Update 1.10 builds and keep older saves working

.gitattributes

@@ -0,0 +1,6 @@
+* text=auto eol=lf
+*.jar binary
+*.zip binary
+*.png binary
+*.ogg binary
+*.ttf binary

.github/workflows/ci.yml

@@ -0,0 +1,229 @@
+name: Base Metals 1.10 CI
+
+on:
+  push:
+    branches:
+      - master-1.10.2
+      - 'feature/**'
+  pull_request:
+    branches:
+      - master-1.10.2
+
+permissions:
+  contents: read
+
+concurrency:
+  group: basemetals-1.10-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  cold-forge-bootstrap:
+    name: Cold Forge bootstrap
+    runs-on: ubuntu-latest
+    timeout-minutes: 75
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Install pinned Java 25 ForgeGradle Mavenizer runtime
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '25.0.3+9.0.LTS'
+
+      - name: Install pinned Java 8 compilation toolchain
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '8.0.502+7'
+
+      - name: Install pinned Java 17 Gradle runtime
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '17.0.1+12'
+
+      - name: Stage checksum-verified legacy dependencies
+        id: dependencies
+        shell: bash
+        run: |
+          set -euo pipefail
+          mirror="$RUNNER_TEMP/legacy-dependency-mirror"
+          bash gradle/stage-legacy-dependencies.sh "$mirror"
+          echo "repository=$mirror" >> "$GITHUB_OUTPUT"
+
+      - name: Bootstrap Forge from an empty cache
+        shell: bash
+        env:
+          GRADLE_USER_HOME: ${{ runner.temp }}/basemetals-cold-gradle
+        run: |
+          set -euo pipefail
+          test ! -e .gradle
+          test ! -e "$GRADLE_USER_HOME"
+          mkdir -p "$GRADLE_USER_HOME"
+          chmod +x ./gradlew
+          gradle_args=(
+            classes verifyReleaseDependencies
+            -PlegacyDependencyVerificationRepository="${{ steps.dependencies.outputs.repository }}"
+            --no-daemon --no-build-cache --stacktrace --max-workers=2
+            -Porg.gradle.java.installations.paths="$JAVA_HOME,$JAVA_HOME_8_X64,$JAVA_HOME_25_X64"
+            -Porg.gradle.java.installations.auto-detect=false
+            -Porg.gradle.java.installations.auto-download=false
+          )
+          ./gradlew "${gradle_args[@]}"
+
+      - name: Verify same-cache bootstrap offline
+        shell: bash
+        env:
+          GRADLE_USER_HOME: ${{ runner.temp }}/basemetals-cold-gradle
+        run: |
+          set -euo pipefail
+          gradle_args=(
+            classes verifyReleaseDependencies
+            -PlegacyDependencyVerificationRepository="${{ steps.dependencies.outputs.repository }}"
+            --rerun-tasks --offline --no-daemon --no-build-cache --stacktrace --max-workers=2
+            -Porg.gradle.java.installations.paths="$JAVA_HOME,$JAVA_HOME_8_X64,$JAVA_HOME_25_X64"
+            -Porg.gradle.java.installations.auto-detect=false
+            -Porg.gradle.java.installations.auto-download=false
+          )
+          ./gradlew "${gradle_args[@]}"
+
+  build:
+    name: Build, test, and audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Install pinned Java 25 ForgeGradle Mavenizer runtime
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '25.0.3+9.0.LTS'
+
+      - name: Install pinned Java 8 compilation and runtime toolchain
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '8.0.502+7'
+
+      - name: Install pinned Java 17 Gradle runtime
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '17.0.1+12'
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
+
+      - name: Stage checksum-verified dependencies
+        id: dependencies
+        shell: bash
+        run: |
+          set -euo pipefail
+          mirror="$RUNNER_TEMP/legacy-dependency-mirror"
+          bash gradle/stage-legacy-dependencies.sh "$mirror"
+          echo "repository=$mirror" >> "$GITHUB_OUTPUT"
+
+      - name: Prepare clean packaged Forge runtime
+        id: forge
+        shell: bash
+        run: |
+          set -euo pipefail
+          runtime="$RUNNER_TEMP/forge-1.10.2-2511-runtime"
+          bash gradle/prepare-packaged-forge-runtime.sh "$runtime" "$JAVA_HOME_8_X64/bin/java"
+          echo "runtime=$runtime" >> "$GITHUB_OUTPUT"
+
+      - name: Install world-audit tools
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: '3.12'
+
+      - name: Install world-audit libraries
+        run: python3 -m pip install nbtlib==2.0.4 numpy==2.2.6
+
+      - name: Build, test, audit, qualify runtimes, and generate Eclipse launches
+        shell: bash
+        run: |
+          set -euo pipefail
+          chmod +x ./gradlew
+          gradle_args=(
+            clean check build javadoc verifyReleaseDependencies verifyReleaseArtifacts
+            writeReleaseChecksums prepareEclipse packagedForgeRuntimeTest
+            -PpythonExecutable=python3
+            -PreleaseBuild=true
+            -PlegacyDependencyVerificationRepository="${{ steps.dependencies.outputs.repository }}"
+            -PpackagedForgeRuntimeRoot="${{ steps.forge.outputs.runtime }}"
+            --no-daemon --stacktrace --max-workers=2
+            -Porg.gradle.java.installations.paths="$JAVA_HOME,$JAVA_HOME_8_X64,$JAVA_HOME_25_X64"
+            -Porg.gradle.java.installations.auto-detect=false
+            -Porg.gradle.java.installations.auto-download=false
+          )
+          ./gradlew "${gradle_args[@]}"
+          cp build/release/SHA256SUMS "$RUNNER_TEMP/first-SHA256SUMS"
+
+      - name: Verify the prepared release bundle
+        shell: bash
+        run: |
+          set -euo pipefail
+          bundle="$RUNNER_TEMP/release-input"
+          mkdir -p "$bundle"
+          cp build/libs/BaseMetals-2.5.1.110021{,-sources,-javadoc}.jar "$bundle/"
+          cp build/release/SHA256SUMS CHANGELOG.txt "$bundle/"
+          ./gradlew verifyPreparedReleaseArtifacts verifyMavenCoordinates \
+            -PpreparedReleaseDir="$bundle" \
+            -PlegacyDependencyVerificationRepository="${{ steps.dependencies.outputs.repository }}" \
+            -Porg.gradle.java.installations.paths="$JAVA_HOME,$JAVA_HOME_8_X64,$JAVA_HOME_25_X64" \
+            -Porg.gradle.java.installations.auto-detect=false \
+            -Porg.gradle.java.installations.auto-download=false \
+            --offline --no-daemon --stacktrace --max-workers=2
+
+      - name: Verify reproducible release archives
+        shell: bash
+        run: |
+          set -euo pipefail
+          gradle_args=(
+            clean build javadoc verifyReleaseArtifacts writeReleaseChecksums
+            -PreleaseBuild=true
+            -PlegacyDependencyVerificationRepository="${{ steps.dependencies.outputs.repository }}"
+            --offline --no-daemon --no-build-cache --stacktrace --max-workers=2
+            -Porg.gradle.java.installations.paths="$JAVA_HOME,$JAVA_HOME_8_X64,$JAVA_HOME_25_X64"
+            -Porg.gradle.java.installations.auto-detect=false
+            -Porg.gradle.java.installations.auto-download=false
+          )
+          ./gradlew "${gradle_args[@]}"
+          cmp "$RUNNER_TEMP/first-SHA256SUMS" build/release/SHA256SUMS
+
+      - name: Upload audited release candidate
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: BaseMetals-1.10.2-${{ github.sha }}
+          if-no-files-found: error
+          retention-days: 30
+          path: |
+            build/libs/BaseMetals-2.5.1.110021.jar
+            build/libs/BaseMetals-2.5.1.110021-sources.jar
+            build/libs/BaseMetals-2.5.1.110021-javadoc.jar
+            build/release/SHA256SUMS
+            CHANGELOG.txt
+
+      - name: Upload bounded diagnostics on failure
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: BaseMetals-1.10.2-diagnostics-${{ github.sha }}
+          if-no-files-found: ignore
+          retention-days: 14
+          path: |
+            build/test-results/**
+            build/reports/**
+            build/packaged-forge-checks/**/*-console.txt
+            build/packaged-forge-checks/**/logs/*.log
+            build/packaged-forge-checks/**/crash-reports/*.txt
+            build/packaged-forge-checks/**/*-worldgen.json
+            build/packaged-forge-checks/**/*-review.json
+            build/packaged-forge-checks/**/*-launch.json
+            build/problems/**

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,80 @@
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - master-1.10.2
+      - 'feature/**'
+  pull_request:
+    branches:
+      - master-1.10.2
+  schedule:
+    - cron: '47 7 * * 4'
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze Java
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Install pinned Java 25 ForgeGradle Mavenizer runtime
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '25.0.3+9.0.LTS'
+
+      - name: Install pinned Java 8 compilation toolchain
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '8.0.502+7'
+
+      - name: Install pinned Java 17 Gradle runtime
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '17.0.1+12'
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
+        with:
+          languages: java-kotlin
+
+      - name: Stage checksum-verified dependencies
+        id: dependencies
+        shell: bash
+        run: |
+          set -euo pipefail
+          mirror="$RUNNER_TEMP/legacy-dependency-mirror"
+          bash gradle/stage-legacy-dependencies.sh "$mirror"
+          echo "repository=$mirror" >> "$GITHUB_OUTPUT"
+
+      - name: Compile production code
+        shell: bash
+        run: |
+          set -euo pipefail
+          chmod +x ./gradlew
+          gradle_args=(
+            clean classes
+            -PlegacyDependencyVerificationRepository="${{ steps.dependencies.outputs.repository }}"
+            --no-daemon --no-build-cache --stacktrace --max-workers=2
+            -Porg.gradle.java.installations.paths="$JAVA_HOME,$JAVA_HOME_8_X64,$JAVA_HOME_25_X64"
+            -Porg.gradle.java.installations.auto-detect=false
+            -Porg.gradle.java.installations.auto-download=false
+          )
+          ./gradlew "${gradle_args[@]}"
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4