple/pkl-evolution/blob/main/spices/SPICE-0028-multiline-string-continuation.adoc[SPICE-0028].
+
+[[parse-time-variable-resolution]]
+=== Parse-time variable resolution
+
+Pkl now resolves variables at parse time (https://github.com/apple/pkl/pull/1429[#1429], https://github.com/apple/pkl/pull/1622[#1622], https://github.com/apple/pkl/pull/1634[#1634], https://github.com/apple/pkl/pull/1706[#1706]).
+
+Currently, Pkl defers the resolution of variable names to when the node is executed.
+In Pkl 0.32, these are resolved when the file is parsed.
+
+This is a pre-requisite feature for many upcoming features, such as flat member syntax and method varargs.
+
+Additionally, this enables some runtime optimizations, including let expressions.
+
+[[let-expression-improvements]]
+=== Let expression performance improvements
+
+Performance improvements were made to the handling of xref:language-reference:index.adoc#let-expressions[let expressions] (https://github.com/apple/pkl/pull/1622[#1622], https://github.com/apple/pkl/pull/1634[#1634]).
+
+Here is a sample benchmark:
+
+[source,pkl]
+----
+amends "pkl:Benchmark"
+
+microbenchmarks {
+  ["let"] {
+    expression =
+      let (a = 1)
+      let (b = 2)
+      let (c = 3)
+      let (d = 4)
+      let (e = 1)
+      let (f = 2)
+      let (g = 3)
+      let (h = 4)
+      let (i = 1)
+      let (j = 2)
+      let (k = 3)
+      let (l = 4)
+      let (m = 1)
+      let (n = 2)
+      let (o = 3)
+      let (p = 4)
+      let (q = 1)
+      let (r = 2)
+      let (s = 3)
+      let (t = 4)
+        a + b + c + d + e + f + g + h + i + j + k + l + m + n + o + p + q + r + s + t
+  }
+}
+
+output {
+  renderer {
+    converters {
+      [Duration] = (it: Duration) -> super[Duration].apply(it.toUnit("ns"))
+    }
+  }
+}
+----
+
+And here are the results when run on a MacBook Pro M4 Max machine: `jpkl` is about 12x faster, while native `pkl` is about 4000x faster:
+
+|===
+|Variant |Results (mean)
+
+|jpkl
+|1208.06.ns -> 97.76.ns
+
+|pkl
+|1275.96.ns -> 0.32.ns
+|===
+
+=== Test reporter
+
+A test reporter option is added when running tests (https://github.com/apple/pkl/pull/1563[#1563], https://github.com/apple/pkl/pull/1597[#1597]).
+
+A new CLI flag, `--test-reporter`, is now available to the `pkl test` and `pkl project package` commands.
+This flag accepts the name of a test reporter to be used to format test result output.
+
+There are two possible reporters:
+
+* `spec` (default) - the current reporter
+* `minimal` - a reporter that only emits failing tests
+
+This option is also available to pkl-gradle users.
+
+=== Dependency notation improvements
+
+Pkl's evaluator now accepts https://pkl-lang.org/main/current/language-reference/index.html#dependency-notation[dependency notation URIs] as source modules (https://github.com/apple/pkl/pull/1595[#1595]).
+
+In Pkl 0.31, we introduced xref:0.31.adoc#cli-dependency-notation[CLI support for dependency notation].
+Now, this support has been extended to the evaluator itself.
+This means that users of Pkl's various language bindings can also use dependency notation.
+
+Additionally, the limitation on local dependencies has been dropped.
+
+=== pkldoc supports single-package docsites
+
+pkldoc has improved support for single-package documentation websites (https://github.com/apple/pkl/pull/1592[#1592]).
+
+When a docsite has only one package name, and also no overview from a `docsite-info.pkl`, the resulting docsite does not have a top-level package index page.
+Instead, it redirects to the package page, and omits the site-level element from the breadcrumb.
+
+=== Allowed package imports in `PklProject`
+
+PklProject files can now import xref:language-reference:index.adoc#package-asset-uri[package asset URIs] (https://github.com/apple/pkl/pull/1547[#1547]).
+
+This means that it is now possible to centralize and share common configurations across multiple projects.
+
+=== Java Library Changes
+
+==== Switch to JSpecify annotations
+
+Pkl has switched to using https://jspecify.dev[JSpecify] for annotating nullability (https://github.com/apple/pkl/pull/1515[#1515], https://github.com/apple/pkl/pull/1527[#1527], https://github.com/apple/pkl/pull/1528[#1528], https://github.com/apple/pkl/pull/1530[#1530], https://github.com/apple/pkl/pull/1544[#1544], https://github.com/apple/pkl/pull/1601[#1601], https://github.com/apple/pkl/pull/1607[#1607]).
+
+Currently, Pkl uses annotations from the `com.google.code.findbugs:jsr305` library.
+This suffers from some issues:
+
+* The https://jcp.org/en/jsr/detail?id=305[JSR-305 proposal] itself is dormant and unlikely to be adopted.
+* The `com.google.code.findbugs:jsr305` library contributes packages to `javax`, which violates the https://www.oracle.com/downloads/licenses/binary-code-license.html[Oracle Binary Code License Agreement].
+
+In contrast, JSpecify is widely seen as the standard for nullability annotations, and is already understood by most tools.
+
+This impacts Pkl's Java APIs; methods previously annotated using JSR-305 nullability annotations now use JSpecify. 
+Additionally, the Java code generator now emits JSpecify annotations by default.
+
+==== New API: `org.pkl.config.java.ConfigDecoder`
+
+A new API is introduced called `org.pkl.config.java.ConfigDecoder` (https://github.com/apple/pkl/pull/1533[#1533]).
+
+Currently, the `org.pkl.config.java.Config` interface mixes configuration representation with decoding logic.
+To better separate these concerns, a new API is introduced for decoding.
+
+Example:
+
+[source,java]
+----
+class Main {
+  Config getConfig() {
+    var decoder = new ConfigDecoderBuilder().preconfigured().build();
+    return decoder.decode(bytes);
+  }
+}
+----
+
+==== New `asNullable` methods in `pkl.config.java`
+
+New methods are added for decoding into nullable types (https://github.com/apple/pkl/pull/1544[#1544]).
+
+The following methods are introduced:
+
+* `org.pkl.config.java.Config.asNullable`
+* `org.pkl.config.java.JavaType.pairOfNullableFirst`
+* `org.pkl.config.java.JavaType.pairOfNullableSecond`
+* `org.pkl.config.java.JavaType.pairOfNullableFirstAndSecond`
+* `org.pkl.config.java.JavaType.arrayOfNullable`
+* `org.pkl.config.java.JavaType.iterableOfNullable`
+* `org.pkl.config.java.JavaType.collectionOfNullable`
+* `org.pkl.config.java.JavaType.listOfNullable`
+* `org.pkl.config.java.JavaType.setOfNullable`
+* `org.pkl.config.java.JavaType.mapOfNullableKeys`
+* `org.pkl.config.java.JavaType.mapOfNullableValues`
+* `org.pkl.config.java.JavaType.mapOfNullableKeysAndValues`
+
+NOTE: `org.pkl.config.java.Config.as` can also return a `null` value. In a future release, this method will have a runtime non-null assertion.
+
+==== `pkl-formatter` migrated to Java
+
+The `pkl-formatter` library has been migrated from Kotlin to Java (https://github.com/apple/pkl/pull/1514[#1514]).
+
+Therefore, its Kotlin dependency is dropped.
+
+=== Standard Library Changes
+
+==== `pkl:EvaluatorSettings`
+
+* New method: link:{uri-stdlib-evaluatorSettingsModule}#resolve()[`EvaluatorSettings.resolve()`]
+* New method: link:{uri-stdlib-evaluatorSettingsModule}#resolveForOs()[`EvaluatorSettings.resolveForOs()`]
+* New property: link:{uri-stdlib-evaluatorSettingsExternalReaderClass}#workingDir[`EvaluatorSettings#ExternalReader.workingDir`]
+* New property: link:{uri-stdlib-evaluatorSettingsHttpClass}#headers[`EvaluatorSettings#Http.headers`]
+* New typealias: link:{uri-stdlib-evaluatorSettingsModule}#HttpHeaders[`EvaluatorSettings.HttpHeaders`]
+* New typealias: link:{uri-stdlib-evaluatorSettingsModule}#HttpHeaderName[`EvaluatorSettings.HttpHeaderName`]
+* New typealias: link:{uri-stdlib-evaluatorSettingsModule}#HttpHeaderValue[`EvaluatorSettings.HttpHeaderValue`]
+
+==== `pkl:base`
+
+* New property: link:{uri-stdlib-baseModule}/String#isGlobPattern[`String.isGlobPattern`]
+
+==== `pkl:Project`
+
+* New property: link:{uri-stdlib-projectModule}#resolvedEvaluatorSettings[`Project.resolvedEvaluatorSettings`]
+
+==== `pkl:ref`
+
+* New module introduced.
+
+=== pkl-gradle changes
+
+The following changes have been made to pkl-gradle.
+
+==== Support for external readers
+
+External readers can now be configured when configuring evaluators (https://github.com/apple/pkl/pull/1578[#1578]).
+
+For example:
+
+[source,kotlin]
+----
+val myPklTask by pkl.evaluators.creating {
+  val foo by externalModuleReaders.creating {
+    executable = "pkl-foo-reader"
+    arguments = listOf("--bar", "baz")
+  }
+}
+----
+
+==== Support for module/resource readers from SPI
+
+Gradle users can now add module/resource readers by registering a service via the Java SPI mechanism (https://github.com/apple/pkl/pull/1581[#1581]).
+
+==== Support for Gradle configuration cache
+
+The plugin now supports the Gradle configuration cache feature (https://github.com/apple/pkl/issues/1425[#1425]).
+
+Thanks to https://github.com/ffluk3[@ffluk3] for their contributions to this feature!
 
 == Breaking Changes [small]#💔#
 
-Things to watch out for when upgrading.
+=== Name resolution changes
 
-=== Removed Java APIs
+Variables are now <<parse-time-variable-resolution,resolved at parse time>>.
 
-The following APIs have been removed without replacement.
+As part of this change, some names are resolved differently.
 
-* `org.pkl.config.java.Config#makeConfig` (pr:https://github.com/apple/pkl/pull/1531[])
+Take the following code:
 
-.XXX
+[source,pkl]
-[%collapsible]
+----
-====
+qux = "outer"
-XXX
-====
 
-== Work In Progress [small]#🚆#
+foo {
+  when (cond) {
+    qux = "inner"
+  }
+  res = qux
+}
+----
 
-They missed the train but deserve a mention.
+Currently, `res = qux` will eval to either `res = "outer"` or `res = "inner"` depending on whether `cond` evals to `true` or not.
+This is a lexical lookup that is either one level up, or zero levels up, depending on the result of code execution.
 
-.XXX
+This type of resolution is not possible at parse time, because we do not know what `cond` executes to.
-[%collapsible]
+In Pkl 0.32, `res` will always resolve to the inner `qux`, and this snippet will throw if the when generator does not fire.
-====
+
-XXX
+=== Java API changes
-====
+
+The following breaking changes have been made to the Java API.
+
+* `org.pkl.config.java.Config#makeConfig`
++
+Removed without replacement
+
+* `org.pkl.config.java.Config.fromPklBinary`
++
+Deprecated, replaced with `org.pkl.config.java.ConfigDecoder`
+
+* `org.pkl.config.java.mapper.NonNull`
++
+Deprecated, replaced with `org.jspecify.annotations.NonNull`
+
+* `org.pkl.core.evaluatorSettings.PklEvaluatorSettings.parse`
++
+No longer accepts `pathNormalizer` argument
+
+* `org.pkl.formatter.Formatter`
+** Pass `GrammarVersion` to constructor instead of each `format` method
+** Replace `format(Path): String` with `format(Reader, Appendable)`
+** Mark as `throws IOException`
+** Deprecate methods that accept `GrammarVersion` as an argument
+
+=== Loading rule changes in `pkl:EvaluatorSettings`
+
+Breaking changes have been made to how evaluator settings are loaded when using `PklProject` (https://github.com/apple/pkl/pull/1394[#1394]).
+
+==== Loading rule changes for the external reader executable
+
+The following changes have been made for the `executable` property in an external reader:
+
+* If the executable does not contain a slash (`/` on POSIX, `\` on Windows) character, it is always resolved against the `PATH` environment variable.
+* If it does contain a slash, it is resolved relative to the enclosing PklProject directory, instead of the current working directory.
+
+=== Changes to `--external-module-reader` and `--external-resource-reader` CLI flags 
+
+The `--external-module-reader` and `--external-resource-reader` CLI flags will _replace_ any external readers otherwise configured within a PklProject, instead of add to it (https://github.com/apple/pkl/pull/1394[#1394]).
+
+This makes this behavior consistent with how other settings work.
+
+== Bug Fixes [small]#🐜#
+
+The following bugs have been fixed.
+
+* Data race in MessagePack encoder during concurrent server sends (https://github.com/apple/pkl/issues/1486[#1486])
+* pkl-doc library publishes incorrect Maven dependency scopes (https://github.com/apple/pkl/issues/1517[#1517])
+* Re-using pklbinary#Renderer during rendering results in incorrect output (https://github.com/apple/pkl/pull/1525[#1525])
+* Cannot glob using subpatterns inside a project dependency (https://github.com/apple/pkl/issues/1545[#1545])
+* Project package command incompatible with glob imports on Windows (https://github.com/apple/pkl/issues/1556[#1556])
+* Thrown PklBugException when using power assertions with unavailable source sections (https://github.com/apple/pkl/pull/1571[#1571])
+* pkl-doc: DocGenerator never shuts down its thread pool (https://github.com/apple/pkl/issues/1583[#1583])
+* Imports gathering Gradle task can fail with a confusing exception (https://github.com/apple/pkl/issues/1591[#1591])
+* HTTP rewrite fails with PklBugException under tr-TR locale when host contains 'I' (https://github.com/apple/pkl/issues/1617[#1617])
+* Formatter bug fixes (https://github.com/apple/pkl/pull/1619[#1619])
+* Unrelated error message thrown when computing an error message (https://github.com/apple/pkl/pull/1629[#1629])
+* pkl-binary serialization produces an incomplete msgpack value in the presence of local properties (https://github.com/apple/pkl/issues/1631[#1631]).
+* Poor parser error message (https://github.com/apple/pkl/issues/1638[#1638])
+* relativePathTo does not check if receiver is a module (https://github.com/apple/pkl/issues/1649[#1649])
+* `Int` overflow on multiplication throws unexpected exception (https://github.com/apple/pkl/issues/1651[#1651])
+* Incorrect eager check for `Map` type (https://github.com/apple/pkl/issues/1653[#1653])
+* Incorrect `toRadixString()` for `math.minInt` (https://github.com/apple/pkl/issues/1655[#1655])
+* `Evaluator.evaluateSchema()` throws if properties are annotated with `@ConvertProperty` (https://github.com/apple/pkl/issues/1657[#1657])
+* `String.padStart` and `String.padEnd` return incorrect strings sometimes (https://github.com/apple/pkl/issues/1661[#1661])
+* `String.getOrNull` crashes with certain strings (https://github.com/apple/pkl/issues/1662[#1662])
+* Incorrect facts in `pkl:base` doc comments (https://github.com/apple/pkl/pull/1669[#1669])
+* Index-based methods on Set aren't implemented (https://github.com/apple/pkl/issues/1682[#1682])
+* pkl-gradle throws exception when a Pkl task can't create an evaluator during configuration time (https://github.com/apple/pkl/pull/1684[#1684])
+* Unrelated exception gets thrown when validating elements/entries in objects (https://github.com/apple/pkl/issues/1697[#1697])
+* Type argument is lost in constraint expressions within generic typealiases (https://github.com/apple/pkl/issues/1705[#1705])
+* Typealiases with type var as root are broken (https://github.com/apple/pkl/issues/1711[#1711])
+* Incorrect `List`/`Set`/`Map`/`Listing`/`Mapping`/union type check behavior through typealiases (https://github.com/apple/pkl/issues/1710[#1710])
+* Type aliases with type var as root are broken (https://github.com/apple/pkl/issues/1711[#1711])
+* Type checks through aliases are always run lazily even when they should be eager (https://github.com/apple/pkl/issues/1716[#1716])
+* Improve thread safety when evaluating `pkl:base` (https://github.com/apple/pkl/pull/1719[#1719])
+* Incorrect member links in doc comments (https://github.com/apple/pkl/pull/1723[#1723])
+* pkl-gradle plugin does not allow `projectpackage:` reads by default (https://github.com/apple/pkl/issues/1734[#1734])
+* `IntSeq` incorrectly emits on empty ``IntSeq``s (https://github.com/apple/pkl/issues/1738[#1738])
+
+== Security Fixes [small]#🔒#
+
+The following security vulnerabilities were fixed:
+
+* Remote packages can read local filesystem items by escaping local dependency roots (https://github.com/apple/pkl/security/advisories/GHSA-fgvf-hh2w-cxff[GHSA-fgvf-hh2w-cxff], https://github.com/apple/pkl/pull/1737[#1737])
+* Packages can be read/written outside the configured cache directory (https://github.com/apple/pkl/security/advisories/GHSA-87qh-25w9-mh34[GHSA-87qh-25w9-mh34], https://github.com/apple/pkl/pull/1683[#1683])
 
 == Contributors [small]#🙏#
 
 We would like to thank the contributors to this release (in alphabetical order):
 
-* XXX
+* https://github.com/04cb[@04cb]
+* https://github.com/0xmrma[@0xmrma]
+* https://github.com/adityabagchi24[@adityabagchi24]
+* https://github.com/adityasingh2400[@adityasingh2400]
+* https://github.com/bioball[@bioball]
+* https://github.com/fallintoplace[@fallintoplace]
+* https://github.com/ffluk3[@ffluk3]
+* https://github.com/HT154[@HT154]
+* https://github.com/KushalP[@KushalP]
+* https://github.com/kyokuping[@kyokuping]
+* https://github.com/ldaley[@ldaley]
+* https://github.com/mirkoalicastro[@mirkoalicastro]
+* https://github.com/netvl[@netvl]
+* https://github.com/odenix[@odenix]
+* https://github.com/stackoverflow[@stackoverflow]
+* https://github.com/vinayakj592[@vinayakj592]

docs/modules/release-notes/pages/0.33.adoc

@@ -0,0 +1,36 @@
+= Pkl 0.33 Release Notes
+:version: 0.33
+:version-minor: 0.33.0
+:release-date: XXX
+:version-next: 0.34
+:version-next-date: February 2027
+
+include::partial$intro.adoc[]
+
+== Highlights [small]#💖#
+
+=== XXX
+
+== Noteworthy [small]#🎶#
+
+=== XXX
+
+== Breaking Changes [small]#💔#
+
+=== Removal of macOS amd64 (Intel) Binaries
+
+Native `pkl` and `pkldoc` binaries for Intel Mac systems are no longer published with Pkl releases.
+
+To continue running new Pkl releases on these systems, use an appropriate Java runtime and the `jpkl` and `jpkldoc` Java executables.
+
+=== XXX
+
+== Bug Fixes [small]#🐜#
+
+* XXX
+
+== Contributors [small]#🙏#
+
+We would like to thank the contributors to this release (in alphabetical order):
+
+* XXX

docs/modules/release-notes/pages/changelog.adoc

@@ -1,8 +1,15 @@
 = Changelog
 include::ROOT:partial$component-attributes.adoc[]
 
+[[release-0.33.0]]
+== 0.33.0 (UNRELEASED)
+
+xref:0.33.adoc[Release Notes]
+
 [[release-0.32.0]]
-== 0.32.0 (UNRELEASED)
+== 0.32.0 (2026-07-08)
+
+xref:0.32.adoc[Release Notes]
 
 [[release-0.31.1]]
 == 0.31.1 (2026-03-26)
@@ -38,6 +45,7 @@ Thank you to all the contributors for this release!
 == 0.31.0 (2026-02-26)
 
 xref:0.31.adoc[Release Notes]
+
 [[release-0.30.2]]
 
 == 0.30.2 (2025-12-15)

docs/modules/style-guide/pages/index.adoc

@@ -193,7 +193,7 @@ Too many lines separate `foo` and `baz`.
 Properties that override an existing property shouldn't have doc comments nor type annotations,
 unless the type is intentionally overridden via `extends`.
 
-[source%tested,{pkl}]
+[source%parsed,{pkl}]
 ----
 amends "myOtherModule.pkl"
 

docs/nav.adoc

@@ -41,6 +41,7 @@
 * xref:ROOT:evolution-and-roadmap.adoc[Evolution and Roadmap]
 
 * xref:release-notes:index.adoc[Release Notes]
+** xref:release-notes:0.33.adoc[0.33 Release Notes]
 ** xref:release-notes:0.32.adoc[0.32 Release Notes]
 ** xref:release-notes:0.31.adoc[0.31 Release Notes]
 ** xref:release-notes:0.30.adoc[0.30 Release Notes]

docs/src/test/kotlin/DocSnippetTests.kt

@@ -1,3 +1,22 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import java.nio.file.Files
+import kotlin.io.path.isDirectory
+import kotlin.io.path.isRegularFile
+import kotlin.io.path.useDirectoryEntries
 import org.junit.platform.commons.annotation.Testable
 import org.junit.platform.engine.*
 import org.junit.platform.engine.TestDescriptor.Type
@@ -16,23 +35,18 @@ import org.pkl.core.Loggers
 import org.pkl.core.SecurityManagers
 import org.pkl.core.StackFrameTransformers
 import org.pkl.core.evaluatorSettings.TraceMode
+import org.pkl.core.http.HttpClient
 import org.pkl.core.module.ModuleKeyFactories
 import org.pkl.core.repl.ReplRequest
 import org.pkl.core.repl.ReplResponse
 import org.pkl.core.repl.ReplServer
+import org.pkl.core.resource.ResourceReaders
 import org.pkl.core.util.IoUtils
-import org.pkl.core.http.HttpClient
 import org.pkl.parser.Parser
 import org.pkl.parser.ParserError
 import org.pkl.parser.syntax.ClassProperty
-import org.pkl.core.resource.ResourceReaders
-import java.nio.file.Files
-import kotlin.io.path.isDirectory
-import kotlin.io.path.isRegularFile
-import kotlin.io.path.useDirectoryEntries
 
-@Testable
+@Testable class DocSnippetTests
-class DocSnippetTests
 
 class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.ExecutionContext>() {
   private val projectDir = rootProjectDir.resolve("docs")
@@ -41,7 +55,8 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
   private companion object {
     val headingRegex = Regex("""(?u)^\s*(=++)\s*(.+)""")
     val collapsibleBlockRegex = Regex("""(?u)^\s*\[%collapsible""")
-    val codeBlockRegex = Regex("""(?u)^\s*\[source(?:%(tested|parsed)(%error)?)?(?:,\{?([a-zA-Z-_]+)}?)?""")
+    val codeBlockRegex =
+      Regex("""(?u)^\s*\[source(?:%(tested|parsed)(%error)?)?(?:,\{?([a-zA-Z-_]+)}?)?""")
     val codeBlockNameRegex = Regex("""(?u)^\s*\.(.+)""")
     val codeBlockDelimiterRegex = Regex("""(?u)^\s*----""")
     val graphicsRegex = Regex("\\[small]#.+#")
@@ -51,7 +66,7 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
 
   override fun discover(
     discoveryRequest: EngineDiscoveryRequest,
-    uniqueId: UniqueId
+    uniqueId: UniqueId,
   ): TestDescriptor {
     val packageSelectors = discoveryRequest.getSelectorsByType(PackageSelector::class.java)
     val classSelectors = discoveryRequest.getSelectorsByType(ClassSelector::class.java)
@@ -62,12 +77,14 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
     val packageName = testClass.`package`.name
     val className = testClass.name
 
-    if (methodSelectors.isEmpty()
+    if (
-      && (packageSelectors.isEmpty() || packageSelectors.any { it.packageName == packageName })
+      methodSelectors.isEmpty() &&
-      && (classSelectors.isEmpty() || classSelectors.any { it.className == className })
+        (packageSelectors.isEmpty() || packageSelectors.any { it.packageName == packageName }) &&
+        (classSelectors.isEmpty() || classSelectors.any { it.className == className })
     ) {
 
-      val rootDescriptor = Descriptor.Path(uniqueId, docsDir.fileName.toString(), ClassSource.from(testClass), docsDir)
+      val rootDescriptor =
+        Descriptor.Path(uniqueId, docsDir.fileName.toString(), ClassSource.from(testClass), docsDir)
       doDiscover(rootDescriptor, uniqueIdSelectors)
       return rootDescriptor
     }
@@ -77,19 +94,17 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
   }
 
   override fun createExecutionContext(request: ExecutionRequest): ExecutionContext {
-    val replServer = ReplServer(
+    val replServer =
+      ReplServer(
         SecurityManagers.defaultManager,
         HttpClient.dummyClient(),
         Loggers.stdErr(),
         listOf(
           ModuleKeyFactories.standardLibrary,
           ModuleKeyFactories.classPath(DocSnippetTests::class.java.classLoader),
-        ModuleKeyFactories.file
+          ModuleKeyFactories.file,
-      ),
-      listOf(
-        ResourceReaders.environmentVariable(),
-        ResourceReaders.externalProperty()
         ),
+        listOf(ResourceReaders.environmentVariable(), ResourceReaders.externalProperty()),
         System.getenv(),
         emptyMap(),
         null,
@@ -104,9 +119,9 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
   }
 
   private fun doDiscover(rootDescriptor: TestDescriptor, selectors: List<UniqueIdSelector>) {
-    fun isMatch(other: UniqueId) = selectors.isEmpty() || selectors.any {
+    fun isMatch(other: UniqueId) =
-      it.uniqueId.hasPrefix(other) || other.hasPrefix(it.uniqueId)
+      selectors.isEmpty() ||
-    }
+        selectors.any { it.uniqueId.hasPrefix(other) || other.hasPrefix(it.uniqueId) }
 
     docsDir.useDirectoryEntries { docsDirEntries ->
       for (docsDirEntry in docsDirEntries) {
@@ -116,11 +131,12 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
         val docsDirEntryId = rootDescriptor.uniqueId.append("dir", docsDirEntryName)
         if (!isMatch(docsDirEntryId)) continue
 
-        val docsDirEntryDescriptor = Descriptor.Path(
+        val docsDirEntryDescriptor =
+          Descriptor.Path(
             docsDirEntryId,
             docsDirEntryName,
             DirectorySource.from(docsDirEntry.toFile()),
-          docsDirEntry
+            docsDirEntry,
           )
         rootDescriptor.addChild(docsDirEntryDescriptor)
 
@@ -131,16 +147,19 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
           for (pagesDirEntry in pagesDirEntries) {
             val pagesDirEntryName = pagesDirEntry.fileName.toString()
             val pagesDirEntryId = docsDirEntryId.append("file", pagesDirEntryName)
-            if (!pagesDirEntry.isRegularFile() ||
+            if (
+              !pagesDirEntry.isRegularFile() ||
                 !pagesDirEntryName.endsWith(".adoc") ||
                 !isMatch(pagesDirEntryId)
-            ) continue
+            )
+              continue
 
-            val pagesDirEntryDescriptor = Descriptor.Path(
+            val pagesDirEntryDescriptor =
+              Descriptor.Path(
                 pagesDirEntryId,
                 pagesDirEntryName,
                 FileSource.from(pagesDirEntry.toFile()),
-              pagesDirEntry
+                pagesDirEntry,
               )
             docsDirEntryDescriptor.addChild(pagesDirEntryDescriptor)
 
@@ -174,16 +193,14 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
         }
 
         val parent = sections.firstOrNull() ?: docDescriptor
-        val normalizedTitle = title
+        val normalizedTitle =
-          .replace("<code>", "")
+          title.replace("<code>", "").replace("</code>", "").replace(graphicsRegex, "").trim()
-          .replace("</code>", "")
+        val childSection =
-          .replace(graphicsRegex, "")
+          Descriptor.Section(
-          .trim()
-        val childSection = Descriptor.Section(
             parent.uniqueId.append("section", normalizedTitle),
             normalizedTitle,
             FileSource.from(docDescriptor.path.toFile(), FilePosition.from(lineNum)),
-          newLevel
+            newLevel,
           )
 
         sections.addFirst(childSection)
@@ -217,7 +234,8 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
           codeBlockNum += 1
           val (testMode, error, language) = codeBlockMatch.destructured
           if (testMode.isNotEmpty()) {
-            val blockName = codeBlockNameRegex.find(prevLine)?.groupValues?.get(1) ?: "snippet$codeBlockNum"
+            val blockName =
+              codeBlockNameRegex.find(prevLine)?.groupValues?.get(1) ?: "snippet$codeBlockNum"
             while (linesIterator.hasNext()) {
               advance()
               val startDelimiterMatch = codeBlockDelimiterRegex.find(line)
@@ -236,10 +254,13 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
                           snippetId,
                           blockName,
                           language,
-                          FileSource.from(docDescriptor.path.toFile(), FilePosition.from(jumpToLineNum)),
+                          FileSource.from(
+                            docDescriptor.path.toFile(),
+                            FilePosition.from(jumpToLineNum),
+                          ),
                           builder.toString(),
                           testMode == "parsed",
-                          error.isNotEmpty()
+                          error.isNotEmpty(),
                         )
                       )
                     }
@@ -261,28 +282,21 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
     }
   }
 
-  private sealed class Descriptor(
+  private sealed class Descriptor(uniqueId: UniqueId, displayName: String, source: TestSource) :
-    uniqueId: UniqueId,
+    AbstractTestDescriptor(uniqueId, displayName, source), Node<ExecutionContext> {
-    displayName: String,
-    source: TestSource
-  ) : AbstractTestDescriptor(uniqueId, displayName, source), Node<ExecutionContext> {
 
     class Path(
       uniqueId: UniqueId,
       displayName: String,
       source: TestSource,
-      val path: java.nio.file.Path
+      val path: java.nio.file.Path,
     ) : Descriptor(uniqueId, displayName, source) {
 
       override fun getType() = Type.CONTAINER
     }
 
-    class Section(
+    class Section(uniqueId: UniqueId, displayName: String, source: TestSource, val level: Int) :
-      uniqueId: UniqueId,
+      Descriptor(uniqueId, displayName, source) {
-      displayName: String,
-      source: TestSource,
-      val level: Int
-    ) : Descriptor(uniqueId, displayName, source) {
 
       override fun getType() = Type.CONTAINER
 
@@ -299,7 +313,7 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
       source: TestSource,
       private val code: String,
       private val parseOnly: Boolean,
-      private val expectError: Boolean
+      private val expectError: Boolean,
     ) : Descriptor(uniqueId, displayName, source) {
 
       override fun getType() = Type.TEST
@@ -308,11 +322,14 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
         when (language) {
           "pkl" -> Parser().parseModule(code)
           "pkl-expr" -> Parser().parseExpressionInput(code)
-          else -> throw(Exception("Unrecognized language: $language"))
+          else -> throw (Exception("Unrecognized language: $language"))
         }
       }
 
-      override fun execute(context: ExecutionContext, executor: DynamicTestExecutor): ExecutionContext {
+      override fun execute(
+        context: ExecutionContext,
+        executor: DynamicTestExecutor,
+      ): ExecutionContext {
         if (parseOnly) {
           try {
             parsed
@@ -328,12 +345,7 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
         }
 
         context.replServer.handleRequest(
-          ReplRequest.Eval(
+          ReplRequest.Eval("snippet", code, !expectError, !expectError)
-            "snippet",
-            code,
-            !expectError,
-            !expectError
-          )
         )
 
         val properties = parsed.children()?.filterIsInstance<ClassProperty>() ?: emptyList()
@@ -342,21 +354,21 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
 
         // force each property
         for (prop in properties) {
-          responses.addAll(context.replServer.handleRequest(
+          responses.addAll(
-            ReplRequest.Eval(
+            context.replServer.handleRequest(
-              "snippet",
+              ReplRequest.Eval("snippet", prop.name.value, false, true)
-              prop.name.value,
+            )
-              false,
-              true
           )
-          ))
         }
         if (expectError) {
-          if (responses.dropLast(1).any { it !is ReplResponse.EvalSuccess } ||
+          if (
-            responses.last() !is ReplResponse.EvalError) {
+            responses.dropLast(1).any { it !is ReplResponse.EvalSuccess } ||
+              responses.last() !is ReplResponse.EvalError
+          ) {
             throw AssertionError(
               "Expected %error snippet to fail at the end, but got the following REPL responses:\n\n" +
-                  responses.joinToString("\n\n") { it.message })
+                responses.joinToString("\n\n") { it.message }
+            )
           }
 
           return context

gradle.properties

@@ -1,7 +1,7 @@
 # suppress inspection "UnusedProperty" for whole file
 
 group=org.pkl-lang
-version=0.32.0
+version=0.33.0
 
 # google-java-format requires jdk.compiler exports
 org.gradle.jvmargs= \

gradle/libs.versions.toml

@@ -3,66 +3,64 @@ assertj = "3.27.7"
 checksumPlugin = "1.4.0"
 # 5.0.3 is the last version compatible with Kotlin 2.2
 clikt = "5.0.3"
-commonMark = "0.28.0"
+commonMark = "0.29.0"
 downloadTaskPlugin = "5.7.0"
-errorProne = "2.48.0"
+errorProne = "2.50.0"
 errorPronePlugin = "5.1.0"
-geantyref = "1.3.16"
+geantyref = "2.0.1"
 #noinspection UnusedVersionCatalogEntry
 googleJavaFormat = "1.35.0"
-# 25.0.2 no longer supports macos-x64
+graalVm = "25.1.3"
-graalVm = "25.0.1"
+graalVmJdkVersion = "25.0.3"
-#noinspection UnusedVersionCatalogEntry
-graalVmJdkVersion = "25.0.1"
 # slightly hacky but convenient place so we remember to update the checksum
+# pklGraalVm.gradle.kts assumes this entry exists
 #noinspection UnusedVersionCatalogEntry
-graalVmSha256-macos-x64 = "a3d895b4cd1c783badbd277ec70409806bd4102fca0d2a60dbaeb0bab41aec30"
+graalVmSha256-macos-x64 = "unavailable"
 #noinspection UnusedVersionCatalogEntry
-graalVmSha256-macos-aarch64 = "066339f24a8ab5c161548491a9400f7344e7761a1e46f8979e76c7ef11d5bc76"
+graalVmSha256-macos-aarch64 = "b41cdde27691a0e04a1f2b0660624bc37e59c738e536888860c4c9f65a4a9a3b"
 #noinspection UnusedVersionCatalogEntry
-graalVmSha256-linux-x64 = "01e39fe1a87f28b842a3e4e3b77be9b544dca3a58fa6e93b924a6106c8bac7fb"
+graalVmSha256-linux-x64 = "e9cd1637be853e105f8b09125b4b19fbce385696465d782cbca8bb80e1df8f0d"
 #noinspection UnusedVersionCatalogEntry
-graalVmSha256-linux-aarch64 = "7aa0b9935a80e67f37c6025678393dbd123bb6f2226811decbc1a13093fc8ae2"
+graalVmSha256-linux-aarch64 = "5e79978983439d28506ebef82254fe9f98995121208dc8be77c604f4ad5bc579"
 #noinspection UnusedVersionCatalogEntry
-graalVmSha256-windows-x64 = "fde83c5ceec2c75560c747ccd9f314f90e4cf5c5287416e67c4ce442e344ca27"
+graalVmSha256-windows-x64 = "96f1e7a9674b5b5751224104ff0c4624f15f9522b190d960a041cab72c381393"
 # pklGraalVm.gradle.kts assumes this entry exists
 #noinspection UnusedVersionCatalogEntry
 graalVmSha256-windows-aarch64 = "unavailable"
 ideaExtPlugin = "1.4.1"
-javaPoet = "0.14.0"
+javaPoet = "0.17.0"
 javaxInject = "1"
 jimfs = "1.3.1"
-jline = "4.0.12"
+jline = "4.3.1"
 jmh = "1.37"
 jmhPlugin = "0.7.3"
 jspecify = "1.0.0"
-jsr305 = "3.0.2"
+junit = "6.1.1"
-junit = "6.0.3"
 # 1.7+ generates much more verbose code
 kotlinPoet = "1.6.0"
 kotlinStdLib = "2.2.21"
 #noinspection UnusedVersionCatalogEntry
 kotlinTarget = "2.2"
-kotlinToolchain = "2.3.20"
+kotlinToolchain = "2.4.0"
 kotlinxHtml = "0.12.0"
 # 1.9.0 is the last version compatible with Kotlin 2.2
 kotlinxSerialization = "1.9.0"
-kotlinxCoroutines = "1.10.2"
+kotlinxCoroutines = "1.11.0"
 #noinspection UnusedVersionCatalogEntry
 ktfmt = "0.62"
 # replaces nuValidator's log4j dependency
 # 2.17.1 is the last version compatible with nuValidator
 log4j = "2.17.1"
-msgpack = "0.9.11"
+msgpack = "0.9.12"
 nexusPublishPlugin = "2.0.0"
-nullaway = "0.13.2"
+nullaway = "0.13.7"
 nullawayPlugin = "3.0.0"
-nuValidator = "26.4.2"
+nuValidator = "26.6.24"
 paguro = "3.10.3"
-shadowPlugin = "9.4.1"
+shadowPlugin = "9.4.2"
-slf4j = "2.0.17"
+slf4j = "2.0.18"
 snakeYaml = "3.0.1"
-spotlessPlugin = "8.4.0"
+spotlessPlugin = "8.7.0"
 wiremock = "3.13.2"
 
 [libraries] # ordered alphabetically
@@ -74,6 +72,7 @@ commonMarkTables = { group = "org.commonmark", name = "commonmark-ext-gfm-tables
 downloadTaskPlugin = { group = "de.undercouch", name = "gradle-download-task", version.ref = "downloadTaskPlugin" }
 #noinspection UnusedVersionCatalogEntry
 errorProne = { group = "com.google.errorprone", name = "error_prone_core", version.ref = "errorProne" }
+errorProneAnnotations = { group = "com.google.errorprone", name = "error_prone_annotations", version.ref = "errorProne" }
 errorPronePlugin = { group = "net.ltgt.gradle", name = "gradle-errorprone-plugin", version.ref = "errorPronePlugin" }
 geantyref = { group = "io.leangen.geantyref", name = "geantyref", version.ref = "geantyref" }
 graalCompiler = { group = "org.graalvm.compiler", name = "compiler", version.ref = "graalVm" }
@@ -87,7 +86,6 @@ jlineTerminal = { group = "org.jline", name = "jline-terminal", version.ref = "j
 jlineTerminalJni = { group = "org.jline", name = "jline-terminal-jni", version.ref = "jline" }
 #noinspection UnusedVersionCatalogEntry
 jspecify = { group = "org.jspecify", name = "jspecify", version.ref = "jspecify" }
-jsr305 = { group = "com.google.code.findbugs", name = "jsr305", version.ref = "jsr305" }
 junitApi = { group = "org.junit.jupiter", name = "junit-jupiter-api", version.ref = "junit" }
 junitEngine = { group = "org.junit.jupiter", name = "junit-jupiter-engine", version.ref = "junit" }
 junitParams = { group = "org.junit.jupiter", name = "junit-jupiter-params", version.ref = "junit" }
@@ -118,10 +116,10 @@ slf4jApi = { group = "org.slf4j", name = "slf4j-api", version.ref = "slf4j" }
 slf4jSimple = { group = "org.slf4j", name = "slf4j-simple", version.ref = "slf4j" }
 snakeYaml = { group = "org.snakeyaml", name = "snakeyaml-engine", version.ref = "snakeYaml" }
 spotlessPlugin = { group = "com.diffplug.spotless", name = "spotless-plugin-gradle", version.ref = "spotlessPlugin"}
-svm = { group = "org.graalvm.nativeimage", name = "svm", version.ref = "graalVm" }
+svm = { group = "org.graalvm.nativeimage", name = "svm", version.ref = "graalVmJdkVersion" }
 truffleApi = { group = "org.graalvm.truffle", name = "truffle-api", version.ref = "graalVm" }
 truffleDslProcessor = { group = "org.graalvm.truffle", name = "truffle-dsl-processor", version.ref = "graalVm" }
-truffleSvm = { group = "org.graalvm.nativeimage", name = "truffle-runtime-svm", version.ref = "graalVm" }
+truffleSvm = { group = "org.graalvm.nativeimage", name = "truffle-runtime-svm", version.ref = "graalVmJdkVersion" }
 truffleRuntime = { group = "org.graalvm.truffle", name = "truffle-runtime", version.ref = "graalVm" }
 wiremock = { group = "org.wiremock", name = "wiremock", version.ref = "wiremock" }
 

gradle/wrapper/gradle-wrapper.properties

@@ -1,8 +1,10 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=2ab2958f2a1e51120c326cad6f385153bb11ee93b3c216c5fccebfdfbb7ec6cb
+distributionSha256Sum=bbaeb2fef8710818cf0e261201dab964c572f92b942812df0c3620d62a529a01
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.4.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.0-bin.zip
 networkTimeout=10000
+retries=0
+retryBackOffMs=500
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

gradlew

@@ -20,7 +20,7 @@
 
 ##############################################################################
 #
-#   Gradle start up script for POSIX generated by Gradle.
+#   gradlew start up script for POSIX generated by Gradle.
 #
 #   Important for running:
 #
@@ -29,7 +29,7 @@
 #       bash, then to run this script, type that shell name before the whole
 #       command line, like:
 #
-#           ksh Gradle
+#           ksh gradlew
 #
 #       Busybox and similar reduced shells will NOT work, because this script
 #       requires all of these POSIX shell features:
@@ -57,7 +57,7 @@
 #       Darwin, MinGW, and NonStop.
 #
 #   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/2d6327017519d23b96af35865dc997fcb544fb40/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       https://github.com/gradle/gradle/blob/3d91ce3b8caaf77ad09f381f43615b715b53f72c/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
 #       within the Gradle project.
 #
 #       You can find Gradle at https://github.com/gradle/gradle/.

gradlew.bat

@@ -19,12 +19,12 @@
 @if "%DEBUG%"=="" @echo off
 @rem ##########################################################################
 @rem
-@rem  Gradle startup script for Windows
+@rem  gradlew startup script for Windows
 @rem
 @rem ##########################################################################
 
-@rem Set local scope for the variables with windows NT shell
+@rem Set local scope for the variables, and ensure extensions are enabled
-if "%OS%"=="Windows_NT" setlocal
+setlocal EnableExtensions
 
 set DIRNAME=%~dp0
 if "%DIRNAME%"=="" set DIRNAME=.
@@ -51,7 +51,7 @@ echo. 1>&2
 echo Please set the JAVA_HOME variable in your environment to match the 1>&2
 echo location of your Java installation. 1>&2
 
-goto fail
+"%COMSPEC%" /c exit 1
 
 :findJavaFromJavaHome
 set JAVA_HOME=%JAVA_HOME:"=%
@@ -65,29 +65,18 @@ echo. 1>&2
 echo Please set the JAVA_HOME variable in your environment to match the 1>&2
 echo location of your Java installation. 1>&2
 
-goto fail
+"%COMSPEC%" /c exit 1
 
 :execute
 @rem Setup the command line
 
 
 
-@rem Execute Gradle
+@rem Execute gradlew
-"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
+@rem endlocal doesn't take effect until after the line is parsed and variables are expanded
+@rem which allows us to clear the local environment before executing the java command
+endlocal & "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %* & call :exitWithErrorLevel
 
-:end
+:exitWithErrorLevel
-@rem End local scope for the variables with windows NT shell
+@rem Use "%COMSPEC%" /c exit to allow operators to work properly in scripts
-if %ERRORLEVEL% equ 0 goto mainEnd
+"%COMSPEC%" /c exit %ERRORLEVEL%
-
-:fail
-rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
-rem the _cmd.exe /c_ return code!
-set EXIT_CODE=%ERRORLEVEL%
-if %EXIT_CODE% equ 0 set EXIT_CODE=1
-if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
-exit /b %EXIT_CODE%
-
-:mainEnd
-if "%OS%"=="Windows_NT" endlocal
-
-:omega

jbang-catalog.json

@@ -2,15 +2,15 @@
   "catalogs": {},
   "aliases": {
     "pkl": {
-      "script-ref": "org.pkl-lang:pkl-cli-java:0.31.1",
+      "script-ref": "org.pkl-lang:pkl-cli-java:0.32.0",
       "java-agents": []
     },
     "pkl-codegen-java": {
-      "script-ref": "org.pkl-lang:pkl-codegen-java:0.31.1",
+      "script-ref": "org.pkl-lang:pkl-codegen-java:0.32.0",
       "java-agents": []
     },
     "pkl-codegen-kotlin": {
-      "script-ref": "org.pkl-lang:pkl-codegen-kotlin:0.31.1",
+      "script-ref": "org.pkl-lang:pkl-codegen-kotlin:0.32.0",
       "java-agents": []
     }
   },

pkl-cli/pkl-cli.gradle.kts

@@ -83,8 +83,8 @@ tasks.shadowJar {
   exclude("module-info.*")
 }
 
-val testJavaExecutable by
+val testJavaExecutable =
-  tasks.registering(Test::class) {
+  tasks.register<Test>("testJavaExecutable") {
     testClassesDirs = tasks.test.get().testClassesDirs
     classpath =
       // compiled test classes
@@ -138,7 +138,7 @@ fun Exec.useRootDirAndSuppressOutput() {
 
 // 0.28 Preparing for JDK21 toolchains revealed that `testStartJavaExecutable` may pass, even though
 // the evaluator fails. To catch this, we eval a simple expression using the fat jar.
-val testEvalJavaExecutable by
+val testEvalJavaExecutable =
   setupJavaExecutableRun("testEvalJavaExecutable", evalTestFlags) { useRootDirAndSuppressOutput() }
 
 // Run the same evaluator tests on all configured JDK test versions.

pkl-cli/src/main/kotlin/org/pkl/cli/CliCommandRunner.kt

@@ -67,7 +67,7 @@ constructor(
     val evaluator = builder.build()
     evaluator.use {
       evaluator.evaluateCommand(
-        uri(resolvedSourceModules.first()),
+        uri(options.normalizedSourceModules.first()),
         reservedFlagNames,
         reservedFlagShortNames,
       ) { spec ->

pkl-cli/src/main/kotlin/org/pkl/cli/CliEvaluator.kt

@@ -115,7 +115,7 @@ constructor(
     // used just to resolve the `%{moduleName}` placeholder
     val moduleResolver = ModuleResolver(moduleKeyFactories(ModulePathResolver.empty()))
 
-    return resolvedSourceModules.associateWith { uri ->
+    return options.base.normalizedSourceModules.associateWith { uri ->
       val moduleDir: String? =
         IoUtils.toPath(uri)?.let {
           IoUtils.relativize(it.parent, workingDir).toString().ifEmpty { "." }
@@ -191,7 +191,7 @@ constructor(
         }
       } else {
         var outputWritten = false
-        for (moduleUri in resolvedSourceModules) {
+        for (moduleUri in options.base.normalizedSourceModules) {
           val moduleSource = toModuleSource(moduleUri, inputStream)
           if (options.expression != null) {
             val output = evaluator.evaluateExpressionString(moduleSource, options.expression)
@@ -229,8 +229,8 @@ constructor(
   private fun writeMultipleFileOutput(builder: EvaluatorBuilder) {
     val outputDirs = directoryOutputPaths!!
     val writtenFiles = mutableMapOf<Path, OutputFile>()
+    builder.setOutputFormat(options.outputFormat).build().use { evaluator ->
       for ((moduleUri, outputDir) in outputDirs) {
-      val evaluator = builder.setOutputFormat(options.outputFormat).build()
         if (outputDir.exists() && !outputDir.isDirectory()) {
           throw CliException("Output path `$outputDir` exists and is not a directory.")
         }
@@ -268,6 +268,7 @@ constructor(
         }
       }
     }
+  }
 
   /**
    * Resolves [rel] against this Path name-by-name. At each step, the real path is resolved if the

pkl-cli/src/main/kotlin/org/pkl/cli/CliImportAnalyzer.kt

@@ -66,7 +66,7 @@ constructor(
     try {
       return builder
         .apply {
-          for ((idx, sourceModule) in resolvedSourceModules.withIndex()) {
+          for ((idx, sourceModule) in options.base.normalizedSourceModules.withIndex()) {
             addExternalProperty("pkl.analyzeImports.$idx", sourceModule.toString())
           }
         }

pkl-cli/src/main/kotlin/org/pkl/cli/CliTestRunner.kt

@@ -15,6 +15,7 @@
  */
 package org.pkl.cli
 
+import java.io.StringWriter
 import java.io.Writer
 import org.pkl.commons.cli.*
 import org.pkl.core.Closeables
@@ -22,8 +23,9 @@ import org.pkl.core.EvaluatorBuilder
 import org.pkl.core.ModuleSource.uri
 import org.pkl.core.PklException
 import org.pkl.core.TestResults
-import org.pkl.core.stdlib.test.report.JUnitReport
+import org.pkl.core.stdlib.test.report.JUnitReporter
-import org.pkl.core.stdlib.test.report.SimpleReport
+import org.pkl.core.stdlib.test.report.MinimalReporter
+import org.pkl.core.stdlib.test.report.SpecReporter
 import org.pkl.core.util.ErrorMessages
 
 class CliTestRunner
@@ -47,7 +49,7 @@ constructor(
 
   private fun evalTest(builder: EvaluatorBuilder) {
     val sources =
-      resolvedSourceModules.ifEmpty { project?.tests?.map { it.toUri() } }
+      options.normalizedSourceModules.ifEmpty { project?.tests?.map { it.toUri() } }
         ?:
         // keep in sync with error message thrown by clikt
         throw CliException(
@@ -64,13 +66,15 @@ constructor(
       var failed = false
       var isExampleWrittenFailure = true
       val moduleNames = mutableSetOf<String>()
-      val reporter = SimpleReport(useColor)
+      val reporter =
+        when (testOptions.reporter) {
+          TestReporter.SPEC -> SpecReporter(useColor)
+          TestReporter.MINIMAL -> MinimalReporter(useColor)
+        }
       val allTestResults = mutableListOf<TestResults>()
 
       val junitDir = testOptions.junitDir
-      if (junitDir != null) {
+      junitDir?.toFile()?.mkdirs()
-        junitDir.toFile().mkdirs()
-      }
 
       for ((idx, moduleUri) in sources.withIndex()) {
         try {
@@ -80,8 +84,11 @@ constructor(
             failed = results.failed()
             isExampleWrittenFailure = results.isExampleWrittenFailure.and(isExampleWrittenFailure)
           }
-          reporter.report(results, consoleWriter)
+          val tmpWriter = StringWriter()
-          if (sources.size > 1 && idx != sources.size - 1) {
+          reporter.report(results, tmpWriter)
+          val report = tmpWriter.toString()
+          consoleWriter.write(report)
+          if (report.isNotEmpty() && sources.size > 1 && idx != sources.size - 1) {
             consoleWriter.append('\n')
           }
           consoleWriter.flush()
@@ -101,7 +108,7 @@ constructor(
             moduleNames += moduleName
 
             if (!testOptions.junitAggregateReports) {
-              JUnitReport().reportToPath(results, junitDir.resolve(moduleName))
+              JUnitReporter().reportToPath(results, junitDir.resolve(moduleName))
             }
           }
         } catch (ex: Exception) {
@@ -119,7 +126,7 @@ constructor(
       }
       if (testOptions.junitAggregateReports && junitDir != null) {
         val fileName = "${testOptions.junitAggregateSuiteName}.xml"
-        JUnitReport(testOptions.junitAggregateSuiteName)
+        JUnitReporter(testOptions.junitAggregateSuiteName)
           .summarizeToPath(allTestResults, junitDir.resolve(fileName))
       }
       consoleWriter.append('\n')

pkl-cli/src/main/kotlin/org/pkl/cli/repl/ReplMessages.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

pkl-cli/src/test/kotlin/org/pkl/cli/CliEvaluatorTest.kt

@@ -1295,7 +1295,7 @@ result = someLib.x
         CliBaseOptions(
           sourceModules = listOf(moduleUri),
           workingDir = tempDir,
-          caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+          caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
         )
       )
     val buffer = ByteArrayOutputStream()
@@ -1337,7 +1337,7 @@ result = someLib.x
         CliBaseOptions(
           sourceModules = listOf(moduleUri),
           workingDir = tempDir,
-          caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+          caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
           settings = settingsFile,
         )
       )
@@ -1367,7 +1367,7 @@ result = someLib.x
           workingDir = tempDir,
           moduleCacheDir = tempDir,
           noCache = true,
-          caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+          caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
           testPort = packageServer.port,
         )
       )
@@ -1473,7 +1473,7 @@ result = someLib.x
           sourceModules = listOf(URI("package://localhost:1/birds@0.5.0#/catalog/Ostrich.pkl")),
           noCache = true,
           httpProxy = URI(wwRuntimeInfo.httpBaseUrl),
-          caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+          caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
           allowedModules = SecurityManagers.defaultAllowedModules + Pattern.compile("http:"),
         )
       )
@@ -1614,6 +1614,24 @@ result = someLib.x
     assertThat(output).isEqualTo("result = 1\n")
   }
 
+  @Test
+  fun `eval configured http headers`(wwRuntimeInfo: WireMockRuntimeInfo) {
+    stubFor(get(anyUrl()).willReturn(ok("result = 1")))
+    val file = URI("${wwRuntimeInfo.httpBaseUrl}/foo.pkl")
+    val output =
+      evalToConsole(
+        CliEvaluatorOptions(
+          CliBaseOptions(
+            sourceModules = listOf(file),
+            httpHeaders = mapOf("**" to mapOf("X-Foo" to listOf("Foo"))),
+            allowedModules =
+              listOf(Pattern.compile("http:"), Pattern.compile("file:"), Pattern.compile("pkl:")),
+          )
+        )
+      )
+    verify(getRequestedFor(urlEqualTo("/foo.pkl")).withHeader("X-Foo", equalTo("Foo")))
+  }
+
   @Test
   fun `eval file with non-ASCII name`() {
     val tempDirUri = tempDir.toUri()
@@ -1754,6 +1772,32 @@ result = someLib.x
     )
   }
 
+  @Test
+  fun `eval dependency notation source`(@TempDir tempDir: Path) {
+    PackageServer.populateCacheDir(tempDir)
+    val projectPath =
+      FileTestUtils.rootProjectDir.resolve(
+        "pkl-commons-cli/src/main/resources/org/pkl/commons/cli/project1/"
+      )
+    val options =
+      CliEvaluatorOptions(
+        CliBaseOptions(
+          sourceModules = listOf(URI("@fruit/catalog/apple.pkl")),
+          projectDir = projectPath,
+          moduleCacheDir = tempDir,
+        )
+      )
+    val output = evalToConsole(options)
+    assertThat(output)
+      .isEqualTo(
+        """
+        name = "Apple 🍎"
+
+        """
+          .trimIndent()
+      )
+  }
+
   private fun evalModuleThatImportsPackage(certsFile: Path?, testPort: Int = -1) {
     val moduleUri =
       writePklFile(

pkl-cli/src/test/kotlin/org/pkl/cli/CliMainTest.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -169,4 +169,60 @@ class CliMainTest {
     link.createSymbolicLinkPointingTo(dir)
     return link
   }
+
+  @Test
+  fun `invalid http header glob pattern`() {
+    val ex =
+      assertThrows<BadParameterValue> {
+        rootCmd.parse(arrayOf("eval", "--http-header", "foo{{}}=bar:baz", "myModule.pkl"))
+      }
+    assertThat(ex.message)
+      .contains("Sub-patterns cannot be nested. To fix, remove or escape the inner `{` character.")
+  }
+
+  @Test
+  fun `forbidden http header name`() {
+    val ex =
+      assertThrows<BadParameterValue> {
+        rootCmd.parse(arrayOf("eval", "--http-header", "**=Connection: baz", "myModule.pkl"))
+      }
+    assertThat(ex.message).contains("HTTP header `Connection` is a reserved header")
+  }
+
+  @Test
+  fun `bad http header value`() {
+    val ex =
+      assertThrows<BadParameterValue> {
+        rootCmd.parse(arrayOf("eval", "--http-header", "**=X-Foo:🙃", "myModule.pkl"))
+      }
+    assertThat(ex.message).contains("HTTP header value `🙃` has invalid syntax")
+  }
+
+  @Test
+  fun `multiple headers`() {
+    val cmd = RootCommand()
+    cmd.parse(
+      arrayOf(
+        "eval",
+        "--http-header",
+        "**=X-Foo:Foo",
+        "--http-header",
+        "**=X-Foo:Foo2",
+        "--http-header",
+        "**=X-Bar:Bar",
+        "--http-header",
+        "https://example.com/**=X-Qux:Qux",
+        "pkl:base",
+      )
+    )
+
+    val evalCmd = cmd.registeredSubcommands().filterIsInstance<EvalCommand>().first()
+    assertThat(evalCmd.baseOptions.httpHeaders)
+      .isEqualTo(
+        mapOf(
+          "**" to mapOf("X-Foo" to listOf("Foo", "Foo2"), "X-Bar" to listOf("Bar")),
+          "https://example.com/**" to mapOf("X-Qux" to listOf("Qux")),
+        )
+      )
+  }
 }

pkl-cli/src/test/kotlin/org/pkl/cli/CliPackageDownloaderTest.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -44,7 +44,7 @@ class CliPackageDownloaderTest {
         baseOptions =
           CliBaseOptions(
             moduleCacheDir = tempDir,
-            caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+            caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
             testPort = server.port,
           ),
         packageUris =
@@ -83,7 +83,7 @@ class CliPackageDownloaderTest {
         baseOptions =
           CliBaseOptions(
             workingDir = tempDir,
-            caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+            caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
             testPort = server.port,
           ),
         packageUris = listOf(PackageUri("package://localhost:0/birds@0.5.0")),
@@ -103,7 +103,7 @@ class CliPackageDownloaderTest {
         baseOptions =
           CliBaseOptions(
             moduleCacheDir = tempDir,
-            caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+            caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
             testPort = server.port,
           ),
         packageUris =
@@ -124,7 +124,7 @@ class CliPackageDownloaderTest {
         baseOptions =
           CliBaseOptions(
             moduleCacheDir = tempDir,
-            caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+            caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
             testPort = server.port,
           ),
         packageUris =
@@ -165,7 +165,7 @@ class CliPackageDownloaderTest {
         baseOptions =
           CliBaseOptions(
             moduleCacheDir = tempDir,
-            caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+            caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
             testPort = server.port,
           ),
         packageUris = listOf(PackageUri("package://localhost:0/badChecksum@1.0.0")),
@@ -184,7 +184,7 @@ class CliPackageDownloaderTest {
         baseOptions =
           CliBaseOptions(
             moduleCacheDir = tempDir,
-            caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+            caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
             testPort = server.port,
           ),
         packageUris =
@@ -221,7 +221,7 @@ class CliPackageDownloaderTest {
         baseOptions =
           CliBaseOptions(
             moduleCacheDir = tempDir,
-            caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+            caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
             testPort = server.port,
           ),
         packageUris = listOf(PackageUri("package://localhost:0/birds@0.5.0")),

pkl-cli/src/test/kotlin/org/pkl/cli/CliProjectPackagerTest.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -763,6 +763,43 @@ class CliProjectPackagerTest {
       )
   }
 
+  @Test
+  fun `import path verification with glob imports`(@TempDir tempDir: Path) {
+    tempDir.writeFile(
+      "main.pkl",
+      """
+      import* "**.pkl" as foo
+
+      res = foo
+      """
+        .trimIndent(),
+    )
+    tempDir.writeFile(
+      "PklProject",
+      """
+      amends "pkl:Project"
+
+      package {
+        name = "mypackage"
+        version = "1.0.0"
+        baseUri = "package://example.com/mypackage"
+        packageZipUrl = "https://foo.com"
+      }
+      """
+        .trimIndent(),
+    )
+
+    CliProjectPackager(
+        CliBaseOptions(workingDir = tempDir),
+        listOf(tempDir),
+        CliTestOptions(),
+        ".out/%{name}@%{version}",
+        skipPublishCheck = true,
+        consoleWriter = StringWriter(),
+      )
+      .run()
+  }
+
   @Test
   @DisabledOnOs(OS.WINDOWS)
   fun `import path verification -- absolute read from root dir`(@TempDir tempDir: Path) {
@@ -930,7 +967,7 @@ class CliProjectPackagerTest {
         CliProjectPackager(
             CliBaseOptions(
               workingDir = tempDir,
-              caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+              caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
               testPort = packageServer.port,
             ),
             listOf(tempDir.resolve("project")),
@@ -974,7 +1011,7 @@ class CliProjectPackagerTest {
     CliProjectPackager(
         CliBaseOptions(
           workingDir = tempDir,
-          caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+          caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
           testPort = packageServer.port,
         ),
         listOf(tempDir.resolve("project")),

pkl-cli/src/test/kotlin/org/pkl/cli/CliProjectResolverTest.kt

@@ -87,7 +87,7 @@ class CliProjectResolverTest {
     CliProjectResolver(
         CliBaseOptions(
           workingDir = tempDir,
-          caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+          caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
           testPort = packageServer.port,
           noCache = true,
         ),
@@ -142,7 +142,7 @@ class CliProjectResolverTest {
     CliProjectResolver(
         CliBaseOptions(
           workingDir = tempDir,
-          caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+          caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
           testPort = packageServer.port,
           noCache = true,
         ),
@@ -240,7 +240,7 @@ class CliProjectResolverTest {
     )
     CliProjectResolver(
         CliBaseOptions(
-          caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+          caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
           testPort = packageServer.port,
           noCache = true,
         ),
@@ -322,7 +322,7 @@ class CliProjectResolverTest {
     val errOut = StringWriter()
     CliProjectResolver(
         CliBaseOptions(
-          caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+          caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
           testPort = packageServer.port,
           noCache = true,
         ),
@@ -397,7 +397,7 @@ class CliProjectResolverTest {
     val errOut = StringWriter()
     CliProjectResolver(
         CliBaseOptions(
-          caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+          caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
           testPort = packageServer.port,
           noCache = true,
         ),
@@ -484,7 +484,7 @@ class CliProjectResolverTest {
     assertThatCode {
         CliProjectResolver(
             CliBaseOptions(
-              caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+              caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
               testPort = packageServer.port,
               noCache = true,
             ),

pkl-codegen-java/src/main/kotlin/org/pkl/codegen/java/CliJavaCodeGenerator.kt

@@ -31,7 +31,7 @@ class CliJavaCodeGenerator(private val options: CliJavaCodeGeneratorOptions) :
     val builder = evaluatorBuilder()
     try {
       builder.build().use { evaluator ->
-        for (moduleUri in resolvedSourceModules) {
+        for (moduleUri in options.base.normalizedSourceModules) {
           val schema = evaluator.evaluateSchema(ModuleSource.uri(moduleUri))
           val codeGenerator = JavaCodeGenerator(schema, options.toJavaCodeGeneratorOptions())
           try {

pkl-codegen-java/src/main/kotlin/org/pkl/codegen/java/JavaCodeGenerator.kt

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-@file:Suppress("unused")
+@file:Suppress("unused", "CanConvertToMultiDollarString")
 
 package org.pkl.codegen.java
 
@@ -172,7 +172,7 @@ class JavaCodeGenerator(
       val annotation = codegenOptions.nonNullAnnotation
       val className =
         if (annotation == null) {
-          ClassName.get("org.pkl.config.java.mapper", "NonNull")
+          ClassName.get("org.jspecify.annotations", "NonNull")
         } else {
           toClassName(annotation)
         }

pkl-codegen-java/src/main/kotlin/org/pkl/codegen/java/Main.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

pkl-codegen-java/src/test/kotlin/org/pkl/codegen/java/JavaCodeGeneratorTest.kt

@@ -1549,8 +1549,9 @@ class JavaCodeGeneratorTest {
 
     // not worthwhile to add spring & spring boot dependency just so that this test can compile
     // their annotations
-    val javaCodeWithoutSpringAnnotations =
+    val javaCodeWithoutSpringAnnotations = javaCode.deleteLines {
-      javaCode.deleteLines { it.contains("ConfigurationProperties") }
+      it.contains("ConfigurationProperties")
+    }
     assertThat(javaCodeWithoutSpringAnnotations).compilesSuccessfully()
   }
 

pkl-codegen-java/src/test/resources/org/pkl/codegen/java/GenerateGetters.jva

@@ -5,8 +5,8 @@ import java.lang.Override;
 import java.lang.String;
 import java.lang.StringBuilder;
 import java.util.Objects;
+import org.jspecify.annotations.NonNull;
 import org.pkl.config.java.mapper.Named;
-import org.pkl.config.java.mapper.NonNull;
 import org.pkl.core.DataSize;
 import org.pkl.core.Duration;
 

pkl-codegen-java/src/test/resources/org/pkl/codegen/java/Inheritance.jva

@@ -5,8 +5,8 @@ import java.lang.Override;
 import java.lang.String;
 import java.lang.StringBuilder;
 import java.util.Objects;
+import org.jspecify.annotations.NonNull;
 import org.pkl.config.java.mapper.Named;
-import org.pkl.config.java.mapper.NonNull;
 import org.pkl.core.Duration;
 
 public final class Mod {

pkl-codegen-java/src/test/resources/org/pkl/codegen/java/Javadoc.jva

@@ -5,8 +5,8 @@ import java.lang.Override;
 import java.lang.String;
 import java.lang.StringBuilder;
 import java.util.Objects;
+import org.jspecify.annotations.NonNull;
 import org.pkl.config.java.mapper.Named;
-import org.pkl.config.java.mapper.NonNull;
 
 /**
  * module comment.

pkl-codegen-java/src/test/resources/org/pkl/codegen/java/PropertyTypes.jva

@@ -11,8 +11,8 @@ import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
 import java.util.regex.Pattern;
+import org.jspecify.annotations.NonNull;
 import org.pkl.config.java.mapper.Named;
-import org.pkl.config.java.mapper.NonNull;
 import org.pkl.core.DataSize;
 import org.pkl.core.DataSizeUnit;
 import org.pkl.core.Duration;

pkl-codegen-kotlin/src/main/kotlin/org/pkl/codegen/kotlin/CliKotlinCodeGenerator.kt

@@ -32,7 +32,7 @@ class CliKotlinCodeGenerator(private val options: CliKotlinCodeGeneratorOptions)
 
     try {
       builder.build().use { evaluator ->
-        for (moduleUri in resolvedSourceModules) {
+        for (moduleUri in options.base.normalizedSourceModules) {
           val schema = evaluator.evaluateSchema(ModuleSource.uri(moduleUri))
           val codeGenerator = KotlinCodeGenerator(schema, options.toKotlinCodeGeneratorOptions())
           try {

pkl-codegen-kotlin/src/main/kotlin/org/pkl/codegen/kotlin/Main.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

pkl-codegen-kotlin/src/test/kotlin/org/pkl/codegen/kotlin/CliKotlinCodeGeneratorTest.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

pkl-codegen-kotlin/src/test/kotlin/org/pkl/codegen/kotlin/KotlinCodeGeneratorTest.kt

@@ -1464,8 +1464,9 @@ class KotlinCodeGeneratorTest {
 
     // not worthwhile to add spring & spring boot dependency just so that this test can compile
     // their annotations
-    val kotlinCodeWithoutSpringAnnotations =
+    val kotlinCodeWithoutSpringAnnotations = kotlinCode.deleteLines {
-      kotlinCode.deleteLines { it.contains("ConfigurationProperties") }
+      it.contains("ConfigurationProperties")
+    }
     assertThat(kotlinCodeWithoutSpringAnnotations).compilesSuccessfully()
   }
 

pkl-commons-cli/pkl-commons-cli.gradle.kts

@@ -19,10 +19,11 @@ plugins {
   id("pklPublishLibrary")
 }
 
-val svmClasspath: Configuration by configurations.creating
+val svmClasspath: Configuration = configurations.create("svmClasspath")
 
 // used by pklNativeExecutable.gradle.kts
-@Suppress("unused") val svm: SourceSet by sourceSets.creating { compileClasspath = svmClasspath }
+@Suppress("unused")
+val svm: SourceSet = sourceSets.create("svm") { compileClasspath = svmClasspath }
 
 dependencies {
   api(projects.pklCore)

pkl-commons-cli/src/main/kotlin/org/pkl/commons/cli/CliBaseOptions.kt

@@ -144,11 +144,14 @@ data class CliBaseOptions(
   /** URL prefixes to rewrite. */
   val httpRewrites: Map<URI, URI>? = null,
 
+  /** HTTP headers to add to the request. */
+  val httpHeaders: Map<String, Map<String, List<String>>>? = null,
+
   /** External module reader process specs */
-  val externalModuleReaders: Map<String, ExternalReader> = mapOf(),
+  val externalModuleReaders: Map<String, ExternalReader>? = null,
 
   /** External resource reader process specs */
-  val externalResourceReaders: Map<String, ExternalReader> = mapOf(),
+  val externalResourceReaders: Map<String, ExternalReader>? = null,
 
   /** Defines options for the formatting of calls to the trace() method. */
   val traceMode: TraceMode? = null,
@@ -186,14 +189,13 @@ data class CliBaseOptions(
     sourceModules
       .map { uri ->
         if (uri.isAbsolute) uri
-        else if (uri.path.startsWith("@") && !noProject && normalizedProjectFile != null) uri
+        else if (uri.path.startsWith("@")) uri
         else IoUtils.resolve(normalizedWorkingDir.toUri(), uri)
       }
       // sort modules to make cli output independent of source module order
       .sorted()
 
-  val normalizedSettingsModule: URI? =
+  val normalizedSettingsModule: URI? = settings?.let { uri ->
-    settings?.let { uri ->
     if (uri.isAbsolute) uri else IoUtils.resolve(normalizedWorkingDir.toUri(), uri)
   }
 

pkl-commons-cli/src/main/kotlin/org/pkl/commons/cli/CliCommand.kt

@@ -86,36 +86,6 @@ abstract class CliCommand(protected val cliOptions: CliBaseOptions) {
     }
   }
 
-  protected fun resolveModuleUri(uri: URI): URI =
-    if (uri.isAbsolute) uri
-    else { // must be @dep/mod.pkl notation!!
-      if (!uri.path.startsWith('@'))
-        throw CliBugException(
-          RuntimeException("tried to resolve project URI `$uri` with no @ prefix")
-        )
-      if (project == null)
-        throw CliBugException(
-          RuntimeException("tried to resolve project URI `$uri` with no project present")
-        )
-      val dep = uri.path.substringBefore('/').drop(1)
-      val path = uri.path.dropWhile { it != '/' }
-      if (path.isEmpty()) throw CliException("Invalid project dependency URI `$uri`.")
-
-      val remoteDep =
-        project!!.dependencies.remoteDependencies()[dep]
-          ?: if (project!!.dependencies.localDependencies().containsKey(dep))
-            throw CliException(
-              "Only remote project dependencies may be referenced using @-notation. Dependency `@$dep` is a local dependency."
-            )
-          else throw CliException("Project does not contain dependency `@$dep`.")
-      remoteDep.packageUri.toPackageAssetUri(path).uri
-    }
-
-  protected val resolvedSourceModules: List<URI> by lazy {
-    if (project == null) cliOptions.normalizedSourceModules
-    else cliOptions.normalizedSourceModules.map(::resolveModuleUri)
-  }
-
   protected fun loadProject(projectFile: Path): Project {
     val securityManager =
       SecurityManagers.standard(
@@ -140,7 +110,7 @@ abstract class CliCommand(protected val cliOptions: CliBaseOptions) {
 
   private val evaluatorSettings: PklEvaluatorSettings? by lazy {
     @Suppress("PklCliDirectProjectEvaluatorSettingsAccess")
-    if (cliOptions.omitProjectSettings) null else project?.evaluatorSettings
+    if (cliOptions.omitProjectSettings) null else project?.resolvedEvaluatorSettings
   }
 
   protected val allowedModules: List<Pattern> by lazy {
@@ -215,15 +185,19 @@ abstract class CliCommand(protected val cliOptions: CliBaseOptions) {
   }
 
   protected val httpRewrites: Map<URI, URI>? by lazy {
-    cliOptions.httpRewrites ?: evaluatorSettings?.http?.rewrites ?: settings.http?.rewrites()
+    cliOptions.httpRewrites ?: evaluatorSettings?.http?.rewrites ?: settings.http?.rewrites
+  }
+
+  private val httpHeaders: Map<String, Map<String, List<String>>>? by lazy {
+    cliOptions.httpHeaders ?: evaluatorSettings?.http?.headers ?: settings.http?.headers
   }
 
   protected val externalModuleReaders: Map<String, PklEvaluatorSettings.ExternalReader> by lazy {
-    (evaluatorSettings?.externalModuleReaders ?: emptyMap()) + cliOptions.externalModuleReaders
+    cliOptions.externalModuleReaders ?: evaluatorSettings?.externalModuleReaders ?: mapOf()
   }
 
   protected val externalResourceReaders: Map<String, PklEvaluatorSettings.ExternalReader> by lazy {
-    (evaluatorSettings?.externalResourceReaders ?: emptyMap()) + cliOptions.externalResourceReaders
+    cliOptions.externalResourceReaders ?: evaluatorSettings?.externalResourceReaders ?: mapOf()
   }
 
   private val externalProcesses:
@@ -277,6 +251,7 @@ abstract class CliCommand(protected val cliOptions: CliBaseOptions) {
         setProxy(proxyAddress, noProxy ?: listOf())
       }
       httpRewrites?.let(::setRewrites)
+      httpHeaders?.let(::setHeaders)
       // Lazy building significantly reduces execution time of commands that do minimal work.
       // However, it means that HTTP client initialization errors won't surface until an HTTP
       // request is made.
@@ -307,6 +282,7 @@ abstract class CliCommand(protected val cliOptions: CliBaseOptions) {
       add(ResourceReaders.modulePath(modulePathResolver))
       add(ResourceReaders.pkg())
       add(ResourceReaders.projectpackage())
+      addAll(ResourceReaders.fromServiceProviders())
       add(ResourceReaders.file())
       add(ResourceReaders.http())
       add(ResourceReaders.https())

pkl-commons-cli/src/main/kotlin/org/pkl/commons/cli/CliTestOptions.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -22,4 +22,5 @@ class CliTestOptions(
   val overwrite: Boolean = false,
   val junitAggregateReports: Boolean = false,
   val junitAggregateSuiteName: String = "pkl-tests",
+  val reporter: TestReporter = TestReporter.default,
 )

pkl-commons-cli/src/main/kotlin/org/pkl/commons/cli/TestReporter.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -13,15 +13,13 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.pkl.core.util;
+package org.pkl.commons.cli
 
-import java.lang.annotation.*;
+enum class TestReporter {
-import javax.annotation.meta.TypeQualifierNickname;
+  SPEC,
-import javax.annotation.meta.When;
+  MINIMAL;
 
-@Target({ElementType.TYPE_PARAMETER, ElementType.TYPE_USE})
+  companion object {
-@Retention(RetentionPolicy.RUNTIME)
+    @JvmStatic val default: TestReporter = SPEC
-@Documented
+  }
-@javax.annotation.Nonnull(when = When.ALWAYS)
+}
-@TypeQualifierNickname
-public @interface Nonnull {}

pkl-commons-cli/src/main/kotlin/org/pkl/commons/cli/commands/BaseOptions.kt

@@ -35,6 +35,7 @@ import org.pkl.core.evaluatorSettings.Color
 import org.pkl.core.evaluatorSettings.PklEvaluatorSettings.ExternalReader
 import org.pkl.core.evaluatorSettings.TraceMode
 import org.pkl.core.runtime.VmUtils
+import org.pkl.core.util.GlobResolver
 import org.pkl.core.util.IoUtils
 
 @Suppress("MemberVisibilityCanBePrivate")
@@ -54,7 +55,8 @@ class BaseOptions : OptionGroup() {
             if (IoUtils.isUriLike(moduleName)) URI(moduleName)
             // Can't just use URI constructor, because URI(null, null, "C:/foo/bar", null) turns
             // into `URI("C", null, "/foo/bar", null)`.
-            else if (IoUtils.isWindowsAbsolutePath(moduleName)) Path.of(moduleName).toUri()
+            else if (IoUtils.isWindows() && IoUtils.isWindowsAbsolutePath(moduleName))
+              Path.of(moduleName).toUri()
             else URI(null, null, IoUtils.toNormalizedPathString(Path.of(moduleName)), null)
           } catch (e: URISyntaxException) {
             val message = buildString {
@@ -90,9 +92,11 @@ class BaseOptions : OptionGroup() {
     > {
       return splitPair(delimiter).convert {
         val cmd = shlex(it.second)
-        Pair(it.first, ExternalReader(cmd.first(), cmd.drop(1)))
+        Pair(it.first, ExternalReader(cmd.first(), cmd.drop(1), null))
       }
     }
+
+    private val headerRegex = Regex("""^(.+?):[ \t]*(.*)$""")
   }
 
   private val defaults = CliBaseOptions()
@@ -285,6 +289,37 @@ class BaseOptions : OptionGroup() {
       .multiple()
       .toMap()
 
+  val httpHeaders: Map<String, Map<String, List<String>>> by
+    option(
+        names = arrayOf("--http-header"),
+        metavar = "<url-pattern>=<header name>:<header value>",
+        help = "HTTP header to add to the request.",
+      )
+      .splitPair()
+      .transformAll { pairs ->
+        buildMap<String, MutableMap<String, MutableList<String>>> {
+          for ((pattern, headerNameAndValue) in pairs) {
+            try {
+              GlobResolver.toRegexPattern(pattern)
+            } catch (e: GlobResolver.InvalidGlobPatternException) {
+              fail(e.message!!)
+            }
+            val (headerName, headerValue) =
+              headerRegex.find(headerNameAndValue)?.destructured
+                ?: fail("Header '$headerNameAndValue' is not in 'name:value' format.")
+            try {
+              IoUtils.validateHeaderName(headerName)
+              IoUtils.validateHeaderValue(headerValue)
+            } catch (e: IllegalArgumentException) {
+              fail(e.message!!)
+            }
+            getOrPut(pattern) { mutableMapOf() }
+              .getOrPut(headerName) { mutableListOf() }
+              .add(headerValue)
+          }
+        }
+      }
+
   val externalModuleReaders: Map<String, ExternalReader> by
     option(
         names = arrayOf("--external-module-reader"),
@@ -351,8 +386,9 @@ class BaseOptions : OptionGroup() {
       httpProxy = proxy,
       httpNoProxy = noProxy,
       httpRewrites = httpRewrites.ifEmpty { null },
-      externalModuleReaders = externalModuleReaders,
+      httpHeaders = httpHeaders.ifEmpty { null },
-      externalResourceReaders = externalResourceReaders,
+      externalModuleReaders = externalModuleReaders.ifEmpty { null },
+      externalResourceReaders = externalResourceReaders.ifEmpty { null },
       traceMode = traceMode,
       powerAssertionsEnabled = powerAssertionsEnabled,
     )

pkl-commons-cli/src/main/kotlin/org/pkl/commons/cli/commands/TestOptions.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,9 +19,11 @@ import com.github.ajalt.clikt.parameters.groups.OptionGroup
 import com.github.ajalt.clikt.parameters.options.default
 import com.github.ajalt.clikt.parameters.options.flag
 import com.github.ajalt.clikt.parameters.options.option
+import com.github.ajalt.clikt.parameters.types.enum
 import com.github.ajalt.clikt.parameters.types.path
 import java.nio.file.Path
 import org.pkl.commons.cli.CliTestOptions
+import org.pkl.commons.cli.TestReporter
 
 class TestOptions : OptionGroup() {
   private val junitReportDir: Path? by
@@ -51,7 +53,19 @@ class TestOptions : OptionGroup() {
   private val overwrite: Boolean by
     option(names = arrayOf("--overwrite"), help = "Force generation of expected examples.").flag()
 
+  private val reporter: TestReporter by
+    option(names = arrayOf("--test-reporter"), help = "Which test reporter to use for CLI output.")
+      .enum<TestReporter> { it.name.lowercase() }
+      .single()
+      .default(TestReporter.default)
+
   val cliTestOptions: CliTestOptions by lazy {
-    CliTestOptions(junitReportDir, overwrite, junitAggregateReports, junitAggregateSuiteName)
+    CliTestOptions(
+      junitReportDir,
+      overwrite,
+      junitAggregateReports,
+      junitAggregateSuiteName,
+      reporter,
+    )
   }
 }

pkl-commons-cli/src/main/resources/org/pkl/commons/cli/project1/PklProject

@@ -0,0 +1,5 @@
+amends "pkl:Project"
+
+dependencies {
+  ["fruit"] { uri = "package://localhost:0/fruit@1.1.0" }
+}

pkl-commons-cli/src/main/resources/org/pkl/commons/cli/project1/PklProject.deps.json

@@ -0,0 +1,12 @@
+{
+  "schemaVersion": 1,
+  "resolvedDependencies": {
+    "package://localhost:0/fruit@1": {
+      "type": "remote",
+      "uri": "projectpackage://localhost:0/fruit@1.1.0",
+      "checksums": {
+        "sha256": "$skipChecksumVerification"
+      }
+    }
+  }
+}

pkl-commons-cli/src/test/kotlin/org/pkl/commons/cli/BaseCommandTest.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -98,17 +98,17 @@ class BaseCommandTest {
     assertThat(cmd.baseOptions.externalModuleReaders)
       .isEqualTo(
         mapOf(
-          "scheme3" to ExternalReader("reader3", emptyList()),
+          "scheme3" to ExternalReader("reader3", emptyList(), null),
-          "scheme4" to ExternalReader("reader4", listOf("with", "args")),
+          "scheme4" to ExternalReader("reader4", listOf("with", "args"), null),
-          "scheme+ext" to ExternalReader("reader5", listOf("with", "args")),
+          "scheme+ext" to ExternalReader("reader5", listOf("with", "args"), null),
         )
       )
     assertThat(cmd.baseOptions.externalResourceReaders)
       .isEqualTo(
         mapOf(
-          "scheme1" to ExternalReader("reader1", emptyList()),
+          "scheme1" to ExternalReader("reader1", emptyList(), null),
-          "scheme2" to ExternalReader("reader2", listOf("with", "args")),
+          "scheme2" to ExternalReader("reader2", listOf("with", "args"), null),
-          "scheme+ext" to ExternalReader("reader5", listOf("with", "args")),
+          "scheme+ext" to ExternalReader("reader5", listOf("with", "args"), null),
         )
       )
   }

pkl-commons-cli/src/test/kotlin/org/pkl/commons/cli/CliCommandTest.kt

@@ -17,13 +17,10 @@ package org.pkl.commons.cli
 
 import com.github.ajalt.clikt.core.parse
 import com.github.ajalt.clikt.parameters.groups.provideDelegate
-import java.net.URI
 import java.nio.file.Path
 import kotlin.io.path.ExperimentalPathApi
-import kotlin.io.path.writeText
 import org.assertj.core.api.Assertions.assertThat
 import org.junit.jupiter.api.Test
-import org.junit.jupiter.api.assertThrows
 import org.junit.jupiter.api.condition.DisabledOnJre
 import org.junit.jupiter.api.condition.JRE
 import org.junit.jupiter.api.io.TempDir
@@ -31,12 +28,12 @@ import org.pkl.commons.cli.commands.BaseCommand
 import org.pkl.commons.cli.commands.ProjectOptions
 import org.pkl.commons.writeString
 import org.pkl.core.SecurityManagers
+import org.pkl.core.evaluatorSettings.PklEvaluatorSettings
 import org.pkl.core.evaluatorSettings.TraceMode
 import org.pkl.core.util.IoUtils
 
 @OptIn(ExperimentalPathApi::class)
 class CliCommandTest {
-
   private val cmd =
     object : BaseCommand("test", "") {
       val projectOptions: ProjectOptions by ProjectOptions()
@@ -49,7 +46,6 @@ class CliCommandTest {
   class CliTest(options: CliBaseOptions) : CliCommand(options) {
     override fun doRun() = Unit
 
-    val myResolvedSourceModules = resolvedSourceModules
     val myAllowedModules = allowedModules
     val myAllowedResources = allowedResources
     val myRootDir = rootDir
@@ -98,114 +94,6 @@ class CliCommandTest {
       )
   }
 
-  @Test
-  fun `@-notation package URIs - treated as relative paths when no project present`(
-    @TempDir tempDir: Path
-  ) {
-    cmd.parse(arrayOf("--working-dir=$tempDir"))
-    val opts = cmd.baseOptions.baseOptions(listOf(URI("@foo/bar.pkl")), testMode = true)
-    val cliTest = CliTest(opts)
-    assertThat(cliTest.myResolvedSourceModules)
-      .isEqualTo(listOf(tempDir.toUri().resolve("@foo/bar.pkl")))
-  }
-
-  @Test
-  fun `@-notation package URIs - empty paths are rejected`(@TempDir tempDir: Path) {
-    tempDir
-      .resolve("PklProject")
-      .writeText(
-        """
-        amends "pkl:Project"
-        """
-          .trimIndent()
-      )
-    cmd.parse(arrayOf("--working-dir=$tempDir"))
-    val opts = cmd.baseOptions.baseOptions(listOf(URI("@no.slash")), testMode = true)
-    val exc = assertThrows<CliException> { CliTest(opts) }
-    assertThat(exc.message).isEqualTo("Invalid project dependency URI `@no.slash`.")
-  }
-
-  @Test
-  fun `@-notation package URIs - missing dependencies are rejected`(@TempDir tempDir: Path) {
-    tempDir
-      .resolve("PklProject")
-      .writeText(
-        """
-        amends "pkl:Project"
-        """
-          .trimIndent()
-      )
-    cmd.parse(arrayOf("--working-dir=$tempDir"))
-    val opts = cmd.baseOptions.baseOptions(listOf(URI("@foo/bar.pkl")), testMode = true)
-    val exc = assertThrows<CliException> { CliTest(opts) }
-    assertThat(exc.message).isEqualTo("Project does not contain dependency `@foo`.")
-  }
-
-  @Test
-  fun `@-notation package URIs - local dependencies are rejected`(
-    @TempDir tempDir: Path,
-    @TempDir depDir: Path,
-  ) {
-    depDir
-      .resolve("PklProject")
-      .writeText(
-        """
-        amends "pkl:Project"
-
-        package {
-          name = "foo"
-          baseUri = "package://example.com/foo"
-          version = "0.0.1"
-          packageZipUrl = "https://example.com/foo@\(version).zip"
-        }
-        """
-          .trimIndent()
-      )
-
-    tempDir
-      .resolve("PklProject")
-      .writeText(
-        """
-      amends "pkl:Project"
-
-      dependencies {
-        ["foo"] = import("${depDir.toUri().resolve("PklProject")}")
-      }
-    """
-          .trimIndent()
-      )
-    cmd.parse(arrayOf("--working-dir=$tempDir"))
-    val opts = cmd.baseOptions.baseOptions(listOf(URI("@foo/bar.pkl")), testMode = true)
-    val exc = assertThrows<CliException> { CliTest(opts) }
-    assertThat(exc.message)
-      .isEqualTo(
-        "Only remote project dependencies may be referenced using @-notation. Dependency `@foo` is a local dependency."
-      )
-  }
-
-  @Test
-  fun `@-notation package URIs - remote dependencies are resolved`(@TempDir tempDir: Path) {
-    tempDir
-      .resolve("PklProject")
-      .writeText(
-        """
-        amends "pkl:Project"
-
-        dependencies {
-          ["foo"] {
-            uri = "package://example.com/foo@1.2.3"
-          }
-        }
-        """
-          .trimIndent()
-      )
-    cmd.parse(arrayOf("--working-dir=$tempDir"))
-    val opts = cmd.baseOptions.baseOptions(listOf(URI("@foo/bar.pkl")), testMode = true)
-    val cliTest = CliTest(opts)
-    assertThat(cliTest.myResolvedSourceModules)
-      .isEqualTo(listOf(tempDir.toUri().resolve("package://example.com/foo@1.2.3#/bar.pkl")))
-  }
-
   val projectWithAllEvaluatorSettings =
     """
     amends "pkl:Project"
@@ -284,4 +172,32 @@ class CliCommandTest {
           .isNotNull
       }
   }
+
+  @Test
+  fun `--external-module-reader blows away PklProject externalModuleReaders`(
+    @TempDir tempDir: Path
+  ) {
+    tempDir
+      .resolve("PklProject")
+      .writeString(
+        // language=pkl
+        """
+        amends "pkl:Project"
+
+        evaluatorSettings {
+          externalModuleReaders {
+            ["foo"] {
+              executable = "foo"
+            }
+          }
+        }
+        """
+          .trimIndent()
+      )
+    cmd.parse(arrayOf("--external-module-reader", "bar=bar"))
+    val opts = cmd.baseOptions.baseOptions(emptyList(), null, true)
+    val cliTest = CliTest(opts)
+    assertThat(cliTest.myExternalModuleReaders)
+      .isEqualTo(mapOf("bar" to PklEvaluatorSettings.ExternalReader("bar", listOf(), null)))
+  }
 }

pkl-commons-test/pkl-commons-test.gradle.kts

@@ -37,7 +37,7 @@ dependencies {
  * These packages are used by PackageServer to serve assets when running LanguageSnippetTests and
  * PackageResolversTest.
  */
-val createTestPackages by tasks.registering
+val createTestPackages = tasks.register("createTestPackages")
 
 // make sure that declaring a dependency on this project suffices to have test fixtures generated
 tasks.processResources {
@@ -92,8 +92,8 @@ val keystoreName = "localhost.p12"
 val keystoreFile = keystoreDir.map { it.file(keystoreName) }
 val certsFileName = "localhost.pem"
 
-val generateKeys by
+val generateKeys =
-  tasks.registering(JavaExec::class) {
+  tasks.register<JavaExec>("generateKeys") {
     outputs.file(keystoreFile)
     mainClass.set("sun.security.tools.keytool.Main")
     args =
@@ -117,8 +117,8 @@ val generateKeys by
     }
   }
 
-val exportCerts by
+val exportCerts =
-  tasks.registering(JavaExec::class) {
+  tasks.register<JavaExec>("exportCerts") {
     val outputFile = keystoreDir.map { it.file(certsFileName) }
     dependsOn(generateKeys)
     inputs.file(keystoreFile)

pkl-commons-test/src/main/kotlin/org/pkl/commons/test/Executables.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -57,7 +57,6 @@ object Executables {
 
   object pkl : ExecutablePaths("pkl-cli") {
     val macAarch64: Path = executable("pkl-macos-aarch64")
-    val macAmd64: Path = executable("pkl-macos-amd64")
     val linuxAarch64: Path = executable("pkl-linux-aarch64")
     val linuxAmd64: Path = executable("pkl-linux-amd64")
     val alpineAmd64: Path = executable("pkl-alpine-linux-amd64")
@@ -65,12 +64,11 @@ object Executables {
 
     // order (aarch64 before amd64, linux before alpine) affects [firstExisting]
     override val allNative: List<Path> =
-      listOf(macAarch64, macAmd64, linuxAarch64, linuxAmd64, alpineAmd64, windowsAmd64)
+      listOf(macAarch64, linuxAarch64, linuxAmd64, alpineAmd64, windowsAmd64)
   }
 
   object pkldoc : ExecutablePaths("pkl-doc") {
     val macAarch64: Path = executable("pkldoc-macos-aarch64")
-    val macAmd64: Path = executable("pkldoc-macos-amd64")
     val linuxAarch64: Path = executable("pkldoc-linux-aarch64")
     val linuxAmd64: Path = executable("pkldoc-linux-amd64")
     val alpineAmd64: Path = executable("pkldoc-alpine-linux-amd64")
@@ -80,6 +78,6 @@ object Executables {
 
     // order (aarch64 before amd64, linux before alpine) affects [firstExisting]
     override val allNative: List<Path> =
-      listOf(macAarch64, macAmd64, linuxAarch64, linuxAmd64, alpineAmd64, windowsAmd64)
+      listOf(macAarch64, linuxAarch64, linuxAmd64, alpineAmd64, windowsAmd64)
   }
 }