Merge branch 'master' into feature/remove_beta_annotation_from_Hashin…

…gInputStream

.github/workflows/ci.yml

@@ -27,13 +27,13 @@ jobs:
     steps:
       # Cancel any previous runs for the same branch that are still running.
       - name: 'Cancel previous runs'
-        uses: styfle/cancel-workflow-action@0.11.0
+        uses: styfle/cancel-workflow-action@b173b6ec0100793626c2d9e6b90435061f4fc3e5
         with:
           access_token: ${{ github.token }}
       - name: 'Check out repository'
-        uses: actions/checkout@v3
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
       - name: 'Set up JDK ${{ matrix.java }}'
-        uses: actions/setup-java@v3.6.0
+        uses: actions/setup-java@5ffc13f4174014e2d4d4572b3d74c3fa61aeb2c2
 
         with:
           java-version: ${{ matrix.java }}
@@ -58,9 +58,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Check out repository'
-        uses: actions/checkout@v3
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
       - name: 'Set up JDK 11'
-        uses: actions/setup-java@v3.6.0
+        uses: actions/setup-java@5ffc13f4174014e2d4d4572b3d74c3fa61aeb2c2
 
         with:
           java-version: 11
@@ -84,9 +84,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Check out repository'
-        uses: actions/checkout@v3
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
       - name: 'Set up JDK 11'
-        uses: actions/setup-java@v3.6.0
+        uses: actions/setup-java@5ffc13f4174014e2d4d4572b3d74c3fa61aeb2c2
 
         with:
           java-version: 11

.github/workflows/scorecard.yml

@@ -0,0 +1,72 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '45 9 * * 0'
+  push:
+    branches: [ "master" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@80e868c13c90f172d68d1f4501dee99e2479f7af # v2.1.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecard on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@f3feb00acb00f31a6f60280e6ace9ca31d91c76a # v2.3.2
+        with:
+          sarif_file: results.sarif

README.md

@@ -2,6 +2,7 @@
 
 [![Latest release](https://img.shields.io/github/release/google/guava.svg)](https://github.com/google/guava/releases/latest)
 [![Build Status](https://github.com/google/guava/workflows/CI/badge.svg?branch=master)](https://github.com/google/guava/actions)
+[![OpenSSF Best Practices](https://bestpractices.coreinfrastructure.org/projects/7197/badge)](https://bestpractices.coreinfrastructure.org/projects/7197)
 
 Guava is a set of core Java libraries from Google that includes new collection types
 (such as multimap and multiset), immutable collections, a graph library, and

android/guava-testlib/src/com/google/common/collect/testing/AbstractIteratorTester.java

@@ -31,6 +31,7 @@
 import java.util.Set;
 import java.util.Stack;
 import junit.framework.AssertionFailedError;
+import org.checkerframework.checker.nullness.qual.Nullable;
 
 /**
  * Most of the logic for {@link IteratorTester} and {@link ListIteratorTester}.
@@ -148,7 +149,7 @@ protected final class MultiExceptionListIterator implements ListIterator<E> {
      * this to determine which stack to pop from on a call to {@code remove()} (or to pop from and
      * push to on a call to {@code set()}).
      */
-    Stack<E> stackWithLastReturnedElementAtTop = null;
+    @Nullable Stack<E> stackWithLastReturnedElementAtTop = null;
 
     MultiExceptionListIterator(List<E> expectedElements) {
       Helpers.addAll(nextElements, Helpers.reverse(expectedElements));
@@ -363,7 +364,7 @@ private static List<Object> subListCopy(Object[] source, int size) {
   }
 
   private interface IteratorOperation {
-    Object execute(Iterator<?> iterator);
+    @Nullable Object execute(Iterator<?> iterator);
   }
 
   /**
@@ -449,7 +450,7 @@ private <T extends Iterator<E>> void internalExecuteAndCompare(
   private static final IteratorOperation REMOVE_METHOD =
       new IteratorOperation() {
         @Override
-        public Object execute(Iterator<?> iterator) {
+        public @Nullable Object execute(Iterator<?> iterator) {
           iterator.remove();
           return null;
         }
@@ -475,7 +476,7 @@ private final IteratorOperation newAddMethod() {
     final Object toInsert = elementsToInsert.next();
     return new IteratorOperation() {
       @Override
-      public Object execute(Iterator<?> iterator) {
+      public @Nullable Object execute(Iterator<?> iterator) {
         @SuppressWarnings("unchecked")
         ListIterator<Object> rawIterator = (ListIterator<Object>) iterator;
         rawIterator.add(toInsert);
@@ -488,7 +489,7 @@ private final IteratorOperation newSetMethod() {
     final E toInsert = elementsToInsert.next();
     return new IteratorOperation() {
       @Override
-      public Object execute(Iterator<?> iterator) {
+      public @Nullable Object execute(Iterator<?> iterator) {
         @SuppressWarnings("unchecked")
         ListIterator<E> li = (ListIterator<E>) iterator;
         li.set(toInsert);

android/guava-testlib/src/com/google/common/collect/testing/AbstractMapTester.java

@@ -23,6 +23,7 @@
 import java.util.ListIterator;
 import java.util.Map;
 import java.util.Map.Entry;
+import org.checkerframework.checker.nullness.qual.Nullable;
 import org.junit.Ignore;
 
 /**
@@ -167,7 +168,7 @@ protected void expectMissing(Entry<K, V>... entries) {
     }
   }
 
-  private static boolean equal(Object a, Object b) {
+  private static boolean equal(@Nullable Object a, @Nullable Object b) {
     return a == b || (a != null && a.equals(b));
   }
 

android/guava-testlib/src/com/google/common/collect/testing/AbstractTester.java

@@ -18,6 +18,7 @@
 
 import com.google.common.annotations.GwtCompatible;
 import junit.framework.TestCase;
+import org.checkerframework.checker.nullness.qual.Nullable;
 
 /**
  * This abstract base class for testers allows the framework to inject needed information after
@@ -34,8 +35,8 @@
 public class AbstractTester<G> extends TestCase {
   private G subjectGenerator;
   private String suiteName;
-  private Runnable setUp;
-  private Runnable tearDown;
+  private @Nullable Runnable setUp;
+  private @Nullable Runnable tearDown;
 
   // public so that it can be referenced in generated GWT tests.
   @Override
@@ -54,7 +55,8 @@ public void tearDown() throws Exception {
   }
 
   // public so that it can be referenced in generated GWT tests.
-  public final void init(G subjectGenerator, String suiteName, Runnable setUp, Runnable tearDown) {
+  public final void init(
+      G subjectGenerator, String suiteName, @Nullable Runnable setUp, @Nullable Runnable tearDown) {
     this.subjectGenerator = subjectGenerator;
     this.suiteName = suiteName;
     this.setUp = setUp;

android/guava-testlib/src/com/google/common/collect/testing/BaseComparable.java

@@ -18,6 +18,7 @@
 
 import com.google.common.annotations.GwtCompatible;
 import java.io.Serializable;
+import org.checkerframework.checker.nullness.qual.Nullable;
 
 /**
  * Simple base class to verify that we handle generics correctly.
@@ -38,7 +39,7 @@ public int hashCode() { // delegate to 's'
   }
 
   @Override
-  public boolean equals(Object other) {
+  public boolean equals(@Nullable Object other) {
     if (other == null) {
       return false;
     } else if (other instanceof BaseComparable) {

android/guava-testlib/src/com/google/common/collect/testing/FeatureSpecificTestSuiteBuilder.java

@@ -39,6 +39,7 @@
 import junit.framework.Test;
 import junit.framework.TestCase;
 import junit.framework.TestSuite;
+import org.checkerframework.checker.nullness.qual.Nullable;
 
 /**
  * Creates, based on your criteria, a JUnit test suite that exhaustively tests the object generated
@@ -62,7 +63,7 @@ protected B self() {
 
   // Test Data
 
-  private G subjectGenerator;
+  private @Nullable G subjectGenerator;
   // Gets run before every test.
   private Runnable setUp;
   // Gets run at the conclusion of every test.
@@ -125,7 +126,7 @@ public Set<Feature<?>> getFeatures() {
 
   // Name
 
-  private String name;
+  private @Nullable String name;
 
   /** Configures this builder produce a TestSuite with the given name. */
   @CanIgnoreReturnValue

android/guava-testlib/src/com/google/common/collect/testing/Helpers.java

@@ -40,11 +40,12 @@
 import java.util.Set;
 import junit.framework.Assert;
 import junit.framework.AssertionFailedError;
+import org.checkerframework.checker.nullness.qual.Nullable;
 
 @GwtCompatible(emulated = true)
 public class Helpers {
   // Clone of Objects.equal
-  static boolean equal(Object a, Object b) {
+  static boolean equal(@Nullable Object a, @Nullable Object b) {
     return a == b || (a != null && a.equals(b));
   }
 
@@ -253,7 +254,7 @@ static void fail(Throwable cause, Object message) {
   }
 
   public static <K, V> Comparator<Entry<K, V>> entryComparator(
-      Comparator<? super K> keyComparator) {
+      @Nullable Comparator<? super K> keyComparator) {
     return new Comparator<Entry<K, V>>() {
       @Override
       @SuppressWarnings("unchecked") // no less safe than putting it in the map!
@@ -384,7 +385,7 @@ public V setValue(V value) {
 
       @SuppressWarnings("unchecked")
       @Override
-      public boolean equals(Object o) {
+      public boolean equals(@Nullable Object o) {
         if (o instanceof Entry) {
           Entry<K, V> e = (Entry<K, V>) o;
           e.setValue(value); // muhahaha!
@@ -462,7 +463,7 @@ protected NullsBefore(String justAfterNull) {
     }
 
     @Override
-    public int compare(String lhs, String rhs) {
+    public int compare(@Nullable String lhs, @Nullable String rhs) {
       if (lhs == rhs) {
         return 0;
       }
@@ -486,7 +487,7 @@ public int compare(String lhs, String rhs) {
     }
 
     @Override
-    public boolean equals(Object obj) {
+    public boolean equals(@Nullable Object obj) {
       if (obj instanceof NullsBefore) {
         NullsBefore other = (NullsBefore) obj;
         return justAfterNull.equals(other.justAfterNull);

android/guava-testlib/src/com/google/common/collect/testing/MinimalIterable.java

@@ -20,6 +20,7 @@
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Iterator;
+import org.checkerframework.checker.nullness.qual.Nullable;
 
 /**
  * An implementation of {@code Iterable} which throws an exception on all invocations of the {@link
@@ -63,7 +64,7 @@ public static <E> MinimalIterable<E> from(Collection<E> elements) {
     return (MinimalIterable) of(elements.toArray());
   }
 
-  private Iterator<E> iterator;
+  private @Nullable Iterator<E> iterator;
 
   private MinimalIterable(Iterator<E> iterator) {
     this.iterator = iterator;

android/guava-testlib/src/com/google/common/collect/testing/MinimalSet.java

@@ -22,6 +22,7 @@
 import java.util.Collection;
 import java.util.List;
 import java.util.Set;
+import org.checkerframework.checker.nullness.qual.Nullable;
 
 /**
  * A simplistic set which implements the bare minimum so that it can be used in tests without
@@ -63,7 +64,7 @@ private MinimalSet(Class<? super E> type, E... contents) {
    */
 
   @Override
-  public boolean equals(Object object) {
+  public boolean equals(@Nullable Object object) {
     if (object instanceof Set) {
       Set<?> that = (Set<?>) object;
       return (this.size() == that.size()) && this.containsAll(that);