Add Swedish translation for admin messages

Adds messages_sv.properties to provide Swedish translations for all admin interface messages including password validation, LDAP errors, client URL validation, and error messages.

Closes #45281

Signed-off-by: Rickard Otvos <rickard.0413@gmail.com>

.editorconfig

@@ -10,3 +10,4 @@ insert_final_newline = true
 ij_java_use_single_class_imports = true
 ij_java_class_count_to_use_import_on_demand = 999
 ij_java_names_count_to_use_import_on_demand = 999
+ij_java_imports_layout = java.**,javax.**,|,jakarta.**,|,org.keycloak.**,|,*,|,$jakarta.**,$java.**,javax.**,|,$org.keycloak.**,|,$*

.github/CODEOWNERS

@@ -2,7 +2,7 @@
 # Overview
 #
 # Pattern used to match files follows most of the same rules as used in gitignore files. Order is
-# important; the last matching pattern takes precendence.
+# important; the last matching pattern takes precedence.
 #
 # For more info see:
 # https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
@@ -40,13 +40,24 @@
 /docs/guides/server/                                        @keycloak/cloud-native-maintainers @keycloak/maintainers
 /docs/guides/operator/                                      @keycloak/cloud-native-maintainers @keycloak/maintainers
 /integration/client-cli/admin-cli/                          @keycloak/cloud-native-maintainers @keycloak/maintainers
+/rest/admin-v2/                                             @keycloak/cloud-native-maintainers @keycloak/maintainers
 
 ###################################################################################################
 # UI (@keycloak/ui-maintainers)
 ###################################################################################################
 
 /themes/                                                    @keycloak/ui-maintainers @keycloak/maintainers
-/js/                                                        @keycloak/ui-maintainers
+/js/                                                        @keycloak/ui-maintainers @keycloak/maintainers
-/js/**/maven-resources-community/**/messages_*.properties   @keycloak/ui-maintainers @keycloak/maintainers
+/js/**/messages_*.properties                                @keycloak/ui-maintainers @keycloak/maintainers
-/adapters/oidc/js/                                          @keycloak/ui-maintainers
+/adapters/oidc/js/                                          @keycloak/ui-maintainers @keycloak/maintainers
-/rest/admin-ui-ext/                                         @keycloak/ui-maintainers
+/rest/admin-ui-ext/                                         @keycloak/ui-maintainers @keycloak/maintainers
+
+###################################################################################################
+# SRE (@keycloak/sre-maintainers)
+###################################################################################################
+
+/model/infinispan/                                          @keycloak/sre-maintainers @keycloak/maintainers
+/tests/clustering/                                          @keycloak/sre-maintainers @keycloak/maintainers
+/test-framework/clustering/                                 @keycloak/sre-maintainers @keycloak/maintainers
+/docs/guides/high-availability/                             @keycloak/sre-maintainers @keycloak/maintainers
+/docs/guides/observability/                                 @keycloak/sre-maintainers @keycloak/maintainers

.github/ISSUE_TEMPLATE/bug.yml

@@ -1,6 +1,7 @@
 name: Bug Report
 description: Report a non-security sensitive bug in Keycloak
 labels: ["kind/bug", "status/triage"]
+type: bug
 body:
   - type: checkboxes
     attributes:
@@ -48,6 +49,7 @@ body:
         - infinispan
         - ldap
         - login/ui
+        - observability
         - oidc
         - oid4vc
         - operator

.github/ISSUE_TEMPLATE/enhancement.yml

@@ -1,12 +1,34 @@
 name: Enhancement Request
 description: Request an enhancement to an existing feature
 labels: ["kind/enhancement", "status/triage"]
+type: enhancement
 body:
   - type: textarea
     id: description
     attributes:
       label: Description
-      description: Describe the enhancement at a high-level.
+      description: Describe the enhancement at a high-level
+    validations:
+      required: true
+  - type: textarea
+    id: value_proposition
+    attributes:
+      label: Value Proposition
+      description: Describe what value the enhancement brings
+    validations:
+      required: true
+  - type: textarea
+    id: goals
+    attributes:
+      label: Goals
+      description: Describe what the enhancement should provide
+    validations:
+      required: true
+  - type: textarea
+    id: non_goals
+    attributes:
+      label: Non-Goals
+      description: Describe what the enhancement should not provide, or is out of scope
     validations:
       required: true
   - type: input
@@ -16,20 +38,13 @@ body:
       description: |
         If there has been a discussion around the enhancement, provide a link to the discussion.
 
-        Please note that larger enhancements should be discussed through [GitHub Discussion](https://github.com/keycloak/keycloak/discussions/categories/ideas).
+        Please note that all, except small requests, should be discussed through [GitHub Discussion](https://github.com/keycloak/keycloak/discussions/categories/ideas).
     validations:
       required: false
   - type: textarea
-    id: motivation
+    id: notes
     attributes:
-      label: Motivation
+      label: Notes
-      description: Describe why the feature should be added.
+      description: Design ideas? Implementation ideas? Anything that will give us more context about the enhancement you are proposing!
-    validations:
-      required: false
-  - type: textarea
-    id: details
-    attributes:
-      label: Details
-      description: More details? Implementation ideas? Anything that will give us more context about the enhancement you are proposing!
     validations:
       required: false

.github/ISSUE_TEMPLATE/epic.yml

@@ -1,36 +0,0 @@
-name: Epic
-description: A large feature that is broken down into multiple linked issues.
-labels: ["kind/epic", "status/triage"]
-body:
-  - type: textarea
-    id: description
-    attributes:
-      label: Description
-      description: Describe the feature at a high-level.
-    validations:
-      required: true
-  - type: input
-    id: discussion
-    attributes:
-      label: Discussion
-      description: |
-        Provide a link to the GitHub Discussion for the feature.
-    validations:
-      required: true
-  - type: textarea
-    id: issues
-    attributes:
-      label: Issues
-      description: List the issues related to this epic.
-      placeholder: |
-        - #1
-        - #2
-    validations:
-      required: false
-  - type: textarea
-    id: motivation
-    attributes:
-      label: Motivation
-      description: Provide a brief explanation of why the feature should be added.
-    validations:
-      required: false

.github/ISSUE_TEMPLATE/feature.yml

@@ -1,12 +1,34 @@
 name: Feature Request
 description: Request a new feature to be added to Keycloak
 labels: ["kind/feature", "status/triage"]
+type: feature
 body:
   - type: textarea
     id: description
     attributes:
       label: Description
-      description: Describe the feature at a high-level.
+      description: Describe the feature at a high-level
+    validations:
+      required: true
+  - type: textarea
+    id: value_proposition
+    attributes:
+      label: Value Proposition
+      description: Describe what value the feature brings
+    validations:
+      required: true
+  - type: textarea
+    id: goals
+    attributes:
+      label: Goals
+      description: Describe what capabilities the feature should provide
+    validations:
+      required: true
+  - type: textarea
+    id: non_goals
+    attributes:
+      label: Non-Goals
+      description: Describe capabilities the feature should not provide, or is out of scope
     validations:
       required: true
   - type: input
@@ -20,16 +42,9 @@ body:
     validations:
       required: false
   - type: textarea
-    id: motivation
+    id: notes
     attributes:
-      label: Motivation
+      label: Notes
-      description: Describe why the feature should be added.
-    validations:
-      required: false
-  - type: textarea
-    id: details
-    attributes:
-      label: Details
       description: Design ideas? Implementation ideas? Anything that will give us more context about the feature you are proposing!
     validations:
       required: false

.github/ISSUE_TEMPLATE/milestone.yml

@@ -0,0 +1,33 @@
+name: Milestone
+description: Milestones are used to break up larger features
+labels: ["kind/milestone", "status/triage"]
+type: milestone
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: Describe the milestone at a high-level
+    validations:
+      required: true
+  - type: textarea
+    id: goals
+    attributes:
+      label: Goals
+      description: Describe what capabilities the milestone should provide
+    validations:
+      required: true
+  - type: textarea
+    id: non_goals
+    attributes:
+      label: Non-Goals
+      description: Describe capabilities the milestone should not provide, or is out of scope
+    validations:
+      required: true
+  - type: textarea
+    id: notes
+    attributes:
+      label: Notes
+      description: Design ideas? Implementation ideas? Anything that will give us more about the milestone
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/task.yml

@@ -1,6 +1,7 @@
 name: Task
 description: Any tasks that are not directly adding a new feature, enhancement or fixing a bug
 labels: ["kind/task"]
+type: task
 body:
   - type: textarea
     id: description

.github/actions/archive-surefire-reports/action.yml

@@ -1,46 +0,0 @@
-name: Archive Surefire reports
-description: It will upload and archive surefire reports per particular test run.
-inputs:
-  job-id:
-    description: 'Id of the particular job run.'
-    required: true
-  release-branches:
-    description: 'List of all related release branches (in JSON format)'
-    required: false
-    default: '["refs/heads/release/22.0","refs/heads/release/24.0","refs/heads/release/26.0"]'
-  keep-days:
-    description: 'For how many days to store the particular artifact.'
-    required: false
-    default: 1
-
-runs:
-  using: composite
-  steps:
-    - id: find-surefire-reports-linux
-      name: Find Surefire reports directories
-      if: runner.os == 'Linux'
-      shell: bash
-      run: |
-        echo "dirs<<EOF" >> $GITHUB_OUTPUT
-        echo "$(find ~+ -type d -not -empty -name surefire-reports*)" >> $GITHUB_OUTPUT 
-        echo "EOF" >> $GITHUB_OUTPUT
-
-    - id: find-surefire-reports-win
-      name: Find Surefire reports directories
-      if: runner.os == 'Windows'
-      shell: bash
-      run: |
-        echo "dirs<<EOF" >> $GITHUB_OUTPUT
-        echo "$(find ~+ -type d -not -empty -name surefire-reports* | sed 's@/d@D:@')" >> $GITHUB_OUTPUT
-        echo "EOF" >> $GITHUB_OUTPUT
-
-    - id: upload-surefire-linux
-      name: Upload Surefire reports
-      if: (!cancelled() && contains(fromJSON(inputs.release-branches), github.ref) && contains(fromJSON('["push", "workflow_dispatch"]'), github.event_name))
-      uses: actions/upload-artifact@v4
-      with:
-        name: surefire-${{ inputs.job-id }}
-        path: |
-          ${{ steps.find-surefire-reports-linux.outputs.dirs }}
-          ${{ steps.find-surefire-reports-win.outputs.dirs }}
-        retention-days: ${{ inputs.keep-days }}

.github/actions/azure-create-database/action.yml

@@ -0,0 +1,102 @@
+name: Create Azure SQL Database
+description: Create Azure SQL Database
+
+inputs:
+  name:
+    description: 'The name prefix for the Azure SQL resources'
+    required: true
+  region:
+    description: 'The Azure region used to host the SQL server'
+    required: true
+  admin-user:
+    description: 'The admin username for the SQL server'
+    required: false
+    default: 'sqladmin'
+  db-user:
+    description: 'The db username for the Keycloak DB'
+    required: false
+    default: 'keycloak'
+  admin-password:
+    description: 'Override admin password (auto-generated if not provided)'
+    required: false
+  db-password:
+    description: 'Override DB password (auto-generated if not provided)'
+    required: false
+  subscription:
+    description: 'Azure subscription ID'
+    required: true
+
+outputs:
+  endpoint:
+    description: 'The Endpoint URL for SQL clients to connect to'
+    value: ${{ steps.create.outputs.endpoint }}
+  db:
+    description: 'Database name'
+    value: ${{ steps.create.outputs.db }}
+  username:
+    description: 'DB user principal'
+    value: ${{ steps.create.outputs.username }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Generate secure passwords
+      id: generate-passwords
+      shell: bash
+      run: |
+        # Generate passwords using OpenSSL
+        generate_password() {
+          openssl rand -base64 48 | tr -d '\n/' | head -c 32
+        }
+        
+        # Use provided passwords or generate random ones
+        if [[ -n "${{ inputs.admin-password }}" ]]; then
+          ADMIN_PASSWORD="${{ inputs.admin-password }}"
+          echo "INFO: Using provided admin password"
+        else
+          ADMIN_PASSWORD=$(generate_password)
+          echo "INFO: Using generated admin password"
+        fi
+        
+        if [[ -n "${{ inputs.db-password }}" ]]; then
+          DB_PASSWORD="${{ inputs.db-password }}"
+          echo "INFO: Using provided DB password"
+        else
+          DB_PASSWORD=$(generate_password)
+          echo "INFO: Using generated DB password"
+        fi
+        
+        # Mask passwords
+        echo "::add-mask::$ADMIN_PASSWORD"
+        echo "::add-mask::$DB_PASSWORD"
+        
+        # Export to environment for subsequent steps
+        {
+          echo "AZURE_ADMIN_PASSWORD=$ADMIN_PASSWORD"
+          echo "AZURE_DB_PASSWORD=$DB_PASSWORD"
+        } >> $GITHUB_ENV
+    
+    - name: Install sqlcmd (mssql-tools)
+      shell: bash
+      run: |
+        sudo apt-get update
+        sudo ACCEPT_EULA=Y apt-get install -y curl apt-transport-https gnupg
+        curl https://packages.microsoft.com/keys/microsoft.asc | sudo apt-key add -
+        curl https://packages.microsoft.com/config/ubuntu/22.04/prod.list | sudo tee /etc/apt/sources.list.d/msprod.list
+        sudo apt-get update
+        sudo ACCEPT_EULA=Y apt-get install -y mssql-tools unixodbc-dev
+        echo "/opt/mssql-tools/bin" >> $GITHUB_PATH
+
+    - id: create
+      shell: bash
+      run: |
+        ./azure_create_sql.sh
+      working-directory: .github/scripts/azure/sql
+      env:
+        AZURE_NAME: ${{ inputs.name }}
+        AZURE_REGION: ${{ inputs.region }}
+        AZURE_SUBSCRIPTION: ${{ inputs.subscription }}
+        AZURE_ADMIN_PASSWORD: ${{ env.AZURE_ADMIN_PASSWORD }}
+        AZURE_ADMIN_USER: ${{ inputs.admin-user }}
+        AZURE_DB_PASSWORD: ${{ env.AZURE_DB_PASSWORD }}
+        AZURE_DB_USER: ${{ inputs.db-user }}

.github/actions/build-keycloak/action.yml

@@ -49,7 +49,7 @@ runs:
     - id: upload-keycloak-maven-repository
       name: Upload Keycloak Maven artifacts
       if: inputs.upload-m2-repo == 'true'
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: m2-keycloak.tzts
         path: m2-keycloak.tzts
@@ -58,7 +58,7 @@ runs:
     - id: upload-keycloak-dist
       name: Upload Keycloak dist
       if: inputs.upload-dist == 'true'
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: keycloak-dist
         path: quarkus/dist/target/keycloak*.tar.gz

.github/actions/conditional/action.yml

@@ -34,6 +34,9 @@ outputs:
   codeql-javascript:
     description: Should "codeql-analysis.yml / javascript" execute
     value: ${{ steps.changes.outputs.codeql-javascript }}
+  codeql-actions:
+    description: Should "codeql-analysis.yml / GitHub Actions" execute
+    value: ${{ steps.changes.outputs.codeql-actions }}
   codeql-typescript:
     description: Should "codeql-analysis.yml / typescript" execute
     value: ${{ steps.changes.outputs.codeql-typescript }}
@@ -46,6 +49,9 @@ outputs:
   sssd:
     description: Should "sssd.yml" execute
     value: ${{ steps.changes.outputs.sssd }}
+  admin-v2:
+    description: Should Admin v2 tests execute
+    value: ${{ steps.changes.outputs.admin-v2 }}
 
 runs:
   using: composite

.github/actions/conditional/conditions

@@ -3,6 +3,7 @@
 # To test a pattern run '.github/actions/conditional/conditional.sh <remote name> <branch>'
 
 .github/actions/                            ci ci-quarkus ci-store ci-sssd operator js codeql-java codeql-javascript codeql-typescript guides documentation
+.github/fake_fips/                          ci
 .github/scripts/                            ci ci-quarkus ci-sssd
 .github/scripts/ansible/                    ci-store
 .github/scripts/aws/                        ci-store
@@ -10,9 +11,13 @@
 .github/workflows/ci.yml                    ci ci-quarkus ci-store ci-sssd ci-webauthn
 .github/workflows/operator-ci.yml           operator
 .github/workflows/js-ci.yml                 js
-.github/workflows/codeql-analysis.yml       codeql-java codeql-javascript codeql-typescript
+.github/workflows/codeql-analysis.yml       codeql-java codeql-javascript codeql-typescript codeql-actions
+.github/codeql/codeql-config-javascript.yml codeql-javascript
+.github/codeql/codeql-config-typescript.yml codeql-typescript
 .github/workflows/guides.yml                guides
 .github/workflows/documentation.yml         documentation
+.github/workflows/*.yml                     codeql-actions
+.github/actions/**/*.yml                    codeql-actions
 
 .mvn/                                       ci ci-quarkus ci-store ci-sssd ci-webauthn operator js codeql-java codeql-javascript codeql-typescript guides documentation
 mvnw                                        ci ci-quarkus ci-store ci-sssd ci-webauthn operator js codeql-java codeql-javascript codeql-typescript guides documentation
@@ -35,6 +40,7 @@ docs/documentation/                         documentation
 js/                                         js
 rest/admin-ui-ext/                          js
 services/                                   js
+themes/                                     js
 js/apps/account-ui/                         ci ci-webauthn
 js/libs/ui-shared/                          ci ci-webauthn
 
@@ -53,3 +59,5 @@ js/libs/ui-shared/                          ci ci-webauthn
 *.tsx                                       codeql-typescript
 
 testsuite::database-suite                   ci-store
+
+rest/admin-v2/                              admin-v2

.github/actions/corepack-setup/action.yml

@@ -0,0 +1,36 @@
+name: Setup Corepack
+description: Sets up and caches the Corepack tools to speed up the build.
+
+runs:
+  using: composite
+  steps:
+    - name: Enable Corepack
+      shell: bash
+      run: corepack enable
+
+    - id: cache-key
+      name: Generate key for tools cache
+      shell: bash
+      working-directory: js
+      run: echo "key=corepack-tools-$(jq -r '.packageManager' package.json)" >> $GITHUB_OUTPUT
+
+    - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+      id: cache
+      name: Cache Corepack tools
+      with:
+        # See: https://github.com/nodejs/corepack?tab=readme-ov-file#offline-workflow
+        path: ./js/corepack.tgz
+        key: ${{ runner.os }}-${{ steps.cache-key.outputs.key }}
+
+    - name: Install Corepack tools from cache
+      if: steps.cache.outputs.cache-hit == 'true'
+      shell: bash
+      working-directory: js
+      run: corepack install -g --cache-only ./corepack.tgz
+
+    - name: Package Corepack tools
+      if: steps.cache.outputs.cache-hit != 'true'
+      shell: bash
+      working-directory: js
+      run: corepack pack
+

.github/actions/install-chrome/action.yml

@@ -3,17 +3,17 @@ description: Download and install the compatible Chrome and Chromedriver
 
 inputs:
   version:
-    description: The version of Chrome and Chromedriver to install.
+    description: The version of Chrome and Chromedriver to install. By default none is installed.
     required: false
-    default: 134.0.6998.165 # Ensures compatibility with the testsuite
+    default: default # E.g. 135.0.7049.84 (fixed version), default (chrome provided by GHA box)
 
 runs:
   using: composite
   steps:
 
-    # Cannot use Chrome for Testing. Acts weirdly and would probably require some changes in the testsuite.
     - id: install-chrome
       name: Install Chrome
+      if: inputs.version != 'default'
       shell: bash
       run: |
         sudo apt-get remove google-chrome-stable
@@ -22,9 +22,18 @@ runs:
 
     - id: install-chromedriver
       name: Install Chromedriver
+      if: inputs.version != 'default'
       shell: bash
       run: |
         wget https://storage.googleapis.com/chrome-for-testing-public/${{ inputs.version }}/linux64/chromedriver-linux64.zip -O /tmp/chromedriver.zip --no-verbose
         unzip -j /tmp/chromedriver.zip -d /tmp
         sudo mv -f /tmp/chromedriver $CHROMEWEBDRIVER/chromedriver
         sudo chmod +x $CHROMEWEBDRIVER/chromedriver
+
+    - id: show-version
+      name: Show Version
+      if: inputs.version == 'default'
+      shell: bash
+      run: |
+        google-chrome --version
+        $CHROMEWEBDRIVER/chromedriver --version

.github/actions/integration-test-setup/action.yml

@@ -14,6 +14,10 @@ inputs:
 runs:
   using: composite
   steps:
+    - id: update-hosts
+      name: Update /etc/hosts
+      uses: ./.github/actions/update-hosts
+
     - id: setup-java
       name: Setup Java
       uses: ./.github/actions/java-setup
@@ -31,7 +35,7 @@ runs:
 
     - id: download-keycloak
       name: Download Keycloak Maven artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         name: m2-keycloak.tzts
 

.github/actions/java-setup/action.yml

@@ -16,7 +16,7 @@ runs:
   steps:
     - id: setup-java
       name: Setup Java
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
       with:
         distribution: ${{ inputs.distribution }}
         java-version: ${{ inputs.java-version }}

.github/actions/maven-cache/action.yml

@@ -3,7 +3,7 @@ description: Caches Maven artifacts
 
 inputs:
   create-cache-if-it-doesnt-exist:
-    description: > 
+    description: >
       Only those callers which fill the cache with the right contents should set this to true to avoid creating a cache
       which contains too few or too many entries.
     required: false
@@ -19,41 +19,46 @@ runs:
 
     - id: cache-maven-repository
       name: Maven cache
-      uses: actions/cache@v4
+      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       if: inputs.create-cache-if-it-doesnt-exist == 'true'
       with:
         # Two asterisks are needed to make the follow-up exclusion work
         # see https://github.com/actions/toolkit/issues/713 for the upstream issue
+        #
+        # Hybrid cache strategy: Use an OS-specific key for writing, but allow fallback to a cross-OS cache for reading.
         path: |
           ~/.m2/repository/*/*
           !~/.m2/repository/org/keycloak
-        key: ${{ steps.weekly-cache-key.outputs.key }}
+        key: mvn-${{ runner.os }}-${{ steps.weekly-cache-key.outputs.key }}
+        restore-keys: |
+          mvn--${{ steps.weekly-cache-key.outputs.key }}
         # Enable cross-os archive use the cache on both Linux and Windows
         enableCrossOsArchive: true
 
-    - shell: powershell
-      name: Link the cached Maven repository to the OS-dependent location
-      if: inputs.create-cache-if-it-doesnt-exist == 'false' && runner.os == 'Windows'
-      # The cache restore in the next step uses the relative path which was valid on Linux and that is part of the archive it downloads.
-      # You'll see that path when you enable debugging for the GitHub workflow on Windows.
-      # On Windows, the .m2 folder is in different location, so move all the contents to the right folder here.
-      # Also, not using the C: drive will speed up the build, see https://github.com/actions/runner-images/issues/8755
-      run: |
-        mkdir -p ../../../.m2/repository
-        cmd /c mklink /d $HOME\.m2\repository D:\.m2\repository
-
     - id: restore-maven-repository
       name: Maven cache
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       if: inputs.create-cache-if-it-doesnt-exist == 'false'
       with:
         # This needs to repeat the same path pattern as above to find the matching cache
+        # Hybrid cache strategy used again
         path: |
           ~/.m2/repository/*/*
           !~/.m2/repository/org/keycloak
-        key: ${{ steps.weekly-cache-key.outputs.key }}
+        key: mvn-${{ runner.os }}-${{ steps.weekly-cache-key.outputs.key }}
+        restore-keys: |
+          mvn--${{ steps.weekly-cache-key.outputs.key }}
         enableCrossOsArchive: true
 
+    - shell: bash
+      name: Copy restored maven repo to home folder in Windows
+      if: (steps.cache-maven-repository.outputs.cache-hit == 'true' || steps.restore-maven-repository.outputs.cache-hit == 'true') && runner.os == 'Windows'
+      run: |
+        if [ -d ../../../.m2/repository ]; then
+          cp -r ../../../.m2/repository ~/.m2
+          rm -r ../../../.m2/repository
+        fi
+
     - id: node-cache
       name: Node cache
       uses: ./.github/actions/node-cache

.github/actions/node-cache/action.yml

@@ -12,7 +12,7 @@ runs:
         echo "pnpm=$(cat js/pom.xml | grep '<pnpm.version>' | cut -d '>' -f 2 | cut -d '<' -f 1 | cut -c 1-)" >> $GITHUB_OUTPUT
 
     # Downloading Node.js often fails due to network issues, therefore we cache the artifacts downloaded by the frontend plugin.
-    - uses: actions/cache@v4
+    - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       id: cache-binaries
       name: Cache Node.js and PNPM binaries
       with:

.github/actions/pnpm-setup/action.yml

@@ -5,20 +5,19 @@ inputs:
   node-version:
     description: Node.js version
     required: false
-    default: "22"
+    default: "24"
 
 runs:
   using: composite
   steps:
     - name: Set up Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version: ${{ inputs.node-version }}
         check-latest: true
 
-    - name: Enable Corepack
+    - name: Setup Corepack
-      shell: bash
+      uses: ./.github/actions/corepack-setup
-      run: corepack enable
 
     - name: PNPM store cache
       uses: ./.github/actions/pnpm-store-cache

.github/actions/pnpm-store-cache/action.yml

@@ -9,7 +9,7 @@ runs:
       shell: bash
       run: echo "key=pnpm-store-`date -u "+%Y-%U"`" >> $GITHUB_OUTPUT
 
-    - uses: actions/cache@v4
+    - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       name: Cache PNPM store
       with:
         # See: https://pnpm.io/npmrc#store-dir

.github/actions/prunsrv-setup/action.yml

@@ -0,0 +1,81 @@
+name: Setup Apache Commons Daemon (Procrun)
+description: Download and cache Apache Commons Daemon prunsrv.exe for Windows service tests
+
+inputs:
+  version:
+    description: Apache Commons Daemon version (leave empty for latest)
+    required: false
+    default: ""
+
+outputs:
+  prunsrv-path:
+    description: Path to the prunsrv.exe executable
+    value: ${{ steps.setup.outputs.prunsrv-path }}
+  version:
+    description: The resolved Apache Commons Daemon version
+    value: ${{ steps.resolve-version.outputs.version }}
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve latest version
+      id: resolve-version
+      shell: pwsh
+      run: |
+        $inputVersion = "${{ inputs.version }}"
+        if ([string]::IsNullOrWhiteSpace($inputVersion)) {
+          Write-Host "No version specified, detecting latest version from Apache downloads..."
+          $indexUrl = "https://downloads.apache.org/commons/daemon/binaries/windows/"
+          $response = Invoke-WebRequest -Uri $indexUrl -UseBasicParsing
+          # Parse the HTML to find the zip file and extract version
+          $match = [regex]::Match($response.Content, 'commons-daemon-(\d+\.\d+\.\d+)-bin-windows\.zip')
+          if ($match.Success) {
+            $version = $match.Groups[1].Value
+            Write-Host "Detected latest version: $version"
+          } else {
+            Write-Error "Could not detect latest version from Apache downloads page"
+            exit 1
+          }
+        } else {
+          $version = $inputVersion
+          Write-Host "Using specified version: $version"
+        }
+        echo "version=$version" >> $env:GITHUB_OUTPUT
+
+    - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+      id: cache
+      name: Cache Apache Commons Daemon
+      with:
+        path: ${{ runner.temp }}/commons-daemon
+        key: commons-daemon-${{ steps.resolve-version.outputs.version }}-windows-amd64
+
+    - name: Download Apache Commons Daemon
+      if: steps.cache.outputs.cache-hit != 'true'
+      shell: pwsh
+      run: |
+        $version = "${{ steps.resolve-version.outputs.version }}"
+        $downloadUrl = "https://downloads.apache.org/commons/daemon/binaries/windows/commons-daemon-${version}-bin-windows.zip"
+        $zipPath = Join-Path "${{ runner.temp }}" "commons-daemon.zip"
+        $extractPath = Join-Path "${{ runner.temp }}" "commons-daemon"
+
+        Write-Host "Downloading Apache Commons Daemon $version from $downloadUrl"
+        Invoke-WebRequest -Uri $downloadUrl -OutFile $zipPath -UseBasicParsing
+
+        Write-Host "Extracting to $extractPath"
+        Expand-Archive -Path $zipPath -DestinationPath $extractPath -Force
+        Remove-Item $zipPath -Force
+
+    - name: Setup environment
+      id: setup
+      shell: pwsh
+      run: |
+        $prunsrvPath = "${{ runner.temp }}/commons-daemon/amd64/prunsrv.exe"
+
+        if (-not (Test-Path $prunsrvPath)) {
+          Write-Error "prunsrv.exe not found at $prunsrvPath"
+          exit 1
+        }
+
+        Write-Host "Apache Commons Daemon prunsrv.exe found at: $prunsrvPath"
+        echo "COMMONS_DAEMON_HOME=${{ runner.temp }}/commons-daemon/amd64" >> $env:GITHUB_ENV
+        echo "prunsrv-path=$prunsrvPath" >> $env:GITHUB_OUTPUT

.github/actions/run-store-tests/action.yml

@@ -0,0 +1,85 @@
+name: Store IT
+description: Run Store integration tests
+
+inputs:
+  db:
+    description: The database to use for tests
+    required: true
+
+runs:
+  using: composite
+  steps:
+
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+    - id: integration-test-setup
+      name: Integration test setup
+      uses: ./.github/actions/integration-test-setup
+
+    - name: Run new base tests
+      shell: bash
+      run: |
+        KC_TEST_DATABASE=${{ inputs.db }} KC_TEST_DATABASE_REUSE=true TESTCONTAINERS_REUSE_ENABLE=true ./mvnw package -f tests/pom.xml -Dtest=DatabaseTestSuite -Dkeycloak.distribution.start.timeout=360
+
+    - name: Database container port
+      shell: bash
+      run: |
+        # The Ryuk container process exists temporarily after the JVM terminates, wait for only the database container to remain
+        while [ "$(docker ps -q | wc -l)" -ne 1 ]; do
+          docker ps
+          sleep 10
+        done
+        DATABASE_PORT=$(docker ps -l --format '{{ .ID }}' | xargs docker port | cut -d ':' -f 2)
+        echo "DATABASE_PORT=$DATABASE_PORT" >> $GITHUB_ENV 
+
+    - name: Run base tests
+      shell: bash
+      run: |
+        TESTS=`testsuite/integration-arquillian/tests/base/testsuites/suite.sh database`
+        echo "Tests: $TESTS"
+        ./mvnw test ${{ env.SUREFIRE_RETRY }} \
+          -Pauth-server-quarkus -Pdb-${{ inputs.db }} \
+          "-Dwebdriver.chrome.driver=$CHROMEWEBDRIVER/chromedriver" \
+          -Dtest=$TESTS \
+          -Ddocker.database.skip=true \
+          -Ddocker.database.port=$DATABASE_PORT \
+          -Ddocker.container.testdb.ip=localhost \
+          -Dkeycloak.distribution.start.timeout=360 \
+          -pl testsuite/integration-arquillian/tests/base 2>&1 | misc/log/trimmer.sh
+
+    - name: Run cluster JDBC_PING2 UDP smoke test
+      shell: bash
+      run: |
+        ./mvnw test ${{ env.SUREFIRE_RETRY }} \
+          -Pauth-server-cluster-quarkus \
+          -Pdb-${{ inputs.db }} \
+          -Dtest=RealmInvalidationClusterTest \
+          -Dsession.cache.owners=2 \
+          -Dauth.server.quarkus.cluster.stack=jdbc-ping-udp \
+          -Ddocker.database.skip=true \
+          -Ddocker.database.port=$DATABASE_PORT \
+          -Ddocker.container.testdb.ip=localhost \
+          -pl testsuite/integration-arquillian/tests/base \
+          2>&1 | misc/log/trimmer.sh
+
+    - name: Run cluster JDBC_PING2 TCP smoke test
+      shell: bash
+      run: |
+        ./mvnw test ${{ env.SUREFIRE_RETRY }} \
+          -Pauth-server-cluster-quarkus \
+          -Pdb-${{ inputs.db }} \
+          -Dtest=RealmInvalidationClusterTest \
+          -Dsession.cache.owners=2 \
+          -Dauth.server.quarkus.cluster.stack=jdbc-ping \
+          -Ddocker.database.skip=true \
+          -Ddocker.database.port=$DATABASE_PORT \
+          -Ddocker.container.testdb.ip=localhost \
+          -pl testsuite/integration-arquillian/tests/base \
+          2>&1 | misc/log/trimmer.sh
+
+    - uses: ./.github/actions/upload-flaky-tests
+      name: Upload flaky tests
+      env:
+        GH_TOKEN: ${{ github.token }}
+      with:
+        job-name: Store IT

.github/actions/update-hosts/action.yml

@@ -0,0 +1,21 @@
+name: Update /etc/hosts
+description: Update /etc/hosts file to hardcode known hostnames. This is to avoid test instability due to DNS resolution issues.
+
+runs:
+  using: composite
+  steps:
+
+    - id: update-hosts-linux
+      name: Update /etc/hosts
+      if: runner.os == 'Linux'
+      shell: bash
+      run: |
+        printf "\n\n$(cat .github/actions/update-hosts/hosts)" | sudo tee -a /etc/hosts
+
+    - id: update-hosts-windows
+      name: Update C:\Windows\System32\drivers\etc\hosts
+      if: runner.os == 'Windows'
+      shell: powershell
+      run: |
+        "`n`n" | Add-Content C:\Windows\System32\drivers\etc\hosts
+        Get-Content .github/actions/update-hosts/hosts | Add-Content C:\Windows\System32\drivers\etc\hosts

.github/actions/update-hosts/hosts

@@ -0,0 +1,2 @@
+127.0.0.1 localtest.me admin.localtest.me localhost-myapp.localtest.me localhost-sso.localtest.me realmFrontend.localtest.me proxy.kc.localtest.me
+::1 localtest.me admin.localtest.me localhost-myapp.localtest.me localhost-sso.localtest.me realmFrontend.localtest.me proxy.kc.localtest.me

.github/actions/upload-flaky-tests/action.yml

@@ -47,9 +47,9 @@ runs:
           echo "EOF" >> $GITHUB_OUTPUT
         fi
 
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       if: ${{ steps.flaky-tests.outputs.flakes }}
       with:
         name: flaky-tests-${{ github.job }}-${{ join(matrix.*, '-') }}
         path: ${{ steps.flaky-tests.outputs.flakes }}
-        if-no-files-found: error
+        if-no-files-found: error

.github/actions/upload-heapdumps/action.yml

@@ -1,17 +0,0 @@
-name: Upload JVM Heapdumps
-description: Upload JVM Heapdumps
-
-runs:
-  using: composite
-  steps:
-    - id: upload-jvm-heapdumps
-      name: Upload JVM Heapdumps
-      # Windows runners are running into https://github.com/actions/upload-artifact/issues/240
-      if: runner.os != 'Windows'
-      uses: actions/upload-artifact@v4
-      with:
-        name: jvm-heap-dumps
-        path: |
-          '**/java_pid*.hprof'
-          !distribution/**
-        if-no-files-found: ignore

.github/codeql/codeql-config-javascript.yml

@@ -0,0 +1,3 @@
+paths-ignore:
+  # This file is invalid on purpose for testing. Exclude it to prevent an "Unexpected token" error in CodeQL being reported.
+  - testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers-deployment/src/main/resources/scripts/test-bad-script-mapper3.js

.github/codeql/codeql-config-typescript.yml

@@ -0,0 +1,3 @@
+paths-ignore:
+  # This file is invalid on purpose for testing. Exclude it to prevent an "Unexpected token" error in CodeQL being reported.
+  - testsuite/integration-arquillian/servers/auth-server/services/testsuite-providers-deployment/src/main/resources/scripts/test-bad-script-mapper3.js

.github/dependabot.yml

@@ -2,22 +2,32 @@ version: 2
 updates:
   - package-ecosystem: github-actions
     directory: /
-    open-pull-requests-limit: 999
-    rebase-strategy: disabled
     schedule:
-      interval: daily
+      interval: weekly
-      time: "00:00"
+      day: "sunday"
+      time: "03:00"
       timezone: Etc/GMT
+    open-pull-requests-limit: 10 # It's wise to keep this low even with grouping
+    rebase-strategy: disabled
     labels:
       - area/dependencies
       - area/ci
+    groups:
+      actions-dependencies: # This name will be used in the PR title
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
   - package-ecosystem: npm
     directory: js
     schedule:
-      interval: daily
+      interval: weekly
-      time: "00:00"
+      day: "thursday"
+      time: "03:00"
       timezone: Etc/GMT
-    open-pull-requests-limit: 999
+    open-pull-requests-limit: 10 # It's wise to keep this low even with grouping
     rebase-strategy: disabled
     labels:
       - area/dependencies
@@ -35,3 +45,10 @@ updates:
         update-types: ["version-update:semver-major"]
       - dependency-name: "react-router-dom"
         update-types: ["version-update:semver-major"]
+    groups:
+      npm-dependencies: # This name will be used in the PR title
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"

.github/fake_fips/fake_fips.c

@@ -34,7 +34,9 @@ static struct ctl_table crypto_sysctl_table[] = {
 		.mode		= 0444,
 		.proc_handler	= proc_dointvec
 	},
-        {}
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 11, 0))
+	{}
+#endif
 };
 static struct ctl_table crypto_dir_table[] = {
 	{
@@ -44,7 +46,9 @@ static struct ctl_table crypto_dir_table[] = {
 		.child          = crypto_sysctl_table
 #endif
 	},
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 11, 0))
 	{}
+#endif
 };
 
 static struct ctl_table_header *crypto_sysctls;

.github/mvn-rel-settings.xml

@@ -1,37 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
-          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 http://maven.apache.org/xsd/settings-1.0.0.xsd">
-    <activeProfiles>
-        <activeProfile>keycloak-rel</activeProfile>
-    </activeProfiles>
-    <profiles>
-        <profile>
-            <id>keycloak-rel</id>
-            <repositories>
-                <repository>
-                    <id>${env.MAVEN_ID}</id>
-                    <url>${env.MAVEN_URL}</url>
-                    <snapshots>
-                        <enabled>true</enabled>
-                    </snapshots>
-                    <releases>
-                        <enabled>true</enabled>
-                  </releases>
-                </repository>
-            </repositories>
-        </profile>
-    </profiles>
-    <servers>
-        <server>
-            <id>${env.MAVEN_ID}</id>
-            <username>${env.MAVEN_USERNAME}</username>
-           <password>${env.MAVEN_PASSWORD}</password>
-        </server>
-        <server>
-            <id>gpg.passphrase</id>
-            <passphrase>${env.MAVEN_GPG_PASSPHRASE}</passphrase>
-        </server>
-    </servers>
-
-</settings>

.github/scripts/ansible/azure_vm_manager.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Usage: ./azure_vm_manager.sh <create|delete> <region> <cluster_name>
+ACTION=${1:-}
+REGION=${2:-}
+CLUSTER=${3:-}
+
+if [[ -z "$ACTION" || -z "$REGION" || -z "$CLUSTER" ]]; then
+  echo "Usage: $0 <create|delete> <region> <cluster_name>"
+  exit 1
+fi
+
+SSH_KEY="$CLUSTER"_"$REGION"
+ADMIN_USER="azureuser"
+VM_SIZE="Standard_D2s_v5"
+IMAGE="Ubuntu2404"
+
+if [[ "$ACTION" == "create" ]]; then
+  # 1. Resource group (created via idempotent command)
+  az group create --name "$CLUSTER" --location "$REGION"
+
+  # 2. SSH key
+  if [[ ! -f "${SSH_KEY}" ]]; then
+    ssh-keygen -t rsa -b 2048 -f "${SSH_KEY}" -N ""
+  fi
+
+  # 3. Network security group
+  az network nsg create --resource-group "$CLUSTER" --name "$CLUSTER-nsg"
+  az network nsg rule create --resource-group "$CLUSTER" --nsg-name "$CLUSTER-nsg" --name Allow-SSH --protocol Tcp --priority 1000 --destination-port-range 22 --access Allow --direction Inbound
+
+  # 4. Public IP
+  az network public-ip create --resource-group "$CLUSTER" --name "$CLUSTER-pip" --allocation-method Static
+
+  # 5. Virtual network
+  az network vnet create --resource-group "$CLUSTER" --name "$CLUSTER-vnet" --address-prefix 10.0.0.0/16
+
+  # 6. Subnet
+  az network vnet subnet create --resource-group "$CLUSTER" --vnet-name "$CLUSTER-vnet" --name "$CLUSTER-subnet" --address-prefix 10.0.0.0/24
+
+  # 7. Network interface
+  az network nic create --resource-group "$CLUSTER" --name "$CLUSTER-nic" --vnet-name "$CLUSTER-vnet" --subnet "$CLUSTER-subnet" --network-security-group "$CLUSTER-nsg" --public-ip-address "$CLUSTER-pip"
+
+  # 8. VM
+  az vm create \
+    --resource-group "$CLUSTER" \
+    --name "$CLUSTER-vm" \
+    --nics "$CLUSTER-nic" \
+    --image "$IMAGE" \
+    --size "$VM_SIZE" \
+    --admin-username "$ADMIN_USER" \
+    --ssh-key-values "${SSH_KEY}.pub" \
+    --authentication-type ssh \
+    --no-wait
+
+  # 9. Wait for VM IP
+  az vm wait --created --resource-group "$CLUSTER" --name "$CLUSTER-vm"
+  VM_IP=$(az network public-ip show --resource-group "$CLUSTER" --name "$CLUSTER-pip" --query ipAddress -o tsv)
+
+  # 10. Wait for SSH
+  for i in {1..30}; do
+    if nc -z "$VM_IP" 22; then break; fi
+    sleep 5
+  done
+
+  # 11. Create inventory file with both host and group
+  cat > "${CLUSTER}_${REGION}_inventory.yml" <<EOF
+all:
+  hosts:
+    keycloak:
+      ansible_host: $VM_IP
+      ansible_user: $ADMIN_USER
+      ansible_ssh_private_key_file: ${SSH_KEY}
+  children:
+    keycloak_group:
+      hosts:
+        keycloak:
+EOF
+
+  echo "VM provisioned. Inventory: ${CLUSTER}_${REGION}_inventory.yml"
+
+elif [[ "$ACTION" == "delete" ]]; then
+  az group delete --name "$CLUSTER" --yes --no-wait
+  echo "Resource group $CLUSTER deletion initiated."
+else
+  echo "Unknown action: $ACTION"
+  exit 2
+fi

.github/scripts/ansible/keycloak.yml

@@ -1,2 +1,2 @@
 - hosts: keycloak
-  roles: [keycloak_ec2_installer]
+  roles: [keycloak_remote_installer]

.github/scripts/ansible/keycloak_remote_installer.sh

@@ -11,6 +11,6 @@ CLUSTER_NAME=$2
 KEYCLOAK_SRC=$3
 MAVEN_ARCHIVE=$4
 
-ansible-playbook -i ${CLUSTER_NAME}_${REGION}_inventory.yml keycloak.yml \
+ansible-playbook -vvvv -i ${CLUSTER_NAME}_${REGION}_inventory.yml keycloak.yml \
   -e "keycloak_src=\"${KEYCLOAK_SRC}\"" \
   -e "maven_archive=\"${MAVEN_ARCHIVE}\""

.github/scripts/ansible/mvn.yml

@@ -1,2 +1,2 @@
 - hosts: keycloak
-  roles: [mvn_ec2_runner]
+  roles: [mvn_remote_runner]

.github/scripts/ansible/roles/keycloak_remote_installer/README.md

@@ -1,4 +1,4 @@
-# Ansible Role `keycloak_ec2_installer`
+# Ansible Role `keycloak_remote_installer`
 
 Ansible role for installing Keycloak sources and build dependencies on remote nodes.
 

.github/scripts/ansible/roles/keycloak_remote_installer/defaults/main.yml

@@ -1,5 +1,3 @@
-# This should match the user in the *_inventory.yml
-ansible_ssh_user: ec2-user
 # Workspace on the remote hosts
 kc_home: /opt/keycloak
 m2_home: ~/.m2

.github/scripts/ansible/roles/keycloak_remote_installer/tasks/install.yml

@@ -4,8 +4,26 @@
     name: "*"
     state: latest
 
-- name: Install Java {{ java_version }} packages on the remote hosts
+- name: Update apt cache on Ubuntu/Debian
-  when: install_java
+  when: ansible_os_family == 'Debian'
+  apt:
+    update_cache: yes
+
+
+- name: Install Java {{ java_version }} packages on Ubuntu/Debian
+  when:
+    - install_java
+    - ansible_os_family == 'Debian'
+  package:
+    name:
+      - "openjdk-{{ java_version }}-jdk"
+      - "openjdk-{{ java_version }}-jre"
+    state: present
+
+- name: Install Java {{ java_version }} packages on RedHat/Amazon
+  when:
+    - install_java
+    - ansible_os_family != 'Debian'
   package:
     name:
       - "java-{{ java_version }}-openjdk"

.github/scripts/ansible/roles/mvn_remote_runner/README.md

@@ -1,4 +1,4 @@
-# Ansible Role `mvn_ec2_runner`
+# Ansible Role `mvn_remote_runner`
 
 Ansible role for executing `mvn` commands against a Keycloak src on a remote node.
 

.github/scripts/aws/rds/aurora_create.sh

@@ -116,6 +116,7 @@ aws rds create-db-cluster \
 # For now only two AZs in each region are supported due to the two subnets created above
 for i in $( seq ${AURORA_INSTANCES} ); do
   aws rds create-db-instance \
+    --no-auto-minor-version-upgrade \
     --db-cluster-identifier ${AURORA_CLUSTER} \
     --db-instance-identifier "${AURORA_CLUSTER}-instance-${i}" \
     --db-instance-class ${AURORA_INSTANCE_CLASS} \

.github/scripts/azure/sql/README.md

@@ -0,0 +1,63 @@
+# Azure SQL Automation
+
+This folder contains scripts, a composite action, and Ansible helpers to:
+- Create an Azure SQL Server + database and the Keycloak DB user
+- Provision an Azure VM and run Maven/Keycloak tasks on it (Ansible role)
+
+---
+
+## Prerequisites
+
+Make sure that your Azure subscription is registered to use the `Microsoft.Sql` resource provider in order to create SQL resources. You can do this via the Azure Portal or Azure CLI:
+
+```bash
+# Ensure correct subscription is selected
+az account set --subscription <your-subscription-id>
+
+# Check registration status
+az provider show --namespace Microsoft.Sql --query registrationState -o table
+
+# Register the provider
+az provider register --namespace Microsoft.Sql
+```
+
+---
+
+## Files
+
+### Azure-specific scripts
+- **`azure_common.sh`** - Shared defaults and environment checks
+- **`azure_create_sql.sh`** - Create resource group, server, database and DB user using Azure CLI + sqlcmd
+- **`azure_vm_manager.sh`** - CLI wrapper to create/delete Azure VM and produce inventory via Ansible
+
+### Common files shared with EC2 automation
+- **`mvn_remote_runner.sh`** - Runs the existing `mvn.yml` Ansible playbook against the created Azure or EC2 VM
+- **`keycloak_remote_installer.sh`** - Shell script that runs the Ansible playbook to install Keycloak on the provisioned VM
+- **Ansible playbooks and roles** - Under `.github/scripts/ansible/roles/`
+
+---
+
+## GitHub Secrets and Configuration
+
+### Required Secret
+
+**`AZURE_CREDENTIALS`** *(required)* - Service principal JSON used by the `azure/login` action
+
+Create via Azure CLI:
+```bash
+az ad sp create-for-rbac \
+  --name "keycloak-ci" \
+  --role contributor \
+  --scopes /subscriptions/<your-subscription-id> \
+  --sdk-auth
+```
+
+### Optional Variables (override defaults)
+
+- **`AZURE_ADMIN_USER`** - SQL Server admin username *(default: `sqladmin`)*
+- **`AZURE_DB_USER`** - Keycloak database username *(default: `keycloak`)*
+
+### Optional Secrets (override auto-generated passwords)
+
+- **`AZURE_ADMIN_PASSWORD`** - SQL Server admin password *(default: auto-generated)*
+- **`AZURE_DB_PASSWORD`** - Keycloak database user password *(default: auto-generated)*

.github/scripts/azure/sql/azure_common.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -e
+
+if [[ "$RUNNER_DEBUG" == "1" ]]; then
+  set -x
+fi
+
+function requiredEnv() {
+  for ENV in $@; do
+      if [ -z "${!ENV}" ]; then
+        echo "${ENV} variable must be set"
+        exit 1
+      fi
+  done
+}
+
+requiredEnv AZURE_NAME AZURE_REGION AZURE_ADMIN_PASSWORD AZURE_DB_PASSWORD
+
+SCRIPT_DIR=${SCRIPT_DIR:-$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )}
+export AZURE_RG=${AZURE_RG:-"${AZURE_NAME}-rg"}
+export AZURE_ADMIN_USER=${AZURE_ADMIN_USER:-"sqladmin"}
+export AZURE_ADMIN_PASSWORD=${AZURE_ADMIN_PASSWORD}
+export AZURE_DB=${AZURE_DB:-"keycloakdb"}
+export AZURE_DB_USER=${AZURE_DB_USER:-"keycloak"}
+export AZURE_DB_PASSWORD=${AZURE_DB_PASSWORD}
+export AZURE_ALLOW_ALL_FIREWALL=${AZURE_ALLOW_ALL_FIREWALL:-"true"}

.github/scripts/azure/sql/azure_create_sql.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+set -e
+
+if [[ "$RUNNER_DEBUG" == "1" ]]; then
+  set -x
+fi
+
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+source ${SCRIPT_DIR}/azure_common.sh
+
+requiredEnv AZURE_SUBSCRIPTION AZURE_ADMIN_USER AZURE_DB_USER
+
+# Login is expected to be done by the workflow via az login with service principal
+
+# Resource group (created via idempotent command)
+echo "Creating resource group ${AZURE_RG} in ${AZURE_REGION}"
+az group create --name ${AZURE_RG} --location ${AZURE_REGION} --subscription ${AZURE_SUBSCRIPTION}
+
+echo "Creating SQL server ${AZURE_NAME}-sqlsrv"
+az sql server create \
+  --name ${AZURE_NAME}-sqlsrv \
+  --resource-group ${AZURE_RG} \
+  --location ${AZURE_REGION} \
+  --admin-user ${AZURE_ADMIN_USER} \
+  --admin-password "${AZURE_ADMIN_PASSWORD}" \
+  --subscription ${AZURE_SUBSCRIPTION}
+
+echo "Creating database ${AZURE_DB}"
+az sql db create \
+  --resource-group ${AZURE_RG} \
+  --server ${AZURE_NAME}-sqlsrv \
+  --name ${AZURE_DB} \
+  --service-objective Basic \
+  --subscription ${AZURE_SUBSCRIPTION}
+
+if [ "${AZURE_ALLOW_ALL_FIREWALL}" = "true" ]; then
+  echo "Allowing Azure services and current IP (0.0.0.0) - use with caution"
+  az sql server firewall-rule create --resource-group ${AZURE_RG} --server ${AZURE_NAME}-sqlsrv --name AllowAll --start-ip-address 0.0.0.0 --end-ip-address 0.0.0.0 --subscription ${AZURE_SUBSCRIPTION}
+fi
+
+# Create login in master and then create user in the database
+# Wait until server is provisioned
+echo "Waiting for SQL server to be provisioned..."
+for i in {1..30}; do
+  state=$(az sql server show --name ${AZURE_NAME}-sqlsrv --resource-group ${AZURE_RG} --subscription ${AZURE_SUBSCRIPTION} --query "state" -o tsv || echo "")
+  if [ "${state}" = "Ready" ] || [ -z "${state}" ]; then
+    break
+  fi
+  echo "server state=${state}, retrying..."
+  sleep 5
+done
+
+ENDPOINT="${AZURE_NAME}-sqlsrv.database.windows.net"
+ADMIN_USER_FULL="${AZURE_ADMIN_USER}@${AZURE_NAME}-sqlsrv"
+
+echo "Creating login ${AZURE_DB_USER} in master via sqlcmd"
+PASS_ESCAPED=${AZURE_DB_PASSWORD//\'/''}
+sqlcmd -S ${ENDPOINT} -U "${ADMIN_USER_FULL}" -P "${AZURE_ADMIN_PASSWORD}" -d master -Q "IF EXISTS (SELECT 1 FROM sys.sql_logins WHERE name = '${AZURE_DB_USER}') BEGIN ALTER LOGIN [${AZURE_DB_USER}] WITH PASSWORD='${PASS_ESCAPED}'; END ELSE BEGIN CREATE LOGIN [${AZURE_DB_USER}] WITH PASSWORD='${PASS_ESCAPED}'; END"
+
+echo "Creating user ${AZURE_DB_USER} in database ${AZURE_DB} and adding db_owner"
+sqlcmd -S ${ENDPOINT} -U "${ADMIN_USER_FULL}" -P "${AZURE_ADMIN_PASSWORD}" -d ${AZURE_DB} -Q "IF NOT EXISTS (SELECT name FROM sys.database_principals WHERE name = '${AZURE_DB_USER}') BEGIN CREATE USER [${AZURE_DB_USER}] FOR LOGIN [${AZURE_DB_USER}]; END; IF NOT EXISTS (SELECT 1 FROM sys.database_role_members drm JOIN sys.database_principals r ON drm.role_principal_id = r.principal_id JOIN sys.database_principals m ON drm.member_principal_id = m.principal_id WHERE r.name = 'db_owner' AND m.name='${AZURE_DB_USER}') BEGIN ALTER ROLE db_owner ADD MEMBER [${AZURE_DB_USER}]; END"
+
+echo "endpoint=${ENDPOINT}" >> $GITHUB_OUTPUT
+echo "db=${AZURE_DB}" >> $GITHUB_OUTPUT
+echo "username=${AZURE_DB_USER}@${AZURE_NAME}-sqlsrv" >> $GITHUB_OUTPUT

.github/scripts/find-modules-with-unit-tests.sh

@@ -0,0 +1,9 @@
+#!/bin/bash -e
+
+find . -path '**/src/test/java' -type d \
+  | grep -v -E '\./(docs|distribution|misc|operator|((.+/)?tests)|testsuite|test-framework|quarkus)/' \
+  | sed 's|/src/test/java||' \
+  | sed 's|./||' \
+  | sort \
+  | tr '\n' ',' \
+  | sed 's/,$//'

.github/scripts/pr-find-issues-test.sh

@@ -5,7 +5,7 @@ source ./pr-find-issues.sh
 
 function testParsing() {
     echo -n "$1 -> $2 "
-    if [ $(parse_issues "$1") != "$2" ]; then
+    if [ "$(parse_issues "$1")" != "$2" ]; then
         echo "(failure)"
         return 1
     fi
@@ -22,3 +22,4 @@ trap 'testFailed' ERR
 testParsing "Closes #123" "123"
 testParsing "Fixes #123" "123"
 testParsing "Fixes: #123" "123"
+testParsing "Fixes https://github.com/keycloak/keycloak/issues/123" "123"

.github/scripts/pr-find-issues.sh

@@ -8,7 +8,11 @@ if [ "$REPO" == "" ]; then
 fi
 
 function parse_issues() {
-    echo "$1" | grep -i -P -o "(close|closes|closed|resolve|resolves|resolved|fixes|fixed):? #[[:digit:]]*" | cut -d '#' -f 2 | sort -n
+    echo "$1" | \
+      grep -i -P -o "(close|closes|closed|resolve|resolves|resolved|fixes|fixed):? (#|https://github.com/keycloak/keycloak/issues/)[[:digit:]]*" | \
+      sed -e 's|https://github.com/keycloak/keycloak/issues/|#|g' | \
+      sed -e 's|keycloak/keycloak/issues/|#|g' | \
+      cut -d '#' -f 2 | sort -n
 }
 
 if [ "$PR" != "" ]; then

.github/scripts/prepare-quarkus-next.sh

@@ -7,7 +7,7 @@ add_repository() {
 
   local id="sonatype-snapshots"
   local name="Sonatype Snapshots"
-  local url="https://s01.oss.sonatype.org/content/repositories/snapshots/"
+  local url="https://central.sonatype.com/repository/maven-snapshots/"
 
   # Decide the tag based on the element
   local tag

.github/scripts/run-fips-it.sh

@@ -1,5 +1,6 @@
 #!/bin/bash -x
 
+rm -f /etc/system-fips
 dnf install -y java-21-openjdk-devel
 fips-mode-setup --enable --no-bootcfg
 fips-mode-setup --is-enabled
@@ -7,8 +8,10 @@ if [ $? -ne 0 ]; then
   exit 1
 fi
 STRICT_OPTIONS=""
+TESTSUITE_NAME="FipsNonStrictTestSuite"
 if [ "$1" = "strict" ]; then
-  STRICT_OPTIONS="-Dauth.server.fips.mode=strict -Dauth.server.supported.keystore.types=BCFKS -Dauth.server.keystore.type=bcfks -Dauth.server.supported.rsa.key.sizes=2048,4096"
+  STRICT_OPTIONS="-Dauth.server.fips.mode=strict -Dauth.server.supported.keystore.types=BCFKS -Dauth.server.keystore.type=bcfks -Dauth.server.supported.rsa.key.sizes=2048,3072,4096"
+  TESTSUITE_NAME="FipsStrictTestSuite"
 fi
 echo "STRICT_OPTIONS: $STRICT_OPTIONS"
 TESTS=`testsuite/integration-arquillian/tests/base/testsuites/suite.sh fips`
@@ -36,3 +39,6 @@ fi
 
 # Profile app-server-wildfly needs to be explicitly set for FIPS tests
 ./mvnw test -Dsurefire.rerunFailingTestsCount=$SUREFIRE_RERUN_FAILING_COUNT -nsu -B -Pauth-server-quarkus,auth-server-fips140-2,app-server-wildfly -Dcom.redhat.fips=false $STRICT_OPTIONS -Dtest=$TESTS -pl testsuite/integration-arquillian/tests/base 2>&1 | misc/log/trimmer.sh
+
+# New Base Tests
+./mvnw package -nsu -B -Dcom.redhat.fips=false -Dtest=$TESTSUITE_NAME -pl tests/base

.github/scripts/run-fips-ut.sh

@@ -1,5 +1,6 @@
 #!/bin/bash
 
+rm -f /etc/system-fips
 dnf install -y java-21-openjdk-devel crypto-policies-scripts
 fips-mode-setup --enable --no-bootcfg
 fips-mode-setup --is-enabled

.github/scripts/version-compatibility.sh

@@ -0,0 +1,30 @@
+#!/bin/bash -e
+
+if [[ "$RUNNER_DEBUG" == "1" ]]; then
+  set -x
+fi
+
+TARGET_BRANCH="$1"
+REPO="${2:-keycloak}"
+ORG="${3:-keycloak}"
+
+if [[ "${TARGET_BRANCH}" != "release/"* ]]; then
+  echo "skip"
+  exit 0
+fi
+
+ALL_RELEASES=$(gh release list \
+  --repo "${ORG}/${REPO}" \
+  --exclude-drafts \
+  --exclude-pre-releases \
+  --json name \
+  --template '{{range .}}{{.name}}{{"\n"}}{{end}}'
+)
+MAJOR_MINOR=${TARGET_BRANCH#"release/"}
+MAJOR_MINOR_RELEASES=$(echo "${ALL_RELEASES}" | (grep "${MAJOR_MINOR}" || true))
+
+if [[ -z "${MAJOR_MINOR_RELEASES}" ]]; then
+  echo "skip"
+else
+  echo -n "${MAJOR_MINOR_RELEASES}" | jq -cnR '[inputs] | map({version: .})'
+fi

.github/teams.yml

@@ -2,8 +2,10 @@ team/cloud-native:
   - area/admin/cli
   - area/dist/quarkus
   - area/operator
+  - area/observability
+  - area/welcome/ui
 
-team/continuous-testing:
+team/continuous-delivery:
   - area/ci
   - area/testsuite
 
@@ -29,6 +31,7 @@ team/core-iam:
   - area/ldap
   - area/organizations
   - area/user-profile
+  - area/workflows
 
 team/core-shared:
   - area/account/api
@@ -38,14 +41,12 @@ team/core-shared:
   - area/import-export
   - area/infinispan
   - area/storage
-
-team/sre:
-
-team/ui:
   - area/account/ui
   - area/admin/client-js
   - area/admin/ui
-  - area/welcome/ui
+
+team/sre:
+  - area/observability
 
 team/community:
   - area/translations

.github/workflows/aurora-delete.yml

@@ -20,7 +20,7 @@ jobs:
     name: Delete Aurora DB
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Initialize AWS client
         run: |

.github/workflows/codeql-analysis.yml

@@ -33,8 +33,12 @@ jobs:
       java: ${{ steps.conditional.outputs.codeql-java }}
       javascript: ${{ steps.conditional.outputs.codeql-javascript }}
       typescript: ${{ steps.conditional.outputs.codeql-typescript }}
+      actions: ${{ steps.conditional.outputs.codeql-actions }}
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - id: conditional
         uses: ./.github/actions/conditional
@@ -52,10 +56,10 @@ jobs:
       conclusion: ${{ steps.check.outputs.conclusion }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
         with:
           languages: java
 
@@ -63,7 +67,7 @@ jobs:
         uses: ./.github/actions/build-keycloak
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
         with:
           wait-for-processing: true
         env:
@@ -80,17 +84,18 @@ jobs:
       conclusion: ${{ steps.check.outputs.conclusion }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
         env:
           CODEQL_ACTION_EXTRA_OPTIONS: '{"database":{"finalize":["--no-run-unnecessary-builds"]}}'
         with:
           languages: javascript
+          config-file: ./.github/codeql/codeql-config-javascript.yml
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
         with:
           wait-for-processing: true
         env:
@@ -107,17 +112,45 @@ jobs:
       conclusion: ${{ steps.check.outputs.conclusion }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
         env:
           CODEQL_ACTION_EXTRA_OPTIONS: '{"database":{"finalize":["--no-run-unnecessary-builds"]}}'
         with:
           languages: typescript
+          config-file: ./.github/codeql/codeql-config-typescript.yml
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        with:
+          wait-for-processing: true
+        env:
+          CODEQL_ACTION_EXTRA_OPTIONS: '{"database":{"interpret-results":["--max-paths",0]}}'
+
+  actions:
+    name: CodeQL GitHub Actions
+    needs: conditional
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write  # Required for SARIF upload
+    if: needs.conditional.outputs.actions == 'true'
+    outputs:
+      conclusion: ${{ steps.check.outputs.conclusion }}
+
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        env:
+          CODEQL_ACTION_EXTRA_OPTIONS: '{"database":{"finalize":["--no-run-unnecessary-builds"]}}'
+        with:
+          languages: actions
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
         with:
           wait-for-processing: true
         env:
@@ -131,9 +164,10 @@ jobs:
       - java
       - javascript
       - typescript
+      - actions
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - uses: ./.github/actions/status-check
         with:
           jobs: ${{ toJSON(needs) }}

.github/workflows/documentation.yml

@@ -31,8 +31,11 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       documentation: ${{ steps.conditional.outputs.documentation }}
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - id: conditional
         uses: ./.github/actions/conditional
@@ -45,7 +48,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: conditional
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - id: setup-java
         name: Setup Java
@@ -63,7 +66,7 @@ jobs:
 
       - id: upload-keycloak-documentation
         name: Upload Keycloak documentation
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: keycloak-documentation
           path: docs/documentation/dist/target/*.zip
@@ -75,7 +78,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: conditional
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - id: setup-java
         name: Setup Java
@@ -99,7 +102,7 @@ jobs:
       - build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - uses: ./.github/actions/status-check
         with:
-          jobs: ${{ toJSON(needs) }}
+          jobs: ${{ toJSON(needs) }}

.github/workflows/guides.yml

@@ -32,8 +32,11 @@ jobs:
     outputs:
       guides: ${{ steps.conditional.outputs.guides }}
       ci: ${{ steps.conditional.outputs.ci }}
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - id: conditional
         uses: ./.github/actions/conditional
@@ -47,7 +50,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: conditional
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Build Keycloak
         uses: ./.github/actions/build-keycloak
@@ -60,7 +63,7 @@ jobs:
       - build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - uses: ./.github/actions/status-check
         with:
           jobs: ${{ toJSON(needs) }}

.github/workflows/js-ci.yml

@@ -11,7 +11,6 @@ on:
 
 env:
   MAVEN_ARGS: "-B -nsu -Daether.connector.http.connectionMaxTtl=25"
-  RETRY_COUNT: 3
 
 concurrency:
   # Only cancel jobs for PR updates
@@ -31,8 +30,11 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       js-ci: ${{ steps.conditional.outputs.js }}
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - id: conditional
         uses: ./.github/actions/conditional
@@ -45,7 +47,7 @@ jobs:
     if: needs.conditional.outputs.js-ci == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Build Keycloak
         uses: ./.github/actions/build-keycloak
@@ -55,7 +57,7 @@ jobs:
           mv ./quarkus/dist/target/keycloak-999.0.0-SNAPSHOT.tar.gz ./keycloak-999.0.0-SNAPSHOT.tar.gz
 
       - name: Upload Keycloak dist
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: keycloak
           path: keycloak-999.0.0-SNAPSHOT.tar.gz
@@ -68,7 +70,7 @@ jobs:
     env:
       WORKSPACE: "@keycloak/keycloak-admin-client"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - uses: ./.github/actions/pnpm-setup
 
@@ -86,7 +88,7 @@ jobs:
     env:
       WORKSPACE: "@keycloak/keycloak-ui-shared"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - uses: ./.github/actions/pnpm-setup
 
@@ -104,7 +106,7 @@ jobs:
     env:
       WORKSPACE: "@keycloak/keycloak-account-ui"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - uses: ./.github/actions/pnpm-setup
 
@@ -122,7 +124,7 @@ jobs:
     env:
       WORKSPACE: keycloak-admin-ui
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - uses: ./.github/actions/pnpm-setup
 
@@ -144,13 +146,20 @@ jobs:
     runs-on: ubuntu-latest
     env:
       WORKSPACE: "@keycloak/keycloak-account-ui"
+    strategy:
+      matrix:
+        browser: [chromium, firefox]
+        exclude:
+          # Only test with Firefox on scheduled runs
+          - browser: ${{ github.event_name != 'workflow_dispatch' && 'firefox' || '' }}
+      fail-fast: false
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - uses: ./.github/actions/pnpm-setup
 
       - name: Download Keycloak server
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           name: keycloak
 
@@ -170,68 +179,48 @@ jobs:
         working-directory: js
 
       - name: Run Playwright tests
-        run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} test:integration
+        run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} test -- --project=${{ matrix.browser }}
         working-directory: js
 
       - name: Upload Playwright report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         if: always()
         with:
-          name: account-ui-playwright-report
+          name: account-ui-playwright-report-${{ matrix.browser }}
           path: js/apps/account-ui/playwright-report
           retention-days: 30
 
       - name: Upload server logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
-          name: account-ui-server-log
+          name: account-ui-server-log-${{ matrix.browser }}
           path: ~/server.log
 
-
-  generate-test-seed:
-    name: Generate Test Seed
-    needs:
-      - conditional
-    if: needs.conditional.outputs.js-ci == 'true'
-    runs-on: ubuntu-latest
-    outputs:
-      seed: ${{ steps.generate-random-number.outputs.value }}
-    steps:
-      - name: Generate random number
-        id: generate-random-number
-        shell: bash
-        run: |
-          echo "value=$(shuf -i 1-100 -n 1)" >> $GITHUB_OUTPUT
-
   admin-ui-e2e:
     name: Admin UI E2E
     needs:
       - conditional
       - build-keycloak
-      - generate-test-seed
     if: needs.conditional.outputs.js-ci == 'true'
     runs-on: ubuntu-latest
     env:
-      WORKSPACE: keycloak-admin-ui
+      WORKSPACE: "@keycloak/keycloak-admin-ui"
+      RETRY_COUNT: 3
     strategy:
       matrix:
-        browser: [chrome, firefox]
+        browser: [chromium, firefox]
         exclude:
           # Only test with Firefox on scheduled runs
           - browser: ${{ github.event_name != 'workflow_dispatch' && 'firefox' || '' }}
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - uses: ./.github/actions/pnpm-setup
 
-      - name: Compile Admin Client
-        run: pnpm --fail-if-no-match --filter @keycloak/keycloak-admin-client build
-        working-directory: js
-
       - name: Download Keycloak server
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           name: keycloak
 
@@ -241,7 +230,7 @@ jobs:
       - name: Start Keycloak server
         run: |
           tar xfvz keycloak-999.0.0-SNAPSHOT.tar.gz
-          keycloak-999.0.0-SNAPSHOT/bin/kc.sh start-dev --features=admin-fine-grained-authz:v2,transient-users &> ~/server.log &
+          keycloak-999.0.0-SNAPSHOT/bin/kc.sh start-dev --features=admin-fine-grained-authz:v2,transient-users,spiffe,oid4vc-vci,kubernetes-service-accounts,jwt-authorization-grant,workflows &> ~/server.log &
         env:
           KC_BOOTSTRAP_ADMIN_USERNAME: admin
           KC_BOOTSTRAP_ADMIN_PASSWORD: admin
@@ -253,11 +242,11 @@ jobs:
         working-directory: js
 
       - name: Run Playwright tests
-        run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} test:integration
+        run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} test:integration -- --project=${{ matrix.browser }}
         working-directory: js
 
       - name: Upload Playwright report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         if: always()
         with:
           name: admin-ui-playwright-report-${{ matrix.browser }}
@@ -266,11 +255,47 @@ jobs:
 
       - name: Upload server logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: admin-ui-server-log-${{ matrix.browser }}
           path: ~/server.log
 
+  keycloak-admin-client:
+    name: Keycloak Admin Client
+    needs:
+      - conditional
+      - build-keycloak
+    if: needs.conditional.outputs.js-ci == 'true'
+    runs-on: ubuntu-latest
+    env:
+      WORKSPACE: "@keycloak/keycloak-admin-client"
+      RETRY_COUNT: 3
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Download Keycloak server
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        with:
+          name: keycloak
+
+      - name: Setup Java
+        uses: ./.github/actions/java-setup
+
+      - name: Start Keycloak server
+        run: |
+          tar xfvz keycloak-999.0.0-SNAPSHOT.tar.gz
+          keycloak-999.0.0-SNAPSHOT/bin/kc.sh start-dev --http-port 8180 --features transient-users,oid4vc-vci,declarative-ui,quick-theme,spiffe,kubernetes-service-accounts,workflows,client-auth-federated,jwt-authorization-grant &> ~/server.log &
+          curl --connect-timeout 5 --max-time 10 --retry 10 --retry-all-errors --retry-delay 10 --retry-max-time 120 -s -o /dev/null http://127.0.0.1:8180
+        env:
+          KC_BOOTSTRAP_ADMIN_USERNAME: admin
+          KC_BOOTSTRAP_ADMIN_PASSWORD: admin
+
+      - uses: ./.github/actions/pnpm-setup
+
+      - name: Run tests
+        run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} run test
+        working-directory: js
+
   check:
     name: Status Check - Keycloak JavaScript CI
     if: always()
@@ -283,9 +308,10 @@ jobs:
       - account-ui-e2e
       - admin-ui
       - admin-ui-e2e
+      - keycloak-admin-client
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - uses: ./.github/actions/status-check
         with:
           jobs: ${{ toJSON(needs) }}

.github/workflows/label.yml

@@ -13,7 +13,7 @@ jobs:
     permissions:
       issues: write # Required to add labels to Issues
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           sparse-checkout: .github/scripts
       - name: Add release labels on merge
@@ -41,7 +41,7 @@ jobs:
           fi
           
           echo "Label:      $LABEL"
-          echo "**Label:** [$LABEL](https://github.com/$GITHUB_REPOSITORY/labels/$LABEL" >> $GITHUB_STEP_SUMMARY
+          echo "**Label:** [$LABEL](https://github.com/$GITHUB_REPOSITORY/labels/$LABEL)" >> $GITHUB_STEP_SUMMARY
           
           gh api "/repos/$GITHUB_REPOSITORY/labels/$LABEL" --silent 2>/dev/null || gh label create -R "$GITHUB_REPOSITORY" "$LABEL" -c "0E8A16"
           

.github/workflows/operator-ci.yml

@@ -10,8 +10,8 @@ on:
 
 env:
   MAVEN_ARGS: "-B -nsu -Daether.connector.http.connectionMaxTtl=25"
-  MINIKUBE_VERSION: v1.32.0
+  MINIKUBE_VERSION: v1.37.0
-  KUBERNETES_VERSION: v1.27.10 # OCP 4.14
+  KUBERNETES_VERSION: v1.32.9 # OCP 4.19
   MINIKUBE_MEMORY: 4096 # Without explicitly setting memory, minikube uses ~25% of available memory which might be too little on smaller GitHub runners for running the tests
 
 defaults:
@@ -33,8 +33,11 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       operator: ${{ steps.conditional.outputs.operator }}
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - id: conditional
         uses: ./.github/actions/conditional
@@ -47,7 +50,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: conditional
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Build Keycloak
         uses: ./.github/actions/build-keycloak
@@ -55,56 +58,19 @@ jobs:
           upload-m2-repo: false
           upload-dist: true
 
-  test-local:
+  test-local-apiserver:
-    name: Test local
+    name: Test local apiserver
     runs-on: ubuntu-latest
     needs: [build]
-    strategy:
-      matrix:
-        suite: [slow, fast]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-
-      - name: Set version
-        id: vars
-        run: echo "version_local=0.0.1-${GITHUB_SHA::6}" >> $GITHUB_ENV
 
       - name: Setup Java
         uses: ./.github/actions/java-setup
 
-      - name: Setup Minikube-Kubernetes
-        uses: manusa/actions-setup-minikube@v2.13.1
-        with:
-          minikube version: ${{ env.MINIKUBE_VERSION }}
-          kubernetes version: ${{ env.KUBERNETES_VERSION }}
-          github token: ${{ secrets.GITHUB_TOKEN }}
-          driver: docker
-          start args: --addons=ingress --memory=${{ env.MINIKUBE_MEMORY }} --cni cilium --cpus=max
-
-      - name: Download keycloak distribution
-        id: download-keycloak-dist
-        uses: actions/download-artifact@v4
-        with:
-          name: keycloak-dist
-          path: quarkus/container
-
-      - name: Build Keycloak Docker images
-        run: |
-          eval $(minikube -p minikube docker-env)
-          (cd quarkus/container && docker build --build-arg KEYCLOAK_DIST=$(ls keycloak-*.tar.gz) . -t keycloak:${{ env.version_local }})
-          (cd operator && ./scripts/build-testing-docker-images.sh ${{ env.version_local }} keycloak custom-keycloak)
-
       - name: Test operator running locally
         run: |
-          declare -A PARAMS
+          ./mvnw install -Poperator -pl :keycloak-operator -am
-          PARAMS["slow"]="-Dkc.quarkus.tests.groups=slow"
-          PARAMS["fast"]='-Dkc.quarkus.tests.groups=!slow'
-          
-          ./mvnw install -Poperator -pl :keycloak-operator -am \
-              -Dquarkus.kubernetes.image-pull-policy=IfNotPresent \
-              -Dkc.operator.keycloak.image=keycloak:${{ env.version_local }} \
-              -Dtest.operator.custom.image=custom-keycloak:${{ env.version_local }} \
-              -Dkc.operator.keycloak.image-pull-policy=Never ${PARAMS["${{ matrix.suite }}"]}
 
   test-remote:
     name: Test remote
@@ -114,7 +80,7 @@ jobs:
           matrix:
             suite: [slow, fast]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Set version
         id: vars
@@ -124,17 +90,17 @@ jobs:
         uses: ./.github/actions/java-setup
 
       - name: Setup Minikube-Kubernetes
-        uses: manusa/actions-setup-minikube@v2.13.1
+        uses: manusa/actions-setup-minikube@b589f2d61bf96695c546929c72b38563e856059d # v2.14.0
         with:
           minikube version: ${{ env.MINIKUBE_VERSION }}
           kubernetes version: ${{ env.KUBERNETES_VERSION }}
           github token: ${{ secrets.GITHUB_TOKEN }}
           driver: docker
-          start args: --addons=ingress --memory=${{ env.MINIKUBE_MEMORY }} --cni cilium --cpus=max
+          start args: --addons=ingress --memory=${{ env.MINIKUBE_MEMORY }} --cni calico --cpus=max
 
       - name: Download keycloak distribution
         id: download-keycloak-dist
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           name: keycloak-dist
           path: quarkus/container
@@ -165,26 +131,31 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Setup Java
         uses: ./.github/actions/java-setup
 
       - name: Setup Minikube-Kubernetes
-        uses: manusa/actions-setup-minikube@v2.13.1
+        uses: manusa/actions-setup-minikube@b589f2d61bf96695c546929c72b38563e856059d # v2.14.0
         with:
           minikube version: ${{ env.MINIKUBE_VERSION }}
           kubernetes version: ${{ env.KUBERNETES_VERSION }}
           github token: ${{ secrets.GITHUB_TOKEN }}
           driver: docker
-          start args: --memory=${{ env.MINIKUBE_MEMORY }}
+          start args: --memory=${{ env.MINIKUBE_MEMORY }} --addons=registry --insecure-registry=192.168.49.0/24
 
       - name: Install OPM
-        uses: redhat-actions/openshift-tools-installer@v1
+        uses: redhat-actions/openshift-tools-installer@144527c7d98999f2652264c048c7a9bd103f8a82 # v1.13.1
         with:
           source: github
           opm: 1.21.0
 
+      - name: Install OC
+        uses: redhat-actions/openshift-tools-installer@144527c7d98999f2652264c048c7a9bd103f8a82 # v1.13.1
+        with:
+          oc: 4
+
       - name: Install Yq
         run: sudo snap install yq
 
@@ -194,7 +165,7 @@ jobs:
 
       - name: Download keycloak distribution
         id: download-keycloak-dist
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           name: keycloak-dist
           path: quarkus/container
@@ -202,29 +173,20 @@ jobs:
       - name: Arrange OLM test installation
         working-directory: operator
         run: |
+          echo "Minikube IP $(minikube ip)"
           eval $(minikube -p minikube docker-env)
-          ./scripts/olm-testing.sh ${GITHUB_SHA::6}
+          REGISTRY=$(minikube ip):5000 ./scripts/olm-testing.sh ${GITHUB_SHA::6}
 
       - name: Deploy an example Keycloak and wait for it to be ready
-        working-directory: operator
+        working-directory: operator/scripts
         run: |
-          kubectl apply -f src/test/resources/example-postgres.yaml
+          ./check-crd-installed.sh keycloaks
-          ./scripts/check-crds-installed.sh
+          ./check-crd-installed.sh keycloakrealmimports
-          kubectl apply -f src/test/resources/example-db-secret.yaml
+          ./deploy-examples.sh
-          kubectl apply -f src/test/resources/example-tls-secret.yaml
-          kubectl apply -f src/test/resources/example-keycloak.yaml
-          kubectl apply -f src/test/resources/example-realm.yaml
-          # Wait for the CRs to be ready
-          ./scripts/check-examples-installed.sh
           
       - name: Single namespace cleanup
-        working-directory: operator
+        working-directory: operator/scripts
-        run: |
+        run: ./undeploy-examples.sh
-          kubectl delete -f src/test/resources/example-postgres.yaml
-          kubectl delete -f src/test/resources/example-db-secret.yaml
-          kubectl delete -f src/test/resources/example-tls-secret.yaml
-          kubectl delete -f src/test/resources/example-keycloak.yaml
-          kubectl delete -f src/test/resources/example-realm.yaml
       
       - name: Arrange OLM test installation for all namespaces
         working-directory: operator
@@ -233,16 +195,41 @@ jobs:
           kubectl patch operatorgroup og --type json --patch '[{"op":"remove","path":"/spec/targetNamespaces"}]'
        
       - name: Deploy an example Keycloak in a different namespace and wait for it to be ready
-        working-directory: operator
+        working-directory: operator/scripts
         run: |
           kubectl create ns keycloak
-          kubectl apply -f src/test/resources/example-postgres.yaml -n keycloak
+          ./deploy-examples.sh keycloak
-          kubectl apply -f src/test/resources/example-db-secret.yaml -n keycloak
+          ./undeploy-examples.sh keycloak
-          kubectl apply -f src/test/resources/example-tls-secret.yaml -n keycloak
+
-          kubectl apply -f src/test/resources/example-keycloak.yaml -n keycloak
+      - name: Install ServiceMonitor CRD
-          kubectl apply -f src/test/resources/example-realm.yaml -n keycloak
+        working-directory: operator
-          # Wait for the CRs to be ready
+        run: |
-          ./scripts/check-examples-installed.sh keycloak
+          kubectl apply -f src/test/resources/service-monitor-crds.yml
+          ./scripts/check-crd-installed.sh servicemonitors
+          kubectl delete pod -l name=keycloak-operator
+
+      - name: Deploy an example Keycloak with ServiceMonitor
+        working-directory: operator/scripts
+        run: |
+          ./deploy-examples.sh keycloak
+          kubectl -n keycloak wait servicemonitor/example-kc --for=jsonpath='{.metadata.name}' --timeout=60s
+
+      - name: Debug Custom Resources
+        if: failure()
+        run: |
+          kubectl get keycloaks -A -o yaml
+          kubectl get keycloakrealmimports -A -o yaml
+
+      - name: Gather inspect report
+        if: failure()
+        run: oc adm inspect ns
+
+      - name: Upload inspect report
+        if: failure()
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: oc-inspect
+          path: inspect.*
 
   check:
     name: Status Check - Keycloak Operator CI
@@ -250,12 +237,12 @@ jobs:
     needs:
       - conditional
       - build
-      - test-local
+      - test-local-apiserver
       - test-remote
       - test-olm
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - uses: ./.github/actions/status-check
         with:
           jobs: ${{ toJSON(needs) }}

.github/workflows/quarkus-next.yml

@@ -25,7 +25,7 @@ jobs:
     permissions:
       contents: write # Required to push changes to the repository
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: main
           fetch-depth: 0

.github/workflows/schedule-nightly.yml

@@ -2,7 +2,7 @@ name: Scheduled nightly workflows
 
 on: 
   schedule:
-    - cron: '0 0 * * *'
+    - cron: '0 4 * * *'
   workflow_dispatch:
 
 permissions:
@@ -19,7 +19,7 @@ jobs:
     steps:
       - id: latest-release
         run: |
-          branch="release/$(gh api repos/keycloak/keycloak/branches | jq -r '.[].name' | sort -r | awk -F'/' '/[0-9.]+$/ {print $NF; exit}')"
+          branch="$(gh api --paginate repos/keycloak/keycloak/branches -q '.[].name' | grep '^release/' | sort -r -V | head -n 1)"
           echo "branch=$branch"
           echo "branch=$branch" >> "$GITHUB_OUTPUT"
         env:

.github/workflows/snyk-analysis.yml

@@ -21,12 +21,12 @@ jobs:
     permissions:
       security-events: write # Required for SARIF uploads
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Build Keycloak
         uses: ./.github/actions/build-keycloak
 
-      - uses: snyk/actions/setup@master
+      - uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04 # master
 
       - name: Check for vulnerabilities in Quarkus
         run: snyk test --policy-path=${GITHUB_WORKSPACE}/.github/snyk/.snyk --all-projects --prune-repeated-subdependencies --exclude=tests --sarif-file-output=quarkus-report.sarif quarkus/deployment
@@ -35,7 +35,7 @@ jobs:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
 
       - name: Upload Quarkus scanner results to GitHub
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
         continue-on-error: true
         with:
           sarif_file: quarkus-report.sarif
@@ -50,7 +50,7 @@ jobs:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
 
       - name: Upload Operator scanner results to GitHub
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
         with:
           sarif_file: operator-report.sarif
           category: snyk-operator-report

.github/workflows/stability-base-reruns.yml

@@ -0,0 +1,62 @@
+name: Stability - Base Reruns
+
+on:
+  workflow_dispatch:
+    inputs:
+      tests:
+        type: string
+        description: Tests to run
+        required: true
+      count:
+        type: number
+        description: Number of re-runs
+        default: 50
+
+env:
+  MAVEN_ARGS: "-B -nsu -Daether.connector.http.connectionMaxTtl=25"
+
+defaults:
+  run:
+    shell: bash
+
+permissions:
+  contents: read
+
+jobs:
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Build Keycloak
+        uses: ./.github/actions/build-keycloak
+
+  base-integration-tests:
+    name: Base IT
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 360
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - id: integration-test-setup
+        name: Integration test setup
+        uses: ./.github/actions/integration-test-setup
+
+      - name: Run base tests
+        run: |
+          TESTS="${{ inputs.tests }}"
+          COUNT=${{ inputs.count }}
+          echo "Tests: $TESTS, count: $COUNT"
+          FAILURES=0
+          for i in $(seq 1 $COUNT); do
+            echo "========================================================================="
+            echo Run: $i
+            echo "========================================================================="
+            ./mvnw test ${{ env.SUREFIRE_RETRY }} -Pauth-server-quarkus -Dtest=$TESTS -pl testsuite/integration-arquillian/tests/base 2>&1 | misc/log/trimmer.sh || FAILURES=$(($FAILURES + 1)) 
+            FAILURES=$(($FAILURES + $?))
+          done
+          echo "Failures: $FAILURES"
+          exit $FAILURES

.github/workflows/stability-base.yml

@@ -0,0 +1,61 @@
+name: Stability - Base
+
+on:
+  workflow_dispatch:
+
+env:
+  MAVEN_ARGS: "-B -nsu -Daether.connector.http.connectionMaxTtl=25"
+
+defaults:
+  run:
+    shell: bash
+
+permissions:
+  contents: read
+
+jobs:
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Build Keycloak
+        uses: ./.github/actions/build-keycloak
+
+  base-integration-tests:
+    name: Base IT
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 100
+    strategy:
+      matrix:
+        group: [ 1, 2, 3, 4, 5, 6 ]
+      fail-fast: false
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - id: integration-test-setup
+        name: Integration test setup
+        uses: ./.github/actions/integration-test-setup
+
+      - name: Run base tests
+        run: |
+          TESTS=`testsuite/integration-arquillian/tests/base/testsuites/base-suite.sh ${{ matrix.group }}`
+          echo "Tests: $TESTS"
+          ./mvnw test ${{ env.SUREFIRE_RETRY }} -Pauth-server-quarkus -Dtest=$TESTS -pl testsuite/integration-arquillian/tests/base 2>&1 | misc/log/trimmer.sh
+
+  delete-artifacts:
+    name: Delete artifacts
+    needs: base-integration-tests
+    runs-on: ubuntu-latest
+    if: always()
+    env:
+      GH_TOKEN: ${{ github.token }}
+    permissions:
+      actions: write
+    steps:
+      - name: Delete artifacts
+        run:
+          gh api /repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts | jq .artifacts[].id | xargs -I {} gh api -X DELETE /repos/${{ github.repository }}/actions/artifacts/{}

.github/workflows/stability-clustering.yml

@@ -0,0 +1,57 @@
+name: Stability - Clustering
+
+on:
+  workflow_dispatch:
+
+env:
+  MAVEN_ARGS: "-B -nsu -Daether.connector.http.connectionMaxTtl=25"
+
+defaults:
+  run:
+    shell: bash
+
+permissions:
+  contents: read
+
+jobs:
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Build Keycloak
+        uses: ./.github/actions/build-keycloak
+
+  clustering-integration-tests:
+    name: Clustering IT
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 35
+    env:
+      MAVEN_OPTS: -Xmx1024m
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - id: integration-test-setup
+        name: Integration test setup
+        uses: ./.github/actions/integration-test-setup
+
+      - name: Run cluster tests
+        run: |
+          ./mvnw test ${{ env.SUREFIRE_RETRY }} -Pauth-server-cluster-quarkus,db-postgres "-Dwebdriver.chrome.driver=$CHROMEWEBDRIVER/chromedriver" -Dsession.cache.owners=2 -Dtest=**.cluster.** -pl testsuite/integration-arquillian/tests/base 2>&1 | misc/log/trimmer.sh
+
+  delete-artifacts:
+    name: Delete artifacts
+    needs: clustering-integration-tests
+    runs-on: ubuntu-latest
+    if: always()
+    env:
+      GH_TOKEN: ${{ github.token }}
+    permissions:
+      actions: write
+    steps:
+      - name: Delete artifacts
+        run:
+          gh api /repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts | jq .artifacts[].id | xargs -I {} gh api -X DELETE /repos/${{ github.repository }}/actions/artifacts/{}

.github/workflows/stability-js-ci.yml

@@ -0,0 +1,172 @@
+name: Stability - Keycloak JavaScript CI
+
+on:
+  workflow_dispatch:
+
+env:
+  MAVEN_ARGS: "-B -nsu -Daether.connector.http.connectionMaxTtl=25"
+
+defaults:
+  run:
+    shell: bash
+
+permissions:
+  contents: read
+
+jobs:
+  build-keycloak:
+    name: Build Keycloak
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Build Keycloak
+        uses: ./.github/actions/build-keycloak
+
+      - name: Prepare archive for upload
+        run: |
+          mv ./quarkus/dist/target/keycloak-999.0.0-SNAPSHOT.tar.gz ./keycloak-999.0.0-SNAPSHOT.tar.gz
+
+      - name: Upload Keycloak dist
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: keycloak
+          path: keycloak-999.0.0-SNAPSHOT.tar.gz
+
+  account-ui-e2e:
+    name: Account UI E2E
+    needs:
+      - build-keycloak
+    runs-on: ubuntu-latest
+    env:
+      WORKSPACE: "@keycloak/keycloak-account-ui"
+    strategy:
+      matrix:
+        browser: [chromium, firefox]
+        exclude:
+          # Only test with Firefox on scheduled runs
+          - browser: ${{ github.event_name != 'workflow_dispatch' && 'firefox' || '' }}
+      fail-fast: false
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - uses: ./.github/actions/pnpm-setup
+
+      - name: Download Keycloak server
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        with:
+          name: keycloak
+
+      - name: Setup Java
+        uses: ./.github/actions/java-setup
+
+      - name: Start Keycloak server
+        run: |
+          tar xfvz keycloak-999.0.0-SNAPSHOT.tar.gz
+          keycloak-999.0.0-SNAPSHOT/bin/kc.sh start-dev --features=transient-users,oid4vc-vci &> ~/server.log &
+        env:
+          KC_BOOTSTRAP_ADMIN_USERNAME: admin
+          KC_BOOTSTRAP_ADMIN_PASSWORD: admin
+
+      - name: Install Playwright browsers
+        run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} exec playwright install --with-deps
+        working-directory: js
+
+      - name: Run Playwright tests
+        run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} test -- --project=${{ matrix.browser }}
+        working-directory: js
+
+      - name: Upload Playwright report
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        if: failure()
+        with:
+          name: account-ui-playwright-report-${{ matrix.browser }}
+          path: js/apps/account-ui/playwright-report
+          retention-days: 7
+
+      - name: Upload server logs
+        if: failure()
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: account-ui-server-log-${{ matrix.browser }}
+          path: ~/server.log
+          retention-days: 7
+
+  admin-ui-e2e:
+    name: Admin UI E2E
+    needs:
+      - build-keycloak
+    runs-on: ubuntu-latest
+    env:
+      WORKSPACE: "@keycloak/keycloak-admin-ui"
+    strategy:
+      matrix:
+        browser: [chromium, firefox]
+        exclude:
+          # Only test with Firefox on scheduled runs
+          - browser: ${{ github.event_name != 'workflow_dispatch' && 'firefox' || '' }}
+      fail-fast: false
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - uses: ./.github/actions/pnpm-setup
+
+      - name: Download Keycloak server
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        with:
+          name: keycloak
+
+      - name: Setup Java
+        uses: ./.github/actions/java-setup
+
+      - name: Start Keycloak server
+        run: |
+          tar xfvz keycloak-999.0.0-SNAPSHOT.tar.gz
+          keycloak-999.0.0-SNAPSHOT/bin/kc.sh start-dev --features=admin-fine-grained-authz:v2,transient-users,spiffe,oid4vc-vci &> ~/server.log &
+        env:
+          KC_BOOTSTRAP_ADMIN_USERNAME: admin
+          KC_BOOTSTRAP_ADMIN_PASSWORD: admin
+          KC_BOOTSTRAP_ADMIN_CLIENT_ID: temporary-admin-service
+          KC_BOOTSTRAP_ADMIN_CLIENT_SECRET: temporary-admin-service
+
+      - name: Install Playwright browsers
+        run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} exec playwright install --with-deps
+        working-directory: js
+
+      - name: Run Playwright tests
+        run: pnpm --fail-if-no-match --filter ${{ env.WORKSPACE }} test:integration -- --project=${{ matrix.browser }}
+        working-directory: js
+
+      - name: Upload Playwright report
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        if: failure()
+        with:
+          name: admin-ui-playwright-report-${{ matrix.browser }}
+          path: js/apps/admin-ui/playwright-report
+          retention-days: 7
+
+      - name: Upload server logs
+        if: failure()
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: admin-ui-server-log-${{ matrix.browser }}
+          path: ~/server.log
+          retention-days: 7
+
+  delete-artifacts:
+    name: Delete artifacts
+    needs:
+      - account-ui-e2e
+      - admin-ui-e2e
+    runs-on: ubuntu-latest
+    if: always()
+    env:
+      GH_TOKEN: ${{ github.token }}
+    permissions:
+      actions: write
+    steps:
+      - name: Delete artifacts (excluding Playwright reports and server logs)
+        run: |
+          gh api /repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts \
+          | jq '.artifacts[] | select(.name | test("playwright-report|server-log") | not) | .id' \
+          | xargs -I {} gh api -X DELETE /repos/${{ github.repository }}/actions/artifacts/{}

.github/workflows/trivy-analysis.yml

@@ -24,10 +24,10 @@ jobs:
       security-events: write # Required for SARIF uploads
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@0.30.0
+        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1
         with:
           image-ref: quay.io/keycloak/${{ matrix.container }}:nightly
           format: sarif
@@ -41,7 +41,7 @@ jobs:
           TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
         with:
           sarif_file: trivy-results.sarif
           category: ${{ matrix.container }}

.github/workflows/weblate.yml

@@ -35,4 +35,5 @@ jobs:
       - run: |
           if [ '${{ secrets.WEBLATE_TOKEN }}' != '' ]; then
             curl --fail-with-body -d operation=pull -H "Authorization: Token ${{ secrets.WEBLATE_TOKEN }}" https://hosted.weblate.org/api/projects/keycloak/repository/
+            curl --fail-with-body -d operation=push -H "Authorization: Token ${{ secrets.WEBLATE_TOKEN }}" https://hosted.weblate.org/api/projects/keycloak/repository/
           fi

.gitignore

@@ -5,6 +5,7 @@
 # Intellij
 ###################
 .idea
+.run
 *.iml
 !.idea/icon.png
 
@@ -97,3 +98,7 @@ quarkus/data/*.db
 
 .env
 .env.test
+
+# Keycloak state dir as suggested in the docs
+# -Dkc.home.dir=.kc
+.kc

ADOPTERS.md

@@ -50,6 +50,8 @@ List of organization names below is based on information collected using Keycloa
 * Prodesan
 * Quest Software
 * Research Industrial Software Engineering (RISE)
+* [SICK AG](https://www.sick.com)
+* [SMF](https://www.smf.de)
 * Sportsbet.com.au
 * [Stacklok](https://stacklok.com/)
 * Stack Labs
@@ -61,4 +63,5 @@ List of organization names below is based on information collected using Keycloa
 * TRT9 - Brasil
 * UnitedHealthcare
 * Wayfair LLC
+* [Xata](https://xata.io)
 * ...More individuals

CONTRIBUTING.md

@@ -110,6 +110,33 @@ git commit --signoff --message "This is the commit message"
 
 This option adds a `Signed-off-by` trailer at the end of the commit log message.
 
+### Spotless
+
+Spotless is used to check and apply code formatting. To check your code locally before sending a PR run:
+
+```
+./mvnw spotless:check
+```
+
+You can either use your IDE to fix these issues; or Spotless can fix them for you by running:
+
+```
+./mvnw spotless:apply
+```
+
+A good practice is to create a commit with your changes prior to running `spotless:apply` then you can see and
+review what changes Spotless has applied, for example by using a diff tool. Finally, if you are happy with the changes
+Spotless has applied you can amend the changes to your commit by running:
+
+```
+git add -a
+git commit --amend
+```
+
+Note: If you get the error `Could not find goal 'verify' in plugin com.diffplug.spotless:spotless-maven-plugin` you are
+probably running `mvn spotless:check` instead of `./mvnw spotless:check`. This is most likely a bug in Maven or the 
+Spotless plugin.
+ 
 ### Commit messages and issue linking
 
 The format for a commit message should look like:

MAINTAINERS.md

@@ -1,12 +1,11 @@
 # Active maintainers
 
 * [Alexander Schwartz](https://github.com/ahus1)
-* [Bruno Oliveira da Silva](https://github.com/abstractj)
 * [Marek Posolda](https://github.com/mposolda)
-* [Michal Hajas](https://github.com/mhajas)
 * [Pedro Igor](https://github.com/pedroigor)
 * [Sebastian Schuster](https://github.com/sschu)
 * [Stan Silvert](https://github.com/ssilvert)
+* [Steven Hawkins](https://github.com/shawkins)
 * [Stian Thorgersen](https://github.com/stianst) (project lead)
 * [Takashi Norimatsu](https://github.com/tnorimat)
 * [Thomas Darimont](https://github.com/thomasdarimont)
@@ -14,6 +13,8 @@
 
 # Emeritus maintainers
 
+* [Bruno Oliveira da Silva](https://github.com/abstractj)
 * [Hynek Mlnařík](https://github.com/hmlnarik)
+* [Michal Hajas](https://github.com/mhajas)
 * [Pavel Drozd](https://github.com/pdrozd)
 

adapters/pom.xml

@@ -24,7 +24,7 @@
         <relativePath>../pom.xml</relativePath>
     </parent>
     <name>Keycloak Adapters</name>
-    <description/>
+    <description>Keycloak Adapters Parent</description>
     <modelVersion>4.0.0</modelVersion>
 
     <artifactId>keycloak-adapters-pom</artifactId>

adapters/saml/core-public/pom.xml

@@ -28,7 +28,7 @@
 
     <artifactId>keycloak-saml-adapter-api-public</artifactId>
     <name>Keycloak SAML Client Adapter Public API</name>
-    <description/>
+    <description>Keycloak SAML Client Adapter Public API</description>
 
 
     <properties>

adapters/saml/core-public/src/main/java/org/keycloak/adapters/saml/SamlAuthenticationError.java

@@ -17,11 +17,12 @@
 
 package org.keycloak.adapters.saml;
 
+import java.util.Objects;
+
 import org.keycloak.adapters.spi.AuthenticationError;
 import org.keycloak.dom.saml.v2.protocol.StatusCodeType;
 import org.keycloak.dom.saml.v2.protocol.StatusResponseType;
 import org.keycloak.saml.common.constants.JBossSAMLURIConstants;
-import java.util.Objects;
 
 /**
  * Object that describes the SAML error that happened.

adapters/saml/core-public/src/main/java/org/keycloak/adapters/saml/SamlPrincipal.java

@@ -17,10 +17,6 @@
 
 package org.keycloak.adapters.saml;
 
-import org.keycloak.common.util.MultivaluedHashMap;
-import org.keycloak.dom.saml.v2.assertion.AssertionType;
-
-import org.keycloak.dom.saml.v2.assertion.NameIDType;
 import java.io.Serializable;
 import java.net.URI;
 import java.security.Principal;
@@ -28,6 +24,11 @@ import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
+
+import org.keycloak.common.util.MultivaluedHashMap;
+import org.keycloak.dom.saml.v2.assertion.AssertionType;
+import org.keycloak.dom.saml.v2.assertion.NameIDType;
+
 import org.w3c.dom.Document;
 
 /**

adapters/saml/core/pom.xml

@@ -28,7 +28,7 @@
 
     <artifactId>keycloak-saml-adapter-core</artifactId>
     <name>Keycloak SAML Client Adapter Core</name>
-    <description/>
+    <description>Keycloak SAML Client Adapter Core</description>
 
     <properties>
         <timestamp>${maven.build.timestamp}</timestamp>

adapters/saml/core/src/main/java/org/keycloak/adapters/cloned/HttpAdapterUtils.java

@@ -17,19 +17,20 @@
 
 package org.keycloak.adapters.cloned;
 
-import org.apache.http.HttpEntity;
-import org.apache.http.HttpResponse;
-
 import java.io.IOException;
 import java.io.InputStream;
 import javax.xml.crypto.dsig.keyinfo.KeyInfo;
+
+import org.keycloak.adapters.saml.descriptor.parsers.SamlDescriptorIDPKeysExtractor;
+import org.keycloak.common.util.MultivaluedHashMap;
+import org.keycloak.saml.common.exceptions.ParsingException;
+
+import org.apache.http.HttpEntity;
+import org.apache.http.HttpResponse;
 import org.apache.http.HttpStatus;
 import org.apache.http.client.HttpClient;
 import org.apache.http.client.methods.HttpGet;
 import org.apache.http.util.EntityUtils;
-import org.keycloak.adapters.saml.descriptor.parsers.SamlDescriptorIDPKeysExtractor;
-import org.keycloak.common.util.MultivaluedHashMap;
-import org.keycloak.saml.common.exceptions.ParsingException;
 
 /**
  * @author <a href="mailto:hmlnarik@redhat.com">Hynek Mlnařík</a>

adapters/saml/core/src/main/java/org/keycloak/adapters/cloned/HttpClientBuilder.java

@@ -17,9 +17,32 @@
 
 package org.keycloak.adapters.cloned;
 
+import java.io.IOException;
+import java.net.URI;
+import java.security.KeyStore;
+import java.security.SecureRandom;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import java.util.Collections;
+import java.util.Date;
+import java.util.List;
+import java.util.concurrent.TimeUnit;
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLException;
+import javax.net.ssl.SSLSession;
+import javax.net.ssl.SSLSocket;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.X509TrustManager;
+
+import org.keycloak.common.util.EnvUtil;
+import org.keycloak.common.util.KeystoreUtil;
+
 import org.apache.http.HttpHost;
 import org.apache.http.client.CookieStore;
 import org.apache.http.client.HttpClient;
+import org.apache.http.client.params.ClientPNames;
+import org.apache.http.client.params.CookiePolicy;
 import org.apache.http.conn.ClientConnectionManager;
 import org.apache.http.conn.params.ConnRoutePNames;
 import org.apache.http.conn.scheme.PlainSocketFactory;
@@ -36,28 +59,6 @@ import org.apache.http.impl.conn.SingleClientConnManager;
 import org.apache.http.impl.conn.tsccm.ThreadSafeClientConnManager;
 import org.apache.http.params.BasicHttpParams;
 import org.apache.http.params.HttpConnectionParams;
-import org.keycloak.common.util.EnvUtil;
-import org.keycloak.common.util.KeystoreUtil;
-
-import javax.net.ssl.HostnameVerifier;
-import javax.net.ssl.SSLContext;
-import javax.net.ssl.SSLException;
-import javax.net.ssl.SSLSession;
-import javax.net.ssl.SSLSocket;
-import javax.net.ssl.TrustManager;
-import javax.net.ssl.X509TrustManager;
-import java.io.IOException;
-import java.net.URI;
-import java.security.KeyStore;
-import java.security.SecureRandom;
-import java.security.cert.CertificateException;
-import java.security.cert.X509Certificate;
-import java.util.Collections;
-import java.util.Date;
-import java.util.List;
-import java.util.concurrent.TimeUnit;
-import org.apache.http.client.params.ClientPNames;
-import org.apache.http.client.params.CookiePolicy;
 
 /**
  * Abstraction for creating HttpClients. Allows SSL configuration.

adapters/saml/core/src/main/java/org/keycloak/adapters/cloned/SniSSLSocketFactory.java

@@ -17,16 +17,6 @@
 
 package org.keycloak.adapters.cloned;
 
-import org.apache.http.HttpHost;
-import org.apache.http.conn.scheme.HostNameResolver;
-import org.apache.http.conn.ssl.SSLSocketFactory;
-import org.apache.http.conn.ssl.TrustStrategy;
-import org.apache.http.conn.ssl.X509HostnameVerifier;
-import org.apache.http.protocol.HttpContext;
-import org.keycloak.common.util.Environment;
-
-import javax.net.ssl.SSLContext;
-import javax.net.ssl.SSLSocket;
 import java.io.IOException;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
@@ -44,6 +34,17 @@ import java.security.UnrecoverableKeyException;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.logging.Level;
 import java.util.logging.Logger;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLSocket;
+
+import org.keycloak.common.util.Environment;
+
+import org.apache.http.HttpHost;
+import org.apache.http.conn.scheme.HostNameResolver;
+import org.apache.http.conn.ssl.SSLSocketFactory;
+import org.apache.http.conn.ssl.TrustStrategy;
+import org.apache.http.conn.ssl.X509HostnameVerifier;
+import org.apache.http.protocol.HttpContext;
 
 /**
  * SSLSocketFactory that uses Server Name Indication (SNI) TLS extension.

adapters/saml/core/src/main/java/org/keycloak/adapters/saml/AbstractInitiateLogin.java

@@ -17,8 +17,10 @@
 
 package org.keycloak.adapters.saml;
 
+import java.io.IOException;
+import java.security.KeyPair;
+
 import org.keycloak.adapters.saml.SamlDeployment.IDP.SingleSignOnService;
-import org.jboss.logging.Logger;
 import org.keycloak.adapters.spi.AuthChallenge;
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.saml.BaseSAML2BindingBuilder;
@@ -28,8 +30,7 @@ import org.keycloak.saml.common.constants.JBossSAMLURIConstants;
 import org.keycloak.saml.common.exceptions.ConfigurationException;
 import org.keycloak.saml.common.exceptions.ProcessingException;
 
-import java.io.IOException;
+import org.jboss.logging.Logger;
-import java.security.KeyPair;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>

adapters/saml/core/src/main/java/org/keycloak/adapters/saml/DefaultSamlDeployment.java

@@ -17,21 +17,22 @@
 
 package org.keycloak.adapters.saml;
 
-import org.keycloak.common.enums.SslRequired;
+import java.net.URI;
-import org.keycloak.saml.SignatureAlgorithm;
-
 import java.security.KeyPair;
 import java.security.PrivateKey;
 import java.security.PublicKey;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Set;
-import org.apache.http.client.HttpClient;
+
 import org.keycloak.adapters.saml.rotation.SamlDescriptorPublicKeyLocator;
+import org.keycloak.common.enums.SslRequired;
 import org.keycloak.rotation.CompositeKeyLocator;
 import org.keycloak.rotation.HardcodedKeyLocator;
 import org.keycloak.rotation.KeyLocator;
-import java.net.URI;
+import org.keycloak.saml.SignatureAlgorithm;
+
+import org.apache.http.client.HttpClient;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>

adapters/saml/core/src/main/java/org/keycloak/adapters/saml/PropertiesBasedRoleMapper.java

@@ -20,14 +20,14 @@ package org.keycloak.adapters.saml;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.InputStream;
-import java.util.Collections;
 import java.util.HashSet;
 import java.util.Properties;
 import java.util.Set;
 
-import org.jboss.logging.Logger;
 import org.keycloak.adapters.saml.config.parsers.ResourceLoader;
 
+import org.jboss.logging.Logger;
+
 /**
  * A {@link RoleMappingsProvider} implementation that uses a {@code properties} file to determine the mappings that should be applied
  * to the SAML principal and roles. It is always identified by the id {@code properties-based-role-mapper} in {@code keycloak-saml.xml}.

adapters/saml/core/src/main/java/org/keycloak/adapters/saml/RoleMappingsProviderUtils.java

@@ -22,10 +22,11 @@ import java.util.Map;
 import java.util.Properties;
 import java.util.ServiceLoader;
 
-import org.jboss.logging.Logger;
 import org.keycloak.adapters.saml.config.SP;
 import org.keycloak.adapters.saml.config.parsers.ResourceLoader;
 
+import org.jboss.logging.Logger;
+
 /**
  * Utility class that allows for the instantiation and configuration of role mappings providers.
  *

adapters/saml/core/src/main/java/org/keycloak/adapters/saml/SamlAuthenticator.java

@@ -17,7 +17,6 @@
 
 package org.keycloak.adapters.saml;
 
-import org.jboss.logging.Logger;
 import org.keycloak.adapters.saml.profile.SamlAuthenticationHandler;
 import org.keycloak.adapters.saml.profile.ecp.EcpAuthenticationHandler;
 import org.keycloak.adapters.saml.profile.webbrowsersso.WebBrowserSsoAuthenticationHandler;
@@ -25,6 +24,8 @@ import org.keycloak.adapters.spi.AuthChallenge;
 import org.keycloak.adapters.spi.AuthOutcome;
 import org.keycloak.adapters.spi.HttpFacade;
 
+import org.jboss.logging.Logger;
+
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $

adapters/saml/core/src/main/java/org/keycloak/adapters/saml/SamlDeployment.java

@@ -17,15 +17,16 @@
 
 package org.keycloak.adapters.saml;
 
-import org.keycloak.common.enums.SslRequired;
+import java.net.URI;
-import org.keycloak.saml.SignatureAlgorithm;
-
 import java.security.KeyPair;
 import java.security.PrivateKey;
 import java.util.Set;
-import org.apache.http.client.HttpClient;
+
+import org.keycloak.common.enums.SslRequired;
 import org.keycloak.rotation.KeyLocator;
-import java.net.URI;
+import org.keycloak.saml.SignatureAlgorithm;
+
+import org.apache.http.client.HttpClient;
 
 /**
  * Represents SAML deployment configuration.

adapters/saml/core/src/main/java/org/keycloak/adapters/saml/SamlSession.java

@@ -17,11 +17,11 @@
 
 package org.keycloak.adapters.saml;
 
-import org.keycloak.adapters.spi.KeycloakAccount;
-
-import javax.xml.datatype.XMLGregorianCalendar;
 import java.io.Serializable;
 import java.util.Set;
+import javax.xml.datatype.XMLGregorianCalendar;
+
+import org.keycloak.adapters.spi.KeycloakAccount;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>

adapters/saml/core/src/main/java/org/keycloak/adapters/saml/SamlSessionStore.java

@@ -17,10 +17,10 @@
 
 package org.keycloak.adapters.saml;
 
-import org.keycloak.adapters.spi.AdapterSessionStore;
-
 import java.util.List;
 
+import org.keycloak.adapters.spi.AdapterSessionStore;
+
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $

adapters/saml/core/src/main/java/org/keycloak/adapters/saml/SamlUtil.java

@@ -17,18 +17,19 @@
 
 package org.keycloak.adapters.saml;
 
-import org.jboss.logging.Logger;
+import java.io.IOException;
+import javax.xml.datatype.DatatypeConstants;
+import javax.xml.datatype.XMLGregorianCalendar;
+
 import org.keycloak.adapters.spi.HttpFacade;
 import org.keycloak.saml.BaseSAML2BindingBuilder;
 import org.keycloak.saml.common.constants.GeneralConstants;
 import org.keycloak.saml.common.exceptions.ConfigurationException;
 import org.keycloak.saml.common.exceptions.ProcessingException;
 import org.keycloak.saml.processing.core.saml.v2.util.XMLTimeUtil;
-import org.w3c.dom.Document;
 
-import javax.xml.datatype.DatatypeConstants;
+import org.jboss.logging.Logger;
-import javax.xml.datatype.XMLGregorianCalendar;
+import org.w3c.dom.Document;
-import java.io.IOException;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>

adapters/saml/core/src/main/java/org/keycloak/adapters/saml/config/PemUtils.java

@@ -20,7 +20,6 @@
 package org.keycloak.adapters.saml.config;
 
 import java.io.ByteArrayInputStream;
-import java.io.IOException;
 import java.io.InputStream;
 import java.security.KeyFactory;
 import java.security.NoSuchAlgorithmException;
@@ -34,12 +33,13 @@ import java.security.cert.X509Certificate;
 import java.security.spec.InvalidKeySpecException;
 import java.security.spec.PKCS8EncodedKeySpec;
 import java.security.spec.X509EncodedKeySpec;
+import java.util.Base64;
+
+import org.keycloak.common.crypto.CryptoConstants;
+import org.keycloak.common.util.PemException;
 
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.jboss.logging.Logger;
-import org.keycloak.common.crypto.CryptoConstants;
-import org.keycloak.common.util.Base64;
-import org.keycloak.common.util.PemException;
 
 /**
  * Fork of the PemUtils from common module to avoid dependency on keycloak-crypto-default
@@ -125,9 +125,9 @@ public class PemUtils {
     private static byte[] pemToDer(String pem) {
         try {
             pem = removeBeginEnd(pem);
-            return Base64.decode(pem);
+            return Base64.getMimeDecoder().decode(pem);
-        } catch (IOException ioe) {
+        } catch (IllegalArgumentException e) {
-            throw new PemException(ioe);
+            throw new PemException(e);
         }
     }
 

adapters/saml/core/src/main/java/org/keycloak/adapters/saml/config/parsers/AbstractKeycloakSamlAdapterV1Parser.java

@@ -17,16 +17,16 @@
 
 package org.keycloak.adapters.saml.config.parsers;
 
-import org.keycloak.saml.common.parsers.AbstractStaxParser;
-
-import org.keycloak.saml.common.util.StaxParserUtil;
-import org.keycloak.saml.processing.core.parsers.util.QNameEnumLookup;
 import java.util.Collections;
 import java.util.Set;
 import javax.xml.XMLConstants;
 import javax.xml.namespace.QName;
 import javax.xml.stream.events.StartElement;
 
+import org.keycloak.saml.common.parsers.AbstractStaxParser;
+import org.keycloak.saml.common.util.StaxParserUtil;
+import org.keycloak.saml.processing.core.parsers.util.QNameEnumLookup;
+
 /**
  * 
  */

adapters/saml/core/src/main/java/org/keycloak/adapters/saml/config/parsers/DeploymentBuilder.java

@@ -17,7 +17,24 @@
 
 package org.keycloak.adapters.saml.config.parsers;
 
-import org.jboss.logging.Logger;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.InputStream;
+import java.net.URI;
+import java.security.KeyPair;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import java.util.HashSet;
+import java.util.Set;
+import java.util.concurrent.TimeUnit;
+
+import org.keycloak.adapters.cloned.HttpClientBuilder;
 import org.keycloak.adapters.saml.DefaultSamlDeployment;
 import org.keycloak.adapters.saml.RoleMappingsProviderUtils;
 import org.keycloak.adapters.saml.SamlDeployment;
@@ -30,23 +47,7 @@ import org.keycloak.common.enums.SslRequired;
 import org.keycloak.saml.SignatureAlgorithm;
 import org.keycloak.saml.common.exceptions.ParsingException;
 
-import java.io.File;
+import org.jboss.logging.Logger;
-import java.io.FileInputStream;
-import java.io.FileNotFoundException;
-import java.io.InputStream;
-import java.security.KeyPair;
-import java.security.KeyStore;
-import java.security.KeyStoreException;
-import java.security.PrivateKey;
-import java.security.PublicKey;
-import java.security.cert.Certificate;
-import java.util.HashSet;
-import java.util.Set;
-import org.keycloak.adapters.cloned.HttpClientBuilder;
-import java.net.URI;
-import java.security.cert.CertificateException;
-import java.security.cert.X509Certificate;
-import java.util.concurrent.TimeUnit;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>

adapters/saml/core/src/main/java/org/keycloak/adapters/saml/config/parsers/HttpClientParser.java

@@ -17,13 +17,13 @@
 
 package org.keycloak.adapters.saml.config.parsers;
 
+import javax.xml.stream.XMLEventReader;
+import javax.xml.stream.events.StartElement;
+
 import org.keycloak.adapters.saml.config.IDP.HttpClientConfig;
 import org.keycloak.saml.common.exceptions.ParsingException;
 import org.keycloak.saml.common.util.StaxParserUtil;
 
-import javax.xml.stream.XMLEventReader;
-import javax.xml.stream.events.StartElement;
-
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $

adapters/saml/core/src/main/java/org/keycloak/adapters/saml/config/parsers/IdpParser.java

@@ -17,14 +17,14 @@
 
 package org.keycloak.adapters.saml.config.parsers;
 
+import java.util.concurrent.TimeUnit;
+import javax.xml.stream.XMLEventReader;
+import javax.xml.stream.events.StartElement;
+
 import org.keycloak.adapters.saml.config.IDP;
 import org.keycloak.saml.common.exceptions.ParsingException;
 import org.keycloak.saml.common.util.StaxParserUtil;
 
-import javax.xml.stream.XMLEventReader;
-import javax.xml.stream.events.StartElement;
-import java.util.concurrent.TimeUnit;
-
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
  * @version $Revision: 1 $