[CALCITE-7736] Replace the Checker Framework with NullAway and JSpecify

.editorconfig

@@ -20,9 +20,6 @@ ij_java_use_single_class_imports = true
 max_line_length = 100
 ij_any_wrap_long_lines = true
 
-[*.astub]
-indent_size = 2
-
 [*.java]
 # Doc: https://youtrack.jetbrains.com/issue/IDEA-170643#focus=streamItem-27-3708697.0-0
 # $ means "static"

.github/pull_request_template.md

@@ -0,0 +1,43 @@
+<!--
+Thanks for sending a pull request! Here are some critical tips for you:
+
+1. READ THE GUIDE FIRST: https://calcite.apache.org/develop/#contributing
+   *For significant contributions, please discuss on the dev mailing list or Jira BEFORE coding.*
+
+2. JIRA IS USUALLY MANDATORY: Ensure you have created an issue on the Calcite Jira:
+   https://issues.apache.org/jira/projects/CALCITE/issues
+   *Check existing issues first to avoid duplicates.*
+   *Note: A Jira is NOT required for typos and cosmetic changes (i.e., changes that are neither bugs nor features).*
+
+3. TIMING: Strongly recommended to create the Jira BEFORE you start writing code (e.g., a day or so before posting a PR).
+   This gives others a chance to weigh in on your specification.
+
+4. CRITICAL CONSISTENCY RULE
+   The following three items MUST match exactly in wording and meaning:
+   (A) The Jira Issue Title
+   (B) This Pull Request Title
+   (C) Your Git Commit Message
+
+   Format: [CALCITE-XXXX] <Description>
+   Example: [CALCITE-0000] Add IF NOT EXISTS clause to CREATE TABLE
+
+   Guidelines for a good Title:
+   - Illustrate using SQL keywords (in ALL-CAPS) rather than Java method names.
+   - Focus on the specification and user experience, not the implementation.
+   - Make it clear whether it is a bug or a feature.
+   - Use words like "should" to indicate desired behavior vs. current behavior (e.g., "Validator should not close model file").
+
+5. REPRODUCTION: If fixing a bug, please provide a concise SQL example or test case to reproduce the issue for a faster review.
+
+6. TESTING: Ensure `./gradlew build` passes and appropriate tests are added/updated.
+-->
+
+## Jira Link
+
+[CALCITE-XXXX](https://issues.apache.org/jira/browse/CALCITE-XXXX)
+
+## Changes Proposed
+<!--
+Please clarify what changes you are proposing. The purpose of this section is to outline the changes and how this PR fixes the issue.
+If possible, please consider writing useful notes for better and faster reviews in your PR.
+-->

.github/workflows/gradle-dependency-submit.yaml

@@ -0,0 +1,31 @@
+name: Dependency Submission
+
+# See https://github.com/gradle/actions/blob/768a17f3488dc3fe0155ff431553e1f53d57e22e/dependency-submission/README.md#the-dependency-submission-action
+# The action allows GitHub to alert about reported vulnerabilities in the project
+on:
+  push:
+    branches:
+      - main
+
+# Declare default permissions as read-only.
+permissions: read-all
+
+jobs:
+  dependency-submission:
+    name: Submit dependencies
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      with:
+        persist-credentials: false
+    - name: Set up JDK 21
+      uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5
+      with:
+        distribution: zulu
+        java-version: 21
+        server-id: central
+    - name: Generate and submit dependency graph
+      uses: gradle/actions/dependency-submission@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5

.github/workflows/main.yml

@@ -71,12 +71,14 @@ jobs:
         remote-build-cache-proxy-enabled: false
         arguments: --scan --no-parallel --no-daemon build javadoc
     - name: 'sqlline and sqllsh'
+      env:
+        JAVA_OPTS: "-Dcalcite.model.classes.allowed=org.apache."
       shell: cmd
       run: |
         call sqlline.bat -e '!quit'
         echo.
         echo Sqlline example/csv
-        call example/csv/sqlline.bat --verbose -u jdbc:calcite:model=example/csv/src/test/resources/model.json -n admin -p admin -f example/csv/src/test/resources/smoke_test.sql
+        call sqlline.bat --verbose -u jdbc:calcite:model=example/csv/src/test/resources/model.json -n admin -p admin -f example/csv/src/test/resources/smoke_test.sql
         echo.
         echo sqlsh
         call sqlsh.bat -o headers "select count(*) commits, author from (select substring(author, 1, position(' <' in author)-1) author from git_commits) group by author order by count(*) desc, author limit 20"
@@ -101,12 +103,14 @@ jobs:
           remote-build-cache-proxy-enabled: false
           arguments: --scan --no-parallel --no-daemon build
       - name: 'sqlline and sqllsh'
+        env:
+          JAVA_OPTS: "-Dcalcite.model.classes.allowed=org.apache."
         shell: cmd
         run: |
           call sqlline.bat -e '!quit'
           echo.
           echo Sqlline example/csv
-          call example/csv/sqlline.bat --verbose -u jdbc:calcite:model=example/csv/src/test/resources/model.json -n admin -p admin -f example/csv/src/test/resources/smoke_test.sql
+          call sqlline.bat --verbose -u jdbc:calcite:model=example/csv/src/test/resources/model.json -n admin -p admin -f example/csv/src/test/resources/smoke_test.sql
           echo.
           echo sqlsh
           call sqlsh.bat -o headers "select count(*) commits, author from (select substring(author, 1, position(' <' in author)-1) author from git_commits) group by author order by count(*) desc, author limit 20"
@@ -131,12 +135,14 @@ jobs:
           remote-build-cache-proxy-enabled: false
           arguments: --scan --no-parallel --no-daemon build
       - name: 'sqlline and sqllsh'
+        env:
+          JAVA_OPTS: "-Dcalcite.model.classes.allowed=org.apache."
         shell: cmd
         run: |
           call sqlline.bat -e '!quit'
           echo.
           echo Sqlline example/csv
-          call example/csv/sqlline.bat --verbose -u jdbc:calcite:model=example/csv/src/test/resources/model.json -n admin -p admin -f example/csv/src/test/resources/smoke_test.sql
+          call sqlline.bat --verbose -u jdbc:calcite:model=example/csv/src/test/resources/model.json -n admin -p admin -f example/csv/src/test/resources/smoke_test.sql
           echo.
           echo sqlsh
           call sqlsh.bat -o headers "select count(*) commits, author from (select substring(author, 1, position(' <' in author)-1) author from git_commits) group by author order by count(*) desc, author limit 20"
@@ -247,18 +253,18 @@ jobs:
           remote-build-cache-proxy-enabled: false
           arguments: --scan --no-parallel --no-daemon -Pguava.version=${{ env.GUAVA }} build
 
-  linux-jdk23: # latest JDK version supported by ForbiddenAPIs plugin, keep this updated (see https://jdk.java.net/)
+  linux-jdk24: # latest JDK version supported by ForbiddenAPIs plugin, keep this updated (see https://jdk.java.net/)
     if: github.event.action != 'labeled'
-    name: 'Linux (JDK 23)'
+    name: 'Linux (JDK 24)'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
         with:
           fetch-depth: 50
-      - name: 'Set up JDK 23'
+      - name: 'Set up JDK 24'
         uses: actions/setup-java@v5
         with:
-          java-version: 23
+          java-version: 24
           distribution: 'zulu'
       - uses: burrunan/gradle-cache-action@v1
         name: Test
@@ -324,73 +330,40 @@ jobs:
           remote-build-cache-proxy-enabled: false
           arguments: --scan --no-parallel --no-daemon build javadoc
       - name: 'sqlline and sqllsh'
+        env:
+          JAVA_OPTS: "-Dcalcite.model.classes.allowed=org.apache."
         run: |
           ./sqlline -e '!quit'
           echo
           echo Sqlline example/csv
-          ./example/csv/sqlline --verbose -u jdbc:calcite:model=example/csv/src/test/resources/model.json -n admin -p admin -f example/csv/src/test/resources/smoke_test.sql
+          ./sqlline --verbose -u jdbc:calcite:model=example/csv/src/test/resources/model.json -n admin -p admin -f example/csv/src/test/resources/smoke_test.sql
           echo
           echo sqlsh
           ./sqlsh -o headers "select count(*) commits, author from (select substring(author, 1, position(' <' in author)-1) author from git_commits) group by author order by count(*) desc, author limit 20"
 
   errorprone-guava-latest:
     if: github.event.action != 'labeled'
-    name: 'ErrorProne (JDK 11, latest Guava)'
+    # This is the only job that verifies nullness, so a nullability problem fails here alone and
+    # the test jobs keep reporting test failures
+    name: 'ErrorProne and NullAway (JDK 21, latest Guava)'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
         with:
           fetch-depth: 50
-      - name: 'Set up JDK 11'
+      # Error Prone 2.43 and later require JDK 21, and NullAway requires JDK 17
+      - name: 'Set up JDK 21'
         uses: actions/setup-java@v5
         with:
-          java-version: 11
+          java-version: 21
           distribution: 'zulu'
       - uses: burrunan/gradle-cache-action@v1
         name: Test
         with:
           job-id: errprone
           remote-build-cache-proxy-enabled: false
           # ErrorProne checks for Beta APIs, so use the latest supported Guava version
-          arguments: --scan --no-parallel --no-daemon -Pguava.version=${{ env.GUAVA_MAX }} -PenableErrorprone classes
-
-  linux-checkerframework:
-    name: 'CheckerFramework (JDK 11)'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          fetch-depth: 50
-      - name: 'Set up JDK 11'
-        uses: actions/setup-java@v5
-        with:
-          java-version: 11
-          distribution: 'zulu'
-      - name: 'Run CheckerFramework'
-        uses: burrunan/gradle-cache-action@v1
-        with:
-          job-id: checkerframework-jdk11
-          remote-build-cache-proxy-enabled: false
-          arguments: --scan --no-parallel --no-daemon -PenableCheckerframework :linq4j:classes :core:classes :server:classes
-
-  linux-checkerframework-oldest-guava:
-    name: 'CheckerFramework (JDK 11, oldest Guava)'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          fetch-depth: 50
-      - name: 'Set up JDK 11'
-        uses: actions/setup-java@v5
-        with:
-          java-version: 11
-          distribution: 'zulu'
-      - name: 'Run CheckerFramework'
-        uses: burrunan/gradle-cache-action@v1
-        with:
-          job-id: checkerframework-jdk11
-          remote-build-cache-proxy-enabled: false
-          arguments: --scan --no-parallel --no-daemon -Pguava.version=${{ env.GUAVA_MIN }} -PenableCheckerframework :linq4j:classes :core:classes :server:classes
+          arguments: --scan --no-parallel --no-daemon -Pguava.version=${{ env.GUAVA_MAX }} -PenableErrorprone classes jmhClasses
 
   linux-slow:
     # Run slow tests when the commit is on main or it is requested explicitly by adding an

.github/workflows/publish-non-release-website-updates.yml

@@ -35,15 +35,26 @@ jobs:
         with:
           fetch-depth: 0
           ref: site
-      - name: Cherry pick the commit to site
+      - name: Cherry pick all commits in push to site
+        env:
+          COMMITS: ${{ toJson(github.event.commits) }}
         run: |
           git config user.email ${{ github.actor }}@users.noreply.github.com
           git config user.name ${{ github.actor }}
-          git cherry-pick --strategy=recursive -X theirs $GITHUB_SHA
-          if [ $? -neq 0 ]; then
-            git status | sed -n 's/deleted by us://p' | xargs git add
-            git cherry-pick --continue --no-edit
-          fi
+
+          # Extract each commit SHA from the push payload and iterate chronologically
+          echo "$COMMITS" | jq -r '.[].id' | while read -r commit_sha; do
+            echo "----------------------------------------"
+            echo "Cherry-picking commit: $commit_sha"
+            echo "----------------------------------------"
+
+            if ! git cherry-pick --strategy=recursive -X theirs "$commit_sha"; then
+              echo "Handling cherry-pick conflict..."
+              git status | sed -n 's/deleted by us://p' | xargs -r git add
+              git cherry-pick --continue --no-edit
+            fi
+          done
+
           git push origin site
 
   publish-website:

.gitignore

@@ -16,26 +16,18 @@
 *~
 .DS_Store
 .gradle
-/target
-/*/target
-/example/*/target
-/build
-/*/build
-/example/*/build
-/buildSrc/build
-/buildSrc/subprojects/*/build
+/**/target
+/**/build
 /site/.jekyll-cache
 
-# VSCode Java plugin
-/example/*/bin
-/*/bin
-/bin
-/.vscode/*
+# VSCode and plugins
+/**/bin
+.vscode
+.metals
 
 # IDEA
-/out
-/*/out/
-/example/*/out
+/**/out
+/**/generated
 # The star is required for further !/.idea/ to work, see https://git-scm.com/docs/gitignore
 /.idea/*
 # Icon for JetBrains Toolbox