Bump com.squareup:kotlinpoet from 1.6.0 to 2.3.0

Bumps [com.squareup:kotlinpoet](https://github.com/square/kotlinpoet) from 1.6.0 to 2.3.0. - [Release notes](https://github.com/square/kotlinpoet/releases) - [Changelog](https://github.com/square/kotlinpoet/blob/main/docs/changelog.md) - [Commits](https://github.com/square/kotlinpoet/compare/1.6.0...2.3.0) --- updated-dependencies: - dependency-name: com.squareup:kotlinpoet dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
SPICE-0028: Add support for multi-line string line continuations (#1507 )
2026-05-25 16:19:20 +02:00 · 2026-04-23 15:16:03 +00:00 · 2026-04-21 10:29:52 -07:00 · 2026-04-20 22:28:57 -07:00 · 2026-04-20 22:02:13 -07:00 · 2026-04-20 11:30:30 -07:00
2526 changed files with 168549 additions and 15193 deletions
@@ -1,168 +0,0 @@
-//===----------------------------------------------------------------------===//
-// Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//===----------------------------------------------------------------------===// 
-// File gets rendered to .circleci/config.yml via git hook.
-amends "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.circleci@1.2.0#/PklCI.pkl"
-
-import "jobs/BuildNativeJob.pkl"
-import "jobs/GradleCheckJob.pkl"
-import "jobs/DeployJob.pkl"
-import "jobs/SimpleGradleJob.pkl"
-
-local prbJobs: Listing<String> = gradleCheckJobs.keys.toListing()
-
-local buildAndTestJobs = (prbJobs) {
-  "bench"
-  "gradle-compatibility"
-  ...buildNativeJobs.keys.filter((it) -> it.endsWith("snapshot"))
-}
-
-local releaseJobs = (prbJobs) {
-  "bench"
-  "gradle-compatibility"
-  ...buildNativeJobs.keys.filter((it) -> it.endsWith("release"))
-}
-
-prb {
-  jobs = prbJobs
-}
-
-main {
-  jobs {
-    ...buildAndTestJobs
-    new {
-      ["deploy-snapshot"] {
-        requires = buildAndTestJobs
-        context = "pkl-maven-release"
-      }
-    }
-  }
-}
-
-release {
-  jobs {
-    ...releaseJobs
-    // do GitHub release first because we can overwrite the tag.
-    // publishing to Maven Central is final.
-    new {
-      ["github-release"] {
-        requires = releaseJobs
-        context = "pkl-github-release"
-      }
-    }
-    new {
-      ["deploy-release"] {
-        requires { "github-release" }
-        context = "pkl-maven-release"
-      }
-    }
-  }
-}
-
-releaseBranch {
-  jobs = releaseJobs
-}
-
-triggerDocsBuild = "both"
-
-triggerPackageDocsBuild = "release"
-
-local buildNativeJobs: Mapping<String, BuildNativeJob> = new {
-  for (_dist in List("release", "snapshot")) {
-    for (_project in List("pkl-cli", "pkl-doc")) {
-      for (_arch in List("amd64", "aarch64")) {
-        for (_os in List("macOS", "linux")) {
-          ["\(_project)-\(_os)-\(_arch)-\(_dist)"] {
-            arch = _arch
-            os = _os
-            isRelease = _dist == "release"
-            project = _project
-          }
-        }
-      }
-      ["\(_project)-linux-alpine-amd64-\(_dist)"] {
-        arch = "amd64"
-        os = "linux"
-        musl = true
-        isRelease = _dist == "release"
-        project = _project
-      }
-      ["\(_project)-windows-amd64-\(_dist)"] {
-        arch = "amd64"
-        os = "windows"
-        isRelease = _dist == "release"
-        project = _project
-      }
-    }
-  }
-}
-
-local gradleCheckJobs: Mapping<String, GradleCheckJob> = new {
-  ["gradle-check"] {
-    javaVersion = "21.0"
-    isRelease = false
-    os = "linux"
-  }
-  ["gradle-check-windows"] {
-    javaVersion = "21.0"
-    isRelease = false
-    os = "windows"
-  }
-}
-
-jobs {
-  for (jobName, job in buildNativeJobs) {
-    [jobName] = job.job
-  }
-  for (jobName, job in gradleCheckJobs) {
-    [jobName] = job.job
-  }
-  ["bench"] = new SimpleGradleJob { command = "bench:jmh" }.job
-  ["gradle-compatibility"] = new SimpleGradleJob {
-    name = "gradle compatibility"
-    command = #"""
-      :pkl-gradle:build \
-        :pkl-gradle:compatibilityTestReleases
-      """#
-  }.job
-  ["deploy-snapshot"] = new DeployJob { command = "publishToSonatype" }.job
-  ["deploy-release"] = new DeployJob {
-    isRelease = true
-    command = "publishToSonatype closeAndReleaseSonatypeStagingRepository"
-  }.job
-  ["github-release"] {
-    docker {
-      new { image = "maniator/gh:v2.40.1" }
-    }
-    steps {
-      new AttachWorkspaceStep { at = "." }
-      new RunStep {
-        name = "Publish release on GitHub"
-        command = #"""
-          # exclude build_artifacts.txt from publish
-          rm -f */build/executable/*.build_artifacts.txt
-          find */build/executable/* -type d | xargs rm -rf 
-          gh release create "${CIRCLE_TAG}" \
-            --title "${CIRCLE_TAG}" \
-            --target "${CIRCLE_SHA1}" \
-            --verify-tag \
-            --notes "Release notes: https://pkl-lang.org/main/current/release-notes/changelog.html#release-${CIRCLE_TAG}" \
-            --repo "${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}" \
-            */build/executable/*
-          """#
-      }
-    }
-  }
-}
@@ -1,192 +0,0 @@
-//===----------------------------------------------------------------------===//
-// Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//===----------------------------------------------------------------------===//
-/// Builds the native `pkl` CLI
-extends "GradleJob.pkl"
-
-import "package://pkg.pkl-lang.org/pkl-pantry/com.circleci.v2@1.5.0#/Config.pkl"
-
-/// The architecture to use
-arch: "amd64"|"aarch64"
-
-/// Whether to link to musl. Otherwise, links to glibc.
-musl: Boolean = false
-
-/// The Gradle project under which to generate the executable
-project: String
-
-javaVersion = "21.0"
-
-extraGradleArgs {
-  when (os == "macOS" && arch == "amd64") {
-    "-Dpkl.targetArch=\(arch)"
-  }
-  when (musl) {
-    "-Dpkl.musl=true"
-  }
-}
-
-local setupLinuxEnvironment: Config.RunStep =
-  let (muslVersion = "1.2.2")
-  let (zlibVersion = "1.2.13")
-    new {
-      name = "Set up environment"
-      shell = "#!/bin/bash -exo pipefail"
-      command = new Listing {
-        #"""
-        sed -ie '/\[ol8_codeready_builder\]/,/^$/s/enabled=0/enabled=1/g' /etc/yum.repos.d/oracle-linux-ol8.repo \
-          && microdnf -y install util-linux tree coreutils-single findutils curl tar gzip git zlib-devel gcc-c++ make openssl glibc-langpack-en libstdc++-static \
-          && microdnf clean all \
-          && rm -rf /var/cache/dnf
-
-        # install jdk
-        curl -Lf \
-         https://github.com/adoptium/temurin\#(module.majorJdkVersion)-binaries/releases/download/\#(module.jdkGitHubReleaseName)/OpenJDK\#(module.majorJdkVersion)U-jdk_\#(if (arch == "amd64") "x64" else "aarch64")_linux_hotspot_\#(module.jdkVersionAlt).tar.gz -o /tmp/jdk.tar.gz
-
-        mkdir /jdk \
-          && cd /jdk \
-          && cat /tmp/jdk.tar.gz | tar --strip-components=1 -xzC .
-
-        mkdir -p ~/staticdeps/bin
-
-        cp /usr/lib/gcc/\#(if (arch == "amd64") "x86_64" else "aarch64")-redhat-linux/8/libstdc++.a ~/staticdeps
-
-        # install zlib
-        if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
-          curl -Lf https://github.com/madler/zlib/releases/download/v\#(zlibVersion)/zlib-\#(zlibVersion).tar.gz -o /tmp/zlib.tar.gz
-
-          mkdir -p /tmp/dep_zlib-\#(zlibVersion) \
-          && cd /tmp/dep_zlib-\#(zlibVersion) \
-          && cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC . \
-          && echo "zlib-\#(zlibVersion): configure..." && ./configure --static --prefix="$HOME"/staticdeps > /dev/null \
-          && echo "zlib-\#(zlibVersion): make..." && make -s -j4 \
-          && echo "zlib-\#(zlibVersion): make install..." && make -s install \
-          && rm -rf /tmp/dep_zlib-\#(zlibVersion)
-        fi
-        """#
-        // don't need musl on aarch because GraalVM only supports musl builds on x86
-        when (arch == "amd64") {
-            #"""
-            # install musl
-            if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
-              curl -Lf https://musl.libc.org/releases/musl-\#(muslVersion).tar.gz -o /tmp/musl.tar.gz
-
-              mkdir -p /tmp/dep_musl-\#(muslVersion) \
-              && cd /tmp/dep_musl-\#(muslVersion) \
-              && cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC . \
-              && echo "musl-\#(muslVersion): configure..." && ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null \
-              && echo "musl-\#(muslVersion): make..." && make -s -j4 \
-              && echo "musl-\#(muslVersion): make install..." && make -s install \
-              && rm -rf /tmp/dep_musl-\#(muslVersion)
-
-              # native-image expects to find an executable at this path.
-              ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
-            fi
-            """#
-        }
-      }.join("\n\n")
-    }
-
-local setupMacEnvironment: Config.RunStep =
-  new {
-    name = "Set up environment"
-    shell = "#!/bin/bash -exo pipefail"
-    command =
-      #"""
-      # install jdk
-      curl -Lf \
-       https://github.com/adoptium/temurin\#(module.majorJdkVersion)-binaries/releases/download/\#(module.jdkGitHubReleaseName)/OpenJDK\#(module.majorJdkVersion)U-jdk_\#(if (arch == "amd64") "x64" else "aarch64")_mac_hotspot_\#(module.jdkVersionAlt).tar.gz -o /tmp/jdk.tar.gz
-
-      mkdir $HOME/jdk \
-        && cd $HOME/jdk \
-        && cat /tmp/jdk.tar.gz | tar --strip-components=1 -xzC .
-      """#
-  }
-
-steps {
-  when (os == "linux") {
-    new Config.RestoreCacheStep {
-      name = "Restore static deps from cache"
-      key = "staticdeps-\(arch)"
-    }
-    setupLinuxEnvironment
-    new Config.SaveCacheStep {
-      name = "Save statics deps to cache"
-      key = "staticdeps-\(arch)"
-      paths {
-        "~/staticdeps"
-      }
-    }
-  }
-  when (os == "macOS") {
-    when (arch == "amd64") {
-      new Config.RunStep {
-        name = "Installing Rosetta 2"
-        command = """
-          /usr/sbin/softwareupdate --install-rosetta --agree-to-license
-          """
-      }
-    }
-    setupMacEnvironment
-  }
-  new Config.RunStep {
-    name = "gradle buildNative"
-    when (module.os == "windows") {
-      shell = "bash.exe"
-    }
-    command = #"""
-      export PATH=~/staticdeps/bin:$PATH
-      ./gradlew \#(module.gradleArgs) \#(project):buildNative
-      """#
-  }
-  new Config.PersistToWorkspaceStep {
-    root = "."
-    paths {
-      "\(project)/build/executable/"
-    }
-  }
-}
-
-job {
-  when (os == "macOS") {
-    macos {
-      xcode = "15.3.0"
-    }
-    resource_class = "m2pro.large"
-    environment {
-      ["JAVA_HOME"] = "/Users/distiller/jdk/Contents/Home"
-    }
-  }
-  when (os == "linux") {
-    docker = new Listing<Config.DockerImage> {
-      new {
-        image = if (arch == "aarch64") "arm64v8/oraclelinux:8-slim" else "oraclelinux:8-slim"
-      }
-    }
-    environment {
-      ["JAVA_HOME"] = "/jdk"
-    }
-    resource_class = if (arch == "aarch64") "arm.xlarge" else "xlarge"
-  }
-  when (os == "windows") {
-    machine {
-      image = "windows-server-2022-gui:current"
-    }
-    resource_class = "windows.large"
-    environment {
-      ["JAVA_HOME"] = "/jdk"
-    }
-  }
-}
@@ -1,43 +0,0 @@
-//===----------------------------------------------------------------------===//
-// Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//===----------------------------------------------------------------------===//
-extends "GradleJob.pkl"
-
-import "package://pkg.pkl-lang.org/pkl-pantry/com.circleci.v2@1.5.0#/Config.pkl"
-
-local self = this
-
-javaVersion = "21.0"
-
-command: String
-
-os = "linux"
-
-steps {
-  new Config.AttachWorkspaceStep { at = "." }
-  new Config.RunStep {
-    command = "./gradlew \(self.gradleArgs) \(module.command)"
-  }
-  // add Java executables to workspace so they get published as a GitHub release
-  new Config.PersistToWorkspaceStep {
-    root = "."
-    paths {
-      "pkl-cli/build/executable/"
-      "pkl-doc/build/executable/"
-      "pkl-codegen-java/build/executable/"
-      "pkl-codegen-kotlin/build/executable/"
-    }
-  }
-}
@@ -1,25 +0,0 @@
-//===----------------------------------------------------------------------===//
-// Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//===----------------------------------------------------------------------===//
-extends "GradleJob.pkl"
-
-import "package://pkg.pkl-lang.org/pkl-pantry/com.circleci.v2@1.5.0#/Config.pkl"
-
-steps {
-  new Config.RunStep {
-    name = "gradle check"
-    command = "./gradlew \(module.gradleArgs) check"
-  }
-}
@@ -1,104 +0,0 @@
-//===----------------------------------------------------------------------===//
-// Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//===----------------------------------------------------------------------===//
-abstract module GradleJob
-
-import "package://pkg.pkl-lang.org/pkl-pantry/com.circleci.v2@1.5.0#/Config.pkl"
-import "package://pkg.pkl-lang.org/pkl-pantry/pkl.experimental.uri@1.0.3#/URI.pkl"
-
-/// Whether this is a release build or not.
-isRelease: Boolean = false
-
-/// The OS to run on
-os: "macOS"|"linux"|"windows"
-
-/// The version of Java to use.
-javaVersion: "17.0"|"21.0"
-
-fixed javaVersionFull =
-  if (javaVersion == "17.0") "17.0.9+9"
-  else "21.0.5+11"
-
-fixed jdkVersionAlt = javaVersionFull.replaceLast("+", "_")
-
-fixed majorJdkVersion = javaVersionFull.split(".").first
-
-fixed jdkGitHubReleaseName =
-  let (ver =
-    // 17.0.9+9 is missing some binaries (see https://github.com/adoptium/adoptium-support/issues/994)
-    if (javaVersionFull == "17.0.9+9" && os == "windows") "jdk-17.0.9+9.1"
-    else "jdk-\(javaVersionFull)"
-  )
-    URI.encodeComponent(ver)
-
-fixed gradleArgs = new Listing {
-  "--info"
-  "--stacktrace"
-  "-DtestReportsDir=${HOME}/test-results"
-  "-DpklMultiJdkTesting=true"
-  when (isRelease) {
-    "-DreleaseBuild=true"
-  }
-  ...extraGradleArgs
-}.join(" ")
-
-extraGradleArgs: Listing<String>
-
-steps: Listing<Config.Step>
-
-job: Config.Job = new {
-  environment {
-    ["LANG"] = "en_US.UTF-8"
-    when (os == "windows") {
-      ["JAVA_HOME"] = "/jdk"
-    }
-  }
-  when (os == "linux") {
-    docker {
-      new {
-        image = "cimg/openjdk:\(javaVersion)"
-      }
-    }
-  }
-  when (os == "windows") {
-    machine {
-      image = "windows-server-2022-gui:current"
-    }
-    resource_class = "windows.large"
-  }
-  steps {
-    "checkout"
-    when (os == "windows") {
-      new Config.RunStep {
-        name = "Set up environment"
-        shell = "bash.exe"
-        command = #"""
-          # install jdk
-          curl -Lf \
-          https://github.com/adoptium/temurin\#(majorJdkVersion)-binaries/releases/download/\#(jdkGitHubReleaseName)/OpenJDK\#(majorJdkVersion)U-jdk_x64_windows_hotspot_\#(jdkVersionAlt).zip -o /tmp/jdk.zip
-
-          unzip /tmp/jdk.zip -d /tmp/jdk \
-            && cd /tmp/jdk/jdk-* \
-            && mkdir /jdk \
-            && cp -r . /jdk
-          """#
-      }
-    }
-    ...module.steps
-    new Config.StoreTestResults {
-      path = "~/test-results"
-    }
-  }
-}
@@ -1,35 +0,0 @@
-//===----------------------------------------------------------------------===//
-// Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//===----------------------------------------------------------------------===//
-extends "GradleJob.pkl"
-
-import "package://pkg.pkl-lang.org/pkl-pantry/com.circleci.v2@1.5.0#/Config.pkl"
-
-name: String = command
-
-command: String
-
-os = "linux"
-
-javaVersion = "21.0"
-
-steps {
-  new Config.RunStep {
-    name = module.name
-    command = """
-      ./gradlew \(module.gradleArgs) \(module.command)
-      """
-  }
-}
@@ -1,5 +1,6 @@
 # linguist-generated would suppress files in diffs
 **/src/test/files/** linguist-vendored
+.github/workflows/* linguist-generated

 /docs/** linguist-documentation

@@ -2,7 +2,7 @@

 files=`git diff --cached --name-status`

-if [[ $files =~ .circleci/config.pkl ]]; then
-  pkl eval .circleci/config.pkl -o .circleci/config.yml
-  git add .circleci/config.yml
+if [[ $files =~ .github/* ]]; then
+  pkl eval --project-dir .github/ -m .github .github/index.pkl
+  git add .github/workflows/
 fi
@@ -0,0 +1,10 @@
+amends "pkl:Project"
+
+dependencies {
+  ["pkl.impl.ghactions"] {
+    uri = "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.6.0"
+  }
+  ["gha"] {
+    uri = "package://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.4.0"
+  }
+}
@@ -0,0 +1,40 @@
+{
+  "schemaVersion": 1,
+  "resolvedDependencies": {
+    "package://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1": {
+      "type": "remote",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.4.0",
+      "checksums": {
+        "sha256": "e0b9a9f71071d6101e9d764c069b2ec4a597d5315cb6e4c265b3f0d90c2b482c"
+      }
+    },
+    "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1": {
+      "type": "remote",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.6.0",
+      "checksums": {
+        "sha256": "fbc3c456ea468a0fe6baa9b3d30167259ac04e721a41a10fe82d2970026f0b1d"
+      }
+    },
+    "package://pkg.pkl-lang.org/pkl-pantry/pkl.experimental.deepToTyped@1": {
+      "type": "remote",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/pkl.experimental.deepToTyped@1.2.0",
+      "checksums": {
+        "sha256": "84c7feb391f4ac273a99dc89b8fd51dbcd21dbda4ce640f6908527f83acdd4d6"
+      }
+    },
+    "package://pkg.pkl-lang.org/pkl-pantry/pkl.github.dependabotManagedActions@1": {
+      "type": "remote",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/pkl.github.dependabotManagedActions@1.1.0",
+      "checksums": {
+        "sha256": "025fac778f2c5f75c8229fa4ec0f49ebdb99a61affe9aae489fefd8fccd92faa"
+      }
+    },
+    "package://pkg.pkl-lang.org/pkl-pantry/com.github.dependabot@1": {
+      "type": "remote",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/com.github.dependabot@1.0.1",
+      "checksums": {
+        "sha256": "0a4fe9b0983716ec49fb060b9e5e83f8c365eb899d517123b43134416a9574b6"
+      }
+    }
+  }
+}
@@ -0,0 +1,67 @@
+amends "@gha/Workflow.pkl"
+
+import "@gha/catalog.pkl"
+
+on {
+  push {
+    branches {
+      "main"
+    }
+  }
+  pull_request {}
+  schedule {
+    // Run at 01:38 on Saturday
+    new { cron = "38 1 * * 6" }
+  }
+}
+
+local class CodeQLScan {
+  language: String
+
+  `build-mode`: String
+}
+
+local scans: Listing<CodeQLScan> = new {
+  new {
+    language = "actions"
+    `build-mode` = "none"
+  }
+  new {
+    language = "java-kotlin"
+    `build-mode` = "autobuild"
+  }
+  new {
+    language = "javascript-typescript"
+    `build-mode` = "none"
+  }
+}
+
+jobs {
+  for (scan in scans) {
+    ["analyze-\(scan.language)"] {
+      name = "Analyze (\(scan.language))"
+      `runs-on` = "ubuntu-latest"
+      permissions {
+        `security-events` = "write"
+      }
+      steps {
+        catalog.`actions/checkout@v6`
+        new {
+          name = "Initialize CodeQL"
+          uses = "github/codeql-action/init@v4"
+          with {
+            ["languages"] = scan.language
+            ["build-mode"] = scan.`build-mode`
+          }
+        }
+        new {
+          name = "Perform CodeQL Analysis"
+          uses = "github/codeql-action/analyze@v4"
+          with {
+            ["category"] = "/language:\(scan.language)"
+          }
+        }
+      }
+    }
+  }
+}
@@ -0,0 +1,18 @@
+version: 2
+updates:
+- package-ecosystem: gradle
+  cooldown:
+    default-days: 7
+  directory: /
+  schedule:
+    interval: weekly
+- package-ecosystem: github-actions
+  cooldown:
+    default-days: 7
+  directory: /
+  ignore:
+  - dependency-name: '*'
+    update-types:
+    - version-update:semver-major
+  schedule:
+    interval: weekly
@@ -0,0 +1,247 @@
+amends "@pkl.impl.ghactions/PklCI.pkl"
+
+import "@gha/Workflow.pkl"
+
+import "jobs/BuildJavaExecutableJob.pkl"
+import "jobs/BuildNativeJob.pkl"
+import "jobs/DeployJob.pkl"
+import "jobs/GithubRelease.pkl"
+import "jobs/GradleJob.pkl"
+import "jobs/PklJob.pkl"
+import "jobs/SimpleGradleJob.pkl"
+import "codeql.pkl"
+
+triggerDocsBuild = "both"
+
+testReports {
+  junit {
+    "**/build/test-results/**/*.xml"
+  }
+  html {
+    "**/build/reports/tests/**/*"
+  }
+  excludeJobs {
+    "bench"
+    "github-release"
+    "dependency-submission"
+    "dependency-review"
+    Regex("deploy-.*")
+  }
+}
+
+local baseGradleCheck: SimpleGradleJob = new {
+  isRelease = false
+  command = "check"
+  fetchDepth = 0
+}
+
+local gradleCheck = (baseGradleCheck) {
+  os = "linux"
+}
+
+local gradleCheckWindows = (baseGradleCheck) {
+  os = "windows"
+}
+
+local typealias PklJobs = Mapping<String, PklJob | *Workflow.Job>
+
+local toWorkflowJobs: (PklJobs) -> Workflow.Jobs = (it) -> new Workflow.Jobs {
+  for (k, v in it) {
+    when (v is PklJob) {
+      [k] = v.job
+    } else {
+      [k] = v
+    }
+  }
+}
+
+local gradleCheckJobs: PklJobs = new {
+  ["gradle-check"] = gradleCheck
+  ["gradle-check-windows"] = gradleCheckWindows
+}
+
+local buildNativeJobs: Mapping<String, BuildNativeJob> = new {
+  for (_dist in List("release", "snapshot")) {
+    for (_project in List("pkl-cli", "pkl-doc")) {
+      for (_arch in List("amd64", "aarch64")) {
+        for (_os in List("macOS", "linux")) {
+          ["\(_project)-\(_os)-\(_arch)-\(_dist)"] {
+            arch = _arch
+            os = _os
+            isRelease = _dist == "release"
+            project = _project
+          }
+        }
+      }
+      ["\(_project)-alpine-linux-amd64-\(_dist)"] {
+        arch = "amd64"
+        os = "linux"
+        musl = true
+        isRelease = _dist == "release"
+        project = _project
+      }
+      ["\(_project)-windows-amd64-\(_dist)"] {
+        arch = "amd64"
+        os = "windows"
+        isRelease = _dist == "release"
+        project = _project
+      }
+    }
+  }
+}
+
+local buildNativeSnapshots = buildNativeJobs.toMap().filter((key, _) -> key.endsWith("snapshot"))
+
+local buildNativeReleases = buildNativeJobs.toMap().filter((key, _) -> key.endsWith("release"))
+
+local benchmarkJob: SimpleGradleJob = new { command = "bench:jmh" }
+
+local gradleCompatibilityJob: SimpleGradleJob = new {
+  command = ":pkl-gradle:build :pkl-gradle:compatibilityTestReleases"
+  fetchDepth = 0
+}
+
+local buildJavaExecutableJob: BuildJavaExecutableJob = new {
+  fetchDepth = 0
+}
+
+local buildAndTestJobs: PklJobs = new {
+  ...gradleCheckJobs
+  ["bench"] = benchmarkJob
+  ["gradle-compatibility"] = gradleCompatibilityJob
+  ["java-executables-snapshot"] = (buildJavaExecutableJob) { isRelease = false }
+  ...buildNativeSnapshots
+}
+
+local releaseJobs: PklJobs = new {
+  ...gradleCheckJobs
+  ["bench"] = benchmarkJob
+  ["gradle-compatibility"] = gradleCompatibilityJob
+  ["java-executables-release"] = (buildJavaExecutableJob) { isRelease = true }
+  ...buildNativeReleases
+}
+
+// By default, just run ./gradlew check on linux.
+// Trigger other checks based on GitHub PR description. Examples:
+//
+//    * [windows]                     -- Test on Windows
+//    * [native]                      -- Test all native builds
+//    * [native-pkl-cli]              -- Test all pkl-cli os/arch pairs
+//    * [native-pkl-cli-macos]        -- Test pkl-cli on macOS
+prb {
+  local prbJobs: Mapping<String, GradleJob> = new {
+    ["gradle-check"] = gradleCheck
+    ["gradle-check-windows"] = (gradleCheckWindows) {
+      `if` = "contains(github.event.pull_request.body, '[windows]')"
+    }
+    for (jobName, job in buildNativeSnapshots) {
+      [jobName] = (job) {
+        local tags = new Listing {
+          "[native]"
+          "[native-\(job.project)]"
+          "[native-\(job.project)-\(job.os)]"
+          "[native-\(job.project)-\(job.os)-\(job.arch)]"
+          "[native-\(job.project)-\(job.os)-\(job.arch)]"
+          when (job.musl) {
+            "[native-\(job.project)-alpine-\(job.os)-\(job.arch)]"
+          }
+        }
+        `if` =
+          tags
+            .toList()
+            .map((it) -> "contains(github.event.pull_request.body, '\(it)')")
+            .join(" || ")
+      }
+    }
+  }
+  local prbJobs2 = (prbJobs) {
+    [[true]] {
+      // better SLA when not running on nightly
+      nightlyMacOS = false
+    }
+  }
+  jobs = prbJobs2 |> toWorkflowJobs
+}
+
+build {
+  jobs = buildAndTestJobs |> toWorkflowJobs
+}
+
+main {
+  jobs =
+    (buildAndTestJobs) {
+      ["deploy-snapshot"] = (
+        new DeployJob {
+          extraGradleArgs {
+            "--no-parallel"
+          }
+          command = "publishToSonatype"
+        }
+      ) {
+        needs = buildAndTestJobs.keys.toListing()
+      }
+      ["dependency-submission"] {
+        `runs-on` = "ubuntu-latest"
+        permissions {
+          contents = "write"
+        }
+        steps {
+          module.catalog.`actions/checkout@v6`
+          (module.catalog.`actions/setup-java@v5`) {
+            with {
+              `java-version` = "25"
+              distribution = "temurin"
+            }
+          }
+          (module.catalog.`gradle/actions/dependency-submission@v6`) {
+            with {
+              // language=regexp
+              `dependency-graph-include-configurations` =
+                ".*[rR]untimeClasspath|.*[cC]ompileClasspath"
+            }
+          }
+        }
+      }
+    } |> toWorkflowJobs
+}
+
+releaseBranch {
+  jobs = releaseJobs |> toWorkflowJobs
+}
+
+release {
+  jobs =
+    (releaseJobs) {
+      ["deploy-release"] = (
+        new DeployJob {
+          isRelease = true
+          command = "publishToSonatype closeAndReleaseSonatypeStagingRepository"
+        }
+      ) {
+        needs = releaseJobs.keys.toListing()
+      }
+      ["github-release"] = new GithubRelease {
+        needs = "deploy-release"
+      }
+    } |> toWorkflowJobs
+}
+
+dependabot {
+  updates {
+    new {
+      `package-ecosystem` = "gradle"
+      schedule {
+        interval = "weekly"
+      }
+      cooldown {
+        `default-days` = 7
+      }
+      directory = "/"
+    }
+  }
+}
+
+workflows {
+  // add codeql workflow to set of workflows
+  ["workflows/codeql.yml"] = codeql
+}
@@ -0,0 +1,32 @@
+extends "GradleJob.pkl"
+
+import "@gha/catalog.pkl"
+
+// Keep this in sync with projects that build java executables
+local projects: List<String> = List("pkl-doc", "pkl-cli", "pkl-codegen-java", "pkl-codegen-kotlin")
+
+local command =
+  new Listing<String> {
+    "./gradlew"
+    module.gradleArgs
+    for (project in projects) {
+      // NOTE: `build` doesn't build native executables
+      "\(project):build"
+    }
+  }.join(" ")
+
+steps {
+  catalog.`actions/checkout@v6`
+  new {
+    name = "gradle build java executables"
+    shell = "bash"
+    run = command
+  }
+  (catalog.`actions/upload-artifact@v5`) {
+    name = "Upload executable artifacts"
+    with {
+      name = "executable-java"
+      path = "*/build/executable/**/*"
+    }
+  }
+}
@@ -0,0 +1,73 @@
+extends "GradleJob.pkl"
+
+import "@gha/catalog.pkl"
+import "@gha/context.pkl"
+
+/// Whether to link to musl. Otherwise, links to glibc.
+musl: Boolean(implies(module.os == "linux")) = false
+
+/// The Gradle project under which to generate the executable
+project: String
+
+extraGradleArgs {
+  when (os == "macOS" && arch == "amd64") {
+    "-Dpkl.targetArch=\(module.arch)"
+    #""-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh""#
+  }
+  when (musl) {
+    "-Dpkl.musl=true"
+  }
+}
+
+preSteps {
+  when (os == "linux" && !musl) {
+    new {
+      name = "Install deps"
+      run =
+        "dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en"
+    }
+  }
+}
+
+steps {
+  when (musl) {
+    new {
+      name = "Install musl and zlib"
+      run = read("../scripts/install_musl.sh").text
+    }
+  }
+  // workaround for https://github.com/actions/checkout/issues/1048
+  when (os == "linux" && !musl) {
+    new {
+      name = "Fix git ownership"
+      // language=bash
+      run = #"git status || git config --system --add safe.directory "$GITHUB_WORKSPACE""#
+    }
+  }
+  new {
+    name = "gradle buildNative"
+    shell = "bash"
+    run = "./gradlew \(module.gradleArgs) \(project):buildNative"
+  }
+  (catalog.`actions/upload-artifact@v5`) {
+    name = "Upload executable artifacts"
+    with {
+      name =
+        if (musl)
+          "executable-\(project)-alpine-\(module.os)-\(module.arch)"
+        else
+          "executable-\(project)-\(module.os)-\(module.arch)"
+      // Need to insert a wildcard to make actions/upload-artifact preserve the folder hierarchy.
+      // See https://github.com/actions/upload-artifact/issues/206
+      path = "\(project)*/build/executable/**/*"
+    }
+  }
+}
+
+fixed job {
+  when (os == "linux" && !musl) {
+    container {
+      image = "redhat/ubi8:8.10"
+    }
+  }
+}
@@ -0,0 +1,31 @@
+extends "GradleJob.pkl"
+
+import "@gha/catalog.pkl"
+import "@gha/Workflow.pkl"
+import "@pkl.impl.ghactions/helpers.pkl"
+
+local self = this
+
+command: String
+
+arch = "amd64"
+
+os = "linux"
+
+steps {
+  catalog.`actions/checkout@v6`
+  (catalog.`actions/download-artifact@v6`) {
+    with {
+      pattern = "executable-**"
+      `merge-multiple` = true
+    }
+  }
+  new Workflow.Step {
+    run = "./gradlew \(self.gradleArgs) \(module.command)"
+  }
+    |> helpers.withMavenPublishSecrets
+}
+
+fixed job {
+  environment = "maven-release"
+}
@@ -0,0 +1,44 @@
+module GithubRelease
+
+extends "PklJob.pkl"
+
+import "@gha/catalog.pkl"
+import "@gha/context.pkl"
+
+fixed job {
+  `runs-on` = "ubuntu-latest"
+  permissions {
+    contents = "write"
+  }
+  needs = "deploy-release"
+  steps {
+    (catalog.`actions/download-artifact@v6`) {
+      with {
+        pattern = "executable-**"
+        `merge-multiple` = true
+      }
+    }
+    new {
+      name = "Publish release on GitHub"
+      env {
+        ["GH_TOKEN"] = context.github.token
+        ["TAG_NAME"] = context.github.refName
+        ["GIT_SHA"] = context.github.sha
+        ["GH_REPO"] = context.github.repository
+      }
+      // language=bash
+      run =
+        #"""
+        # exclude build_artifacts.txt from publish
+        rm -f */build/executable/*.build_artifacts.txt
+        find */build/executable/* -type d | xargs rm -rf
+        gh release create ${TAG_NAME} \
+          --title "${TAG_NAME}" \
+          --target "${GIT_SHA}" \
+          --verify-tag \
+          --notes "Release notes: https://pkl-lang.org/main/current/release-notes/changelog.html#release-${TAG_NAME}" \
+          */build/executable/*
+        """#
+    }
+  }
+}
@@ -0,0 +1,102 @@
+abstract module GradleJob
+
+extends "PklJob.pkl"
+
+import "@gha/Workflow.pkl"
+import "@pkl.impl.ghactions/catalog.pkl"
+
+/// Whether this is a release build or not.
+isRelease: Boolean = false
+
+/// The architecture to use
+arch: "amd64" | "aarch64" = "amd64"
+
+/// The OS to run on.
+os: "macOS" | "linux" | "windows" = "linux"
+
+// TODO flip this to `true` when nightly macOS is available
+/// Whether to run on nightly macOS.
+nightlyMacOS: Boolean(implies(os == "macOS")) = false
+
+extraGradleArgs: Listing<String>
+
+steps: Listing<Workflow.Step>
+
+preSteps: Listing<Workflow.Step>
+
+/// The fetch depth to use when doing a git checkout.
+fetchDepth: Int?
+
+fixed gradleArgs =
+  new Listing {
+    "--info"
+    "--stacktrace"
+    "--no-daemon"
+    "-DpklMultiJdkTesting=true"
+    when (isRelease) {
+      "-DreleaseBuild=true"
+    }
+    ...extraGradleArgs
+  }.join(" ")
+
+fixed job {
+  env {
+    ["LANG"] = "en_US.UTF-8"
+    when (os == "windows") {
+      ["JAVA_HOME"] = "/jdk"
+    }
+  }
+  when (os == "macOS") {
+    `if` =
+      let (cond = "github.repository_owner == 'apple'")
+        if (super.`if` != null)
+          "(\(super.`if`)) && \(cond)"
+        else
+          cond
+  }
+  `runs-on` =
+    if (os == "linux" && arch == "amd64")
+      "ubuntu-latest"
+    else if (os == "linux" && arch == "aarch64")
+      "ubuntu-24.04-arm"
+    else if (os == "windows")
+      "windows-latest"
+    else
+      new Listing {
+        "self-hosted"
+        "macos"
+        when (nightlyMacOS) {
+          "nightly"
+        }
+      }
+  steps {
+    ...preSteps
+    // full checkout (needed for spotless)
+    (catalog.`actions/checkout@v6`) {
+      when (fetchDepth != null) {
+        with {
+          `fetch-depth` = fetchDepth
+        }
+      }
+    }
+    (catalog.`actions/setup-java@v5`) {
+      with {
+        `java-version` = "25"
+        distribution = "temurin"
+        architecture =
+          if (arch == "amd64")
+            "x64"
+          else
+            "aarch64"
+      }
+    }
+    (catalog.`gradle/actions/setup-gradle@v5`) {
+      when (isRelease) {
+        with {
+          `cache-disabled` = true
+        }
+      }
+    }
+    ...module.steps
+  }
+}
@@ -0,0 +1,29 @@
+abstract module PklJob
+
+extends "@pkl.impl.ghactions/jobs/PklJob.pkl"
+
+/// Identify any jobs that must complete successfully before this job will run.
+///
+/// It can be a string or array of strings.
+/// If a job fails or is skipped, all jobs that need it are skipped unless the jobs use a conditional expression that
+/// causes the job to continue.
+/// If a run contains a series of jobs that need each other, a failure or skip applies to all jobs in the dependency
+/// chain from the point of failure or skip onwards. If you would like a job to run even if a job it is dependent on
+/// did not succeed, use the `always()` conditional expression in `jobs.<job_id>.if`.
+///
+/// See: <https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idneeds>
+needs: (String | *Listing<String>)?
+
+/// A conditional to prevent a job from running unless a condition is met.
+///
+/// You can use any supported context and expression to create a conditional.
+/// For more information on which contexts are supported in this key, see
+/// [Contexts reference](https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#context-availability).
+@SourceCode { language = "GithubExpressionLanguage" }
+`if`: String?
+
+/// The underlying workflow job
+fixed job {
+  `if` = module.`if`
+  needs = module.needs
+}
@@ -0,0 +1,18 @@
+extends "GradleJob.pkl"
+
+name: String = command
+
+command: String
+
+os = "linux"
+
+steps {
+  new {
+    name = module.name
+    shell = "bash"
+    run =
+      """
+      ./gradlew \(module.gradleArgs) \(module.command)
+      """
+  }
+}
@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+clang -arch x86_64 "$@"
@@ -0,0 +1,71 @@
+set -e
+mkdir -p ~/staticdeps/
+
+ZLIB_VERSION="1.2.13"
+MUSL_VERSION="1.2.5"
+
+# install zlib
+if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
+  # Download zlib tarball and signature
+  curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" -o /tmp/zlib.tar.gz
+  curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz.asc" -o /tmp/zlib.tar.gz.asc
+
+  # Import zlib GPG key
+  gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 5ED46A6721D365587791E2AA783FCD8E58BCAFBA
+
+  # Verify GPG signature
+  echo "Verifying zlib GPG signature..."
+  gpg --verify /tmp/zlib.tar.gz.asc /tmp/zlib.tar.gz
+
+  mkdir -p "/tmp/dep_zlib-${ZLIB_VERSION}"
+  cd "/tmp/dep_zlib-${ZLIB_VERSION}"
+  # shellcheck disable=SC2002
+  cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC .
+
+  echo "zlib-${ZLIB_VERSION}: configure..." 
+  ./configure --static --prefix="$HOME"/staticdeps > /dev/null
+
+  echo "zlib-${ZLIB_VERSION}: make..." 
+  make -s -j4
+
+  echo "zlib-${ZLIB_VERSION}: make install..." 
+  make -s install
+
+  rm -rf /tmp/dep_zlib-${ZLIB_VERSION}
+fi
+
+# install musl
+if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
+  # Download musl tarball and signature
+  curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz" -o /tmp/musl.tar.gz
+  curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz.asc" -o /tmp/musl.tar.gz.asc
+
+  # Import musl GPG key
+  gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 836489290BB6B70F99FFDA0556BCDB593020450F
+
+  # Verify GPG signature
+  echo "Verifying musl GPG signature..."
+  gpg --verify /tmp/musl.tar.gz.asc /tmp/musl.tar.gz
+
+  mkdir -p "/tmp/dep_musl-${MUSL_VERSION}"
+  cd "/tmp/dep_musl-${MUSL_VERSION}"
+
+  # shellcheck disable=SC2002
+  cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC .
+
+  echo "musl-${MUSL_VERSION}: configure..." 
+  ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null
+
+  echo "musl-${MUSL_VERSION}: make..." 
+  make -s -j4
+
+  echo "musl-${MUSL_VERSION}: make install..." 
+  make -s install
+
+  rm -rf "/tmp/dep_musl-${MUSL_VERSION}"
+
+  # native-image expects to find an executable at this path.
+  ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
+fi
+
+echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
@@ -0,0 +1,40 @@
+#file: noinspection MandatoryParamsAbsent,UndefinedAction
+# This is a fake workflow that never runs.
+# It's used to pin actions to specific git SHAs when generating actual workflows.
+# It also gets updated by dependabot (see .github/dependabot.yml).
+# Generated from Workflow.pkl. DO NOT EDIT.
+name: __lockfile__
+'on':
+  push:
+    branches-ignore:
+    - '**'
+    tags-ignore:
+    - '**'
+permissions: {}
+jobs:
+  locks:
+    if: 'false'
+    runs-on: nothing
+    steps:
+    - name: EnricoMi/publish-unit-test-result-action@v2
+      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
+    - name: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+    - name: actions/create-github-app-token@v2
+      uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
+    - name: actions/download-artifact@v6
+      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+    - name: actions/setup-java@v5
+      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - name: actions/upload-artifact@v5
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+    - name: dawidd6/action-download-artifact@v11
+      uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
+    - name: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+    - name: github/codeql-action/init@v4
+      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+    - name: gradle/actions/dependency-submission@v6
+      uses: gradle/actions/dependency-submission@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6
+    - name: gradle/actions/setup-gradle@v5
+      uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
@@ -0,0 +1,826 @@
+# Generated from Workflow.pkl. DO NOT EDIT.
+name: Build
+'on':
+  push:
+    branches-ignore:
+    - main
+    - release/*
+    - dependabot/**
+    tags-ignore:
+    - '**'
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+permissions:
+  contents: read
+jobs:
+  gradle-check:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: check
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-check
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-check
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  gradle-check-windows:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: check
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-check-windows
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-check-windows
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  bench:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: bench:jmh
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true bench:jmh
+  gradle-compatibility:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-compatibility
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-compatibility
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  java-executables-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - name: gradle build java executables
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-java
+        path: '*/build/executable/**/*'
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-java-executables-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-java-executables-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-macOS-amd64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-linux-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-cli-macOS-aarch64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-linux-aarch64-snapshot:
+    runs-on: ubuntu-24.04-arm
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-linux-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-linux-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-linux-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-cli-alpine-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Install musl and zlib
+      run: |
+        set -e
+        mkdir -p ~/staticdeps/
+
+        ZLIB_VERSION="1.2.13"
+        MUSL_VERSION="1.2.5"
+
+        # install zlib
+        if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
+          # Download zlib tarball and signature
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" -o /tmp/zlib.tar.gz
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz.asc" -o /tmp/zlib.tar.gz.asc
+
+          # Import zlib GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 5ED46A6721D365587791E2AA783FCD8E58BCAFBA
+
+          # Verify GPG signature
+          echo "Verifying zlib GPG signature..."
+          gpg --verify /tmp/zlib.tar.gz.asc /tmp/zlib.tar.gz
+
+          mkdir -p "/tmp/dep_zlib-${ZLIB_VERSION}"
+          cd "/tmp/dep_zlib-${ZLIB_VERSION}"
+          # shellcheck disable=SC2002
+          cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "zlib-${ZLIB_VERSION}: configure..." 
+          ./configure --static --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "zlib-${ZLIB_VERSION}: make..." 
+          make -s -j4
+
+          echo "zlib-${ZLIB_VERSION}: make install..." 
+          make -s install
+
+          rm -rf /tmp/dep_zlib-${ZLIB_VERSION}
+        fi
+
+        # install musl
+        if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
+          # Download musl tarball and signature
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz" -o /tmp/musl.tar.gz
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz.asc" -o /tmp/musl.tar.gz.asc
+
+          # Import musl GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 836489290BB6B70F99FFDA0556BCDB593020450F
+
+          # Verify GPG signature
+          echo "Verifying musl GPG signature..."
+          gpg --verify /tmp/musl.tar.gz.asc /tmp/musl.tar.gz
+
+          mkdir -p "/tmp/dep_musl-${MUSL_VERSION}"
+          cd "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # shellcheck disable=SC2002
+          cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "musl-${MUSL_VERSION}: configure..." 
+          ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "musl-${MUSL_VERSION}: make..." 
+          make -s -j4
+
+          echo "musl-${MUSL_VERSION}: make install..." 
+          make -s install
+
+          rm -rf "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # native-image expects to find an executable at this path.
+          ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
+        fi
+
+        echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-alpine-linux-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-alpine-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-alpine-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-windows-amd64-snapshot:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-windows-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-windows-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-windows-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-macOS-amd64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-linux-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-doc-macOS-aarch64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-linux-aarch64-snapshot:
+    runs-on: ubuntu-24.04-arm
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-linux-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-linux-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-linux-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-doc-alpine-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Install musl and zlib
+      run: |
+        set -e
+        mkdir -p ~/staticdeps/
+
+        ZLIB_VERSION="1.2.13"
+        MUSL_VERSION="1.2.5"
+
+        # install zlib
+        if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
+          # Download zlib tarball and signature
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" -o /tmp/zlib.tar.gz
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz.asc" -o /tmp/zlib.tar.gz.asc
+
+          # Import zlib GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 5ED46A6721D365587791E2AA783FCD8E58BCAFBA
+
+          # Verify GPG signature
+          echo "Verifying zlib GPG signature..."
+          gpg --verify /tmp/zlib.tar.gz.asc /tmp/zlib.tar.gz
+
+          mkdir -p "/tmp/dep_zlib-${ZLIB_VERSION}"
+          cd "/tmp/dep_zlib-${ZLIB_VERSION}"
+          # shellcheck disable=SC2002
+          cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "zlib-${ZLIB_VERSION}: configure..." 
+          ./configure --static --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "zlib-${ZLIB_VERSION}: make..." 
+          make -s -j4
+
+          echo "zlib-${ZLIB_VERSION}: make install..." 
+          make -s install
+
+          rm -rf /tmp/dep_zlib-${ZLIB_VERSION}
+        fi
+
+        # install musl
+        if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
+          # Download musl tarball and signature
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz" -o /tmp/musl.tar.gz
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz.asc" -o /tmp/musl.tar.gz.asc
+
+          # Import musl GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 836489290BB6B70F99FFDA0556BCDB593020450F
+
+          # Verify GPG signature
+          echo "Verifying musl GPG signature..."
+          gpg --verify /tmp/musl.tar.gz.asc /tmp/musl.tar.gz
+
+          mkdir -p "/tmp/dep_musl-${MUSL_VERSION}"
+          cd "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # shellcheck disable=SC2002
+          cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "musl-${MUSL_VERSION}: configure..." 
+          ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "musl-${MUSL_VERSION}: make..." 
+          make -s -j4
+
+          echo "musl-${MUSL_VERSION}: make install..." 
+          make -s install
+
+          rm -rf "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # native-image expects to find an executable at this path.
+          ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
+        fi
+
+        echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-alpine-linux-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-alpine-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-alpine-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-windows-amd64-snapshot:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-windows-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-windows-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-windows-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  publish-test-results:
+    if: '!cancelled()'
+    needs:
+    - gradle-check
+    - gradle-check-windows
+    - gradle-compatibility
+    - java-executables-snapshot
+    - pkl-cli-macOS-amd64-snapshot
+    - pkl-cli-linux-amd64-snapshot
+    - pkl-cli-macOS-aarch64-snapshot
+    - pkl-cli-linux-aarch64-snapshot
+    - pkl-cli-alpine-linux-amd64-snapshot
+    - pkl-cli-windows-amd64-snapshot
+    - pkl-doc-macOS-amd64-snapshot
+    - pkl-doc-linux-amd64-snapshot
+    - pkl-doc-macOS-aarch64-snapshot
+    - pkl-doc-linux-aarch64-snapshot
+    - pkl-doc-alpine-linux-amd64-snapshot
+    - pkl-doc-windows-amd64-snapshot
+    permissions:
+      checks: write
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+      with:
+        pattern: test-results-xml-*
+    - name: Publish test results
+      if: '!cancelled()'
+      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
+      with:
+        comment_mode: 'off'
+        files: test-results-xml-*/**/*.xml
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-publish-test-results
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
@@ -0,0 +1,63 @@
+# Generated from Workflow.pkl. DO NOT EDIT.
+'on':
+  pull_request: {}
+  push:
+    branches:
+    - main
+  schedule:
+  - cron: 38 1 * * 6
+jobs:
+  analyze-actions:
+    name: Analyze (actions)
+    permissions:
+      security-events: write
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+      with:
+        languages: actions
+        build-mode: none
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+      with:
+        category: /language:actions
+  analyze-java-kotlin:
+    name: Analyze (java-kotlin)
+    permissions:
+      security-events: write
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+      with:
+        languages: java-kotlin
+        build-mode: autobuild
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+      with:
+        category: /language:java-kotlin
+  analyze-javascript-typescript:
+    name: Analyze (javascript-typescript)
+    permissions:
+      security-events: write
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+      with:
+        languages: javascript-typescript
+        build-mode: none
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+      with:
+        category: /language:javascript-typescript
@@ -0,0 +1,929 @@
+# Generated from Workflow.pkl. DO NOT EDIT.
+name: Build (main)
+'on':
+  push:
+    branches:
+    - main
+    tags-ignore:
+    - '**'
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+permissions:
+  contents: read
+jobs:
+  gradle-check:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: check
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-check
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-check
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  gradle-check-windows:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: check
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-check-windows
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-check-windows
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  bench:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: bench:jmh
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true bench:jmh
+  gradle-compatibility:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-compatibility
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-compatibility
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  java-executables-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - name: gradle build java executables
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-java
+        path: '*/build/executable/**/*'
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-java-executables-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-java-executables-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-macOS-amd64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-linux-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-cli-macOS-aarch64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-linux-aarch64-snapshot:
+    runs-on: ubuntu-24.04-arm
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-linux-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-linux-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-linux-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-cli-alpine-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Install musl and zlib
+      run: |
+        set -e
+        mkdir -p ~/staticdeps/
+
+        ZLIB_VERSION="1.2.13"
+        MUSL_VERSION="1.2.5"
+
+        # install zlib
+        if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
+          # Download zlib tarball and signature
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" -o /tmp/zlib.tar.gz
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz.asc" -o /tmp/zlib.tar.gz.asc
+
+          # Import zlib GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 5ED46A6721D365587791E2AA783FCD8E58BCAFBA
+
+          # Verify GPG signature
+          echo "Verifying zlib GPG signature..."
+          gpg --verify /tmp/zlib.tar.gz.asc /tmp/zlib.tar.gz
+
+          mkdir -p "/tmp/dep_zlib-${ZLIB_VERSION}"
+          cd "/tmp/dep_zlib-${ZLIB_VERSION}"
+          # shellcheck disable=SC2002
+          cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "zlib-${ZLIB_VERSION}: configure..." 
+          ./configure --static --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "zlib-${ZLIB_VERSION}: make..." 
+          make -s -j4
+
+          echo "zlib-${ZLIB_VERSION}: make install..." 
+          make -s install
+
+          rm -rf /tmp/dep_zlib-${ZLIB_VERSION}
+        fi
+
+        # install musl
+        if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
+          # Download musl tarball and signature
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz" -o /tmp/musl.tar.gz
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz.asc" -o /tmp/musl.tar.gz.asc
+
+          # Import musl GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 836489290BB6B70F99FFDA0556BCDB593020450F
+
+          # Verify GPG signature
+          echo "Verifying musl GPG signature..."
+          gpg --verify /tmp/musl.tar.gz.asc /tmp/musl.tar.gz
+
+          mkdir -p "/tmp/dep_musl-${MUSL_VERSION}"
+          cd "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # shellcheck disable=SC2002
+          cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "musl-${MUSL_VERSION}: configure..." 
+          ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "musl-${MUSL_VERSION}: make..." 
+          make -s -j4
+
+          echo "musl-${MUSL_VERSION}: make install..." 
+          make -s install
+
+          rm -rf "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # native-image expects to find an executable at this path.
+          ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
+        fi
+
+        echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-alpine-linux-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-alpine-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-alpine-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-windows-amd64-snapshot:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-windows-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-windows-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-windows-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-macOS-amd64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-linux-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-doc-macOS-aarch64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-linux-aarch64-snapshot:
+    runs-on: ubuntu-24.04-arm
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-linux-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-linux-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-linux-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-doc-alpine-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Install musl and zlib
+      run: |
+        set -e
+        mkdir -p ~/staticdeps/
+
+        ZLIB_VERSION="1.2.13"
+        MUSL_VERSION="1.2.5"
+
+        # install zlib
+        if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
+          # Download zlib tarball and signature
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" -o /tmp/zlib.tar.gz
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz.asc" -o /tmp/zlib.tar.gz.asc
+
+          # Import zlib GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 5ED46A6721D365587791E2AA783FCD8E58BCAFBA
+
+          # Verify GPG signature
+          echo "Verifying zlib GPG signature..."
+          gpg --verify /tmp/zlib.tar.gz.asc /tmp/zlib.tar.gz
+
+          mkdir -p "/tmp/dep_zlib-${ZLIB_VERSION}"
+          cd "/tmp/dep_zlib-${ZLIB_VERSION}"
+          # shellcheck disable=SC2002
+          cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "zlib-${ZLIB_VERSION}: configure..." 
+          ./configure --static --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "zlib-${ZLIB_VERSION}: make..." 
+          make -s -j4
+
+          echo "zlib-${ZLIB_VERSION}: make install..." 
+          make -s install
+
+          rm -rf /tmp/dep_zlib-${ZLIB_VERSION}
+        fi
+
+        # install musl
+        if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
+          # Download musl tarball and signature
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz" -o /tmp/musl.tar.gz
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz.asc" -o /tmp/musl.tar.gz.asc
+
+          # Import musl GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 836489290BB6B70F99FFDA0556BCDB593020450F
+
+          # Verify GPG signature
+          echo "Verifying musl GPG signature..."
+          gpg --verify /tmp/musl.tar.gz.asc /tmp/musl.tar.gz
+
+          mkdir -p "/tmp/dep_musl-${MUSL_VERSION}"
+          cd "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # shellcheck disable=SC2002
+          cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "musl-${MUSL_VERSION}: configure..." 
+          ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "musl-${MUSL_VERSION}: make..." 
+          make -s -j4
+
+          echo "musl-${MUSL_VERSION}: make install..." 
+          make -s install
+
+          rm -rf "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # native-image expects to find an executable at this path.
+          ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
+        fi
+
+        echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-alpine-linux-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-alpine-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-alpine-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-windows-amd64-snapshot:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-windows-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-windows-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-windows-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  deploy-snapshot:
+    needs:
+    - gradle-check
+    - gradle-check-windows
+    - bench
+    - gradle-compatibility
+    - java-executables-snapshot
+    - pkl-cli-macOS-amd64-snapshot
+    - pkl-cli-linux-amd64-snapshot
+    - pkl-cli-macOS-aarch64-snapshot
+    - pkl-cli-linux-aarch64-snapshot
+    - pkl-cli-alpine-linux-amd64-snapshot
+    - pkl-cli-windows-amd64-snapshot
+    - pkl-doc-macOS-amd64-snapshot
+    - pkl-doc-linux-amd64-snapshot
+    - pkl-doc-macOS-aarch64-snapshot
+    - pkl-doc-linux-aarch64-snapshot
+    - pkl-doc-alpine-linux-amd64-snapshot
+    - pkl-doc-windows-amd64-snapshot
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    environment: maven-release
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+      with:
+        pattern: executable-**
+        merge-multiple: true
+    - env:
+        ORG_GRADLE_PROJECT_signingKeyId: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGKEYID }}
+        ORG_GRADLE_PROJECT_signingKey: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGKEY }}
+        ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGPASSWORD }}
+        ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.ORG_GRADLE_PROJECT_SONATYPEPASSWORD }}
+        ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.ORG_GRADLE_PROJECT_SONATYPEUSERNAME }}
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true --no-parallel publishToSonatype
+  dependency-submission:
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+    - uses: gradle/actions/dependency-submission@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6
+      with:
+        dependency-graph-include-configurations: .*[rR]untimeClasspath|.*[cC]ompileClasspath
+  publish-test-results:
+    if: '!cancelled()'
+    needs:
+    - gradle-check
+    - gradle-check-windows
+    - gradle-compatibility
+    - java-executables-snapshot
+    - pkl-cli-macOS-amd64-snapshot
+    - pkl-cli-linux-amd64-snapshot
+    - pkl-cli-macOS-aarch64-snapshot
+    - pkl-cli-linux-aarch64-snapshot
+    - pkl-cli-alpine-linux-amd64-snapshot
+    - pkl-cli-windows-amd64-snapshot
+    - pkl-doc-macOS-amd64-snapshot
+    - pkl-doc-linux-amd64-snapshot
+    - pkl-doc-macOS-aarch64-snapshot
+    - pkl-doc-linux-aarch64-snapshot
+    - pkl-doc-alpine-linux-amd64-snapshot
+    - pkl-doc-windows-amd64-snapshot
+    permissions:
+      checks: write
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+      with:
+        pattern: test-results-xml-*
+    - name: Publish test results
+      if: '!cancelled()'
+      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
+      with:
+        comment_mode: 'off'
+        files: test-results-xml-*/**/*.xml
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-publish-test-results
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  trigger-downstream-builds:
+    if: github.repository_owner == 'apple'
+    needs:
+    - gradle-check
+    - gradle-check-windows
+    - bench
+    - gradle-compatibility
+    - java-executables-snapshot
+    - pkl-cli-macOS-amd64-snapshot
+    - pkl-cli-linux-amd64-snapshot
+    - pkl-cli-macOS-aarch64-snapshot
+    - pkl-cli-linux-aarch64-snapshot
+    - pkl-cli-alpine-linux-amd64-snapshot
+    - pkl-cli-windows-amd64-snapshot
+    - pkl-doc-macOS-amd64-snapshot
+    - pkl-doc-linux-amd64-snapshot
+    - pkl-doc-macOS-aarch64-snapshot
+    - pkl-doc-linux-aarch64-snapshot
+    - pkl-doc-alpine-linux-amd64-snapshot
+    - pkl-doc-windows-amd64-snapshot
+    - deploy-snapshot
+    - dependency-submission
+    - publish-test-results
+    runs-on: ubuntu-latest
+    steps:
+    - name: Create app token
+      id: app-token
+      uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
+      with:
+        app-id: ${{ secrets.PKL_CI_CLIENT_ID }}
+        private-key: ${{ secrets.PKL_CI }}
+        owner: ${{ github.repository_owner }}
+    - name: Trigger pkl-lang.org build
+      env:
+        GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        SOURCE_RUN: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+      run: |-
+        gh workflow run \
+          --repo apple/pkl-lang.org \
+          --ref main \
+          --field source_run="${SOURCE_RUN}" \
+          main.yml
@@ -0,0 +1,755 @@
+# Generated from Workflow.pkl. DO NOT EDIT.
+name: Pull Request
+'on':
+  pull_request: {}
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+jobs:
+  gradle-check:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: check
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-check
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-check
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  gradle-check-windows:
+    if: contains(github.event.pull_request.body, '[windows]')
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: check
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-check-windows
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-check-windows
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-macOS-amd64-snapshot:
+    if: (contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-cli]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS-amd64]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS-amd64]')) && github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-linux-amd64-snapshot:
+    if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-cli]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux-amd64]')
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-linux-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-cli-macOS-aarch64-snapshot:
+    if: (contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-cli]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS-aarch64]') || contains(github.event.pull_request.body, '[native-pkl-cli-macOS-aarch64]')) && github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-linux-aarch64-snapshot:
+    if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-cli]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux-aarch64]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux-aarch64]')
+    runs-on: ubuntu-24.04-arm
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-linux-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-linux-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-linux-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-cli-alpine-linux-amd64-snapshot:
+    if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-cli]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-cli-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-cli-alpine-linux-amd64]')
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Install musl and zlib
+      run: |
+        set -e
+        mkdir -p ~/staticdeps/
+
+        ZLIB_VERSION="1.2.13"
+        MUSL_VERSION="1.2.5"
+
+        # install zlib
+        if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
+          # Download zlib tarball and signature
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" -o /tmp/zlib.tar.gz
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz.asc" -o /tmp/zlib.tar.gz.asc
+
+          # Import zlib GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 5ED46A6721D365587791E2AA783FCD8E58BCAFBA
+
+          # Verify GPG signature
+          echo "Verifying zlib GPG signature..."
+          gpg --verify /tmp/zlib.tar.gz.asc /tmp/zlib.tar.gz
+
+          mkdir -p "/tmp/dep_zlib-${ZLIB_VERSION}"
+          cd "/tmp/dep_zlib-${ZLIB_VERSION}"
+          # shellcheck disable=SC2002
+          cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "zlib-${ZLIB_VERSION}: configure..." 
+          ./configure --static --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "zlib-${ZLIB_VERSION}: make..." 
+          make -s -j4
+
+          echo "zlib-${ZLIB_VERSION}: make install..." 
+          make -s install
+
+          rm -rf /tmp/dep_zlib-${ZLIB_VERSION}
+        fi
+
+        # install musl
+        if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
+          # Download musl tarball and signature
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz" -o /tmp/musl.tar.gz
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz.asc" -o /tmp/musl.tar.gz.asc
+
+          # Import musl GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 836489290BB6B70F99FFDA0556BCDB593020450F
+
+          # Verify GPG signature
+          echo "Verifying musl GPG signature..."
+          gpg --verify /tmp/musl.tar.gz.asc /tmp/musl.tar.gz
+
+          mkdir -p "/tmp/dep_musl-${MUSL_VERSION}"
+          cd "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # shellcheck disable=SC2002
+          cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "musl-${MUSL_VERSION}: configure..." 
+          ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "musl-${MUSL_VERSION}: make..." 
+          make -s -j4
+
+          echo "musl-${MUSL_VERSION}: make install..." 
+          make -s install
+
+          rm -rf "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # native-image expects to find an executable at this path.
+          ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
+        fi
+
+        echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-alpine-linux-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-alpine-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-alpine-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-windows-amd64-snapshot:
+    if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-cli]') || contains(github.event.pull_request.body, '[native-pkl-cli-windows]') || contains(github.event.pull_request.body, '[native-pkl-cli-windows-amd64]') || contains(github.event.pull_request.body, '[native-pkl-cli-windows-amd64]')
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-windows-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-windows-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-windows-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-macOS-amd64-snapshot:
+    if: (contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-doc]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS-amd64]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS-amd64]')) && github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-linux-amd64-snapshot:
+    if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-doc]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux-amd64]')
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-linux-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-doc-macOS-aarch64-snapshot:
+    if: (contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-doc]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS-aarch64]') || contains(github.event.pull_request.body, '[native-pkl-doc-macOS-aarch64]')) && github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-linux-aarch64-snapshot:
+    if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-doc]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux-aarch64]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux-aarch64]')
+    runs-on: ubuntu-24.04-arm
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-linux-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-linux-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-linux-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-doc-alpine-linux-amd64-snapshot:
+    if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-doc]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-doc-linux-amd64]') || contains(github.event.pull_request.body, '[native-pkl-doc-alpine-linux-amd64]')
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Install musl and zlib
+      run: |
+        set -e
+        mkdir -p ~/staticdeps/
+
+        ZLIB_VERSION="1.2.13"
+        MUSL_VERSION="1.2.5"
+
+        # install zlib
+        if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
+          # Download zlib tarball and signature
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" -o /tmp/zlib.tar.gz
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz.asc" -o /tmp/zlib.tar.gz.asc
+
+          # Import zlib GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 5ED46A6721D365587791E2AA783FCD8E58BCAFBA
+
+          # Verify GPG signature
+          echo "Verifying zlib GPG signature..."
+          gpg --verify /tmp/zlib.tar.gz.asc /tmp/zlib.tar.gz
+
+          mkdir -p "/tmp/dep_zlib-${ZLIB_VERSION}"
+          cd "/tmp/dep_zlib-${ZLIB_VERSION}"
+          # shellcheck disable=SC2002
+          cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "zlib-${ZLIB_VERSION}: configure..." 
+          ./configure --static --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "zlib-${ZLIB_VERSION}: make..." 
+          make -s -j4
+
+          echo "zlib-${ZLIB_VERSION}: make install..." 
+          make -s install
+
+          rm -rf /tmp/dep_zlib-${ZLIB_VERSION}
+        fi
+
+        # install musl
+        if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
+          # Download musl tarball and signature
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz" -o /tmp/musl.tar.gz
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz.asc" -o /tmp/musl.tar.gz.asc
+
+          # Import musl GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 836489290BB6B70F99FFDA0556BCDB593020450F
+
+          # Verify GPG signature
+          echo "Verifying musl GPG signature..."
+          gpg --verify /tmp/musl.tar.gz.asc /tmp/musl.tar.gz
+
+          mkdir -p "/tmp/dep_musl-${MUSL_VERSION}"
+          cd "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # shellcheck disable=SC2002
+          cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "musl-${MUSL_VERSION}: configure..." 
+          ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "musl-${MUSL_VERSION}: make..." 
+          make -s -j4
+
+          echo "musl-${MUSL_VERSION}: make install..." 
+          make -s install
+
+          rm -rf "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # native-image expects to find an executable at this path.
+          ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
+        fi
+
+        echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-alpine-linux-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-alpine-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-alpine-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-windows-amd64-snapshot:
+    if: contains(github.event.pull_request.body, '[native]') || contains(github.event.pull_request.body, '[native-pkl-doc]') || contains(github.event.pull_request.body, '[native-pkl-doc-windows]') || contains(github.event.pull_request.body, '[native-pkl-doc-windows-amd64]') || contains(github.event.pull_request.body, '[native-pkl-doc-windows-amd64]')
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-windows-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-windows-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+        if-no-files-found: ignore
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-windows-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  upload-event-file:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Upload event file
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-event-file
+        path: ${{ github.event_path }}
+  check-pkl-github-actions:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - name: Setup Pkl
+      id: setup-pkl
+      env:
+        PKL_VERSION: 0.30.0
+        PKL_FILENAME: pkl
+        PKL_DOWNLOAD_URL: https://github.com/apple/pkl/releases/download/0.30.0/pkl-linux-amd64
+      shell: bash
+      run: |-
+        DIR="$(mktemp -d /tmp/pkl-$PKL_VERSION-XXXXXX)"
+        PKL_EXEC="$DIR/$PKL_FILENAME"
+        curl -sfL -o $PKL_EXEC "$PKL_DOWNLOAD_URL"
+        chmod +x $PKL_EXEC
+        echo "$DIR" >> "$GITHUB_PATH"
+        echo "pkl_exec=$PKL_EXEC" >> "$GITHUB_OUTPUT"
+    - shell: bash
+      run: rm -rf .github/**/[a-z]*.yml
+    - shell: bash
+      run: pkl eval -m .github/ --project-dir .github/ .github/index.pkl
+    - name: check git status
+      shell: bash
+      run: |-
+        if [ -n "$(git status --porcelain)" ]; then
+          echo "Running pkl resulted in a diff! You likely need to run 'pkl eval' and commit the changes."
+          git diff --name-only
+          exit 1
+        fi
@@ -0,0 +1,864 @@
+# Generated from Workflow.pkl. DO NOT EDIT.
+name: Build (release branch)
+'on':
+  push:
+    branches:
+    - release/*
+    tags-ignore:
+    - '**'
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+jobs:
+  gradle-check:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: check
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-check
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-check
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  gradle-check-windows:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: check
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-check-windows
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-check-windows
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  bench:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: bench:jmh
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true bench:jmh
+  gradle-compatibility:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-compatibility
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-compatibility
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  java-executables-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - name: gradle build java executables
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-java
+        path: '*/build/executable/**/*'
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-java-executables-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-java-executables-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-macOS-amd64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-linux-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-cli-macOS-aarch64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-linux-aarch64-snapshot:
+    runs-on: ubuntu-24.04-arm
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-linux-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-linux-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-linux-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-cli-alpine-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Install musl and zlib
+      run: |
+        set -e
+        mkdir -p ~/staticdeps/
+
+        ZLIB_VERSION="1.2.13"
+        MUSL_VERSION="1.2.5"
+
+        # install zlib
+        if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
+          # Download zlib tarball and signature
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" -o /tmp/zlib.tar.gz
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz.asc" -o /tmp/zlib.tar.gz.asc
+
+          # Import zlib GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 5ED46A6721D365587791E2AA783FCD8E58BCAFBA
+
+          # Verify GPG signature
+          echo "Verifying zlib GPG signature..."
+          gpg --verify /tmp/zlib.tar.gz.asc /tmp/zlib.tar.gz
+
+          mkdir -p "/tmp/dep_zlib-${ZLIB_VERSION}"
+          cd "/tmp/dep_zlib-${ZLIB_VERSION}"
+          # shellcheck disable=SC2002
+          cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "zlib-${ZLIB_VERSION}: configure..." 
+          ./configure --static --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "zlib-${ZLIB_VERSION}: make..." 
+          make -s -j4
+
+          echo "zlib-${ZLIB_VERSION}: make install..." 
+          make -s install
+
+          rm -rf /tmp/dep_zlib-${ZLIB_VERSION}
+        fi
+
+        # install musl
+        if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
+          # Download musl tarball and signature
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz" -o /tmp/musl.tar.gz
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz.asc" -o /tmp/musl.tar.gz.asc
+
+          # Import musl GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 836489290BB6B70F99FFDA0556BCDB593020450F
+
+          # Verify GPG signature
+          echo "Verifying musl GPG signature..."
+          gpg --verify /tmp/musl.tar.gz.asc /tmp/musl.tar.gz
+
+          mkdir -p "/tmp/dep_musl-${MUSL_VERSION}"
+          cd "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # shellcheck disable=SC2002
+          cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "musl-${MUSL_VERSION}: configure..." 
+          ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "musl-${MUSL_VERSION}: make..." 
+          make -s -j4
+
+          echo "musl-${MUSL_VERSION}: make install..." 
+          make -s install
+
+          rm -rf "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # native-image expects to find an executable at this path.
+          ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
+        fi
+
+        echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-alpine-linux-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-alpine-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-alpine-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-windows-amd64-snapshot:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-windows-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-windows-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-windows-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-macOS-amd64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-linux-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-doc-macOS-aarch64-snapshot:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-linux-aarch64-snapshot:
+    runs-on: ubuntu-24.04-arm
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-linux-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-linux-aarch64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-linux-aarch64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-doc-alpine-linux-amd64-snapshot:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: Install musl and zlib
+      run: |
+        set -e
+        mkdir -p ~/staticdeps/
+
+        ZLIB_VERSION="1.2.13"
+        MUSL_VERSION="1.2.5"
+
+        # install zlib
+        if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
+          # Download zlib tarball and signature
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" -o /tmp/zlib.tar.gz
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz.asc" -o /tmp/zlib.tar.gz.asc
+
+          # Import zlib GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 5ED46A6721D365587791E2AA783FCD8E58BCAFBA
+
+          # Verify GPG signature
+          echo "Verifying zlib GPG signature..."
+          gpg --verify /tmp/zlib.tar.gz.asc /tmp/zlib.tar.gz
+
+          mkdir -p "/tmp/dep_zlib-${ZLIB_VERSION}"
+          cd "/tmp/dep_zlib-${ZLIB_VERSION}"
+          # shellcheck disable=SC2002
+          cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "zlib-${ZLIB_VERSION}: configure..." 
+          ./configure --static --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "zlib-${ZLIB_VERSION}: make..." 
+          make -s -j4
+
+          echo "zlib-${ZLIB_VERSION}: make install..." 
+          make -s install
+
+          rm -rf /tmp/dep_zlib-${ZLIB_VERSION}
+        fi
+
+        # install musl
+        if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
+          # Download musl tarball and signature
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz" -o /tmp/musl.tar.gz
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz.asc" -o /tmp/musl.tar.gz.asc
+
+          # Import musl GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 836489290BB6B70F99FFDA0556BCDB593020450F
+
+          # Verify GPG signature
+          echo "Verifying musl GPG signature..."
+          gpg --verify /tmp/musl.tar.gz.asc /tmp/musl.tar.gz
+
+          mkdir -p "/tmp/dep_musl-${MUSL_VERSION}"
+          cd "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # shellcheck disable=SC2002
+          cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "musl-${MUSL_VERSION}: configure..." 
+          ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "musl-${MUSL_VERSION}: make..." 
+          make -s -j4
+
+          echo "musl-${MUSL_VERSION}: make install..." 
+          make -s install
+
+          rm -rf "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # native-image expects to find an executable at this path.
+          ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
+        fi
+
+        echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-alpine-linux-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-alpine-linux-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-alpine-linux-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-windows-amd64-snapshot:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-windows-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-windows-amd64-snapshot
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-windows-amd64-snapshot
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  publish-test-results:
+    if: '!cancelled()'
+    needs:
+    - gradle-check
+    - gradle-check-windows
+    - gradle-compatibility
+    - java-executables-snapshot
+    - pkl-cli-macOS-amd64-snapshot
+    - pkl-cli-linux-amd64-snapshot
+    - pkl-cli-macOS-aarch64-snapshot
+    - pkl-cli-linux-aarch64-snapshot
+    - pkl-cli-alpine-linux-amd64-snapshot
+    - pkl-cli-windows-amd64-snapshot
+    - pkl-doc-macOS-amd64-snapshot
+    - pkl-doc-linux-amd64-snapshot
+    - pkl-doc-macOS-aarch64-snapshot
+    - pkl-doc-linux-aarch64-snapshot
+    - pkl-doc-alpine-linux-amd64-snapshot
+    - pkl-doc-windows-amd64-snapshot
+    permissions:
+      checks: write
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+      with:
+        pattern: test-results-xml-*
+    - name: Publish test results
+      if: '!cancelled()'
+      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
+      with:
+        comment_mode: 'off'
+        files: test-results-xml-*/**/*.xml
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-publish-test-results
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  trigger-downstream-builds:
+    if: github.repository_owner == 'apple'
+    needs:
+    - gradle-check
+    - gradle-check-windows
+    - bench
+    - gradle-compatibility
+    - java-executables-snapshot
+    - pkl-cli-macOS-amd64-snapshot
+    - pkl-cli-linux-amd64-snapshot
+    - pkl-cli-macOS-aarch64-snapshot
+    - pkl-cli-linux-aarch64-snapshot
+    - pkl-cli-alpine-linux-amd64-snapshot
+    - pkl-cli-windows-amd64-snapshot
+    - pkl-doc-macOS-amd64-snapshot
+    - pkl-doc-linux-amd64-snapshot
+    - pkl-doc-macOS-aarch64-snapshot
+    - pkl-doc-linux-aarch64-snapshot
+    - pkl-doc-alpine-linux-amd64-snapshot
+    - pkl-doc-windows-amd64-snapshot
+    - publish-test-results
+    runs-on: ubuntu-latest
+    steps:
+    - name: Create app token
+      id: app-token
+      uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
+      with:
+        app-id: ${{ secrets.PKL_CI_CLIENT_ID }}
+        private-key: ${{ secrets.PKL_CI }}
+        owner: ${{ github.repository_owner }}
+    - name: Trigger pkl-lang.org build
+      env:
+        GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        SOURCE_RUN: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+      run: |-
+        gh workflow run \
+          --repo apple/pkl-lang.org \
+          --ref main \
+          --field source_run="${SOURCE_RUN}" \
+          main.yml
@@ -0,0 +1,954 @@
+# Generated from Workflow.pkl. DO NOT EDIT.
+name: Release
+'on':
+  push:
+    branches-ignore:
+    - '**'
+    tags:
+    - '**'
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+permissions:
+  contents: read
+jobs:
+  gradle-check:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: check
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-check
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-check
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  gradle-check-windows:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: check
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-check-windows
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-check-windows
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  bench:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: bench:jmh
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true bench:jmh
+  gradle-compatibility:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with: {}
+    - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-gradle-compatibility
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-gradle-compatibility
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  java-executables-release:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - name: gradle build java executables
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-java
+        path: '*/build/executable/**/*'
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-java-executables-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-java-executables-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-macOS-amd64-release:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-amd64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-amd64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-linux-amd64-release:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-linux-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-linux-amd64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-linux-amd64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-cli-macOS-aarch64-release:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-macOS-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-macOS-aarch64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-macOS-aarch64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-linux-aarch64-release:
+    runs-on: ubuntu-24.04-arm
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-linux-aarch64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-linux-aarch64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-linux-aarch64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-cli-alpine-linux-amd64-release:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
+    - name: Install musl and zlib
+      run: |
+        set -e
+        mkdir -p ~/staticdeps/
+
+        ZLIB_VERSION="1.2.13"
+        MUSL_VERSION="1.2.5"
+
+        # install zlib
+        if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
+          # Download zlib tarball and signature
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" -o /tmp/zlib.tar.gz
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz.asc" -o /tmp/zlib.tar.gz.asc
+
+          # Import zlib GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 5ED46A6721D365587791E2AA783FCD8E58BCAFBA
+
+          # Verify GPG signature
+          echo "Verifying zlib GPG signature..."
+          gpg --verify /tmp/zlib.tar.gz.asc /tmp/zlib.tar.gz
+
+          mkdir -p "/tmp/dep_zlib-${ZLIB_VERSION}"
+          cd "/tmp/dep_zlib-${ZLIB_VERSION}"
+          # shellcheck disable=SC2002
+          cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "zlib-${ZLIB_VERSION}: configure..." 
+          ./configure --static --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "zlib-${ZLIB_VERSION}: make..." 
+          make -s -j4
+
+          echo "zlib-${ZLIB_VERSION}: make install..." 
+          make -s install
+
+          rm -rf /tmp/dep_zlib-${ZLIB_VERSION}
+        fi
+
+        # install musl
+        if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
+          # Download musl tarball and signature
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz" -o /tmp/musl.tar.gz
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz.asc" -o /tmp/musl.tar.gz.asc
+
+          # Import musl GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 836489290BB6B70F99FFDA0556BCDB593020450F
+
+          # Verify GPG signature
+          echo "Verifying musl GPG signature..."
+          gpg --verify /tmp/musl.tar.gz.asc /tmp/musl.tar.gz
+
+          mkdir -p "/tmp/dep_musl-${MUSL_VERSION}"
+          cd "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # shellcheck disable=SC2002
+          cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "musl-${MUSL_VERSION}: configure..." 
+          ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "musl-${MUSL_VERSION}: make..." 
+          make -s -j4
+
+          echo "musl-${MUSL_VERSION}: make install..." 
+          make -s install
+
+          rm -rf "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # native-image expects to find an executable at this path.
+          ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
+        fi
+
+        echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.musl=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-alpine-linux-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-alpine-linux-amd64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-alpine-linux-amd64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-cli-windows-amd64-release:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-cli-windows-amd64
+        path: pkl-cli*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-cli-windows-amd64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-cli-windows-amd64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-macOS-amd64-release:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-amd64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-amd64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-linux-amd64-release:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-linux-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-linux-amd64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-linux-amd64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-doc-macOS-aarch64-release:
+    if: github.repository_owner == 'apple'
+    runs-on:
+    - self-hosted
+    - macos
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-macOS-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-macOS-aarch64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-macOS-aarch64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-linux-aarch64-release:
+    runs-on: ubuntu-24.04-arm
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - name: Install deps
+      run: dnf install -y git binutils gcc glibc-devel zlib-devel libstdc++-static glibc-langpack-en
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: aarch64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
+    - name: Fix git ownership
+      run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-linux-aarch64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-linux-aarch64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-linux-aarch64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+    container:
+      image: redhat/ubi8:8.10
+  pkl-doc-alpine-linux-amd64-release:
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
+    - name: Install musl and zlib
+      run: |
+        set -e
+        mkdir -p ~/staticdeps/
+
+        ZLIB_VERSION="1.2.13"
+        MUSL_VERSION="1.2.5"
+
+        # install zlib
+        if [[ ! -f ~/staticdeps/include/zlib.h ]]; then
+          # Download zlib tarball and signature
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz" -o /tmp/zlib.tar.gz
+          curl -Lf "https://github.com/madler/zlib/releases/download/v${ZLIB_VERSION}/zlib-${ZLIB_VERSION}.tar.gz.asc" -o /tmp/zlib.tar.gz.asc
+
+          # Import zlib GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 5ED46A6721D365587791E2AA783FCD8E58BCAFBA
+
+          # Verify GPG signature
+          echo "Verifying zlib GPG signature..."
+          gpg --verify /tmp/zlib.tar.gz.asc /tmp/zlib.tar.gz
+
+          mkdir -p "/tmp/dep_zlib-${ZLIB_VERSION}"
+          cd "/tmp/dep_zlib-${ZLIB_VERSION}"
+          # shellcheck disable=SC2002
+          cat /tmp/zlib.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "zlib-${ZLIB_VERSION}: configure..." 
+          ./configure --static --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "zlib-${ZLIB_VERSION}: make..." 
+          make -s -j4
+
+          echo "zlib-${ZLIB_VERSION}: make install..." 
+          make -s install
+
+          rm -rf /tmp/dep_zlib-${ZLIB_VERSION}
+        fi
+
+        # install musl
+        if [[ ! -f ~/staticdeps/bin/x86_64-linux-musl-gcc ]]; then
+          # Download musl tarball and signature
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz" -o /tmp/musl.tar.gz
+          curl -Lf "https://musl.libc.org/releases/musl-${MUSL_VERSION}.tar.gz.asc" -o /tmp/musl.tar.gz.asc
+
+          # Import musl GPG key
+          gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 836489290BB6B70F99FFDA0556BCDB593020450F
+
+          # Verify GPG signature
+          echo "Verifying musl GPG signature..."
+          gpg --verify /tmp/musl.tar.gz.asc /tmp/musl.tar.gz
+
+          mkdir -p "/tmp/dep_musl-${MUSL_VERSION}"
+          cd "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # shellcheck disable=SC2002
+          cat /tmp/musl.tar.gz | tar --strip-components=1 -xzC .
+
+          echo "musl-${MUSL_VERSION}: configure..." 
+          ./configure --disable-shared --prefix="$HOME"/staticdeps > /dev/null
+
+          echo "musl-${MUSL_VERSION}: make..." 
+          make -s -j4
+
+          echo "musl-${MUSL_VERSION}: make install..." 
+          make -s install
+
+          rm -rf "/tmp/dep_musl-${MUSL_VERSION}"
+
+          # native-image expects to find an executable at this path.
+          ln -s ~/staticdeps/bin/musl-gcc ~/staticdeps/bin/x86_64-linux-musl-gcc
+        fi
+
+        echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.musl=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-alpine-linux-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-alpine-linux-amd64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-alpine-linux-amd64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  pkl-doc-windows-amd64-release:
+    runs-on: windows-latest
+    env:
+      LANG: en_US.UTF-8
+      JAVA_HOME: /jdk
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
+    - name: gradle buildNative
+      shell: bash
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
+    - name: Upload executable artifacts
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: executable-pkl-doc-windows-amd64
+        path: pkl-doc*/build/executable/**/*
+    - name: Upload Test Result XML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-xml-pkl-doc-windows-amd64-release
+        path: '**/build/test-results/**/*.xml'
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-pkl-doc-windows-amd64-release
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  deploy-release:
+    needs:
+    - gradle-check
+    - gradle-check-windows
+    - bench
+    - gradle-compatibility
+    - java-executables-release
+    - pkl-cli-macOS-amd64-release
+    - pkl-cli-linux-amd64-release
+    - pkl-cli-macOS-aarch64-release
+    - pkl-cli-linux-aarch64-release
+    - pkl-cli-alpine-linux-amd64-release
+    - pkl-cli-windows-amd64-release
+    - pkl-doc-macOS-amd64-release
+    - pkl-doc-linux-amd64-release
+    - pkl-doc-macOS-aarch64-release
+    - pkl-doc-linux-aarch64-release
+    - pkl-doc-alpine-linux-amd64-release
+    - pkl-doc-windows-amd64-release
+    runs-on: ubuntu-latest
+    env:
+      LANG: en_US.UTF-8
+    environment: maven-release
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      with:
+        java-version: '25'
+        distribution: temurin
+        architecture: x64
+    - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
+      with:
+        cache-disabled: true
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+      with:
+        pattern: executable-**
+        merge-multiple: true
+    - env:
+        ORG_GRADLE_PROJECT_signingKeyId: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGKEYID }}
+        ORG_GRADLE_PROJECT_signingKey: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGKEY }}
+        ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGPASSWORD }}
+        ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.ORG_GRADLE_PROJECT_SONATYPEPASSWORD }}
+        ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.ORG_GRADLE_PROJECT_SONATYPEUSERNAME }}
+      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true publishToSonatype closeAndReleaseSonatypeStagingRepository
+  github-release:
+    needs: deploy-release
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+      with:
+        pattern: executable-**
+        merge-multiple: true
+    - name: Publish release on GitHub
+      env:
+        GH_TOKEN: ${{ github.token }}
+        TAG_NAME: ${{ github.ref_name }}
+        GIT_SHA: ${{ github.sha }}
+        GH_REPO: ${{ github.repository }}
+      run: |-
+        # exclude build_artifacts.txt from publish
+        rm -f */build/executable/*.build_artifacts.txt
+        find */build/executable/* -type d | xargs rm -rf
+        gh release create ${TAG_NAME} \
+          --title "${TAG_NAME}" \
+          --target "${GIT_SHA}" \
+          --verify-tag \
+          --notes "Release notes: https://pkl-lang.org/main/current/release-notes/changelog.html#release-${TAG_NAME}" \
+          */build/executable/*
+  publish-test-results:
+    if: '!cancelled()'
+    needs:
+    - gradle-check
+    - gradle-check-windows
+    - gradle-compatibility
+    - java-executables-release
+    - pkl-cli-macOS-amd64-release
+    - pkl-cli-linux-amd64-release
+    - pkl-cli-macOS-aarch64-release
+    - pkl-cli-linux-aarch64-release
+    - pkl-cli-alpine-linux-amd64-release
+    - pkl-cli-windows-amd64-release
+    - pkl-doc-macOS-amd64-release
+    - pkl-doc-linux-amd64-release
+    - pkl-doc-macOS-aarch64-release
+    - pkl-doc-linux-aarch64-release
+    - pkl-doc-alpine-linux-amd64-release
+    - pkl-doc-windows-amd64-release
+    permissions:
+      checks: write
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+      with:
+        pattern: test-results-xml-*
+    - name: Publish test results
+      if: '!cancelled()'
+      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
+      with:
+        comment_mode: 'off'
+        files: test-results-xml-*/**/*.xml
+    - name: Upload Test Result HTML
+      if: '!cancelled()'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: test-results-html-publish-test-results
+        path: '**/build/reports/tests/**/*'
+        if-no-files-found: ignore
+  trigger-downstream-builds:
+    if: github.repository_owner == 'apple'
+    needs:
+    - gradle-check
+    - gradle-check-windows
+    - bench
+    - gradle-compatibility
+    - java-executables-release
+    - pkl-cli-macOS-amd64-release
+    - pkl-cli-linux-amd64-release
+    - pkl-cli-macOS-aarch64-release
+    - pkl-cli-linux-aarch64-release
+    - pkl-cli-alpine-linux-amd64-release
+    - pkl-cli-windows-amd64-release
+    - pkl-doc-macOS-amd64-release
+    - pkl-doc-linux-amd64-release
+    - pkl-doc-macOS-aarch64-release
+    - pkl-doc-linux-aarch64-release
+    - pkl-doc-alpine-linux-amd64-release
+    - pkl-doc-windows-amd64-release
+    - deploy-release
+    - github-release
+    - publish-test-results
+    runs-on: ubuntu-latest
+    steps:
+    - name: Create app token
+      id: app-token
+      uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
+      with:
+        app-id: ${{ secrets.PKL_CI_CLIENT_ID }}
+        private-key: ${{ secrets.PKL_CI }}
+        owner: ${{ github.repository_owner }}
+    - name: Trigger pkl-lang.org build
+      env:
+        GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        SOURCE_RUN: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+      run: |-
+        gh workflow run \
+          --repo apple/pkl-lang.org \
+          --ref main \
+          --field source_run="${SOURCE_RUN}" \
+          main.yml
@@ -0,0 +1,34 @@
+# Generated from Workflow.pkl. DO NOT EDIT.
+name: PR Test Reports
+'on':
+  workflow_run:
+    types:
+    - completed
+    workflows:
+    - Pull Request
+permissions:
+  contents: read
+jobs:
+  test-results:
+    name: Test Results
+    if: github.event.workflow_run.conclusion == 'success' || github.event.workflow_run.conclusion == 'failure'
+    permissions:
+      actions: read
+      checks: write
+    runs-on: ubuntu-latest
+    steps:
+    - name: Download artifacts
+      uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
+      with:
+        path: artifacts
+        name: test-results-.*
+        name_is_regexp: true
+        run_id: ${{ github.event.workflow_run.id }}
+    - name: Publish test results
+      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
+      with:
+        commit: ${{ github.event.workflow_run.head_sha }}
+        comment_mode: 'off'
+        files: artifacts/**/*.xml
+        event_file: artifacts/test-results-event-file/event.json
+        event_name: ${{ github.event.workflow_run.event }}
@@ -15,6 +15,7 @@ testgenerated/
 !.idea/runConfigurations/
 !.idea/scopes/
 !.idea/vcs.xml
+.intellijPlatform/

 .vscode/

@@ -12,6 +12,27 @@
      <option name="REPORT_FIELDS" value="true" />
    </inspection_tool>
    <inspection_tool class="ClassCanBeRecord" enabled="false" level="WEAK WARNING" enabled_by_default="false" />
+    <inspection_tool class="CustomRegExpInspection" enabled="true" level="WARNING" enabled_by_default="true">
+      <option name="myConfigurations">
+        <list>
+          <RegExpInspectionConfiguration>
+            <option name="name" value="PklCliDirectProjectEvaluatorSettingsAccess" />
+            <option name="suppressId" value="PklCliDirectProjectEvaluatorSettingsAccess" />
+            <option name="uuid" value="dd497f47-d38f-3fab-9ed7-eabe699620c8" />
+            <option name="patterns">
+              <list>
+                <InspectionPattern>
+                  <option name="regExp" value="project\?\.evaluatorSettings" />
+                  <option name="_fileType" value="Kotlin" />
+                  <option name="searchContext" value="ANY" />
+                  <option name="replacement" value="evaluatorSettings" />
+                </InspectionPattern>
+              </list>
+            </option>
+          </RegExpInspectionConfiguration>
+        </list>
+      </option>
+    </inspection_tool>
    <inspection_tool class="FieldMayBeFinal" enabled="true" level="INFORMATION" enabled_by_default="true">
      <scope name="AllExceptTruffleAst" level="WARNING" enabled="true" />
    </inspection_tool>
@@ -73,5 +94,6 @@
      <option name="processLiterals" value="true" />
      <option name="processComments" value="true" />
    </inspection_tool>
+    <inspection_tool class="dd497f47-d38f-3fab-9ed7-eabe699620c8" enabled="true" level="ERROR" enabled_by_default="true" editorAttributes="ERRORS_ATTRIBUTES" />
  </profile>
 </component>
@@ -13,11 +13,11 @@ To import the project into IntelliJ, go to File->Open and select the project's r
 If the project is opened but not imported, look for a popup in the lower right corner
 and click its "Import Gradle Project" link.
 . (recommended) Install {uri-gng}[gng] +
-_gng_ enables to run Gradle commands with `gw` (instead of `./gradlew`) from any subdirectory.
+_gng_ enables you to run Gradle commands with `gw` (instead of `./gradlew`) from any subdirectory.
 . (recommended) Set up Git ignore-revs +
 `git config blame.ignoreRevsFile .git-blame-ignore-revs`
 . (recommended) Install {uri-jenv}[jenv] and plugins +
-_jenv_ use specific JDK versions in certain subdirectories. _Pkl_ comes with a `.java-version` file specifying JDK 21. +
+_jenv_ uses specific JDK versions in certain subdirectories. _Pkl_ comes with a `.java-version` file specifying JDK 21. +
 Enable _jenv_ plugins for better handling by `gradle`:
 +
 [source,shell]
@@ -74,9 +74,7 @@ gw wrapper --gradle-version [version] --gradle-distribution-sha256-sum [sha]

 . (optional) Update _gradle/libs.version.toml_
 based on version information from https://search.maven.org, https://plugins.gradle.org, and GitHub repos
-. Run `gw updateDependencyLocks`
 . Validate changes with `gw build buildNative`
-. Review and commit the updated dependency lock files

 == Code Generation

@@ -90,20 +88,27 @@ This will listen on port 5005.

 Example: `./gradlew test -Djvmdebug=true`

+== Snippet Test Plugin
+
+There is an IntelliJ plugin meant for development on the Pkl project itself located in https://github.com/apple/pkl-project-commons[pkl-project-commons].
+
+See https://github.com/apple/pkl-project-commons?tab=readme-ov-file#internal-intellij-plugin[its readme] for instructions on how to set it up.
+
 == Resources
-For automated build setup examples see our https://github.com/apple/pkl/blob/main/.circleci/[CircleCI] jobs like our https://github.com/apple/pkl/blob/main/.circleci/jobs/BuildNativeJob.pkl[BuildNativeJob.pkl], where we build Pkl automatically.
+
+For automated build setup examples see our https://github.com/apple/pkl/blob/main/.github/[GitHub Actions] jobs like our https://github.com/apple/pkl/blob/main/.github/jobs/BuildNativeJob.pkl[BuildNativeJob.pkl], where we build Pkl automatically.

 === Truffle

 * http://ssw.jku.at/Research/Projects/JVM/Truffle.html[Homepage]
 * https://github.com/graalvm/truffle[GitHub]
 * http://lafo.ssw.uni-linz.ac.at/javadoc/truffle/latest/[Javadoc]
-* http://mail.openjdk.java.net/pipermail/graal-dev/[Mailing List]
+* https://mail.openjdk.org/pipermail/graal-dev/[Mailing List]
 * https://medium.com/@octskyward/graal-truffle-134d8f28fb69#.2db370y2g[Graal & Truffle (Article)]
 * https://comserv.cs.ut.ee/home/files/Pool_ComputerScience_2016.pdf?study=ATILoputoo&reference=6319668E7151D556131810BC3F4A627D7FEF5F3B[Truffle Overview (see chapter 1)]
 * https://gist.github.com/smarr/d1f8f2101b5cc8e14e12[Truffle: Languages and Material]
 * https://github.com/smarr/truffle-notes[Truffle Notes]
-* https://wiki.openjdk.java.net/display/Graal/Truffle+FAQ+and+Guidelines[Truffle FAQ]
+* https://www.graalvm.org/latest/graalvm-as-a-platform/language-implementation-framework/[Truffle Language Implementation Framework]

 === Other Config Languages

@@ -1,4 +1,4 @@
-Copyright © 2024-2025 Apple Inc. and the Pkl project authors
+Copyright © 2024-2026 Apple Inc. and the Pkl project authors


 Portions of this software were originally based on 'SnakeYAML' developed by Andrey Somov.
@@ -12,7 +12,7 @@
 :uri-installation: https://pkl-lang.org/main/current/pkl-cli/index.html#installation
 :uri-lang-reference: https://pkl-lang.org/main/current/language-reference/index.html
 :uri-ci-artifacts: https://s01.oss.sonatype.org/content/groups/public/org/pkl-lang/
-:uri-ci-pipeline: https://app.circleci.com/pipelines/github/apple/pkl
+:uri-ci-pipeline: https://github.com/apple/pkl/actions

 A configuration as code language with rich validation and tooling.

@@ -37,7 +37,10 @@ We'd love to hear from you!
 * Create an {uri-github-issue}[issue]
 * Ask a question on {uri-github-discussions}[GitHub Discussions]

-== Development image:https://circleci.com/gh/apple/pkl.svg?style=svg["Apple", link="https://app.circleci.com/pipelines/github/apple/pkl"]
+== Development
+
+image:https://github.com/apple/pkl/actions/workflows/main.yml/badge.svg?style=svg["Build (main)", link="https://github.com/apple/pkl/actions/workflows/main.yml"]
+
 * link:CONTRIBUTING.adoc[] for tips on pull requests and filing issues
 * link:DEVELOPMENT.adoc[] for build instructions
 * {uri-ci-artifacts}[Sonatype Repository] for the artifacts/binaries built by our {uri-ci-pipeline}[CI pipelines] (and those of our other tools and packages repositories).
@@ -60,6 +63,9 @@ We'd love to hear from you!
 |https://github.com/apple/pkl-go-examples[`apple/pkl-go-examples`]
 |Examples for using Pkl within Go applications

+|https://github.com/apple/highlightjs-pkl[`apple/highlightjs-pkl`]
+|Highlight.js syntax highlighting for Pkl
+
 |https://github.com/apple/pkl-intellij[`apple/pkl-intellij`]
 |JetBrains editor plugins providing Pkl language support

@@ -76,7 +82,7 @@ We'd love to hear from you!
 |The pkl-lang.org website

 |https://github.com/apple/pkl-lsp[`apple/pkl-lsp`]
-| Language server for Pkl, implementing the server-side of the Language Server Protocol
+|Language server for Pkl, implementing the server-side of the Language Server Protocol

 |https://github.com/apple/pkl-neovim[`apple/pkl-neovim`]
 |Pkl language support for Neovim
@@ -90,6 +96,9 @@ We'd love to hear from you!
 |https://github.com/apple/pkl-project-commons[`apple/pkl-project-commons`]
 |Utility libraries for Pkl

+|https://github.com/apple/pkl-readers[`apple/pkl-readers`]
+|Shared Pkl https://pkl-lang.org/main/current/language-reference/index.html#external-readers[external reader] tools
+
 |https://github.com/apple/pkl-spring[`apple/pkl-spring`]
 |Spring Boot extension for configuring Boot apps with Pkl

@@ -105,9 +114,9 @@ We'd love to hear from you!
 |https://github.com/apple/pkl.tmbundle[`apple/pkl.tmbundle`]
 |TextMate bundle for Pkl

-|https://github.com/apple/rules_pkl[`apple/rules_pkl`]
-| Bazel build rules for Pkl
-
 |https://github.com/apple/tree-sitter-pkl[`apple/tree-sitter-pkl`]
 |Tree-sitter parser for Pkl
+
+|https://github.com/apple/rules_pkl[`apple/rules_pkl`]
+|Bazel build rules for Pkl
 |===
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -14,8 +14,8 @@
 * limitations under the License.
 */
 plugins {
-  pklAllProjects
-  pklJavaLibrary
+  id("pklAllProjects")
+  id("pklJavaLibrary")
  id("me.champeau.jmh")
 }

@@ -1,54 +0,0 @@
-# This is a Gradle generated file for dependency locking.
-# Manual edits can break the build and are not advised.
-# This file is expected to be part of source control.
-net.bytebuddy:byte-buddy:1.15.11=jmh,jmhRuntimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-net.sf.jopt-simple:jopt-simple:5.0.4=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
-org.apache.commons:commons-math3:3.6.1=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
-org.apiguardian:apiguardian-api:1.1.2=jmhCompileClasspath,jmhImplementationDependenciesMetadata,testCompileClasspath,testImplementationDependenciesMetadata
-org.assertj:assertj-core:3.27.4=jmh,jmhRuntimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.graalvm.compiler:compiler:24.1.2=graal
-org.graalvm.polyglot:polyglot:24.1.2=jmh,jmhRuntimeClasspath,truffle
-org.graalvm.sdk:collections:24.1.2=graal,jmh,jmhRuntimeClasspath,truffle
-org.graalvm.sdk:graal-sdk:24.1.2=jmh,jmhRuntimeClasspath
-org.graalvm.sdk:nativeimage:24.1.2=jmh,jmhRuntimeClasspath,truffle
-org.graalvm.sdk:word:24.1.2=graal,jmh,jmhRuntimeClasspath,truffle
-org.graalvm.truffle:truffle-api:24.1.2=jmh,jmhRuntimeClasspath,truffle
-org.graalvm.truffle:truffle-compiler:24.1.2=graal
-org.jetbrains.intellij.deps:trove4j:1.0.20200330=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-build-common:2.0.21=kotlinBuildToolsApiClasspath
-org.jetbrains.kotlin:kotlin-build-tools-api:2.0.21=kotlinBuildToolsApiClasspath
-org.jetbrains.kotlin:kotlin-build-tools-impl:2.0.21=kotlinBuildToolsApiClasspath
-org.jetbrains.kotlin:kotlin-compiler-embeddable:2.0.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-compiler-runner:2.0.21=kotlinBuildToolsApiClasspath
-org.jetbrains.kotlin:kotlin-daemon-client:2.0.21=kotlinBuildToolsApiClasspath
-org.jetbrains.kotlin:kotlin-daemon-embeddable:2.0.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-klib-commonizer-embeddable:2.0.21=kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-native-prebuilt:2.0.21=kotlinNativeBundleConfiguration
-org.jetbrains.kotlin:kotlin-reflect:2.0.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-script-runtime:2.0.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-scripting-common:2.0.21=kotlinBuildToolsApiClasspath,kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
-org.jetbrains.kotlin:kotlin-scripting-compiler-embeddable:2.0.21=kotlinBuildToolsApiClasspath,kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
-org.jetbrains.kotlin:kotlin-scripting-compiler-impl-embeddable:2.0.21=kotlinBuildToolsApiClasspath,kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
-org.jetbrains.kotlin:kotlin-scripting-jvm:2.0.21=kotlinBuildToolsApiClasspath,kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
-org.jetbrains.kotlin:kotlin-stdlib-jdk7:2.0.21=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.jetbrains.kotlin:kotlin-stdlib-jdk8:2.0.21=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.jetbrains.kotlin:kotlin-stdlib:2.0.21=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath,kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.6.4=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
-org.jetbrains:annotations:13.0=jmh,jmhCompileClasspath,jmhRuntimeClasspath,kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathJmh,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.13.4=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-engine:5.13.4=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-params:5.13.4=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.13.4=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.platform:junit-platform-engine:1.13.4=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath,testRuntimeClasspath
-org.junit.platform:junit-platform-launcher:1.13.4=testRuntimeClasspath
-org.junit:junit-bom:5.13.4=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.msgpack:msgpack-core:0.9.8=jmh,jmhRuntimeClasspath
-org.openjdk.jmh:jmh-core:1.37=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
-org.openjdk.jmh:jmh-generator-asm:1.37=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
-org.openjdk.jmh:jmh-generator-bytecode:1.37=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
-org.openjdk.jmh:jmh-generator-reflection:1.37=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
-org.opentest4j:opentest4j:1.3.0=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.organicdesign:Paguro:3.10.3=jmh,jmhRuntimeClasspath
-org.ow2.asm:asm:9.0=jmh,jmhCompileClasspath,jmhImplementationDependenciesMetadata,jmhRuntimeClasspath
-org.snakeyaml:snakeyaml-engine:2.10=jmh,jmhRuntimeClasspath
-empty=annotationProcessor,apiDependenciesMetadata,compileClasspath,compileOnlyDependenciesMetadata,implementationDependenciesMetadata,intransitiveDependenciesMetadata,jmhAnnotationProcessor,jmhApiDependenciesMetadata,jmhCompileOnlyDependenciesMetadata,jmhIntransitiveDependenciesMetadata,jmhKotlinScriptDefExtensions,kotlinCompilerPluginClasspath,kotlinNativeCompilerPluginClasspath,kotlinScriptDefExtensions,runtimeClasspath,sourcesJar,testAnnotationProcessor,testApiDependenciesMetadata,testCompileOnlyDependenciesMetadata,testIntransitiveDependenciesMetadata,testKotlinScriptDefExtensions
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -23,6 +23,7 @@ import java.util.concurrent.TimeUnit;
 import org.openjdk.jmh.annotations.*;
 import org.openjdk.jmh.util.TempFile;
 import org.openjdk.jmh.util.TempFileManager;
+import org.pkl.core.evaluatorSettings.TraceMode;
 import org.pkl.core.http.HttpClient;
 import org.pkl.core.module.ModuleKeyFactories;
 import org.pkl.core.repl.ReplRequest;
@@ -51,7 +52,8 @@ public class ListSort {
          null,
          IoUtils.getCurrentWorkingDir(),
          StackFrameTransformers.defaultTransformer,
-          false);
+          false,
+          TraceMode.COMPACT);
  private static final List<Object> list = new ArrayList<>(100000);

  static {
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -20,11 +20,16 @@ plugins {
  `jvm-toolchains`
 }

-// Keep this in sync with the constants in `BuildInfo.kt` (those are not addressable here).
-val toolchainVersion = 21
+/**
+ * To avoid the provisioning of multiple JDKs and other build issues, keep this value in sync with
+ * the JVM toolchain versions in `BuildInfo.kt` and `gradle-daemon-jvm.properties`.
+ */
+val toolchainVersion = 25

 dependencies {
  implementation(libs.downloadTaskPlugin)
+  implementation(libs.errorPronePlugin)
+  implementation(libs.nullawayPlugin)
  implementation(libs.spotlessPlugin)
  implementation(libs.kotlinPlugin) { exclude(module = "kotlin-android-extensions") }
  implementation(libs.shadowPlugin)
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -15,7 +15,7 @@
 */
@file:Suppress("UnstableApiUsage")

-rootProject.name = "buildSrc"
+rootProject.name = "build-logic"

 pluginManagement {
  repositories {
@@ -24,7 +24,7 @@ pluginManagement {
  }
 }

-plugins { id("org.gradle.toolchains.foojay-resolver-convention") }
+plugins { id("org.gradle.toolchains.foojay-resolver-convention") version "1.0.0" }

 // makes ~/.gradle/init.gradle unnecessary and ~/.gradle/gradle.properties optional
 dependencyResolutionManagement {
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -31,7 +31,7 @@ import org.gradle.process.CommandLineArgumentProvider

 /**
 * JVM bytecode target; this is pinned at a reasonable version, because downstream JVM projects
- * which consume Pkl will need a minimum Bytecode level at or above this one.
+ * which consume Pkl will need a minimum bytecode level at or above this one.
 *
 * Kotlin and Java need matching bytecode targets, so this is expressed as a build setting and
 * constant default. To override, pass `-DpklJdkToolchain=X` to the Gradle command line, where X is
@@ -40,10 +40,13 @@ import org.gradle.process.CommandLineArgumentProvider
 const val PKL_JVM_TARGET_DEFAULT_MAXIMUM = 17

 /**
- * The Pkl build requires JDK 21+ to build, because JDK 17 is no longer within the default set of
- * supported JDKs for GraalVM. This is a build-time requirement, not a runtime requirement.
+ * The Pkl build requires JDK 25+; otherwise, NullAway will not work correctly.
+ *
+ * This is a build-time requirement, not a runtime requirement. To avoid the provisioning of
+ * multiple JDKs and other build issues, keep this value in sync with the JVM toolchain versions in
+ * `build-logic/build.gradle.kts` and `gradle-daemon-jvm.properties`.
 */
-const val PKL_JDK_VERSION_MIN = 21
+const val PKL_JDK_VERSION_MIN = 25

 /**
 * The JDK minimum is set to match the bytecode minimum, to guarantee that fat JARs work against the
@@ -52,14 +55,15 @@ const val PKL_JDK_VERSION_MIN = 21
 const val PKL_TEST_JDK_MINIMUM = PKL_JVM_TARGET_DEFAULT_MAXIMUM

 /**
- * Maximum JDK version which Pkl is tested with; this should be bumped when new JDK stable releases
- * are issued. At the time of this writing, JDK 23 is the latest available release.
+ * Maximum JDK version which Pkl is tested with; this should be bumped when new JDK releases are
+ * issued.
 */
-const val PKL_TEST_JDK_MAXIMUM = 23
+const val PKL_TEST_JDK_MAXIMUM = 26

 /**
- * Test the full suite of JDKs between [PKL_TEST_JDK_MINIMUM] and [PKL_TEST_JDK_MAXIMUM]; if this is
- * set to `false` (or overridden on the command line), only LTS releases are tested by default.
+ * If `true`, all JDK releases between [PKL_TEST_JDK_MINIMUM] and [PKL_TEST_JDK_MAXIMUM] are tested.
+ * If `false`, only LTS releases within that range are tested. To override, pass
+ * `-DpklTestAllJdks=true` on the Gradle command line.
 */
 const val PKL_TEST_ALL_JDKS = false

@@ -84,12 +88,13 @@ open class BuildInfo(private val project: Project) {
      }
    }

-    val baseName: String by lazy { "graalvm-jdk-${graalVmJdkVersion}_${osName}-${arch}_bin" }
+    val baseName: String by lazy {
+      "graalvm-community-jdk-${graalVmJdkVersion}_${osName}-${arch}_bin"
+    }

    val downloadUrl: String by lazy {
-      val jdkMajor = graalVmJdkVersion.takeWhile { it != '.' }
      val extension = if (os.isWindows) "zip" else "tar.gz"
-      "https://download.oracle.com/graalvm/$jdkMajor/archive/$baseName.$extension"
+      "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-${graalVmJdkVersion}/$baseName.$extension"
    }

    val downloadFile: File by lazy {
@@ -196,17 +201,32 @@ open class BuildInfo(private val project: Project) {
  }

  val testJdkVendors: Sequence<JvmVendorSpec> by lazy {
-    // By default, only OpenJDK is tested during multi-JDK testing. Flip `-DpklTestAllVendors=true`
-    // to additionally test against a suite of JDK vendors, including Azul, Oracle, and GraalVM.
+    // By default, only Adoptium is tested during multi-JDK testing. Flip `-DpklTestAllVendors=true`
+    // to additionally test against GraalVM and Oracle.
    when (System.getProperty("pklTestAllVendors")?.toBoolean()) {
      true -> sequenceOf(JvmVendorSpec.ADOPTIUM, JvmVendorSpec.GRAAL_VM, JvmVendorSpec.ORACLE)
      else -> sequenceOf(JvmVendorSpec.ADOPTIUM)
    }
  }

+  private val isArmWindows: Boolean
+    get() {
+      if (!os.isWindows) {
+        return false
+      }
+      // System.getProperty("os.arch") returns the architecture of the JVM, not the host OS.
+      val procArch = System.getenv("PROCESSOR_ARCHITECTURE")
+      return "ARM64".equals(procArch, ignoreCase = true)
+    }
+
  // Assembles a collection of JDK versions which tests can be run against, considering ancillary
  // parameters like `testAllJdks` and `testExperimentalJdks`.
  val jdkTestRange: Collection<JavaLanguageVersion> by lazy {
+    if (isArmWindows) {
+      // Java toolchains does not work on ARM windows: https://github.com/gradle/gradle/issues/29807
+      // prevent creating tasks to test different JDKs if developing on a Windows ARM machine.
+      return@lazy listOf()
+    }
    JavaVersionRange.inclusive(jdkTestFloor, jdkTestCeiling).toList()
  }

@@ -262,8 +282,9 @@ open class BuildInfo(private val project: Project) {
      val namer = testNamer(baseNameProvider)
      val applyConfig: MultiJdkTestConfigurator = { (version, jdk) ->
        // 1) copy configurations from the template task
-        dependsOn(templateTask)
        templateTask.get().let { template ->
+          // copy explicit dependencies not inferred from task inputs
+          dependsOn(template.dependsOn)
          classpath = template.classpath
          testClassesDirs = template.testClassesDirs
          jvmArgs.addAll(template.jvmArgs)
@@ -289,8 +310,8 @@ open class BuildInfo(private val project: Project) {
            // multiply out by jdk vendor
            testJdkVendors.map { vendor -> (targetVersion to vendor) }
          }
-          .map { (jdkTarget, vendor) ->
-            if (jdkToolchainVersion == jdkTarget)
+          .mapNotNull { (jdkTarget, vendor) ->
+            if (jdkToolchainVersion == jdkTarget) {
              tasks.register(namer(jdkTarget, vendor)) {
                // alias to `test`
                dependsOn(templateTask)
@@ -298,9 +319,11 @@ open class BuildInfo(private val project: Project) {
                description =
                  "Alias for regular '${baseNameProvider()}' task, on JDK ${jdkTarget.asInt()}"
              }
-            else
+            } else {
+              // Always register and enable the task so it can be run explicitly,
+              // but only return it if it should be included in "check".
+              val task =
                tasks.register(namer(jdkTarget, vendor.takeIf { isMultiVendor }), Test::class) {
-                enabled = jdkTarget.isEnabled
                  group = Category.VERIFICATION
                  description = "Run tests against JDK ${jdkTarget.asInt()}"
                  applyConfig(jdkTarget to toolchains.launcherFor { languageVersion = jdkTarget })
@@ -312,6 +335,8 @@ open class BuildInfo(private val project: Project) {
                      }
                    )
                }
+              task.takeIf { jdkTarget.isEnabled }
+            }
          }
          .toList()
      }
@@ -339,7 +364,7 @@ open class BuildInfo(private val project: Project) {
  }

  val hasMuslToolchain: Boolean by lazy {
-    // see "install musl" in .circleci/jobs/BuildNativeJob.pkl
+    // see .github/scripts/install_musl.sh
    File(System.getProperty("user.home"), "staticdeps/bin/x86_64-linux-musl-gcc").exists()
  }

@@ -352,7 +377,7 @@ open class BuildInfo(private val project: Project) {
    // allow -DcommitId=abc123 for build environments that don't have git.
    System.getProperty("commitId").let { if (it != null) return@lazy it }
    // only run command once per build invocation
-    if (project === project.rootProject) {
+    if (project.path == project.rootProject.path) {
      val process =
        ProcessBuilder()
          .command("git", "rev-parse", "--short", "HEAD")
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -36,6 +36,7 @@ abstract class ExecutableJar : DefaultTask() {
  @get:Input abstract val jvmArgs: ListProperty<String>

  @TaskAction
+  @Suppress("unused")
  fun buildJar() {
    val inFile = inJar.get().asFile
    val outFile = outJar.get().asFile
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2025-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -27,6 +27,7 @@ private val ltsReleases =
    JavaLanguageVersion.of(11),
    JavaLanguageVersion.of(17),
    JavaLanguageVersion.of(21),
+    JavaLanguageVersion.of(25),
  )

 /** Describes an inclusive range of JVM versions, based on the [JavaLanguageVersion] type. */
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -57,7 +57,7 @@ open class MergeSourcesJars : DefaultTask() {
    // a word or a period character. should catch most cases.
    val importPattern =
      Pattern.compile(
-        "(?<!(\\w|\\.))(" + relocatedPkgs.keys.joinToString("|") { it.replace(".", "\\.") } + ")"
+        "(?<!([\\w.]))(" + relocatedPkgs.keys.joinToString("|") { it.replace(".", "\\.") } + ")"
      )

    val sourceFileExts = sourceFileExtensions.get()
@@ -70,7 +70,7 @@ open class MergeSourcesJars : DefaultTask() {
        val details = this
        if (details.isDirectory) return@visit

-        var path = details.relativePath.parent.pathString
+        var path = details.relativePath.parent!!.pathString
        val relocatedPath = relocatedPaths.keys.find { path.startsWith(it) }
        if (relocatedPath != null) {
          path = path.replace(relocatedPath, relocatedPaths.getValue(relocatedPath))
@@ -101,7 +101,7 @@ open class MergeSourcesJars : DefaultTask() {
      project.zipTree(jar).visit {
        val details = this
        if (details.isDirectory) return@visit // avoid adding empty dirs
-        result.add(details.relativePath.parent.pathString)
+        result.add(details.relativePath.parent!!.pathString)
      }
    }
    return result
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2025-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -55,8 +55,7 @@ abstract class NativeImageBuild : DefaultTask() {

  @get:Inject protected abstract val execOperations: ExecOperations

-  private val graalVm: Provider<BuildInfo.GraalVm> =
-    arch.map { a ->
+  private val graalVm: Provider<BuildInfo.GraalVm> = arch.map { a ->
    when (a) {
      Architecture.AMD64 -> buildInfo.graalVmAmd64
      Architecture.AARCH64 -> buildInfo.graalVmAarch64
@@ -102,6 +101,7 @@ abstract class NativeImageBuild : DefaultTask() {
  }

  @TaskAction
+  @Suppress("unused")
  protected fun run() {
    execOperations.exec {
      val exclusions =
@@ -118,6 +118,8 @@ abstract class NativeImageBuild : DefaultTask() {
        add("--initialize-at-build-time=")
        // needed for messagepack-java (see https://github.com/msgpack/msgpack-java/issues/600)
        add("--initialize-at-run-time=org.msgpack.core.buffer.DirectBufferAccess")
+        // needed for jline-terminal-jni
+        add("--initialize-at-run-time=org.jline.nativ,org.jline.terminal.impl.jni")
        add("--no-fallback")
        add("-H:IncludeResources=org/pkl/core/stdlib/.*\\.pkl")
        add("-H:IncludeResources=org/jline/utils/.*")
@@ -148,8 +150,7 @@ abstract class NativeImageBuild : DefaultTask() {
        }
        // native-image rejects non-existing class path entries -> filter
        add("--class-path")
-        val pathInput =
-          classpath.filter {
+        val pathInput = classpath.filter {
          it.exists() && !exclusions.any { exclude -> it.name.contains(exclude) }
        }
        add(pathInput.asPath)
@@ -0,0 +1,58 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import com.diffplug.spotless.FormatterFunc
+import com.diffplug.spotless.FormatterStep
+import java.io.Serial
+import java.io.Serializable
+import java.net.URLClassLoader
+import org.gradle.api.artifacts.Configuration
+
+class PklFormatterStep(@Transient private val configuration: Configuration) : Serializable {
+  companion object {
+    @Serial private const val serialVersionUID: Long = 1L
+  }
+
+  fun create(): FormatterStep {
+    return FormatterStep.createLazy(
+      "pkl",
+      { PklFormatterStep(configuration) },
+      { PklFormatterFunc(configuration) },
+    )
+  }
+}
+
+class PklFormatterFunc(@Transient private val configuration: Configuration) :
+  FormatterFunc, Serializable {
+  companion object {
+    @Serial private const val serialVersionUID: Long = 1L
+  }
+
+  private val classLoader by lazy {
+    val urls = configuration.files.map { it.toURI().toURL() }
+    // Use the platform classloader as parent to isolate from Gradle's classloader
+    URLClassLoader(urls.toTypedArray(), ClassLoader.getPlatformClassLoader())
+  }
+
+  private val formatterClass by lazy { classLoader.loadClass("org.pkl.formatter.Formatter") }
+
+  private val formatMethod by lazy { formatterClass.getMethod("format", String::class.java) }
+
+  private val formatterInstance by lazy { formatterClass.getConstructor().newInstance() }
+
+  override fun apply(input: String): String {
+    return formatMethod(formatterInstance, input) as String
+  }
+}
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -15,19 +15,18 @@
 */
 import java.nio.charset.StandardCharsets
 import java.util.Base64
+import org.gradle.api.Project
+import org.gradle.api.publish.PublishingExtension
+import org.gradle.api.publish.maven.MavenPublication
+import org.gradle.api.publish.maven.tasks.AbstractPublishToMaven
 import org.gradle.api.publish.maven.tasks.GenerateMavenPom
+import org.gradle.kotlin.dsl.*
+import org.gradle.plugins.signing.SigningExtension

-plugins {
-  `maven-publish`
-  signing
-}
-
-publishing {
-  publications {
-    components.findByName("java")?.let { javaComponent ->
-      create<MavenPublication>("library") { from(javaComponent) }
-    }
-    withType<MavenPublication>().configureEach {
+/** Configures common POM metadata (licenses, developers, SCM, etc.) for all Pkl publications. */
+fun Project.configurePklPomMetadata() {
+  extensions.configure<PublishingExtension> {
+    publications.withType<MavenPublication>().configureEach {
      pom {
        name.set(artifactId)
        licenses {
@@ -46,7 +45,7 @@ publishing {
        scm {
          connection.set("scm:git:git://github.com/apple/pkl.git")
          developerConnection.set("scm:git:ssh://github.com/apple/pkl.git")
-          val buildInfo = project.extensions.getByType<BuildInfo>()
+          val buildInfo = extensions.getByType<BuildInfo>()
          url.set("https://github.com/apple/pkl/tree/${buildInfo.commitish}")
        }
        issueManagement {
@@ -54,16 +53,17 @@ publishing {
          url.set("https://github.com/apple/pkl/issues")
        }
        ciManagement {
-          system.set("Circle CI")
-          url.set("https://app.circleci.com/pipelines/github/apple/pkl")
+          system.set("GitHub Actions")
+          url.set("https://github.com/apple/pkl/actions")
        }
      }
    }
  }
 }

-val validatePom by
-  tasks.registering {
+/** Configures POM validation task to check for unresolved versions and snapshots in releases. */
+fun Project.configurePomValidation() {
+  val validatePom by tasks.registering {
    if (tasks.findByName("generatePomFileForLibraryPublication") == null) {
      return@registering
    }
@@ -87,7 +87,7 @@ val validatePom by
        val unresolvedVersion = Regex("<version>.*[+,()\\[\\]].*</version>")
        val matches = unresolvedVersion.findAll(text).toList()
        if (matches.isNotEmpty()) {
-          throw GradleException(
+          throw org.gradle.api.GradleException(
            """
        Found unresolved version selector(s) in generated POM:
        ${matches.joinToString("\n") { it.groupValues[0] }}
@@ -102,7 +102,7 @@ val validatePom by
        val snapshotVersion = Regex("<version>.*-SNAPSHOT</version>")
        val matches = snapshotVersion.findAll(text).toList()
        if (matches.isNotEmpty()) {
-          throw GradleException(
+          throw org.gradle.api.GradleException(
            """
        Found snapshot version(s) in generated POM of Pkl release version:
        ${matches.joinToString("\n") { it.groupValues[0] }}
@@ -116,20 +116,23 @@ val validatePom by
    }
  }

-tasks.publish { dependsOn(validatePom) }
-
-// Workaround for maven publish plugin not setting up dependencies correctly.
-// Taken from https://github.com/gradle/gradle/issues/26091#issuecomment-1798137734
-val dependsOnTasks = mutableListOf<String>()
-
-tasks.withType<AbstractPublishToMaven>().configureEach {
-  dependsOnTasks.add(name.replace("publish", "sign").replaceAfter("Publication", ""))
-  dependsOn(dependsOnTasks)
+  tasks.named("publish") { dependsOn(validatePom) }
 }

-signing {
-  // provided as env vars `ORG_GRADLE_PROJECT_signingKey` and `ORG_GRADLE_PROJECT_signingPassword`
-  // in CI.
+/** Configures signing for Pkl publications. */
+fun Project.configurePklSigning() {
+  // Workaround for maven publish plugin not setting up dependencies correctly.
+  // Taken from https://github.com/gradle/gradle/issues/26091#issuecomment-1798137734
+  val dependsOnTasks = mutableListOf<String>()
+
+  tasks.withType<AbstractPublishToMaven>().configureEach {
+    dependsOnTasks.add(name.replace("publish", "sign").replaceAfter("Publication", ""))
+    dependsOn(dependsOnTasks)
+  }
+
+  extensions.configure<SigningExtension> {
+    // provided as env vars `ORG_GRADLE_PROJECT_signingKey` and
+    // `ORG_GRADLE_PROJECT_signingPassword` in CI.
    val signingKey =
      (findProperty("signingKey") as String?)?.let {
        Base64.getDecoder().decode(it).toString(StandardCharsets.US_ASCII)
@@ -138,10 +141,6 @@ signing {
    if (signingKey != null && signingPassword != null) {
      useInMemoryPgpKeys(signingKey, signingPassword)
    }
-  publishing.publications.findByName("library")?.let { sign(it) }
-}
-
-artifacts {
-  project.tasks.findByName("javadocJar")?.let { archives(it) }
-  project.tasks.findByName("sourcesJar")?.let { archives(it) }
+    extensions.getByType<PublishingExtension>().publications.findByName("library")?.let { sign(it) }
+  }
 }
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -0,0 +1,77 @@
+/*
+ * Copyright © 2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import com.diffplug.spotless.FormatterFunc
+import com.diffplug.spotless.FormatterStep
+import java.io.File
+import java.io.Serial
+import java.io.Serializable
+
+/**
+ * A Spotless [FormatterStep] that suppresses formatting changes where the only difference between
+ * the formatted output and the file's content in the upstream base ref is the license header year.
+ *
+ * Avoids an issue where, in the process of working on the codebase:
+ * 1. A file is modified.
+ * 2. Spotless formats the file, and also updates the copyright year.
+ * 3. The original modification is reverted.
+ * 4. Spotless formats the file again, but now the copyright year is the updated year.
+ */
+class RevertYearOnlyChangesStep(private val repoRoot: File, private val ratchetFrom: String) :
+  Serializable {
+  companion object {
+    @Serial private const val serialVersionUID: Long = 1L
+  }
+
+  fun create(): FormatterStep =
+    FormatterStep.createLazy(
+      "revertYearOnlyChanges",
+      { this },
+      { RevertYearOnlyChangesFunc(repoRoot, ratchetFrom) },
+    )
+}
+
+class RevertYearOnlyChangesFunc(private val repoRoot: File, private val ratchetFrom: String) :
+  FormatterFunc.NeedsFile, Serializable {
+  companion object {
+    @Serial private const val serialVersionUID: Long = 1L
+
+    // Matches "Copyright © 2024" or "Copyright © 2024-2025"
+    private val YEAR_REGEX = Regex("""(Copyright © )\d{4}(-\d{4})?""")
+  }
+
+  override fun applyWithFile(unix: String, file: File): String {
+    val relativePath = repoRoot.toPath().relativize(file.toPath()).toString()
+    val upstreamContent = gitShow(ratchetFrom, relativePath) ?: return unix
+    val normalizedRaw = YEAR_REGEX.replace(unix, "\$1YEAR")
+    val normalizedUpstream = YEAR_REGEX.replace(upstreamContent, "\$1YEAR")
+    return if (normalizedRaw == normalizedUpstream) {
+      // Only the year changed — return the upstream content
+      upstreamContent
+    } else {
+      unix
+    }
+  }
+
+  private fun gitShow(ref: String, path: String): String? {
+    val process =
+      ProcessBuilder("git", "show", "$ref:$path")
+        .directory(repoRoot)
+        .redirectErrorStream(true)
+        .start()
+    val output = process.inputStream.readBytes().toString(Charsets.UTF_8)
+    return if (process.waitFor() == 0) output.replace("\r\n", "\n") else null
+  }
+}
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -15,19 +15,19 @@
 */
 import com.diffplug.gradle.spotless.KotlinGradleExtension
 import org.gradle.accessors.dm.LibrariesForLibs
-import org.jetbrains.kotlin.gradle.dsl.JvmTarget
-import org.jetbrains.kotlin.gradle.tasks.KotlinJvmCompile

 plugins { id("com.diffplug.spotless") }

 val buildInfo = extensions.create<BuildInfo>("buildInfo", project)

-dependencyLocking { lockAllConfigurations() }
-
 configurations {
  val rejectedVersionSuffix = Regex("-alpha|-beta|-eap|-m|-rc|-snapshot", RegexOption.IGNORE_CASE)
  configureEach {
    resolutionStrategy {
+      // forbid dependencies whose pom.xml's include version ranges, because this will lead to
+      // unreproducible builds.
+
+      failOnDynamicVersions()
      componentSelection {
        all {
          if (rejectedVersionSuffix.containsMatchIn(candidate.version)) {
@@ -42,25 +42,9 @@ configurations {
  }
 }

-configurations.all {
-  resolutionStrategy.eachDependency {
-    if (requested.group == "org.jetbrains.kotlin") {
-      // prevent transitive deps from bumping Koltin version
-      useVersion(libs.versions.kotlin.get())
-    }
-  }
-}
-
-plugins.withType(JavaPlugin::class).configureEach {
-  tasks.withType<JavaCompile>().configureEach { options.release = 17 }
-}
-
-tasks.withType<KotlinJvmCompile>().configureEach {
-  compilerOptions {
-    jvmTarget = JvmTarget.JVM_17
-    freeCompilerArgs.addAll("-Xjsr305=strict", "-Xjvm-default=all")
-    freeCompilerArgs.add("-Xjdk-release=17")
-  }
+tasks.withType<JavaCompile>().configureEach {
+  javaCompiler = buildInfo.javaCompiler
+  options.release = buildInfo.jvmTarget
 }

 plugins.withType(IdeaPlugin::class).configureEach {
@@ -81,7 +65,7 @@ plugins.withType(MavenPublishPlugin::class).configureEach {
    repositories {
      maven {
        name = "projectLocal" // affects task names
-        url = uri("file:///$rootDir/build/m2")
+        url = rootDir.resolve("build/m2").toURI()
      }
    }
    // use resolved/locked (e.g., `1.15`)
@@ -95,13 +79,6 @@ plugins.withType(MavenPublishPlugin::class).configureEach {
  }
 }

-// settings.gradle.kts sets `--write-locks`
-// if Gradle command line contains this task name
-val updateDependencyLocks by
-  tasks.registering {
-    doLast { configurations.filter { it.isCanBeResolved }.forEach { it.resolve() } }
-  }
-
 val allDependencies by tasks.registering(DependencyReportTask::class)

 tasks.withType(Test::class).configureEach {
@@ -110,7 +87,6 @@ tasks.withType(Test::class).configureEach {
  }
  debugOptions {
    enabled = System.getProperty("jvmdebug")?.toBoolean() ?: false
-    @Suppress("UnstableApiUsage")
    host = "*"
    port = 5005
    suspend = true
@@ -121,7 +97,6 @@ tasks.withType(Test::class).configureEach {
 tasks.withType(JavaExec::class).configureEach {
  debugOptions {
    enabled = System.getProperty("jvmdebug")?.toBoolean() ?: false
-    @Suppress("UnstableApiUsage")
    host = "*"
    port = 5005
    suspend = true
@@ -133,7 +108,7 @@ tasks.withType(JavaExec::class).configureEach {
 private val libs = the<LibrariesForLibs>()

 private val licenseHeaderFile by lazy {
-  rootProject.file("buildSrc/src/main/resources/license-header.star-block.txt")
+  rootProject.file("build-logic/src/main/resources/license-header.star-block.txt")
 }

 private fun KotlinGradleExtension.configureFormatter() {
@@ -142,26 +117,40 @@ private fun KotlinGradleExtension.configureFormatter() {
 }

 val originalRemoteName = System.getenv("PKL_ORIGINAL_REMOTE_NAME") ?: "origin"
+// if we're running against a release branch (or a PR targeted at one), use that branch for
+// ratcheting
+// these env vars are set by GitHub actions:
+// https://docs.github.com/en/actions/reference/workflows-and-actions/variables#default-environment-variables
+val ratchetBranchName =
+  (System.getenv("GITHUB_BASE_REF") ?: System.getenv("GITHUB_REF_NAME"))?.let {
+    if (it.startsWith("release/")) it else null
+  } ?: "main"

 spotless {
-  ratchetFrom = "$originalRemoteName/main"
+  ratchetFrom = "$originalRemoteName/$ratchetBranchName"

-  // When building root project, format buildSrc files too.
-  // We need this because buildSrc is not a subproject of the root project, so a top-level
-  // `spotlessApply` will not trigger `buildSrc:spotlessApply`.
-  if (project === rootProject) {
+  val revertYearOnlyChangesStep =
+    RevertYearOnlyChangesStep(rootProject.rootDir, ratchetFrom!!).create()
+
+  // When building root project, format build-logic files too.
+  // We need this because build-logic is not a subproject of the root project, so a top-level
+  // `spotlessApply` will not trigger `build-logic:spotlessApply`.
+  if (project.path == rootProject.path) {
    kotlinGradle {
      configureFormatter()
-      target("*.kts", "buildSrc/*.kts", "buildSrc/src/*/kotlin/**/*.kts")
+      addStep(revertYearOnlyChangesStep)
+      target("*.kts", "build-logic/*.kts", "build-logic/src/*/kotlin/**/*.kts")
    }
    kotlin {
      ktfmt(libs.versions.ktfmt.get()).googleStyle()
-      target("buildSrc/src/*/kotlin/**/*.kt")
+      target("build-logic/src/*/kotlin/**/*.kt")
      licenseHeaderFile(licenseHeaderFile)
+      addStep(revertYearOnlyChangesStep)
    }
  } else {
    kotlinGradle {
      configureFormatter()
+      addStep(revertYearOnlyChangesStep)
      target("*.kts")
    }
  }
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -15,7 +15,6 @@
 */
 import org.gradle.api.GradleException
 import org.gradle.api.artifacts.Configuration
-import org.gradle.api.component.AdhocComponentWithVariants
 import org.gradle.api.publish.maven.MavenPublication
 import org.gradle.api.tasks.bundling.Jar
 import org.gradle.api.tasks.testing.Test
@@ -24,7 +23,7 @@ import org.gradle.kotlin.dsl.*
 plugins {
  `java-library`
  `maven-publish`
-  id("com.github.johnrengelman.shadow")
+  id("com.gradleup.shadow")
 }

 // make fat Jar available to other subprojects
@@ -60,6 +59,7 @@ val relocations =
    // pkl-doc dependencies
    "org.commonmark." to "org.pkl.thirdparty.commonmark.",
    "org.jetbrains." to "org.pkl.thirdparty.jetbrains.",
+    "_COROUTINE." to "org.pkl.thirdparty.kotlinx._COROUTINE.",

    // pkl-config-java dependencies
    "io.leangen.geantyref." to "org.pkl.thirdparty.geantyref.",
@@ -84,7 +84,7 @@ for ((key, value) in relocations) {
  }
 }

-val nonRelocations = listOf("com/oracle/truffle/", "org/graalvm/")
+val nonRelocations = listOf("com/oracle/truffle/", "org/graalvm/", "org/jspecify")

 tasks.shadowJar {
  inputs.property("relocations", relocations)
@@ -93,12 +93,16 @@ tasks.shadowJar {

  configurations = listOf(project.configurations.runtimeClasspath.get())

+  addMultiReleaseAttribute = true
+
  // not required at runtime / fat JARs can't be used in native-image builds anyway
  exclude("org/pkl/cli/svm/**")

  exclude("META-INF/maven/**")
  exclude("META-INF/upgrade/**")

+  exclude("DebugProbesKt.bin")
+
  val info = project.extensions.getByType<BuildInfo>()
  val minimumJvmTarget = JavaVersion.toVersion(info.jvmTarget)

@@ -126,10 +130,7 @@ tasks.shadowJar {
  mergeServiceFiles()
 }

-// workaround for https://github.com/johnrengelman/shadow/issues/651
-components.withType(AdhocComponentWithVariants::class.java).forEach { c ->
-  c.withVariantsFromConfiguration(project.configurations.shadowRuntimeElements.get()) { skip() }
-}
+shadow { addShadowVariantIntoJavaComponent = false }

 val testFatJar by
  tasks.registering(Test::class) {
@@ -147,8 +148,7 @@ val testFatJar by

 tasks.check { dependsOn(testFatJar) }

-val validateFatJar by
-  tasks.registering {
+val validateFatJar by tasks.registering {
  val outputFile = layout.buildDirectory.file("validateFatJar/result.txt")
  inputs.files(tasks.shadowJar)
  inputs.property("nonRelocations", nonRelocations)
@@ -177,7 +177,7 @@ val validateFatJar by
      throw GradleException("Found unshadowed files:\n" + unshadowedFiles.joinToString("\n"))
    }
  }
-  }
+}

 tasks.check { dependsOn(validateFatJar) }

@@ -207,7 +207,7 @@ artifacts { add("fatJar", tasks.shadowJar) }
 publishing {
  publications {
    named<MavenPublication>("fatJar") {
-      project.shadow.component(this)
+      from(components["shadow"])

      // sources Jar is fat
      artifact(fatSourcesJar.flatMap { it.outputJar.asFile }) { classifier = "sources" }
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -21,6 +21,8 @@ tasks.addRule("Pattern: compatibilityTest[All|Releases|Latest|Candidate|Nightly|
  val taskName = this
  val matchResult = Regex("compatibilityTest(.+)").matchEntire(taskName) ?: return@addRule

+  // https://github.com/gradle/gradle/issues/32599
+  @Suppress("DEPRECATION")
  when (val taskNameSuffix = matchResult.groupValues[1]) {
    "All" ->
      task("compatibilityTestAll") {
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -23,25 +23,27 @@ val validatorConfiguration: Configuration =
  configurations.create("validator") {
    resolutionStrategy.eachDependency {
      if (requested.group == "log4j" && requested.name == "log4j") {
-        @Suppress("UnstableApiUsage") useTarget(buildInfo.libs.findLibrary("log4j12Api").get())
+        useTarget(buildInfo.libs.findLibrary("log4j12Api").get())
        because("mitigate critical security vulnerabilities")
      }
    }
  }

 dependencies {
-  @Suppress("UnstableApiUsage")
  validatorConfiguration(buildInfo.libs.findLibrary("nuValidator").get()) {
-    // we only want jetty-util and jetty-util-ajax (with the right version)
-    // couldn't find a more robust way to express this
+    // remove unnecessary dependencies
+    // (some of the requested versions don't even exist on Maven Central)
+    exclude(group = "org.eclipse.jetty", module = "jetty-alpn-client")
    exclude(group = "org.eclipse.jetty", module = "jetty-continuation")
    exclude(group = "org.eclipse.jetty", module = "jetty-http")
-    exclude(group = "org.eclipse.jetty", module = "jetty-io")
    exclude(group = "org.eclipse.jetty", module = "jetty-security")
    exclude(group = "org.eclipse.jetty", module = "jetty-server")
    exclude(group = "org.eclipse.jetty", module = "jetty-servlets")
+    exclude(group = "org.eclipse.jetty", module = "jetty-jakarta-servlet-api")
+    exclude(group = "org.eclipse.jetty.toolchain")
    exclude(group = "javax.servlet")
-    exclude(group = "commons-fileupload")
+    exclude(group = "org.apache.commons", module = "commons-fileupload2-core")
+    exclude(group = "org.apache.commons", module = "commons-fileupload2-jakarta-servlet5")
  }
 }

@@ -0,0 +1,46 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import net.ltgt.gradle.errorprone.errorprone
+import net.ltgt.gradle.nullaway.nullaway
+import org.gradle.accessors.dm.LibrariesForLibs
+import org.gradle.api.tasks.compile.JavaCompile
+
+plugins {
+  `java-library`
+  id("net.ltgt.errorprone")
+  id("net.ltgt.nullaway")
+}
+
+val libs = the<LibrariesForLibs>()
+
+dependencies {
+  api(libs.jspecify)
+  errorprone(libs.errorProne)
+  errorprone(libs.nullaway)
+}
+
+nullaway { onlyNullMarked = true }
+
+tasks.withType<JavaCompile>().configureEach {
+  options.errorprone.disableAllChecks = true
+  options.errorprone.nullaway {
+    error()
+    onlyNullMarked = true
+    jspecifyMode = true
+    // honor assert x != null in addition to Objects.requireNonNull(x)
+    assertsEnabled = true
+  }
+}
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2025-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@ import org.gradle.kotlin.dsl.support.serviceOf
 plugins {
  id("pklJavaLibrary")
  //  id("pklPublishLibrary")
-  id("com.github.johnrengelman.shadow")
+  id("com.gradleup.shadow")
 }

 val executableSpec = project.extensions.create("executable", ExecutableSpec::class.java)
@@ -47,8 +47,7 @@ fun Task.setupTestStartJavaExecutable(launcher: Provider<JavaLauncher>? = null)
  val outputFile = layout.buildDirectory.file("testStartJavaExecutable/$name")
  outputs.file(outputFile)

-  val execOutput =
-    providers.exec {
+  val execOutput = providers.exec {
    val executablePath = javaExecutable.get().outputs.files.singleFile
    if (launcher?.isPresent == true) {
      commandLine(
@@ -72,7 +71,7 @@ fun Task.setupTestStartJavaExecutable(launcher: Provider<JavaLauncher>? = null)
    outputFile.get().asFile.toPath().apply {
      try {
        parent.createDirectories()
-      } catch (ignored: java.nio.file.FileAlreadyExistsException) {}
+      } catch (_: java.nio.file.FileAlreadyExistsException) {}
      writeText("OK")
    }
  }
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -50,20 +50,18 @@ artifacts {
 }

 spotless {
+  val revertYearOnlyChanges = RevertYearOnlyChangesStep(rootProject.rootDir, ratchetFrom!!).create()
+
  java {
+    addStep(revertYearOnlyChanges)
    googleJavaFormat(libs.versions.googleJavaFormat.get())
    target("src/*/java/**/*.java")
-    licenseHeaderFile(rootProject.file("buildSrc/src/main/resources/license-header.star-block.txt"))
-  }
-  kotlin {
-    ktfmt(libs.versions.ktfmt.get()).googleStyle()
-    target("src/*/kotlin/**/*.kt")
-    licenseHeaderFile(rootProject.file("buildSrc/src/main/resources/license-header.star-block.txt"))
+    licenseHeaderFile(
+      rootProject.file("build-logic/src/main/resources/license-header.star-block.txt")
+    )
  }
 }

-tasks.compileKotlin { enabled = false }
-
 tasks.jar {
  manifest {
    attributes +=
@@ -81,19 +79,6 @@ tasks.javadoc {
  (options as StandardJavadocDocletOptions).addStringOption("Xdoclint:none", "-quiet")
 }

-val workAroundKotlinGradlePluginBug by
-  tasks.registering {
-    doLast {
-      // Works around this problem, which sporadically appears and disappears in different
-      // subprojects:
-      // A problem was found with the configuration of task ':pkl-executor:compileJava' (type
-      // 'JavaCompile').
-      // > Directory '[...]/pkl/pkl-executor/build/classes/kotlin/main'
-      // specified for property 'compileKotlinOutputClasses' does not exist.
-      layout.buildDirectory.dir("classes/kotlin/main").get().asFile.mkdirs()
-    }
-  }
-
 val truffleJavacArgs =
  listOf(
    // TODO: determine correct limits for Truffle specializations
@@ -103,7 +88,6 @@ val truffleJavacArgs =

 tasks.compileJava {
  javaCompiler = info.javaCompiler
-  dependsOn(workAroundKotlinGradlePluginBug)
  options.compilerArgs.addAll(truffleJavacArgs + info.jpmsAddModulesFlags)
 }

@@ -0,0 +1,115 @@
+/*
+ * Copyright © 2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import org.gradle.accessors.dm.LibrariesForLibs
+import org.gradle.api.GradleException
+import org.gradle.kotlin.dsl.getByType
+import org.gradle.kotlin.dsl.kotlin
+import org.gradle.kotlin.dsl.the
+import org.jetbrains.kotlin.gradle.dsl.JvmTarget
+import org.jetbrains.kotlin.gradle.dsl.KotlinVersion
+
+plugins {
+  java
+  kotlin("jvm")
+  id("com.diffplug.spotless")
+}
+
+val buildInfo = project.extensions.getByType<BuildInfo>()
+
+val libs = the<LibrariesForLibs>()
+
+kotlin {
+  jvmToolchain {
+    languageVersion.set(buildInfo.jdkToolchainVersion)
+    vendor.set(buildInfo.jdkVendor)
+  }
+  compilerOptions {
+    val kotlinTarget = KotlinVersion.fromVersion(libs.versions.kotlinTarget.get())
+    languageVersion.set(kotlinTarget)
+    apiVersion.set(kotlinTarget)
+    jvmTarget = JvmTarget.fromTarget(buildInfo.jvmTarget.toString())
+    freeCompilerArgs.addAll(
+      "-jvm-default=no-compatibility", // was: -Xjvm-default=all
+      "-Xjdk-release=${buildInfo.jvmTarget}",
+      "-Xjsr305=strict",
+    )
+  }
+}
+
+spotless {
+  val revertYearOnlyChanges = RevertYearOnlyChangesStep(rootProject.rootDir, ratchetFrom!!).create()
+
+  kotlin {
+    addStep(revertYearOnlyChanges)
+    ktfmt(libs.versions.ktfmt.get()).googleStyle()
+    target("src/*/kotlin/**/*.kt")
+    licenseHeaderFile(
+      rootProject.file("build-logic/src/main/resources/license-header.star-block.txt")
+    )
+  }
+}
+
+/**
+ * Kotlin modules to guard: fail the build if any dependency resolves to a version higher than
+ * `libs.versions.kotlinTarget`. This includes versions introduced via direct declarations, BOMs,
+ * version catalogs, or constraints.
+ */
+val guardedKotlinModules = setOf(libs.kotlinStdLib.get().module, libs.kotlinReflect.get().module)
+
+/**
+ * Classpath configurations where the above rule applies. Kept narrow to avoid interfering with
+ * Gradle/Kotlin plugin internal configurations.
+ */
+val guardedConfigurations =
+  setOf(
+    configurations.compileClasspath,
+    configurations.runtimeClasspath,
+    configurations.testCompileClasspath,
+    configurations.testRuntimeClasspath,
+  )
+
+guardedConfigurations.forEach { configuration ->
+  configuration.configure {
+    incoming.afterResolve {
+      resolutionResult.allComponents.forEach { component ->
+        val moduleVersion = component.moduleVersion ?: return@forEach
+        if (
+          moduleVersion.module in guardedKotlinModules &&
+            moduleVersion.version.exceedsKotlinTarget()
+        ) {
+          throw GradleException(
+            "Resolved ${moduleVersion.module}:${moduleVersion.version} on configuration $name, " +
+              "which exceeds the allowed Kotlin version ($kotlinTargetVersion)"
+          )
+        }
+      }
+    }
+  }
+}
+
+// also works for version ranges like: [2.3.0,)
+val kotlinVersionRegex = Regex("""(\d+)\.(\d+)(?:\.\d+)?""")
+val kotlinTargetVersion = libs.versions.kotlinTarget.get()
+val targetMajor = kotlinTargetVersion.substringBefore('.').toInt()
+val targetMinor = kotlinTargetVersion.substringAfter('.').toInt()
+
+fun String.exceedsKotlinTarget(): Boolean {
+  val version =
+    kotlinVersionRegex.find(this) ?: throw GradleException("Could not parse Kotlin version: $this")
+  val major = version.groupValues[1].toInt()
+  val minor = version.groupValues[2].toInt()
+  return major > targetMajor || (major == targetMajor && minor > targetMinor)
+}
@@ -0,0 +1,29 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import org.gradle.accessors.dm.LibrariesForLibs
+
+plugins { id("pklJavaLibrary") }
+
+val buildInfo = project.extensions.getByType<BuildInfo>()
+
+val libs = the<LibrariesForLibs>()
+
+dependencies {
+  // Kotlin libraries typically expose stdlib types in their public APIs.
+  // Therefore, the stdlib must be available on the consumer's compile classpath,
+  // and "implementation" is not sufficient.
+  api(libs.kotlinStdLib)
+}
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import org.gradle.api.tasks.testing.logging.TestExceptionFormat

 plugins {
  `jvm-test-suite`
-  kotlin("jvm")
+  id("pklKotlinBase")
 }

 val buildInfo = project.extensions.getByType<BuildInfo>()
@@ -27,10 +27,11 @@ val buildInfo = project.extensions.getByType<BuildInfo>()
 val libs = the<LibrariesForLibs>()

 dependencies {
+  testImplementation(libs.kotlinStdLib)
+
  testImplementation(libs.assertj)
  testImplementation(libs.junitApi)
  testImplementation(libs.junitParams)
-  testImplementation(libs.kotlinStdLib)

  testRuntimeOnly(libs.junitEngine)
  testRuntimeOnly(libs.junitLauncher)
@@ -44,7 +45,7 @@ tasks.withType<Test>().configureEach {
  // enable checking of stdlib return types
  systemProperty("org.pkl.testMode", "true")

-  reports.named("html") { enabled = true }
+  reports.named("html") { required = true }

  testLogging { exceptionFormat = TestExceptionFormat.FULL }

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2025-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -13,15 +13,17 @@
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
+import java.lang.Runtime.Version
 import kotlin.io.path.createDirectories
 import kotlin.io.path.writeText
+import org.gradle.accessors.dm.LibrariesForLibs

 plugins {
  id("pklGraalVm")
  id("pklJavaLibrary")
  id("pklNativeLifecycle")
  id("pklPublishLibrary")
-  id("com.github.johnrengelman.shadow")
+  id("com.gradleup.shadow")
 }

 // assumes that `pklJavaExecutable` is also applied
@@ -35,6 +37,18 @@ val stagedLinuxAarch64Executable: Configuration by configurations.creating
 val stagedAlpineLinuxAmd64Executable: Configuration by configurations.creating
 val stagedWindowsAmd64Executable: Configuration by configurations.creating

+val nativeImageClasspath by configurations.creating {
+  extendsFrom(configurations.runtimeClasspath.get())
+  // Ensure native-image version uses GraalVM C SDKs instead of Java FFI or JNA
+  // (comes from artifact `mordant-jvm-graal-ffi`).
+  exclude("com.github.ajalt.mordant", "mordant-jvm-ffm")
+  exclude("com.github.ajalt.mordant", "mordant-jvm-ffm-jvm")
+  exclude("com.github.ajalt.mordant", "mordant-jvm-jna")
+  exclude("com.github.ajalt.mordant", "mordant-jvm-jna-jvm")
+}
+
+val libs = the<LibrariesForLibs>()
+
 dependencies {
  fun executableFile(suffix: String) =
    files(
@@ -42,6 +56,9 @@ dependencies {
        dir.file(executableSpec.name.map { "$it-$suffix" })
      }
    )
+  nativeImageClasspath(libs.truffleRuntime)
+  nativeImageClasspath(libs.graalSdk)
+
  stagedMacAarch64Executable(executableFile("macos-aarch64"))
  stagedMacAmd64Executable(executableFile("macos-amd64"))
  stagedLinuxAmd64Executable(executableFile("linux-amd64"))
@@ -65,7 +82,7 @@ private fun NativeImageBuild.setClasspath() {
  classpath.from(
    project(":pkl-commons-cli").extensions.getByType(SourceSetContainer::class)["svm"].output
  )
-  classpath.from(configurations.runtimeClasspath)
+  classpath.from(nativeImageClasspath)
 }

 val macExecutableAmd64 by
@@ -118,21 +135,20 @@ val windowsExecutableAmd64 by
    mainClass = executableSpec.mainClass
    amd64()
    setClasspath()
-    extraNativeImageArgs.add("-Dfile.encoding=UTF-8")
  }

 val assembleNative by tasks.existing

-val testStartNativeExecutable by
-  tasks.registering {
+val testStartNativeExecutable by tasks.registering {
  dependsOn(assembleNative)

  // dummy file for up-to-date checking
  val outputFile = project.layout.buildDirectory.file("testStartNativeExecutable/output.txt")
  outputs.file(outputFile)

-    val execOutput =
-      providers.exec { commandLine(assembleNative.get().outputs.files.singleFile, "--version") }
+  val execOutput = providers.exec {
+    commandLine(assembleNative.get().outputs.files.singleFile, "--version")
+  }

  doLast {
    val outputText = execOutput.standardOutput.asText.get()
@@ -144,11 +160,42 @@ val testStartNativeExecutable by
    outputFile.get().asFile.toPath().apply {
      try {
        parent.createDirectories()
-        } catch (ignored: java.nio.file.FileAlreadyExistsException) {}
+      } catch (_: java.nio.file.FileAlreadyExistsException) {}
      writeText("OK")
    }
  }
+}
+
+val requiredGlibcVersion: Version = Version.parse("2.17")
+
+val checkGlibc by tasks.registering {
+  enabled = buildInfo.os.isLinux && !buildInfo.musl
+  dependsOn(assembleNative)
+  doLast {
+    val exec = providers.exec {
+      commandLine("objdump", "-T", assembleNative.get().outputs.files.singleFile)
    }
+    val output = exec.standardOutput.asText.get()
+    val minimumGlibcVersion =
+      output
+        .split("\n")
+        .mapNotNull { line ->
+          val match = Regex("GLIBC_([.0-9]*)").find(line)
+          match?.groups[1]?.let { Version.parse(it.value) }
+        }
+        .maxOrNull()
+    if (minimumGlibcVersion == null) {
+      throw GradleException(
+        "Could not determine glibc version from executable. objdump output: $output"
+      )
+    }
+    if (minimumGlibcVersion > requiredGlibcVersion) {
+      throw GradleException(
+        "Incorrect glibc version. Found: $minimumGlibcVersion, required: $requiredGlibcVersion"
+      )
+    }
+  }
+}

 // Expose underlying task's outputs
 private fun <T : Task> Task.wraps(other: TaskProvider<T>) {
@@ -156,7 +203,7 @@ private fun <T : Task> Task.wraps(other: TaskProvider<T>) {
  outputs.files(other)
 }

-val testNative by tasks.existing { dependsOn(testStartNativeExecutable) }
+val testNative by tasks.existing { dependsOn(testStartNativeExecutable, checkGlibc) }

 val assembleNativeMacOsAarch64 by tasks.existing { wraps(macExecutableAarch64) }

@@ -0,0 +1,122 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+val assembleNativeMacOsAarch64 by tasks.registering { group = "build" }
+
+val assembleNativeMacOsAmd64 by tasks.registering { group = "build" }
+
+val assembleNativeLinuxAarch64 by tasks.registering { group = "build" }
+
+val assembleNativeLinuxAmd64 by tasks.registering { group = "build" }
+
+val assembleNativeAlpineLinuxAmd64 by tasks.registering { group = "build" }
+
+val assembleNativeWindowsAmd64 by tasks.registering { group = "build" }
+
+val testNativeMacOsAarch64 by tasks.registering { group = "verification" }
+
+val testNativeMacOsAmd64 by tasks.registering { group = "verification" }
+
+val testNativeLinuxAarch64 by tasks.registering { group = "verification" }
+
+val testNativeLinuxAmd64 by tasks.registering { group = "verification" }
+
+val testNativeAlpineLinuxAmd64 by tasks.registering { group = "verification" }
+
+val testNativeWindowsAmd64 by tasks.registering { group = "verification" }
+
+val buildInfo = project.extensions.getByType<BuildInfo>()
+
+private fun <T : Task> Task.wraps(other: TaskProvider<T>) {
+  dependsOn(other)
+  outputs.files(other)
+}
+
+val assembleNative by tasks.registering {
+  group = "build"
+
+  if (!buildInfo.isCrossArchSupported && buildInfo.isCrossArch) {
+    throw GradleException("Cross-arch builds are not supported on ${buildInfo.os.name}")
+  }
+
+  when {
+    buildInfo.os.isMacOsX && buildInfo.targetArch == "aarch64" -> {
+      wraps(assembleNativeMacOsAarch64)
+    }
+    buildInfo.os.isMacOsX && buildInfo.targetArch == "amd64" -> {
+      wraps(assembleNativeMacOsAmd64)
+    }
+    buildInfo.os.isLinux && buildInfo.targetArch == "aarch64" -> {
+      wraps(assembleNativeLinuxAarch64)
+    }
+    buildInfo.os.isLinux && buildInfo.targetArch == "amd64" -> {
+      if (buildInfo.musl) wraps(assembleNativeAlpineLinuxAmd64) else wraps(assembleNativeLinuxAmd64)
+    }
+    buildInfo.os.isWindows && buildInfo.targetArch == "amd64" -> {
+      wraps(assembleNativeWindowsAmd64)
+    }
+    else -> {
+      doLast {
+        throw GradleException(
+          "Cannot build targeting ${buildInfo.os.name}/${buildInfo.targetArch} with musl=${buildInfo.musl}"
+        )
+      }
+    }
+  }
+}
+
+val testNative by tasks.registering {
+  group = "verification"
+  dependsOn(assembleNative)
+
+  if (!buildInfo.isCrossArchSupported && buildInfo.isCrossArch) {
+    throw GradleException("Cross-arch builds are not supported on ${buildInfo.os.name}")
+  }
+
+  when {
+    buildInfo.os.isMacOsX && buildInfo.targetArch == "aarch64" -> {
+      dependsOn(testNativeMacOsAarch64)
+    }
+    buildInfo.os.isMacOsX && buildInfo.targetArch == "amd64" -> {
+      dependsOn(testNativeMacOsAmd64)
+    }
+    buildInfo.os.isLinux && buildInfo.targetArch == "aarch64" -> {
+      dependsOn(testNativeLinuxAarch64)
+    }
+    buildInfo.os.isLinux && buildInfo.targetArch == "amd64" -> {
+      if (buildInfo.musl) dependsOn(testNativeAlpineLinuxAmd64) else dependsOn(testNativeLinuxAmd64)
+    }
+    buildInfo.os.isWindows && buildInfo.targetArch == "amd64" -> {
+      dependsOn(testNativeWindowsAmd64)
+    }
+    else -> {
+      doLast {
+        throw GradleException(
+          "Cannot build targeting ${buildInfo.os.name}/${buildInfo.targetArch} with musl=${buildInfo.musl}"
+        )
+      }
+    }
+  }
+}
+
+val checkNative by tasks.registering {
+  group = "verification"
+  dependsOn(testNative)
+}
+
+val buildNative by tasks.registering {
+  group = "build"
+  dependsOn(checkNative)
+}
@@ -0,0 +1,38 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+plugins {
+  `maven-publish`
+  signing
+}
+
+publishing {
+  publications {
+    components.findByName("java")?.let { javaComponent ->
+      create<MavenPublication>("library") { from(javaComponent) }
+    }
+  }
+}
+
+configurePklPomMetadata()
+
+configurePomValidation()
+
+configurePklSigning()
+
+artifacts {
+  project.tasks.findByName("javadocJar")?.let { archives(it) }
+  project.tasks.findByName("sourcesJar")?.let { archives(it) }
+}
@@ -0,0 +1,39 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+plugins { id("com.diffplug.spotless") }
+
+val pklFormatter by configurations.creating
+
+dependencies { pklFormatter(rootProject.project("pkl-formatter")) }
+
+spotless {
+  format("pkl") {
+    target("**/*.pkl")
+    addStep(PklFormatterStep(pklFormatter).create())
+    licenseHeaderFile(
+      rootProject.file("build-logic/src/main/resources/license-header.line-comment.txt"),
+      "/// ",
+    )
+    // disable ratcheting for Pkl sources
+    // make any change to pkl-formatter reformat the stdlib
+    ratchetFrom = null
+  }
+}
+
+for (taskName in
+  listOf("spotlessPkl", "spotlessPklApply", "spotlessPklCheck", "spotlessPklDiagnose")) {
+  tasks.named(taskName) { dependsOn(":pkl-formatter:assemble") }
+}
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -14,15 +14,13 @@
 * limitations under the License.
 */
 // https://youtrack.jetbrains.com/issue/KTIJ-19369
-@file:Suppress("DSL_SCOPE_VIOLATION")
-
 import org.jetbrains.gradle.ext.ActionDelegationConfig
 import org.jetbrains.gradle.ext.ActionDelegationConfig.TestRunner.PLATFORM
 import org.jetbrains.gradle.ext.ProjectSettings

 plugins {
-  pklAllProjects
-  pklGraalVm
+  id("pklAllProjects")
+  id("pklGraalVm")

  alias(libs.plugins.ideaExt)
  alias(libs.plugins.jmh) apply false
@@ -1,49 +0,0 @@
-/*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-import org.gradle.accessors.dm.LibrariesForLibs
-import org.jetbrains.kotlin.gradle.dsl.JvmTarget
-import org.jetbrains.kotlin.gradle.tasks.KotlinJvmCompile
-
-plugins {
-  id("pklJavaLibrary")
-  kotlin("jvm")
-}
-
-// Build configuration.
-val buildInfo = project.extensions.getByType<BuildInfo>()
-
-// Version Catalog library symbols.
-val libs = the<LibrariesForLibs>()
-
-dependencies {
-  // At least some of our kotlin APIs contain Kotlin stdlib types
-  // that aren't compiled away by kotlinc (e.g., `kotlin.Function`).
-  // So let's be conservative and default to `api` for now.
-  // For Kotlin APIs that only target Kotlin users (e.g., pkl-config-kotlin),
-  // it won't make a difference.
-  api(buildInfo.libs.findLibrary("kotlinStdLib").get())
-}
-
-tasks.compileKotlin {
-  enabled = true // disabled by pklJavaLibrary
-}
-
-tasks.withType<KotlinJvmCompile>().configureEach {
-  compilerOptions {
-    jvmTarget = JvmTarget.fromTarget(buildInfo.jvmTarget.toString())
-    freeCompilerArgs.addAll("-Xjdk-release=${buildInfo.jvmTarget}")
-  }
-}
@@ -1,129 +0,0 @@
-/*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-val assembleNativeMacOsAarch64 by tasks.registering { group = "build" }
-
-val assembleNativeMacOsAmd64 by tasks.registering { group = "build" }
-
-val assembleNativeLinuxAarch64 by tasks.registering { group = "build" }
-
-val assembleNativeLinuxAmd64 by tasks.registering { group = "build" }
-
-val assembleNativeAlpineLinuxAmd64 by tasks.registering { group = "build" }
-
-val assembleNativeWindowsAmd64 by tasks.registering { group = "build" }
-
-val testNativeMacOsAarch64 by tasks.registering { group = "verification" }
-
-val testNativeMacOsAmd64 by tasks.registering { group = "verification" }
-
-val testNativeLinuxAarch64 by tasks.registering { group = "verification" }
-
-val testNativeLinuxAmd64 by tasks.registering { group = "verification" }
-
-val testNativeAlpineLinuxAmd64 by tasks.registering { group = "verification" }
-
-val testNativeWindowsAmd64 by tasks.registering { group = "verification" }
-
-val buildInfo = project.extensions.getByType<BuildInfo>()
-
-private fun <T : Task> Task.wraps(other: TaskProvider<T>) {
-  dependsOn(other)
-  outputs.files(other)
-}
-
-val assembleNative by
-  tasks.registering {
-    group = "build"
-
-    if (!buildInfo.isCrossArchSupported && buildInfo.isCrossArch) {
-      throw GradleException("Cross-arch builds are not supported on ${buildInfo.os.name}")
-    }
-
-    when {
-      buildInfo.os.isMacOsX && buildInfo.targetArch == "aarch64" -> {
-        wraps(assembleNativeMacOsAarch64)
-      }
-      buildInfo.os.isMacOsX && buildInfo.targetArch == "amd64" -> {
-        wraps(assembleNativeMacOsAmd64)
-      }
-      buildInfo.os.isLinux && buildInfo.targetArch == "aarch64" -> {
-        wraps(assembleNativeLinuxAarch64)
-      }
-      buildInfo.os.isLinux && buildInfo.targetArch == "amd64" -> {
-        if (buildInfo.musl) wraps(assembleNativeAlpineLinuxAmd64)
-        else wraps(assembleNativeLinuxAmd64)
-      }
-      buildInfo.os.isWindows && buildInfo.targetArch == "amd64" -> {
-        wraps(assembleNativeWindowsAmd64)
-      }
-      buildInfo.musl -> {
-        throw GradleException("Building musl on ${buildInfo.os} is not supported")
-      }
-      else -> {
-        throw GradleException(
-          "Unsupported os/arch pair: ${buildInfo.os.name}/${buildInfo.targetArch}"
-        )
-      }
-    }
-  }
-
-val testNative by
-  tasks.registering {
-    group = "verification"
-
-    if (!buildInfo.isCrossArchSupported && buildInfo.isCrossArch) {
-      throw GradleException("Cross-arch builds are not supported on ${buildInfo.os.name}")
-    }
-
-    when {
-      buildInfo.os.isMacOsX && buildInfo.targetArch == "aarch64" -> {
-        dependsOn(testNativeMacOsAarch64)
-      }
-      buildInfo.os.isMacOsX && buildInfo.targetArch == "amd64" -> {
-        dependsOn(testNativeMacOsAmd64)
-      }
-      buildInfo.os.isLinux && buildInfo.targetArch == "aarch64" -> {
-        dependsOn(testNativeLinuxAarch64)
-      }
-      buildInfo.os.isLinux && buildInfo.targetArch == "amd64" -> {
-        if (buildInfo.musl) dependsOn(testNativeAlpineLinuxAmd64)
-        else dependsOn(testNativeLinuxAmd64)
-      }
-      buildInfo.os.isWindows && buildInfo.targetArch == "amd64" -> {
-        dependsOn(testNativeWindowsAmd64)
-      }
-      buildInfo.musl -> {
-        throw GradleException("Building musl on ${buildInfo.os} is not supported")
-      }
-      else -> {
-        throw GradleException(
-          "Unsupported os/arch pair: ${buildInfo.os.name}/${buildInfo.targetArch}"
-        )
-      }
-    }
-  }
-
-val checkNative by
-  tasks.registering {
-    group = "verification"
-    dependsOn(testNative)
-  }
-
-val buildNative by
-  tasks.registering {
-    group = "build"
-    dependsOn(assembleNative, checkNative)
-  }
@@ -1,6 +1,6 @@
 name: main
 title: Main Project
-version: 0.30.0-dev
+version: 0.32.0-dev
 prerelease: true
 nav:
 - nav.adoc
@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -16,8 +16,8 @@
 import org.jetbrains.kotlin.gradle.dsl.KotlinJvmProjectExtension

 plugins {
-  pklAllProjects
-  pklKotlinTest
+  id("pklAllProjects")
+  id("pklKotlinTest")
 }

 sourceSets {
@@ -1,46 +0,0 @@
-# This is a Gradle generated file for dependency locking.
-# Manual edits can break the build and are not advised.
-# This file is expected to be part of source control.
-io.leangen.geantyref:geantyref:1.3.16=testRuntimeClasspath
-net.bytebuddy:byte-buddy:1.15.11=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath,testImplementationDependenciesMetadata
-org.assertj:assertj-core:3.27.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.graalvm.polyglot:polyglot:24.1.2=testRuntimeClasspath
-org.graalvm.sdk:collections:24.1.2=testRuntimeClasspath
-org.graalvm.sdk:graal-sdk:24.1.2=testRuntimeClasspath
-org.graalvm.sdk:nativeimage:24.1.2=testRuntimeClasspath
-org.graalvm.sdk:word:24.1.2=testRuntimeClasspath
-org.graalvm.truffle:truffle-api:24.1.2=testRuntimeClasspath
-org.jetbrains.intellij.deps:trove4j:1.0.20200330=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-build-common:2.0.21=kotlinBuildToolsApiClasspath
-org.jetbrains.kotlin:kotlin-build-tools-api:2.0.21=kotlinBuildToolsApiClasspath
-org.jetbrains.kotlin:kotlin-build-tools-impl:2.0.21=kotlinBuildToolsApiClasspath
-org.jetbrains.kotlin:kotlin-compiler-embeddable:2.0.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-compiler-runner:2.0.21=kotlinBuildToolsApiClasspath
-org.jetbrains.kotlin:kotlin-daemon-client:2.0.21=kotlinBuildToolsApiClasspath
-org.jetbrains.kotlin:kotlin-daemon-embeddable:2.0.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-klib-commonizer-embeddable:2.0.21=kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-native-prebuilt:2.0.21=kotlinNativeBundleConfiguration
-org.jetbrains.kotlin:kotlin-reflect:2.0.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath,testRuntimeClasspath
-org.jetbrains.kotlin:kotlin-script-runtime:2.0.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath
-org.jetbrains.kotlin:kotlin-scripting-common:2.0.21=kotlinBuildToolsApiClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
-org.jetbrains.kotlin:kotlin-scripting-compiler-embeddable:2.0.21=kotlinBuildToolsApiClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
-org.jetbrains.kotlin:kotlin-scripting-compiler-impl-embeddable:2.0.21=kotlinBuildToolsApiClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
-org.jetbrains.kotlin:kotlin-scripting-jvm:2.0.21=kotlinBuildToolsApiClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest
-org.jetbrains.kotlin:kotlin-stdlib-jdk7:2.0.21=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.jetbrains.kotlin:kotlin-stdlib-jdk8:2.0.21=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.jetbrains.kotlin:kotlin-stdlib:2.0.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.6.4=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath
-org.jetbrains:annotations:13.0=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,testCompileClasspath,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-api:5.13.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-engine:5.13.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.jupiter:junit-jupiter-params:5.13.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.platform:junit-platform-commons:1.13.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.platform:junit-platform-engine:1.13.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.junit.platform:junit-platform-launcher:1.13.4=testRuntimeClasspath
-org.junit:junit-bom:5.13.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.msgpack:msgpack-core:0.9.8=testRuntimeClasspath
-org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
-org.organicdesign:Paguro:3.10.3=testRuntimeClasspath
-org.snakeyaml:snakeyaml-engine:2.10=testRuntimeClasspath
-empty=annotationProcessor,apiDependenciesMetadata,compileClasspath,compileOnlyDependenciesMetadata,implementationDependenciesMetadata,intransitiveDependenciesMetadata,kotlinCompilerPluginClasspath,kotlinNativeCompilerPluginClasspath,kotlinScriptDefExtensions,runtimeClasspath,testAnnotationProcessor,testApiDependenciesMetadata,testCompileOnlyDependenciesMetadata,testIntransitiveDependenciesMetadata,testKotlinScriptDefExtensions
@@ -3,7 +3,7 @@
 // the following attributes must be updated immediately before a release

 // pkl version corresponding to current git commit without -dev suffix or git hash
-:pkl-version-no-suffix: 0.30.0
+:pkl-version-no-suffix: 0.32.0
 // tells whether pkl version corresponding to current git commit
 // is a release version (:is-release-version: '') or dev version (:!is-release-version:)
 :!is-release-version:
@@ -68,12 +68,16 @@ endif::[]
 :uri-pkldoc-example: {uri-pkl-examples-tree}/pkldoc

 :uri-stdlib-baseModule: {uri-pkl-stdlib-docs}/base
+:uri-stdlib-CommandModule: {uri-pkl-stdlib-docs}/Command
 :uri-stdlib-analyzeModule: {uri-pkl-stdlib-docs}/analyze
 :uri-stdlib-jsonnetModule: {uri-pkl-stdlib-docs}/jsonnet
 :uri-stdlib-reflectModule: {uri-pkl-stdlib-docs}/reflect
 :uri-stdlib-mathModule: {uri-pkl-stdlib-docs}/math
 :uri-stdlib-xmlModule: {uri-pkl-stdlib-docs}/xml
 :uri-stdlib-protobufModule: {uri-pkl-stdlib-docs}/protobuf
+:uri-stdlib-pklbinaryModule: {uri-pkl-stdlib-docs}/pklbinary
+:uri-stdlib-yamlModule: {uri-pkl-stdlib-docs}/yaml
+:uri-stdlib-YamlParser: {uri-stdlib-yamlModule}/Parser
 :uri-stdlib-evaluatorSettingsModule: {uri-pkl-stdlib-docs}/EvaluatorSettings
 :uri-stdlib-evaluatorSettingsHttpClass: {uri-stdlib-evaluatorSettingsModule}/Http
 :uri-stdlib-Boolean: {uri-stdlib-baseModule}/Boolean
@@ -130,7 +134,10 @@ endif::[]
 :uri-stdlib-Class: {uri-stdlib-baseModule}/Class
 :uri-stdlib-TypeAlias: {uri-stdlib-baseModule}/TypeAlias
 :uri-stdlib-Deprecated: {uri-stdlib-baseModule}/Deprecated
+:uri-stdlib-BaseValueRenderer: {uri-stdlib-baseModule}/BaseValueRenderer
 :uri-stdlib-ValueRenderer: {uri-stdlib-baseModule}/ValueRenderer
+:uri-stdlib-BytesRenderer: {uri-stdlib-baseModule}/BytesRenderer
+:uri-stdlib-YamlRenderer: {uri-stdlib-baseModule}/YamlRenderer
 :uri-stdlib-PcfRenderer-converters: {uri-stdlib-baseModule}/PcfRenderer#converters
 :uri-stdlib-Function: {uri-stdlib-baseModule}/Function
 :uri-stdlib-Function0: {uri-stdlib-baseModule}/Function0
@@ -144,6 +151,13 @@ endif::[]
 :uri-stdlib-Resource: {uri-stdlib-baseModule}/Resource
 :uri-stdlib-outputFiles: {uri-stdlib-baseModule}/ModuleOutput#files
 :uri-stdlib-FileOutput: {uri-stdlib-baseModule}/FileOutput
+:uri-stdlib-Annotation: {uri-stdlib-baseModule}/Annotation
+:uri-stdlib-ConvertProperty: {uri-stdlib-baseModule}/ConvertProperty
+:uri-stdlib-Command-Flag: {uri-stdlib-CommandModule}/Flag
+:uri-stdlib-Command-BooleanFlag: {uri-stdlib-CommandModule}/BooleanFlag
+:uri-stdlib-Command-CountedFlag: {uri-stdlib-CommandModule}/CountedFlag
+:uri-stdlib-Command-Argument: {uri-stdlib-CommandModule}/Argument
+:uri-stdlib-Command-Import: {uri-stdlib-CommandModule}/Import

 :uri-messagepack: https://msgpack.org/index.html
 :uri-messagepack-spec: https://github.com/msgpack/msgpack/blob/master/spec.md
@@ -1,9 +1,15 @@
-= Pkl Binary Encoding
+= `pkl-binary` Encoding
 include::ROOT:partial$component-attributes.adoc[]
 include::partial$component-attributes.adoc[]

-Pkl values can be encoded into a binary format.
-This format is used for Pkl's non-JVM language bindings, for example, for its Go and Swift bindings.
+:uri-pkl-core-Evaluator: {uri-pkl-core-main-sources}/Evaluator.java
+
+Pkl values can be encoded into a binary format called "pkl-binary".
+This format is a lossless serialization of the underlying Pkl values.
+
+Pkl code can be rendered into this format using the {uri-stdlib-pklbinaryModule}[pkl:pklbinary] standard library module.
+
+Alternatively, many language bindings also provide methods to evaluate into `pkl-binary`, such as the `evaluateExpressionPklBinary` method in link:{uri-pkl-core-Evaluator}[org.pkl.core.Evaluator].

 The binary format is uses link:{uri-messagepack}[MessagePack] encoding.

@@ -36,7 +42,9 @@ For example, value `8` gets encoded as MessagePack `int8` format.
 == Non-primitives

 All non-primitive values are encoded as MessagePack arrays.
-The first slot of the array designates the value's type. The remaining slots have fixed meanings depending on the type.
+The first slot of the array designates the value's type.
+The remaining slots have fixed meanings depending on the type.
+Additional slots may be added to types in future Pkl releases. Decoders *must* be designed to defensively discard values beyond the number of known slots for a type or provide meaningful error messages.

 The array's length is the number of slots that are filled. For example, xref:{uri-stdlib-List}[List] is encoded as an MessagePack array with two elements.

@@ -46,16 +54,16 @@ The array's length is the number of slots that are filled. For example, xref:{ur
 ||code |type |description |type |description |type |description

 |link:{uri-stdlib-Typed}[Typed], link:{uri-stdlib-Dynamic}[Dynamic]
-|`0x1`
+|`0x01`
 |link:{uri-messagepack-str}[str]
-|Fully qualified class name
+|<<type-name-encoding,Class name>>
 |link:{uri-messagepack-str}[str]
 |Enclosing module URI
 |link:{uri-messagepack-array}[array]
 |Array of <<object-members,object members>>

 |link:{uri-stdlib-Map}[Map]
-|`0x2`
+|`0x02`
 |link:{uri-messagepack-map}[map]
 |Map of `<value>` to `<value>`
 |
@@ -64,7 +72,7 @@ The array's length is the number of slots that are filled. For example, xref:{ur
 |

 |link:{uri-stdlib-Mapping}[Mapping]
-|`0x3`
+|`0x03`
 |link:{uri-messagepack-map}[map]
 |Map of `<value>` to `<value>`
 |
@@ -73,7 +81,7 @@ The array's length is the number of slots that are filled. For example, xref:{ur
 |

 |link:{uri-stdlib-List}[List]
-|`0x4`
+|`0x04`
 |link:{uri-messagepack-array}[array]
 |Array of `<value>`
 |
@@ -82,7 +90,7 @@ The array's length is the number of slots that are filled. For example, xref:{ur
 |

 |link:{uri-stdlib-Listing}[Listing]
-|`0x5`
+|`0x05`
 |link:{uri-messagepack-array}[array]
 |Array of `<value>`
 |
@@ -91,7 +99,7 @@ The array's length is the number of slots that are filled. For example, xref:{ur
 |

 |link:{uri-stdlib-Set}[Set]
-|`0x6`
+|`0x06`
 |link:{uri-messagepack-array}[array]
 |Array of `<value>`
 |
@@ -100,7 +108,7 @@ The array's length is the number of slots that are filled. For example, xref:{ur
 |

 |link:{uri-stdlib-Duration}[Duration]
-|`0x7`
+|`0x07`
 |{uri-messagepack-float}[float64]
 |Duration value
 |link:{uri-messagepack-str}[str]
@@ -109,7 +117,7 @@ The array's length is the number of slots that are filled. For example, xref:{ur
 |

 |link:{uri-stdlib-DataSize}[DataSize]
-|`0x8`
+|`0x08`
 |link:{uri-messagepack-float}[float64]
 |Value (float64)
 |link:{uri-messagepack-str}[str]
@@ -118,7 +126,7 @@ The array's length is the number of slots that are filled. For example, xref:{ur
 |

 |link:{uri-stdlib-Pair}[Pair]
-|`0x9`
+|`0x09`
 |`<value>`
 |First value
 |`<value>`
@@ -127,7 +135,7 @@ The array's length is the number of slots that are filled. For example, xref:{ur
 |

 |link:{uri-stdlib-IntSeq}[IntSeq]
-|`0xA`
+|`0x0A`
 |link:{uri-messagepack-int}[int]
 |Start
 |link:{uri-messagepack-int}[int]
@@ -136,7 +144,7 @@ The array's length is the number of slots that are filled. For example, xref:{ur
 |Step

 |link:{uri-stdlib-Regex}[Regex]
-|`0xB`
+|`0x0B`
 |link:{uri-messagepack-str}[str]
 |Regex string representation
 |
@@ -145,25 +153,25 @@ The array's length is the number of slots that are filled. For example, xref:{ur
 |

 |link:{uri-stdlib-Class}[Class]
-|`0xC`
-|
-|
-|
-|
+|`0x0C`
+|link:{uri-messagepack-str}[str]
+|<<type-name-encoding,Class name>>
+|link:{uri-messagepack-str}[str]
+|Module URI
 |
 |

 |link:{uri-stdlib-TypeAlias}[TypeAlias]
-|`0xD`
-|
-|
-|
-|
+|`0x0D`
+|link:{uri-messagepack-str}[str]
+|<<type-name-encoding,TypeAlias name>>
+|link:{uri-messagepack-str}[str]
+|Module URI
 |
 |

 |link:{uri-stdlib-Function}[Function]
-|`0xE`
+|`0x0E`
 |
 |
 |
@@ -172,7 +180,7 @@ The array's length is the number of slots that are filled. For example, xref:{ur
 |

 |link:{uri-stdlib-Bytes}[Bytes]
-|`0xF`
+|`0x0F`
 |link:{uri-messagepack-bin}[bin]
 |Binary contents
 |
@@ -181,6 +189,19 @@ The array's length is the number of slots that are filled. For example, xref:{ur
 |
 |===

+[[type-name-encoding]]
+[NOTE]
+====
+Type names have specific encoding rules:
+
+* When the module URI is `pkl:base`:
+** If the type name is `ModuleClass`, this type represents the module class of `pkl:base`.
+** Otherwise, the type name corresponds to a type in `pkl:base`.
+* For all other module URIs:
+** When the type name contains `\#`, the string after the `#` character corresponds to a type in that module. The string before the `#` is the name of the module.
+** Otherwise, the type name is the name of the module and represents the class of the module.
+====
+
 [[object-members]]
 == Object Members

@@ -212,4 +233,3 @@ Like non-primitive values, object members are encoded as MessagePack arrays, whe
 |`<value>`
 |element value
 |===
-
@@ -4,7 +4,7 @@ import org.pkl.config.java.JavaType;
 import org.pkl.core.ModuleSource;
 import org.junit.jupiter.api.Test;

-@SuppressWarnings("unused")
+@SuppressWarnings({"unused", "NewClassNamingConvention"})
 // the pkl-jvm-examples repo has a similar example
 public class JavaConfigExample {
  @Test
@@ -255,8 +255,7 @@ String literals are enclosed in double quotes:
 "Hello, World!"
 ----

-TIP: Except for a few minor differences footnote:[Pkl's string literals have fewer character escape sequences,
-have stricter rules for line indentation in multiline strings, and do not have a line continuation character.],
+TIP: Except for a few minor differences footnote:[Pkl's string literals have fewer character escape sequences and stricter rules for line indentation in multiline strings.],
 String literals have the same syntax and semantics as in Swift 5. Learn one of them, know both of them!

 Inside a string literal, the following character escape sequences have special meaning:
@@ -362,6 +361,23 @@ str = """
  """
 ----

+To prevent line breaks from becoming part of the string's value, use a backslash (`\`) to end those lines.
+
+[source%tested,{pkl}]
+----
+str = """
+  Although the Dodo is extinct, \
+  the species will be remembered.
+  """
+----
+
+This multiline string is equivalent to the following single-line string:
+
+[source%parsed,{pkl-expr}]
+----
+"Although the Dodo is extinct, the species will be remembered."
+----
+
 [[custom-string-delimiters]]
 === Custom String Delimiters

@@ -1423,7 +1439,7 @@ The recipe for transforming a listing is:
 . Transform the list using ``List``'s link:{uri-stdlib-List}[rich API].
 . If necessary, convert the list back to a listing.

-TIP: Often, transformations happen in a link:{uri-stdlib-PcfRenderer-converters}[converter] of a link:{uri-stdlib-ValueRenderer}[value renderer].
+TIP: Often, transformations happen in a link:{uri-stdlib-PcfRenderer-converters}[converter] of a link:{uri-stdlib-BaseValueRenderer}[value renderer].
 Because most value renderers treat lists the same as listings, it is often not necessary to convert back to a listing.

 Equipped with this knowledge, let's try to accomplish our objective:
@@ -1803,7 +1819,7 @@ The recipe for transforming a mapping is:
 . Transform the map using ``Map``'s link:{uri-stdlib-Map}[rich API].
 . If necessary, convert the map back to a mapping.

-TIP: Often, transformations happen in a link:{uri-stdlib-PcfRenderer-converters}[converter] of a link:{uri-stdlib-ValueRenderer}[value renderer].
+TIP: Often, transformations happen in a link:{uri-stdlib-PcfRenderer-converters}[converter] of a link:{uri-stdlib-BaseValueRenderer}[value renderer].
 As most value renderers treat maps the same as mappings, it is often not necessary to convert back to a mapping.

 Equipped with this knowledge, let's try to accomplish our objective:
@@ -2736,6 +2752,10 @@ output {

 For more on path-based converters, see {uri-stdlib-PcfRenderer-converters}[PcfRenderer.converters].

+Special <<annotations,Annotations>> may also be used to influence how class properties are rendered.
+The `ConvertProperty` annotation (and subclasses of it) are automatically applied during.
+For more on annotation-based converters, see link:{uri-stdlib-ConvertProperty}[ConvertProperty].
+
 Sometimes it is useful to directly compute the final module output, bypassing `output.value` and `output.converters`.
 To do so, set the link:{uri-stdlib-baseModule}/ModuleOutput#text[output.text] property to a String value:

@@ -3203,6 +3223,7 @@ This section discusses language features that are generally more relevant to tem
 <<module-keyword,`module` Keyword>> +
 <<glob-patterns,Glob Patterns>> +
 <<doc-comments,Doc Comments>> +
+<<annotations,Annotations>> +
 <<name-resolution,Name Resolution>> +
 <<reserved-keywords,Reserved Keywords>> +
 <<blank-identifiers,Blank Identifiers>> +
@@ -3956,6 +3977,7 @@ emailList: List<EmailAddress> // <2>
 <1> equivalent to `email: String(contains("@"))` for type checking purposes
 <2> equivalent to `emailList: List<String(contains("@"))>` for type checking purposes

+[[nullable-types]]
 ==== Nullable Types

 Class types such as `Bird` (see above) do not admit `null` values.
@@ -4916,7 +4938,7 @@ animals {
 ==== Receiver

 The receiver is the bottom-most object in the <<prototype-chain>>.
-That means that, within the context of an amending object, the reciever is the amending object.
+That means that, within the context of an amending object, the receiver is the amending object.

 Example:
 [source,pkl]
@@ -5332,7 +5354,7 @@ Module-level members can be prefixed with `module.` to resolve name conflicts:
 /// See [module.pigeon].
 ----

-To exclude a member from documentation and code completion, annotate it with `@Unlisted`:
+To exclude a member from documentation and code completion, <<annotations,annotate>> it with `@Unlisted`:

 [source%parsed,{pkl}]
 ----
@@ -5349,6 +5371,47 @@ The following member links are marked up as code but not rendered as links:footn

 Nevertheless, it is a good practice to use member links in the above cases.

+[[annotations]]
+=== Annotations
+
+Annotations are a mechanism to provides extra metadata about Pkl <<modules,modules>>, <<classes,classes>>, <<methods,methods>>, and <<properties,properties>>.
+They provide metadata about the type or member they annotate that can be via link:{uri-stdlib-reflectModule}[reflection] or Pkl's Java APIs.
+The most common use cases for annotations are to add metadata to influence behavior of xref:pkl-doc:index.adoc[Pkldoc], code generation tools, or <<module-output,module output>>.
+
+Annotations are regular Pkl objects whose class extends link:{uri-stdlib-Annotation}[`Annotation`].
+Annotation instances are defined similarly to regular <<classes, class instances>>, but instead of using the `new` keyword the class name is prefixed with `@`.
+The object body may be omitted if an annotation's class has no properties or the declared annotation does not override any of the class's default values
+Multiple annotations may be defined on a member.
+If the annotated member has a <<doc-comments,doc comment>>, the annotation is defined between the comment and the member.
+
+[source%tested,{pkl}]
+----
+/// Module doc comment
+@SomeAnnotation // <1>
+module myModule
+
+class SomeAnnotation extends Annotation { // <2>
+  description: String = "some annotation"
+}
+
+/// Module doc comment
+@SomeAnnotation // <3>
+class Bird {
+  @SomeAnnotation { description = "some property" } // <4>
+  name: String
+
+  @SomeAnnotation { description = "some method" } // <5>
+  @Unlisted // <6>
+  function greet(greeting: String): String = "\(greeting), \(name)!"
+}
+----
+<1> An annotation applied to a module. The annotation(s) must precede the `module` clause and follow the doc comment. The object body is omitted.
+<2> The definition of an annotation class.
+<3> An annotation appied to a class. The object body is omitted.
+<4> An annotation applied to a property. The object body is included because the `description` property is overridden.
+<5> An annotation applied to a method. The object body is included because the `description` property is overridden.
+<6> A second annotation applied to the same method.
+
 [[name-resolution]]
 === Name Resolution

@@ -454,6 +454,16 @@ output {
 ----
 ====

+[[power-assertions-eval]]
+.--power-assertions, --no-power-assertions
+[%collapsible]
+====
+Default: enabled +
+Enable or disable power assertions for detailed assertion failure messages.
+When enabled, type constraint failures will show intermediate values in the assertion expression.
+Use `--no-power-assertions` to disable this feature if you prefer simpler output or better performance.
+====
+
 This command also takes <<common-options, common options>>.

 [[command-server]]
@@ -479,7 +489,9 @@ If these are the only failures, the command exits with exit code 10.
 Otherwise, failures result in exit code 1.

 <modules>::
-The absolute or relative URIs of the modules to test. Relative URIs are resolved against the working directory.
+The absolute or relative URIs of the modules to test.
+The module must extend `pkl:test`.
+Relative URIs are resolved against the working directory.

 ==== Options

@@ -524,6 +536,33 @@ Force generation of expected examples. +
 The old expected files will be deleted if present.
 ====

+[[power-assertions-test]]
+.--power-assertions, --no-power-assertions
+[%collapsible]
+====
+Default: enabled +
+Enable or disable power assertions for detailed assertion failure messages.
+When enabled, test failures will show intermediate values in the assertion expression, making it easier to understand why a test failed.
+Use `--no-power-assertions` to disable this feature if you prefer simpler output.
+====
+
+This command also takes <<common-options, common options>>.
+
+[[command-run]]
+=== `pkl run`
+
+*Synopsis:* `pkl run [<options>] [<module>] [<command options>]`
+
+Evaluate a <<cli-tools,CLI command>> defined by `<module>`.
+
+<module>::
+The absolute or relative URIs of the command module to run.
+The module must extend `pkl:Command`.
+Relative URIs are resolved against the working directory.
+
+<command options>::
+Additional CLI options and arguments defined by `<module>`.
+
 This command also takes <<common-options, common options>>.

 [[command-repl]]
@@ -733,37 +772,54 @@ pkl shell-completion bash
 pkl shell-completion zsh
 ----

-[[command-format-check]]
-=== `pkl format check`
+[[command-format]]
+=== `pkl format`

-*Synopsis*: `pkl format check <file-or-dir-path>`
+*Synopsis*: `pkl format <options> [<paths>]`

-This command checks for format violations on the given file or directory and print their names to stdout. +
-It returns a non-zero status code in case violations are found.
+This command formats or checks formatting of Pkl files. +
+Exit codes:
+
+* 0: No violations found or files were updated.
+* 1: An unexpected error happened (ex.: IO error)
+* 11: Violations were found (when running without `--write`).

 If the path is a directory, recursively looks for files with a `.pkl` extension, or files named `PklProject`.

-[[command-format-apply]]
-=== `pkl format apply`
-
-*Synopsis*: `pkl format apply [<options>] <file-or-dir-path>`
-
-This command formats the given files overwriting them.
-
-If the path is a directory, recursively looks for files with a `.pkl` extension, or files named `PklProject`.
+By default, the input files are formatted, and written to standard out.

 ==== Options

+.--grammar-version
+[%collapsible]
+====
+Default: `2` (latest version) +
+Select the grammar compatibility version for the formatter.
+New versions are created for each backward incompatible grammar change.
+====
+
 .-s, --silent
 [%collapsible]
 ====
-Do not write the name of wrongly formatted files to stdout.
+Skip writing to standard out. Mutually exclusive with `--diff-name-only`.
+====
+
+.-w, --write
+[%collapsible]
+====
+Format files in place, overwriting them. Implies `--diff-name-only`.
+====
+
+.--diff-name-only
+[%collapsible]
+====
+Write the path of files with formatting violations to stdout.
 ====

 [[common-options]]
 === Common options

-The <<command-eval>>, <<command-test>>, <<command-repl>>, <<command-project-resolve>>, <<command-project-package>>, <<command-download-package>>, and <<command-analyze-imports>> commands support the following common options:
+The <<command-eval>>, <<command-test>>, <<command-run>>, <<command-repl>>, <<command-project-resolve>>, <<command-project-package>>, <<command-download-package>>, and <<command-analyze-imports>> commands support the following common options:

 include::../../pkl-cli/partials/cli-common-options.adoc[]

@@ -771,6 +827,17 @@ The <<command-eval>>, <<command-test>>, <<command-repl>>, <<command-download-pac

 include::../../pkl-cli/partials/cli-project-options.adoc[]

+[[root-options]]
+=== Root options
+
+The root `pkl` command supports the following options:
+
+.-v, --version
+[%collapsible]
+====
+Display version information.
+====
+
 == Evaluating Modules

 Say we have the following module:
@@ -853,6 +920,310 @@ If multiple module outputs are written to the same file, or to standard output,
 By default, module outputs are separated with `---`, as in a YAML stream.
 The separator can be customized using the `--module-output-separator` option.

+[[cli-tools]]
+== Implementing CLI Tools
+
+CLI tools can be implemented in Pkl by modules extending the `pkl:Command` module.
+With `pkl:Command`, you can define a script in Pkl that is executed by your shell, providing a better CLI experience.
+
+Regular evaluation requires use of xref:language-reference:index.adoc#resources[resources] like properties and evironment variables to provide parameters:
+[source,bash]
+----
+$ pkl eval script.pkl -p username=me -p password=password
+----
+
+Commands provide a native, familiar CLI experience:
+[source,bash]
+----
+$ pkl run script.pkl --username=admin --password=hunter2
+$ ./script.pkl --username=admin --password=hunter2
+----
+
+Pkl commands have a few properties that distinguish them from standard module evaluation:
+
+* Users provide input to commands using familiar command line idioms, providing a better experience than deriving inputs from xref:language-reference:index.adoc#resources[resources] like external properties or environment variables.
+* Commands can dynamically import modules when they are specified as command line options.
+* Commands may write to standard output (via `output.text` or `output.bytes`) and the filesystem (via `output.files`) in the same evaluation.
+* Command file output may write to any absolute path (not only relative to the `--multiple-file-output-path` option).
+** Relative output paths are written relative to the current working directory (or `--working-dir`, if specified).
+** Paths of output file are printed to the command's standard error.
+
+IMPORTANT: Users of `pkl run` must be aware of the security implications of this behavior.
+Using `pkl eval` prevents accidental overwrites by not allowing absolute paths, but `pkl run` does not offer this protection.
+Commands may write to any path the invoking user has permissions to modify.
+
+Commands are implemented as regular modules and declare their supported command line flags and positional arguments using a class with annotated properties.
+
+=== Defining Commands
+
+Commands are defined by creating a module that extends `pkl:Command`:
+
+[source,pkl%tested]
+.my-tool.pkl
+----
+/// This doc comment becomes part of the command's CLI help!
+/// Markdown formatting is **allowed!**
+extends "pkl:Command"
+
+options: Options // <1>
+
+class Options {
+  // Define CLI flags/arguments...
+}
+
+// Regular module code...
+----
+<1> Re-declaration of the `options` property's type.
+
+Like `pkl eval`, when a command completes without an evaluation error the process exits successfully (exit code 0).
+Commands can return a failure using `throw` (exit code 1), but otherwise may not control the exit code.
+
+Other than the differences listed above, commands behave like any other Pkl module.
+For example, there is no way to execute other programs or make arbitrary HTTP requests.
+If additional functionality is desired, xref:language-reference:index.adoc#external-readers[external readers] may be used to extends Pkl's capabilities.
+
+=== Command Options
+
+Each property of a command's options class becomes a command line option.
+Properties with the `local`, `hidden`, `fixed`, and/or `const` modifiers are not parsed as options
+A property's doc comment, if present, becomes the corresponding option's CLI help description.
+Doc comments are interpreted as Markdown text and formatted nicely when displayed to users.
+Properties must have xref:language-reference:index.adoc#type-annotations[type annotations] to determine how they are parsed.
+
+Properties may be xref:language-reference:index.adoc#annotations[annotated] to influence how they behave:
+
+* Properties annotated with link:{uri-stdlib-Command-Flag}[`@Flag`] become CLI flags named `--<property name>` that accept a value.
+* `Boolean` properties annotated with link:{uri-stdlib-Command-BooleanFlag}[`@BooleanFlag`] become CLI flags named `--<property name>` and `--no-<property name>` that result in `true` and `false` values, respectively.
+* `Int` (and type aliases of `Int`) properties annotated with link:{uri-stdlib-Command-CountedFlag}[`@CountedFlag`] become CLI flags named `--<property name>` that produce a value equal to the number of times they are present on the command line.
+* Properties annotated with link:{uri-stdlib-Command-Argument}[`@Argument`] become positional CLI arguments and are parsed in the order they appear in the class.
+* Properties with no annotation are treated the same as `@Flag` with no further customization.
+
+Flag options may set a `shortName` property to define a single-character abbreviation (`-<short name>`).
+Flag abbreviations may be combined (e.g. `-a -b -v -v -q some-value` is equivalent to `-abvvq some-value`).
+
+[CAUTION]
+====
+Flag names and short names may not conflict with <<common-options,common options>>.
+Future versions of Pkl may introduce additional common options and the names of these options will become forbidden for use in `pkl:Command`.
+Thus, any Pkl release that adds common options may introduce breaking changes for commands.
+
+While unfortunate, this behavior eliminates potentially dangerous or misleading ambiguities between Pkl-defined and user-defined options.
+====
+
+A `@Flag` or `@Argument` property's type annotation determines how it is converted from the raw string value:
+
+|===
+|Type |Behavior
+
+|`String`
+|Value is used verbatim.
+
+|`Char`
+|Value is used verbatim but must be exactly one character.
+
+|`Boolean`
+|True values: `true`, `t`, `1`, `yes`, `y`, `on`
+
+False values: `false`, `f`, `0`, `no`, `n`, `off`
+
+|`Number`
+|Value is parsed as an `Int` if possible, otherwise parsed as `Float`.
+
+|`Float`
+|Value is parsed as a `Float`.
+
+|`Int`
+|Value is parsed as a `Int`.
+
+|`Int8`, `Int16`, `Int32`, `UInt`, `UInt8`, `UInt16`, `UInt32`
+|Value is parsed as a `Int` and must be within the type's range.
+
+|xref:language-reference:index.adoc#union-types[Union] of xref:language-reference:index.adoc#string-literal-types[string literals]
+|Value is used verbatim but must match a member of the union.
+
+|`List<Element>`, `Listing<Element>`, `Set<Element>`
+|Each occurrence of the option becomes an element of the final value.
+
+`Element` values are parsed based on the above primitive types.
+
+|`Map<Key, Value>`, `Mapping<Key, Value>`
+|Each occurrence of the option becomes an entry of the final value.
+
+Values are split on the first `"="` character; the first part is parsed as `Key` and the second as `Value`, both based on the above primitive types.
+
+|`Pair<First, Second>`
+|Value is split on the first `"="` character; the first part is parsed as `First` and the second as `Second`, both based on the above primitive types.
+
+|===
+
+If a flag that accepts only a single value is provided multiple times, the last occurrence becomes the final value.
+
+Only a single positional argument accepting multiple values is permitted per command.
+
+A property with a xref:language-reference:index.adoc#nullable-types[nullable type] is optional and, if not specified on the command line, will have value `null`.
+Properties with default values are also optional.
+Type constraints are evaluated when the command is executed, so additional restrictions on option values are enforced at runtime.
+
+==== Custom Option Conversion and Aggregation
+
+A property may be annotated with any type if its `@Flag` or `@Argument` annotation sets the `convert` or `transformAll` properties.
+The `convert` property is a xref:language-reference:index.adoc#anonymous-functions[function] that overrides how _each_ raw option value is interpreted.
+The `transformAll` property is a function that overrides how _all_ parsed option values become the final property value.
+
+The `convert` and `transformAll` functions may return an pkldoc:Import[pkl:Command] value that is replaced during option parsing with the actual value of the module specified by its `uri` property.
+If `glob` is `true`, the replacement value is a `Mapping`; its keys are the _absolute_ URIs of the matched modules and its values are the actual module values.
+When specifying glob import options on the command line, it is often necessary to quote the value to avoid it being interpreted by the shell.
+If the return value of `convert` or `transformAll` is a `List`, `Set`, `Map`, or `Pair`, each contained value (elements and entry keys/values) that are `Import` values are also replaced.
+
+[IMPORTANT]
+====
+If an option has type `Mapping<String, «some module type»>` and should accept a single glob pattern value, the option's annotation must also set `multiple = false` to override the default behavior of `Mapping` options accepting multiple values.
+Example:
+[source%parsed,{pkl}]
+----
+@Flag {
+  convert = (it) -> new Import { uri = it; glob = true }
+  multiple = false
+}
+birds: Mapping<String, Bird>
+----
+
+If multiple glob patterns values should be accepted and merged, `transformAll` may be used to merge every glob-imported `Mapping`:
+[source%parsed,{pkl}]
+----
+@Flag {
+  convert = (it) -> new Import { uri = it; glob = true }
+  transformAll =
+    (values) -> values.fold(new Mapping {}, (result, element) ->
+      (result) { ...element }
+    )
+}
+birds: Mapping<String, Bird>
+----
+====
+
+=== Subcommands
+
+Like many other command line libraries, `pkl:Command` allows building commands into a hierarchy with a root command and subcommands:
+
+[source,pkl%tested]
+.my-tool.pkl
+----
+extends "pkl:Command"
+
+command {
+  subcommands {
+    import("subcommand1.pkl")
+    import("subcommand2.pkl")
+    for (_, subcommand in import*("./subcommands/*.pkl")) {
+      subcommand
+    }
+  }
+}
+----
+
+[source,pkl%tested]
+.subcommand1.pkl
+----
+extends "pkl:Command"
+
+import "my-tool.pkl"
+
+parent: `my-tool` // <1>
+
+// Regular module code...
+----
+<1> Optional; asserts that this is a subcommand of `my-tool` and simplifies accessing properties and options of the parent command
+
+Each element of `subcommands` must have a unique value for `command.name`.
+
+=== Testing Commands
+
+Command modules are normal Pkl modules, so they may be imported and used like any other module.
+This is particularly helpful when testing commands, as the command's `options` and `parent` properties can be populated by test code.
+
+Testing the above command and subcommand might look like this:
+
+[source,pkl%tested]
+----
+amends "pkl:test"
+
+import "my-tool.pkl"
+import "subcommand1.pkl"
+
+examples {
+  ["Test my-tool"] {
+    (`my-tool`) {
+      options {
+        // Set my-tool options here...
+      }
+    }.output.text
+  }
+  ["Test subcommand1"] {
+    (subcommand1) {
+      parent { // this amends `my-tool`
+        options {
+          // Set my-tool options here...
+        }
+      }
+      options {
+        // Set subcommand options here...
+      }
+    }.output.text
+  }
+}
+----
+
+[[commands-as-standalone-scripts]]
+=== Commands as standalone scripts
+
+On *nix platforms, Pkl commands can be configured to run as standalone tools that can be invoked without the `pkl run` command.
+To achieve this, the command file must be marked executable (i.e. `chmod +x my-tool.pkl`) and a link:https://en.wikipedia.org/wiki/Shebang_(Unix)[shebang comment] must be added on the first line of the file:
+
+[source,pkl%parsed]
+----
+#!/usr/bin/env -S pkl run
+----
+
+NOTE: The `-S` flag for `env` is required on Linux systems due to a limitation of shebang handling in the Linux kernel.
+While not required on other *nix platforms like macOS, but it should be included for compatibility.
+
+==== Shell Completion
+
+Like with Pkl's own CLI, <<command-shell-completion, shell completions>> can be generated for standalone scripts.
+
+[source,shell]
+----
+# Generate shell completion script for bash
+./my-tool.pkl shell-completion bash
+
+# Generate shell completion script for zsh
+./my-tool.pkl shell-completion zsh
+----
+
+==== Customizing Completion Candidates
+
+`@Flag` and `@Argument` annotations may specify the `completionCandidates` to improve generated shell completions.
+
+Valid values include:
+
+* A `Listing<String>` of literal string values to offer for completion.
+* The literal string `"path"`, which offers local file paths for completion.
+
+Options with a string literal union type implicitly offer the members of the union as completion candidates.
+
+=== Flag name ambiguities
+
+It is possible for commands to define flags with names or short names that collide with Pkl's own command line options.
+To avoid ambiguity in parsing these options, all flags for Pkl itself (e.g. `--root-dir`) must be placed before the root command module's URI.
+Command authors are encouraged to avoid overlapping with Pkl's built-in flags, but this may not always be feasible, especially for single-character abbreviated names.
+
+This imposes a limitation around <<commands-as-standalone-scripts,standalone commands>> that prevents users from customizing Pkl evaluator options when they are invoked.
+There are two recommended workarounds for this limitation:
+
+* Use a `PklProject` to define evaluator settings instead of doing so on the command line.
+* If the command line must be used, switch to invoking via `pkl run [<flags>] [<root command module>]`.
+
 [[repl]]
 == Working with the REPL

@@ -109,12 +109,6 @@ Duration, in seconds, after which evaluation of a source module will be timed ou
 Note that a timeout is treated the same as a program error in that any subsequent source modules will not be evaluated.
 ====

-.-v, --version
-[%collapsible]
-====
-Display version information.
-====
-
 .-w, --working-dir
 [%collapsible]
 ====
@@ -163,3 +157,11 @@ The left-hand side describes the source prefix, and the right-hand describes the
 This option is commonly used to enable package mirroring.
 The above example will rewrite URL `\https://pkg.pkl-lang.org/pkl-k8s/k8s@1.0.0` to `\https://my.internal.mirror/pkl-k8s/k8s@1.0.0`.
 ====
+
+.--trace-mode
+[%collapsible]
+====
+Default: `compact` +
+Specifies how `trace()` output is formatted.
+Possible options are `compact` and `pretty`.
+====
@@ -7,7 +7,7 @@ import org.pkl.core.PObject;
 import org.junit.jupiter.api.Test;

 // the pkl-jvm-examples repo has a similar example
-@SuppressWarnings({"unchecked", "unused", "ConstantConditions"})
+@SuppressWarnings({"unchecked", "unused", "ConstantConditions", "NewClassNamingConvention"})
 public class CoreEvaluatorExample {
  @Test
  public void usage() {
@@ -322,6 +322,16 @@ Default: `false` +
 Whether to ignore expected example files and generate them again.
 ====

+[[power-assertions-test]]
+.powerAssertions: Property<Boolean>
+[%collapsible]
+====
+Default: `true` (for test tasks) +
+Example: `powerAssertions = false` +
+Enable or disable power assertions for detailed assertion failure messages.
+When enabled, test failures will show intermediate values in the assertion expression, making it easier to understand why a test failed.
+====
+
 Common properties:

 include::../partials/gradle-modules-properties.adoc[]
@@ -118,3 +118,13 @@ The left-hand side describes the source prefix, and the right-hand describes the
 This option is commonly used to enable package mirroring.
 The above example will rewrite URL `\https://pkg.pkl-lang.org/pkl-k8s/k8s@1.0.0` to `\https://my.internal.mirror/pkl-k8s/k8s@1.0.0`.
 ====
+
+.powerAssertions: Property<Boolean>
+[%collapsible]
+====
+Default: `false` (except for test tasks, which default to `true`) +
+Example: `powerAssertions = true` +
+Enable power assertions for detailed assertion failure messages.
+When enabled, type constraint failures will show intermediate values in the assertion expression.
+This option has a performance impact when constraint failures occur.
+====
@@ -266,7 +266,7 @@ Thanks to https://github.com/gordonbondon[@gordonbondon] for contributing to thi

 === `@Generated` annotation for Java/Kotlin codegen

-Classes generated by the Java and Kotlin code generator can optionally recieve new annotation called `Generated` (https://github.com/apple/pkl/pull/1075[#1075], https://github.com/apple/pkl/pull/1115[#1115]).
+Classes generated by the Java and Kotlin code generator can optionally receive new annotation called `Generated` (https://github.com/apple/pkl/pull/1075[#1075], https://github.com/apple/pkl/pull/1115[#1115]).

 This behavior is toggled with the `--generated-annotation` CLI flag, or the similarly named Gradle property.

@@ -342,6 +342,7 @@ In Pkl 0.29, it is an error to load a module or resource with an opaque `file:`

 NOTE: To import or read a relative path, omit `file:` from the import string. For example, `import("foo/bar.txt")` instead of `import("file:foo/bar.txt")`.

+[[new-base-module-names]]
 === New base module names: `Bytes` and `Charset`

 Two new names are introduced to the base module: `Bytes` and `Charset`.
@@ -1,51 +1,429 @@
 = Pkl 0.30 Release Notes
 :version: 0.30
-:version-minor: 0.30.0
-:release-date: TBD
+:version-minor: 0.30.2
+:release-date: November 3rd, 2025

-link:ROOT:partial$component-attributes.adoc[role=include]
+:yaml-binary-scalar: https://yaml.org/type/binary.html
+
+include::ROOT:partial$component-attributes.adoc[]

 Pkl {version} was released on {release-date}. +
 [.small]#The latest bugfix release is {version-minor}. (xref:changelog.adoc[All Versions])#

-The next release (0.XX) is scheduled for ???..
+This release introduces a code formatter, and an in-language API for producing `pkl-binary` output.
+
+The next release (0.31) is scheduled for February 2026.
 To see what's coming in the future, follow the {uri-pkl-roadmap}[Pkl Roadmap].

-Please send feedback and questions to https://github.com/apple/pkl/discussions[GitHub Discussions], or submit an issue on https://github.com/apple/pkl/issues/new[Github]. +
+Please send feedback and questions to https://github.com/apple/pkl/discussions[GitHub Discussions], or submit an issue on https://github.com/apple/pkl/issues/new[GitHub]. +

 [small]#Pkl is hosted on https://github.com/apple/pkl[GitHub].
 To get started, follow xref:pkl-cli:index.adoc#installation[Installation].#

 == Highlights [small]#💖#

-News you don't want to miss.
+[[formatter]]
+=== Formatter

-=== XXX
+Pkl now has a formatter (https://github.com/apple/pkl/pull/1107[#1107], https://github.com/apple/pkl/pull/1208[#1208], https://github.com/apple/pkl/pull/1211[#1211], https://github.com/apple/pkl/pull/1215[#1215], https://github.com/apple/pkl/pull/1217[#1217], https://github.com/apple/pkl/pull/1235[#1235], https://github.com/apple/pkl/pull/1246[#1246], https://github.com/apple/pkl/pull/1247[#1247], https://github.com/apple/pkl/pull/1252[#1252], https://github.com/apple/pkl/pull/1256[#1256], https://github.com/apple/pkl/pull/1259[#1259], https://github.com/apple/pkl/pull/1260[#1260], https://github.com/apple/pkl/pull/1263[#1263], https://github.com/apple/pkl/pull/1265[#1265], https://github.com/apple/pkl/pull/1266[#1266], https://github.com/apple/pkl/pull/1267[#1267], https://github.com/apple/pkl/pull/1268[#1268], https://github.com/apple/pkl/pull/1270[#1270], https://github.com/apple/pkl/pull/1271[#1271], https://github.com/apple/pkl/pull/1272[#1272], https://github.com/apple/pkl/pull/1273[#1273], https://github.com/apple/pkl/pull/1274[#1274], https://github.com/apple/pkl/pull/1280[#1280], https://github.com/apple/pkl/pull/1283[#1283], https://github.com/apple/pkl/pull/1289[#1289], https://github.com/apple/pkl/pull/1290[#1290])!
+
+Pkl's formatter is _canonical_, which means that it has a single set of formatting rules, with (almost) no configuration options.
+The goal is to eliminate the possibility of formatting debates, which can lead to churn and bike-shedding.
+
+The formatter is available both as a CLI subcommand and as a Java API.
+
+To learn more about this feature, consult https://github.com/apple/pkl-evolution/blob/main/spices/SPICE-0014-canonical-formatter.adoc[SPICE-0014].
+
+==== Using the CLI
+
+The Pkl formatter is available under the `pkl format` subcommand. By default, the command will concatenate and write all formatted content to standard out.
+
+To simply check for formatting violations, getting formatted output on stdout is likely too verbose.
+The `--silent` flag can be used to omit any output, and the <<formatting-exit-codes,exit code>> can be used to determine
+if there are formatting violations.
+
+[source,shell]
+----
+pkl format --silent . || echo "Formatting violations were found!"
+----
+
+Alternatively, the `--names` flag will print out the names of any files that have formatting violations.
+
+[source,shell]
+----
+pkl format --diff-name-only .
+----
+
+To apply formatting, use the `--write` (`-w`) flag.
+This also implies the `--diff-name-only` flag.
+
+[source,shell]
+----
+pkl format -w .
+----
+
+[[formatting-exit-codes]]
+==== Exit codes
+
+The formatter will exit with the following codes:
+
+|===
+|Code |Description
+
+|0
+|No formatting violations were found.
+
+|1
+|Non-formatting errors occurred.
+
+|11
+|Formatting violations were found.
+|===
+
+==== Grammar version
+
+The formatter can be configured with a _grammar version_, which maps to a Pkl version range.
+
+|===
+|Grammar version |Pkl versions
+
+|1
+|0.25 - 0.29
+
+|2
+|0.30+
+|===
+
+Grammar version 2 uses the newly introduced <<trailing-commas,trailing commas>> feature, and therefore is not compatible with existing versions of Pkl.
+To ensure compatibility, use the `--grammar-version 1` CLI flag.
+
+[[binary-renderer-parser]]
+=== `pkl-binary` in-language Renderer
+
+A new in-language API has been added to render values into xref:bindings-specification:binary-encoding.adoc[pkl-binary encoding] (https://github.com/apple/pkl/pull/1203[#1203],
+https://github.com/apple/pkl/pull/1250[#1250], https://github.com/apple/pkl/pull/1275[#1275]).
+
+It's sometimes useful to separate Pkl evaluation from data consumption when used as application or service configuration.
+This is possible with the `pkl-binary` format, which is a lossless encoding of Pkl data.
+
+In this approach, Pkl is first rendered into `pkl-binary` during build time, and then deserialized into classes and structs at startup time.
+This means that the Pkl evaluator does not need to be shipped with the application, which improves code portability and eliminates runtime overhead.
+
+However, currently, the API for getting this binary format is somewhat cumbersome.
+Only the host languages have access to this API (for example, https://swiftpackageindex.com/apple/pkl-swift/0.6.0/documentation/pklswift/evaluator/evaluateexpressionraw(source:expression:)[`evaluateExpressionRaw`] in pkl-swift).
+This means that one-off logic must be written to render this format in the host language.
+
+In 0.30, this renderer is added as an in-language API, through the {uri-stdlib-pklbinaryModule}[`pkl:pklbinary`] standard library module.
+Additionally, it is available through CLI flag `--format pkl-binary`.
+
+For example:
+
+// this is parsed instead of tested because DocSnippetTests only handles textual output (via ReplServer)
+[source%parsed,pkl]
+----
+import "pkl:pklbinary"
+
+output {
+  renderer = new pklbinary.Renderer {}
+}
+----
+
+To learn more about this feature, consult https://github.com/apple/pkl-evolution/blob/main/spices/SPICE-0021-binary-renderer-and-parser.adoc[SPICE-0021].
+
+==== New renderer type: `BytesRenderer`
+
+To enable the `pkl-binary` renderer feature, Pkl now supports renderers that produce `Bytes` output (https://github.com/apple/pkl/pull/1203[#1203]).
+
+The existing `ValueRenderer` class now extends new class `BaseValueRenderer`, and a new `BytesRenderer` class is introduced.
+
+Setting a module's output renderer to a `BytesRenderer` will control its resulting `output.bytes`.
+
+This affects usage scenarios where a module's `output.bytes` is evaluated, for example, when using `pkl eval`.
+
+==== Using `pkl-binary` data
+
+Users of Pkl's language binding libraries can decode `pkl-binary` data into instances of code-generated types.
+
+[tabs]
+====
+Java::
+
+[source,java]
+----
+var encodedData = fetchEncodedData(); // some byte[] or InputStream
+var config = Config.fromPklBinary(encodedData);
+var appConfig = config.as(AppConfig.class);
+----
+
+Kotlin::
+
+[source,kotlin]
+----
+val encodedData = fetchEncodedData() // some ByteArray or InputStream
+val config = Config.fromPklBinary(encodedData, ValueMapper.preconfigured().forKotlin())
+val appConfig = config.to<AppConfig>()
+----
+
+Go::
+
+[source,go]
+----
+encodedData := fetchEncodedData() // some []byte
+var appConfig AppConfig
+if err := pkl.Unmarshal(encodedData, &appConfig); err != nil {
+  // handle error
+} 
+----
+
+Swift::
+
+[source,swift]
+----
+let encodedData = fetchEncodedData() // some [UInt8]
+let appConfig = try PklDecoder.decode(AppConfig.self, from: encodedData)
+----
+====

 == Noteworthy [small]#🎶#

-Ready when you need them.
+[[trailing-commas]]
+=== Trailing Commas

-=== XXX
+Pkl's grammar has been updated to allow including a comma following the final item of comma-separated syntax elements (https://github.com/apple/pkl/pull/1137[#1137]).
+
+These syntax elements are affected:
+
+[source%tested,pkl]
+----
+function add(
+  bar,
+  baz, // <1>
+) = bar + baz
+
+foo = add(
+  1,
+  2, // <2>
+)
+
+typealias MyMapping<
+  Key,
+  Value, // <3>
+> = Mapping<Key, Value>
+
+bar: Mapping<
+  String,
+  Int, // <4>
+>
+
+baz: Mapping(
+  !containsKey("forbidden key"),
+  !containsKey("forbidden value"), // <5>
+)
+
+qux: (
+  String,
+  Int, // <6>
+) -> Dynamic =
+  (paramA, paramB) -> new Dynamic {
+    quux = "\(paramA): \(paramB)"
+  }
+
+corge = (qux) {
+  paramA,
+  paramB, // <7>
+  ->
+  grault = paramA.length * paramB
+}
+----
+<1> Function parameter lists in method definitions.
+<2> Argument lists in method calls.
+<3> Type parameter lists in generic type definitions.
+<4> Type argument lists in type annotations and casts.
+<5> Type constraint lists.
+<6> Function type parameter lists in function type annotations.
+<7> Object body parameter lists.
+
+To learn more about this change, consult https://github.com/apple/pkl-evolution/blob/main/spices/SPICE-0019-trailing-commas.adoc[SPICE-0019].
+
+=== Pretty-printed traces
+
+A new evaluator option is added to enable pretty-printed traces (https://github.com/apple/pkl/pull/1100[#1100], https://github.com/apple/pkl/pull/1227[#1227], https://github.com/apple/pkl/pull/1230[#1230]).
+
+Currently, the `trace()` operator will render values as a single line, and trims the output after 100 characters.
+This can obscure information when debugging.
+
+In 0.30, a new evaluator option is added to control how traces are emitted.
+Two trace modes are introduced:
+
+* `compact` - the current output mode (default).
+* `pretty` - multiline, with no limit on output size.
+
+For example, users of the CLI can specify `--trace-mode` as a flag.
+
+[source,shell]
+----
+pkl eval --trace-mode pretty myModule.pkl  
+----
+
+Thanks to https://github.com/ssalevan[@ssalevan] for their contribution to this feature!
+
+=== Better support for `Bytes` when rendering YAML
+
+Previously, attempting to render a `Bytes` value using {uri-stdlib-YamlRenderer}[`YamlRenderer`] required the use of a link:{uri-stdlib-PcfRenderer-converters}[converter].
+Now, Pkl can natively render YAML containing link:{yaml-binary-scalar}[binary scalars] (https://github.com/apple/pkl/pull/1276[#1276]).
+
+[source,pkl%tested]
+----
+foo {
+  bar = Bytes(1, 2, 3)
+}
+
+rendered = new YamlRenderer {}.renderValue(foo) // <1>
+----
+<1> Result: `bar: !!binary AQID`
+
+Similarly, link:{uri-stdlib-YamlParser}[`yaml.Parser`] now parses binary YAML values as Pkl link:{uri-stdlib-Bytes}[`Bytes`] values (https://github.com/apple/pkl/pull/1277[#1277]).
+This is a breaking change; previously these values were parsed as link:{uri-stdlib-String}[`String`] value containing the base64-encoded binary data.
+
+[source,pkl%tested]
+----
+import "pkl:yaml"
+
+yamlData = 
+  """
+  bytes: !!binary AQID
+  """
+
+parsed = new yaml.Parser {}.parse(yamlData).bytes // <1>
+----
+<1> Result: `Bytes(1, 2, 3)`
+
+[[pkldoc-perf-improvements]]
+=== `pkldoc` performance improvements
+
+The `pkldoc` documentation generator has been overhauled (https://github.com/apple/pkl/pull/1169[#1169], https://github.com/apple/pkl/pull/1224[#1224], https://github.com/apple/pkl/pull/1241[#1241], https://github.com/apple/pkl/pull/1242[#1242]).
+
+Currently, the `pkldoc` tool needs to consume much of an existing documentation website whenever generating new documentation.
+This adds significant I/O overhead as a pkldoc documentation website grows.
+
+The generator has been overhauled to minimize the amount of data needed to be read from the current site.
+
+To read more about this change, consult https://github.com/apple/pkl-evolution/blob/main/spices/SPICE-0018-pkldoc-io-improvements.adoc[SPICE-0018].
+
+[[pkldoc-migration]]
+==== Migration
+
+The new pkldoc website introduces breaking changes to the data model.
+Because of this, existing sites must be migrated before using the `0.30` version of pkldoc.
+
+To migrate, run the one-time command `pkldoc --migrate`.
+
+=== Java API changes
+
+==== New classes
+
+New classes are introduced to the Java API.
+
+* `org.pkl.core.PklBinaryDecoder`
+
+==== New methods
+
+New methods are introduced to the Java API.
+
+* `org.pkl.core.Evaluator.evaluateExpressionPklBinary`
+* `org.pkl.core.EvaluatorBuilder.setTraceMode`
+* `org.pkl.core.EvaluatorBuilder.getTraceMode`
+* `org.pkl.config.java.Config.fromPklBinary`
+
+=== Standard Library changes
+
+New modules, properties, methods, classes and typealiases have been added to the standard library (https://github.com/apple/pkl/pull/1106[#1106]).
+
+==== Changes to `pkl:base`
+
+Additions:
+
+* New class: {uri-stdlib-BaseValueRenderer}[`BaseValueRenderer`]
+* {uri-stdlib-ValueRenderer}[`ValueRenderer`] (now a subclass of {uri-stdlib-BaseValueRenderer}[`BaseValueRenderer`])
+* {uri-stdlib-BytesRenderer}[`BytesRenderer`]
+* {uri-stdlib-baseModule}/RenderDirective#bytes[`RenderDirective.bytes`]
+
+==== Additions to `pkl:EvaluatorSettings`
+
+* {uri-stdlib-evaluatorSettingsModule}#traceMode[`traceMode`]
+
+==== Additions to `pkl:reflect`
+
+* {uri-stdlib-reflectModule}/Class#allMethods[`Class.allMethods`]
+* {uri-stdlib-reflectModule}/Class#allProperties[`Class.allProperties`]
+* {uri-stdlib-reflectModule}/Property#allAnnotations[`Propterty.allAnnotations`]
+* {uri-stdlib-reflectModule}/Propterty#allModifiers[`Propterty.allModifiers`]
+
+==== New module: `pkl:pklbinary`
+
+The `pkl:pklbinary` standard library module is added.
+
+=== `pkl repl` improvements
+
+The REPL now handles interrupts (Ctrl-C) in a more user-friendly way (https://github.com/apple/pkl/pull/1188[#1188]).
+
+Instead of exiting immediately, it behaves like other REPLs:
+
+* If the line is non-empty or in a continuation, the buffer is cleared.
+* If the line is empty, print a message with instructions on exiting the REPL.
+** If another interrupt is sent immediately after, exit.

 == Breaking Changes [small]#💔#

 Things to watch out for when upgrading.

-=== XXX
+=== Binary data handling `yaml.Parser`
+
+link:{yaml-binary-scalar}[YAML binary scalars] are now parsed as link:{uri-stdlib-Bytes}[`Bytes`] values.
+Prior versions of Pkl parsed binary scalars as link:{uri-stdlib-String}[`String`] values containing the base64-encoded binary data.
+
+=== Minimum Kotlin version bump
+
+For users of Pkl's Kotlin libraries, the minimum Kotlin version has been bumped to 2.1 (https://github.com/apple/pkl/pull/1232[#1232]).
+
+=== New base module names: `BaseValueRenderer`, `BytesRenderer`
+
+Two new names are introduced to the base module: `BaseValueRenderer`, and `BytesRenderer`.
+That means that any code that currently references these names on implicit `this` will break (https://github.com/apple/pkl/pull/1203[#1203]).
+
+To learn more about how this breaks code and how to fix it, see xref:0.29.adoc#new-base-module-names[New base module names] in 0.29's release notes.
+
+=== `pkldoc` sites need to be migrated
+
+Due to breaking changes made in pkldoc's data model, existing pkldoc websites must be migrated.
+
+See <<pkldoc-migration>> for more details.

 == Miscellaneous [small]#🐸#

-* XXX
+* Dependency updates (https://github.com/apple/pkl/pull/1184[#1184], https://github.com/apple/pkl/pull/1225[#1225], https://github.com/apple/pkl/pull/1226[#1226], https://github.com/apple/pkl/pull/1228[#1228]).
+* Enforce Pkl formatting of stdlib (https://github.com/apple/pkl/pull/1236[#1236], https://github.com/apple/pkl/pull/1253[#1253], https://github.com/apple/pkl/pull/1258[#1258], https://github.com/apple/pkl/pull/1278[#1278], https://github.com/apple/pkl/pull/1279[#1279]).
+* Add internal IntelliJ plugin that's meant to assist with development of the Pkl codebase itself (https://github.com/apple/pkl/pull/1248[#1248]).
+* Update CircleCI macOS instance type and Xcode version (https://github.com/apple/pkl/pull/1243[#1243], https://github.com/apple/pkl/pull/1244[#1244]).
+* Disable multi-jdk testing when running on Windows ARM (https://github.com/apple/pkl/pull/1223[#1223]).
+* Refine documentation for class `Any` (https://github.com/apple/pkl/pull/1194[#1194]).

 == Bugs fixed [small]#🐜#

 The following bugs have been fixed.

-* XXX (https://github.com/apple/pkl/issues/XXX[XXX])
+* Incorrect error message when refusing to read past root dir (https://github.com/apple/pkl/pull/1234[#1233]).
+* Unicode U+7FFF character (翿) incorrectly parsed as EOF (https://github.com/apple/pkl/pull/1251[#1251]).
+* Fallback certificates do not work in certain classloader setups (https://github.com/apple/pkl/pull/1198[#1199]).

 == Contributors [small]#🙏#

 We would like to thank the contributors to this release (in alphabetical order):

-* XXX
+* https://github.com/bioball[@bioball]
+* https://github.com/HT154[@HT154]
+* https://github.com/netvl[@netvl]
+* https://github.com/spyoungtech[@spyoungtech]
+* https://github.com/srueg[@srueg]
+* https://github.com/ssalevan[@ssalevan]
+* https://github.com/stackoverflow[@stackoverflow]
@@ -0,0 +1,352 @@
+= Pkl 0.31 Release Notes
+:version: 0.31
+:version-minor: 0.31.1
+:release-date: February 26th, 2026
+:version-next: 0.32
+:version-next-date: July 2026
+
+include::partial$intro.adoc[]
+
+== Highlights [small]#💖#
+
+[[power-assertions]]
+=== Power Assertions
+
+Pkl's test output and error output has been improved with power assertions (pr:https://github.com/apple/pkl/pull/1384[], pr:https://github.com/apple/pkl/pull/1419[])!
+
+Pkl has two places that are effectively assertions.
+These are:
+
+* Type constraint expressions
+* Test facts
+
+Currently, when these assertions fail, the error message prints the assertion's source section.
+However, this information can sometimes be lacking.
+It tells you what the mechanics of the assertion is, but doesn't tell you _why_ the assertion is failing.
+
+For example, here is the current error output of a failing typecheck.
+
+[source,text]
+----
+–– Pkl Error ––
+Type constraint `name.endsWith(lastName)` violated.
+Value: new Person { name = "Bub Johnson" }
+
+7 | passenger: Person(name.endsWith(lastName)) = new { name = "Bub Johnson" }
+----
+
+Just from this error message, we don't know what the last name is supposed to be.
+What is `name` supposed to end with?
+We just know it's some property called `lastName` but, we don't know what it _is_.
+
+In Pkl 0.31, the error output becomes:
+
+[source,text]
+----
+–– Pkl Error ––
+Type constraint `name.endsWith(lastName)` violated.
+Value: new Person { name = "Bub Johnson" }
+
+    name.endsWith(lastName)
+    │    │        │
+    │    false    "Smith"
+    "Bub Johnson"
+
+7 | passenger: Person(name.endsWith(lastName)) = new { name = "Bub Johnson" }
+----
+
+Now, we know what the expectation is.
+
+This type of diagram is also added to test facts.
+When tests fail, Pkl emits a diagram of the expression, and the values produced.
+
+For example, given the following test:
+
+.math.pkl
+[source,pkl]
+----
+amends "pkl:test"
+
+facts {
+  local function add(a: Int, b: Int) = a * b
+  local function divide(a: Int, b: Int) = a % b
+  ["math"] {
+    add(3, 4) == 7
+    divide(8, 2) == 4
+  }
+}
+----
+
+The error output now includes a power assertion diagram, which helps explain why the test failed.
+
+[source,text]
+----
+module math
+  facts
+    ✘ math
+       add(3, 4) == 7 (math.pkl:9)
+       │         │
+       12        false
+       divide(8, 2) == 4 (math.pkl:10)
+       │            │
+       0            false
+
+0.0% tests pass [1/1 failed], 0.0% asserts pass [2/2 failed]
+----
+
+To learn more about this feature, consult https://github.com/apple/pkl-evolution/blob/main/spices/SPICE-0026-power-assertions.adoc[SPICE-0026].
+
+[[cli-framework]]
+=== CLI Framework
+
+Pkl 0.31 introduces a new framework for implementing CLI tools in Pkl (pr:https://github.com/apple/pkl/pull/1367[], pr:https://github.com/apple/pkl/pull/1431[], pr:https://github.com/apple/pkl/pull/1432[], pr:https://github.com/apple/pkl/pull/1436[], pr:https://github.com/apple/pkl/pull/1440[], pr:https://github.com/apple/pkl/pull/1444[]).
+
+The framework provides a way to build command line tools with user experience idioms that will be immediately familiar to users.
+CLI tools implemented in Pkl have largely the same capabilities as normal Pkl evaluation (i.e. writing to standard output and files), but this may be extended using xref:language-reference:index.adoc#external-readers[external readers].
+
+Commands are defined by extending the pkldoc:#[pkl:Command] module:
+
+.bird-generator.pkl
+[source,pkl]
+----
+extends "pkl:Command"
+
+options: Options
+
+class Options {
+  /// Mapping of <bird>=<bird age> pairs defining the list of birds.
+  @Argument
+  birds: Mapping<String, Number>
+
+  /// Aggregation function to apply to all bird ages.
+  aggregate: *"sum" | "mean" | "count"
+}
+
+class Bird {
+  /// Name of the bird.
+  name: String
+
+  /// Age of the bird in years.
+  age: Number
+}
+
+birds: Listing<Bird> = new {
+  for (_name, _age in options.birds) {
+    new { name = _name; age = _age }
+  }
+}
+
+result: Number =
+  if (options.aggregate == "sum")
+    birds.toList().fold(0.0, (result, bird) -> result + bird.age)
+  else if (options.aggregate == "mean")
+    birds.toList().fold(0.0, (result, bird) -> result + bird.age) / birds.length
+  else
+    birds.length
+----
+
+Commands are executed using the `pkl run` CLI subcommand:
+
+[source,bash]
+----
+$ pkl run bird-generator.pkl pigeon --aggregate=mean Pigeon=1 Hawk=8 Eagle=3
+birds {
+  new {
+    name = "Pigeon"
+    age = 1
+  }
+  new {
+    name = "Hawk"
+    age = 8
+  }
+  new {
+    name = "Eagle"
+    age = 3
+  }
+}
+result = 4.0
+----
+
+Automatic CLI help is provided:
+
+[source,bash]
+----
+$ pkl run test.pkl -h
+Usage: test.pkl [<options>] [<birds>]... <command> [<args>]...
+
+Options:
+  --aggregate=<count, mean, sum>  Aggregation function to apply to all bird ages.
+  -h, --help                      Show this message and exit
+
+Arguments:
+  <birds>  Mapping of <bird>=<bird age> pairs defining the list of birds.
+----
+
+To learn more about this feature, consult xref:pkl-cli:index.adoc#cli-tools[the documentation] and https://github.com/apple/pkl-evolution/blob/main/spices/SPICE-0025-pkl-run-cli-framework.adoc[SPICE-0025].
+
+== Noteworthy [small]#🎶#
+
+=== Syntax Highlighting
+
+The Pkl CLI displays Pkl code in several locations: stack frames within errors messages, <<power-assertions,power assertions>>, and in the xref:pkl-cli:index.adoc#repl[REPL].
+This code is now syntax highlighted to improve readability (pr:https://github.com/apple/pkl/pull/1385[], pr:https://github.com/apple/pkl/pull/1409[]):
+
+image::syntax-highlight-error.png[syntax highlighted output]
+
+[[cli-dependency-notation]]
+=== CLI Support for Dependency Notation
+
+The Pkl CLI now supports specifying modules using xref:language-reference:index.adoc#project-dependencies[dependency notation] (pr:https://github.com/apple/pkl/pull/1434[], pr:https://github.com/apple/pkl/pull/1439[]).
+This is especially helpful for <<cli-framework,CLI commands>> defined in Packages:
+
+[source,bash]
+----
+$ pkl run @my-tool/cmd.pkl ...
+----
+
+This enhancement applies to the `pkl eval`, `pkl run`, `pkl test`, and `pkl analyze imports` commands.
+It also applies to the `pkldoc`, `pkl-codegen-java`, and `pkl-codegen-kotlin` tools.
+
+[NOTE]
+Dependency notation only works for remote package dependencies. xref:language-reference:index.adoc#local-dependencies[Local dependencies] are not supported.
+
+=== Property Converter Annotations
+
+Pkl provides the pkldoc:BaseValueRenderers#converters[] mechanism for transforming values during rendering.
+Converters are flexible, but their design makes some transformations awkward.
+In particular, modifying property names during rendering required a lot of extra code.
+
+The new pkldoc:ConvertProperty[] annotation adds a way to express parameterized per-property name and value transformations (pr:https://github.com/apple/pkl/pull/1333[]).
+
+To learn more about this feature, consult https://github.com/apple/pkl-evolution/blob/main/spices/SPICE-0024-annotation-converters.adoc[SPICE-0024].
+
+Additional new Pkl APIs for per-format property renaming will be added for many built-in renderers:
+
+.fmt.pkl
+[source,pkl]
+----
+import "pkl:json"
+import "pkl:yaml"
+
+@json.Property { name = "foo_bar" }
+@yaml.Property { name = "foo-bar" }
+fooBar: String = "hello world"
+----
+
+[source,terminaloutput]
+----
+$ pkl eval fmt.pkl -f json
+{
+  "foo_bar": "hello world"
+}
+
+$ pkl eval fmt.pkl -f yaml
+foo-bar: hello world
+----
+
+=== Java API changes
+
+==== New classes
+
+New classes are introduced to the Java API.
+
+* `org.pkl.core.CommandSpec`
+
+==== New methods
+
+New methods are introduced to the Java API.
+
+* `org.pkl.core.Evaluator.evaluateCommand`
+* `org.pkl.core.EvaluatorBuilder.setPowerAssertionsEnabled`
+* `org.pkl.core.EvaluatorBuilder.getPowerAssertionsEnabled`
+* `org.pkl.core.SecurityManager.resolveSecurePath`
+* `org.pkl.config.java.ConfigEvaluator.evaluateOutputValue`
+* `org.pkl.coznfig.java.ConfigEvaluator.evaluateExpression`
+
+=== Standard Library changes
+
+New properties have been added to the standard library (pr:https://github.com/apple/pkl/pull/1396[]).
+
+==== Additions to `pkl:base`
+
+* pkldoc:List#isNotEmpty[]
+* pkldoc:Map#isNotEmpty[]
+* pkldoc:Set#isNotEmpty[]
+* pkldoc:Listing#isNotEmpty[]
+* pkldoc:Mapping#isNotEmpty[]
+* pkldoc:String#isNotEmpty[]
+* pkldoc:String#isNotBlank[]
+* pkldoc:ConvertProperty[]
+* pkldoc:BaseValueRenderer#convertPropertyTransformers[]
+
+==== New module `pkl:Command`
+
+The pkldoc:#[pkl:Command] standard library module is added.
+
+==== Additions to `pkl:json`
+
+* pkldoc:Property[pkl:json]
+
+==== Additions to `pkl:jsonnet`
+
+* pkldoc:Property[pkl:jsonnet]
+
+==== Additions to `pkl:protobuf`
+
+* pkldoc:Property[pkl:protobuf]
+
+==== Additions to `pkl:xml`
+
+* pkldoc:Property[pkl:xml]
+
+==== Additions to `pkl:yaml`
+
+* pkldoc:Property[pkl:yaml]
+
+== Breaking Changes [small]#💔#
+
+Things to watch out for when upgrading.
+
+=== Removal of `@argfile` support
+
+Prior versions of Pkl had an undocumented feature allowing inclusion of CLI arguments from files using `@path/to/file`.
+In order to support <<cli-dependency-notation,dependency notation>> on the CLI, `@argfile` support has been removed from Pkl.
+
+=== Removal of `Collection#transpose()`
+
+Prior versions of Pkl defined a `transpose()` method on the `Collection` class.
+This method was never implemented and threw an error when called.
+As it was never functional, it has been removed entirely without a deprecation warning (pr:https://github.com/apple/pkl/pull/1437[]).
+
+== Miscellaneous [small]#🐸#
+
+* Improve formatting of imports to keep surrounding comments (pr:https://github.com/apple/pkl/pull/1424[]).
+* Add support for evaluating module output and expressions to `ConfigEvaluator` (pr:https://github.com/apple/pkl/pull/1297[]).
+* The `pkl format --write` command now exits successfully when formatting violations are found and updated (pr:https://github.com/apple/pkl/pull/1340[]).
+* Add `pkl-bom` module to aid in aligning Pkl Java dependencies (pr:https://github.com/apple/pkl/pull/1390[]).
+* Improve error message when writing `PklProject.deps.json` fails (pr:https://github.com/apple/pkl/pull/1405[]).
+* Add information about pkldoc:Annotation[]s to the language reference (pr:https://github.com/apple/pkl/pull/1427[]).
+* Improved usability for the `org.pkl.formatter.Formatter` Java API (pr:https://github.com/apple/pkl/pull/1428[]).
+
+== Bugs fixed [small]#🐜#
+
+The following bugs have been fixed.
+
+* `Function.toString()` returns incorrect result (pr:https://github.com/apple/pkl/pull/1411[]).
+* Failure when `--multiple-file-output-path` is a symlink (pr:https://github.com/apple/pkl/pull/1389[]).
+* The `module` type in a non-final module has default value of type `Dynamic` (pr:https://github.com/apple/pkl/pull/1392[]).
+* The `module` type is cached incorrectly in some cases (pr:https://github.com/apple/pkl/pull/1393[]).
+* A possible race condition involving symlinks could bypass `--root-dir` during module and resource reading (pr:https://github.com/apple/pkl/pull/1426[]).
+* `pkl format` produces internal stack traces when lexing fails (pr:https://github.com/apple/pkl/pull/1430[]).
+* `super` access expressions are parsed incorrectly inside the spread operator (pr:https://github.com/apple/pkl/pull/1364[]).
+* Modules and resources with `jar:file:` URIs were not properly sandboxed by `--root-dir` (pr:https://github.com/apple/pkl/pull/1442[]).
+
+== Contributors [small]#🙏#
+
+We would like to thank the contributors to this release (in alphabetical order):
+
+* https://github.com/bioball[@bioball]
+* https://github.com/eddie4941[@eddie4941]
+* https://github.com/HT154[@HT154]
+* https://github.com/stackoverflow[@stackoverflow]
+* https://github.com/StefMa[@StefMa]
@@ -0,0 +1,60 @@
+= Pkl 0.32.0 Release Notes
+:version: 0.32
+:version-minor: 0.32.0
+:release-date: TBD
+:version-next: 0.33
+:version-next-date: TBD
+
+include::partial$intro.adoc[]
+
+== Highlights [small]#💖#
+
+News you don't want to miss.
+
+.XXX
+[%collapsible]
+====
+XXX
+====
+
+== Noteworthy [small]#🎶#
+
+Ready when you need them.
+
+.XXX
+[%collapsible]
+====
+XXX
+====
+
+== Breaking Changes [small]#💔#
+
+Things to watch out for when upgrading.
+
+=== Removed Java APIs
+
+The following APIs have been removed without replacement.
+
+* `org.pkl.config.java.Config#makeConfig` (pr:https://github.com/apple/pkl/pull/1531[])
+
+.XXX
+[%collapsible]
+====
+XXX
+====
+
+== Work In Progress [small]#🚆#
+
+They missed the train but deserve a mention.
+
+.XXX
+[%collapsible]
+====
+XXX
+====
+
+== Contributors [small]#🙏#
+
+We would like to thank the contributors to this release (in alphabetical order):
+
+* XXX
@@ -1,8 +1,86 @@
 = Changelog
 include::ROOT:partial$component-attributes.adoc[]

+[[release-0.32.0]]
+== 0.32.0 (UNRELEASED)
+
+[[release-0.31.1]]
+== 0.31.1 (2026-03-26)
+
+=== Breaking Changes [small]#💔#
+
+* Allow nullable reads for custom/external resources (pr:https://github.com/apple/pkl/pull/1471[]).
+
+This allows custom/external resources to produce `null` values for xref:language-reference:index.adoc#nullable-reads[nullable reads] (`read?`).
+While this is a breaking change in behavior, it is currently not possible to exercise with versions of pkl-go or pkl-swift released prior to this change.
+
+=== Fixes
+
+* Fix typo in changelog and language reference (pr:https://github.com/apple/pkl/pull/1455[]).
+* Fix bugs in `CommandSpecParser` (pr:https://github.com/apple/pkl/pull/1448[], pr:https://github.com/apple/pkl/pull/1449[]).
+* Respect `--omit-project-settings` for all evaluator options (pr:https://github.com/apple/pkl/pull/1459[]).
+* Fix SecurityManager check for HTTP(S) module URIs (pr:https://github.com/apple/pkl/pull/1463[]).
+* Fix performance regression caused by activation of power assertion instrumentation during some union type checks (pr:https://github.com/apple/pkl/pull/1462[]).
+* Fix module reflection when power assertion instrumentation is active (pr:https://github.com/apple/pkl/pull/1464[]).
+* Prevent I/O when checking UNC paths against `--root-dir` (pr:https://github.com/apple/pkl/pull/1466[]).
+* Prevent `--multiple-file-output-path` writes from following symlinks outside the target directory
+(pr:https://github.com/apple/pkl/pull/1467[]).
+
+=== Contributors ❤️
+
+Thank you to all the contributors for this release!
+
+* https://github.com/04cb[@04cb]
+* https://github.com/HT154[@HT154]
+* https://github.com/KushalP[@KushalP]
+
+[[release-0.31.0]]
+== 0.31.0 (2026-02-26)
+
+xref:0.31.adoc[Release Notes]
+[[release-0.30.2]]
+
+== 0.30.2 (2025-12-15)
+
+=== Fixes
+
+* Fixes formatting of blank files (https://github.com/apple/pkl/pull/1351[#1351]).
+* Fixes an issue where the `pkl format` CLI command adds an extra newline when writing formatted content to standard output (https://github.com/apple/pkl/issues/1346[#1346]).
+* Make linux executables link to glibc 2.17 (https://github.com/apple/pkl/pull/1352[#1352]).
+* Fix incorrect parsing of super expressions (https://github.com/apple/pkl/pull/1364[#1364]).
+
+=== Contributors ❤️
+
+Thank you to all the contributors for this release!
+
+* https://github.com/bioball[@bioball]
+* https://github.com/HT154[@HT154]
+* https://github.com/stackoverflow[@stackoverflow]
+
+[[release-0.30.1]]
+== 0.30.1 (2025-12-03)
+
+=== Fixes
+
+* Fixes formatting of `Map` constructors with line comments (https://github.com/apple/pkl/pull/1312[#1312]).
+* Fixes a crash when parsing empty parenthesized types (https://github.com/apple/pkl/pull/1323[#1323]).
+* Fixes a parser issue allowing too many newlines between tokens (https://github.com/apple/pkl/pull/1328[#1328]).
+* Fixes parsing of URIs with schemes containing `+`, `-`, or `.` (https://github.com/apple/pkl/pull/1335[#1335]).
+* Fixes a crash when creating very large `List` instances (https://github.com/apple/pkl/pull/1337[#1337]).
+
+=== Contributors ❤️
+
+Thank you to all the contributors for this release!
+
+* https://github.com/bioball[@bioball]
+* https://github.com/HT154[@HT154]
+* https://github.com/spyoungtech[@spyoungtech]
+* https://github.com/stackoverflow[@stackoverflow]
+
 [[release-0.30.0]]
-== 0.30.0 (TBD)
+== 0.30.0 (2025-10-30)
+
+xref:0.30.adoc[Release notes]

 [[release-0.29.1]]
 == 0.29.1 (2025-08-27)
@@ -2,6 +2,8 @@

 The Pkl team aims to release a new version of Pkl in February, June, and October of each year.

+* xref:0.32.adoc[0.32 Release Notes]
+* xref:0.31.adoc[0.31 Release Notes]
 * xref:0.30.adoc[0.30 Release Notes]
 * xref:0.29.adoc[0.29 Release Notes]
 * xref:0.28.adoc[0.28 Release Notes]
@@ -0,0 +1,12 @@
+include::ROOT:partial$component-attributes.adoc[]
+
+Pkl {version} was released on {release-date}. +
+[.small]#The latest bugfix release is {version-minor}. (xref:changelog.adoc[All Versions])#
+
+The next release ({version-next}) is scheduled for {version-next-date}.
+To see what's coming in the future, follow the {uri-pkl-roadmap}[Pkl Roadmap].
+
+Please send feedback and questions to https://github.com/apple/pkl/discussions[GitHub Discussions], or submit an issue on https://github.com/apple/pkl/issues/new[GitHub]. +
+
+[small]#Pkl is hosted on https://github.com/apple/pkl[GitHub].
+To get started, follow xref:pkl-cli:index.adoc#installation[Installation].#
@@ -2,20 +2,10 @@
 :version: XXX (e.g., 0.9)
 :version-minor: XXX (e.g., 0.9.0)
 :release-date: XXX (e.g., July 11, 2018)
+:version-next: XXX (e.g., 0.10)
+:version-next-date: XXX (e.g., July 2018)

-include::ROOT:partial$component-attributes.adoc[]
-
-Pkl {version} was released on {release-date}. +
-[.small]#The latest bugfix release is {version-minor}. (xref:changelog.adoc[All Versions])#
-
-XXX
-
-The next release (XXX) is scheduled for XXX (e.g., August 2, 2021).
-
-Please send feedback and questions to https://github.com/apple/pkl/discussions[GitHub Discussions], or submit an issue on https://github.com/apple/pkl/issues/new[GitHub]. +
-
-[small]#Pkl is hosted on https://github.com/apple/pkl[GitHub].
-To get started, follow xref:pkl-cli:index.adoc#installation[Installation].#
+include::partial$intro.adoc[]

 == Highlights [small]#💖#

@@ -62,10 +52,3 @@ XXX
 We would like to thank the contributors to this release (in alphabetical order):

 * XXX
-
-== Closed Radars [small]#🔒#
-
-XXX Radars down, Inbox Zero in sight ...
-
-[smaller]
-. XXX (https://github.com/apple/pkl/issues/new[XXX])
@@ -98,7 +98,7 @@ A module that doesn't add new properties shouldn't use the `extends` clause.
 ==== Imports

 Sort imports sections using https://en.wikipedia.org/wiki/Natural_sort_order[natural sorting] by their module URI.
-Relative path imports should be in their own section, separated by a newline.
+Relative path and package imports should be in their own section, separated by a newline.
 There should be no unused imports.

 [source%parsed,{pkl}]
@@ -106,6 +106,8 @@ There should be no unused imports.
 import "modulepath:/foo.pkl"
 import "package://example.com/mypackage@1.0.0#/foo.pkl"

+import "@mypackage/baz.pkl"
+
 import ".../my/file/bar2.pkl"
 import ".../my/file/bar11.pkl"
 ----
@@ -266,7 +268,6 @@ Use line comments or block comments to convey implementation concerns to authors

 Doc comments should start with a one sentence summary paragraph, followed by additional paragraphs if necessary.
 Start new sentences on their own line.
-Add a single space after `///`.

 [source%parsed,{pkl}]
 ----
@@ -335,7 +336,6 @@ class ZebraParty {}
 [source%tested,{pkl}]
 ----
 class zebraParty {}
-class zebraparty {}
 ----

 == Strings
@@ -472,13 +472,6 @@ else
 if (bar) bar else foo
 ----

-.good.pkl
-[source%parsed,{pkl-expr}]
----
-if (bar) bar
-else foo
----
-
 .good.pkl
 [source%parsed,{pkl-expr}]
 ----
@@ -624,19 +617,15 @@ res2 = 1 + 2 // <3>
 res3 = res2 as Number // <3>
 res4 = List(1, 2, 3) // <4>
 res5 = if (foo) bar else baz // <5>
+
+typealias Foo = "foo" | "bar" | "baz" // <6>
 ----
 <1> After keywords
 <2> Before and after braces
 <3> Around infix operators
 <4> After a comma
 <5> Before opening parentheses in control operators (`if`, `for`, `when` are control operators)
-
-NOTE: No spaces are added around the pipe symbol (`|`) in union types.
-
-[source%tested,{pkl}]
----
-typealias Foo = "foo"|"bar"|"baz"
----
+<6> Before and after the pipe symbol (`|`)

 === Object bodies

@@ -41,6 +41,8 @@
 * xref:ROOT:evolution-and-roadmap.adoc[Evolution and Roadmap]

 * xref:release-notes:index.adoc[Release Notes]
+** xref:release-notes:0.32.adoc[0.32 Release Notes]
+** xref:release-notes:0.31.adoc[0.31 Release Notes]
 ** xref:release-notes:0.30.adoc[0.30 Release Notes]
 ** xref:release-notes:0.29.adoc[0.29 Release Notes]
 ** xref:release-notes:0.28.adoc[0.28 Release Notes]
@@ -15,6 +15,7 @@ import org.pkl.commons.test.FileTestUtils.rootProjectDir
 import org.pkl.core.Loggers
 import org.pkl.core.SecurityManagers
 import org.pkl.core.StackFrameTransformers
+import org.pkl.core.evaluatorSettings.TraceMode
 import org.pkl.core.module.ModuleKeyFactories
 import org.pkl.core.repl.ReplRequest
 import org.pkl.core.repl.ReplResponse
@@ -97,6 +98,7 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
      IoUtils.getCurrentWorkingDir(),
      StackFrameTransformers.defaultTransformer,
      false,
+      TraceMode.COMPACT,
    )
    return ExecutionContext(replServer)
  }
@@ -1,7 +1,7 @@
 # suppress inspection "UnusedProperty" for whole file

 group=org.pkl-lang
-version=0.30.0
+version=0.32.0

 # google-java-format requires jdk.compiler exports
 org.gradle.jvmargs= \
--- a/Show More
+++ b/Show More