Merge remote-tracking branch 'upstream/main' into ScholarArchiveFetcher

* upstream/main: (44 commits)
  change codecov (JabRef#10616)
  Add entry based on ISSN number JabRef#10124 (JabRef#10178)
  Enable journal information fetcher directly in popup (JabRef#10598)
  Make generate button wider (JabRef#10588)
  make openRewrite stable again
  Rename cleanup_pr.yml to cleanup-pr.yml
  Changelog
  Fix failing fetcher tests (JabRef#10613)
  ShortDoi
  Fix CHANGELOG.md
  Bump commons-cli:commons-cli from 1.5.0 to 1.6.0 (JabRef#10607)
  Fix issue JabRef#9306: Move "Open only one instance of JabRef" preference option to somewhere else (JabRef#10602)
  Update README.md (JabRef#10604)
  Bump me.champeau.jmh from 0.7.1 to 0.7.2
  Bump org.beryx.jlink from 3.0.0 to 3.0.1
  Bump com.dlsc.gemsfx:gemsfx from 1.82.0 to 1.84.0
  Bump org.apache.logging.log4j:log4j-to-slf4j from 2.21.0 to 2.21.1
  Synchronize scrollbars in the change resolver dialog (JabRef#10587)
  Add button for a user to reset the cite command to the default value. (JabRef#10580)
  openrerwrite
  ...

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,18 +1,18 @@
 <!-- 
 Describe the changes you have made here: what, why, ... 
-Link issues that are fixed, e.g. "Fixes #333".
-If you fixed a koppor issue, link it, e.g. "Fixes https://github.com/koppor/jabref/issues/47".
-The title of the PR must not reference an issue, because GitHub does not support autolinking there.
+Link the issue that will be closed, e.g., "Closes #333".
+If your PR closes a koppor issue, link it using its URL, e.g., "Closes https://github.com/koppor/jabref/issues/47".
+"Closes" is a keyword GitHub uses to link PRs with issues; do not change it.
+Don't reference an issue in the PR title because GitHub does not support auto-linking there.
 -->
 
+### Mandatory checks
 
 <!-- 
 - Go through the list below. Please don't remove any items.
 - [x] done; [ ] not done / not applicable
 -->
 
-### Mandatory checks
-
 - [ ] Change in `CHANGELOG.md` described in a way that is understandable for the average user (if applicable)
 - [ ] Tests created for changes (if applicable)
 - [ ] Manually tested changed features in running JabRef (always required)

.github/workflows/add-to-projects.yml

@@ -4,6 +4,9 @@ on:
   issues:
     types: [labeled]
 
+permissions:
+  issues: write
+
 jobs:
   add-to-project:
     runs-on: ubuntu-latest
@@ -12,28 +15,28 @@ jobs:
       - name: "good first issue"
         if: "${{ github.event.label.name == 'good first issue' }}"
         env:
-          GH_TOKEN: ${{ secrets.PROJECT_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           ISSUE_URL=$(jq --raw-output .issue.html_url "$GITHUB_EVENT_PATH")
           gh project item-add 5 --owner jabref --url $ISSUE_URL
       - name: needs-refinement
         if: github.event.label.name == 'needs-refinement'
         env:
-          GH_TOKEN: ${{ secrets.PROJECT_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           ISSUE_URL=$(jq --raw-output .issue.html_url "$GITHUB_EVENT_PATH")
           gh project item-add 15 --owner jabref --url $ISSUE_URL
       - name: "status: freeze"
         if: "${{ github.event.label.name == 'status: freeze' }}"
         env:
-          GH_TOKEN: ${{ secrets.PROJECT_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           ISSUE_URL=$(jq --raw-output .issue.html_url "$GITHUB_EVENT_PATH")
           gh project item-add 9 --owner jabref --url $ISSUE_URL
       - name: ui
         if: "${{ github.event.label.name == 'ui' }}"
         env:
-          GH_TOKEN: ${{ secrets.PROJECT_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           ISSUE_URL=$(jq --raw-output .issue.html_url "$GITHUB_EVENT_PATH")
           gh project item-add 8 --owner jabref --url $ISSUE_URL

.github/workflows/automerge.yml

@@ -10,10 +10,16 @@ jobs:
     runs-on: ubuntu-latest
     # Run only if PR is inside JabRef's main repository and created by dependabot or by an update workflow
     if: >
-      (github.repository == 'JabRef/jabref') &&
-      ((github.actor == 'dependabot[bot]') ||
-       ((startsWith(github.event.pull_request.title, '[Bot] ') || (startsWith(github.event.pull_request.title, 'Bump '))) &&
-       (github.event.pull_request.head.repo.full_name == 'JabRef/jabref')))
+      (github.repository == 'JabRef/jabref') && 
+      (github.event.pull_request.head.repo.full_name == 'JabRef/jabref') &&
+      (
+        (github.actor == 'dependabot[bot]') ||
+        (
+          startsWith(github.event.pull_request.title, '[Bot] ') || 
+          startsWith(github.event.pull_request.title, 'Bump ') || 
+          startsWith(github.event.pull_request.title, 'New Crowdin updates')
+        )
+      )
     steps:
       - name: Approve PR
         run: gh pr review --approve "$PR_URL"

.github/workflows/deployment.yml

@@ -224,6 +224,13 @@ jobs:
           # tbn = to-be-notarized
           name: JabRef-macOS-tbn
           path: build/distribution
+      - name: Upload to GitHub workflow artifacts store
+        if: (steps.checksecrets.outputs.secretspresent != 'YES')
+        uses: actions/upload-artifact@v3
+        with:
+          # tbn = to-be-notarized
+          name: JabRef-${{ matrix.os }}
+          path: build/distribution
   announce:
     name: Comment on pull request
     runs-on: ubuntu-latest
@@ -242,7 +249,7 @@ jobs:
         env:
           BUILDJABREFPRIVATEKEY: ${{ secrets.buildJabRefPrivateKey }}
       - name: Comment PR
-        if: steps.checksecrets.outputs.secretspresent == 'YES'
+        if: (steps.checksecrets.outputs.secretspresent == 'YES')
         uses: thollander/actions-comment-pull-request@v2
         with:
           message: |

.github/workflows/tests.yml

@@ -136,7 +136,7 @@ jobs:
           submodules: 'false'
           show-progress: 'false'
       - name: markdownlint-cli2-action
-        uses: DavidAnson/markdownlint-cli2-action@v9
+        uses: DavidAnson/markdownlint-cli2-action@v13
         with:
           globs: |
             *.md
@@ -304,6 +304,7 @@ jobs:
     steps:
       - name: Check secrets presence
         id: checksecrets
+        if: github.ref == 'refs/heads/main'
         shell: bash
         run: |
           if [ "$CODECOV_TOKEN" == "" ]; then
@@ -312,25 +313,31 @@ jobs:
             echo "secretspresent=YES" >> $GITHUB_OUTPUT
           fi
         env:
-          SNAPCRAFT_LOGIN_FILE: ${{ secrets.CODECOV_TOKEN }}
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
       - name: Checkout source
+        if: github.ref == 'refs/heads/main'
         uses: actions/checkout@v4
         with:
           submodules: 'true'
           show-progress: 'false'
       - name: Set up JDK
+        if: github.ref == 'refs/heads/main'
         uses: actions/setup-java@v3
         with:
           java-version: 21.0.1
           distribution: 'liberica'
           cache: 'gradle'
       - name: Update test coverage metrics
-        if: steps.checksecrets.outputs.secretspresent == 'YES'
-        run: xvfb-run --auto-servernum ./gradlew jacocoTestReport && bash <(curl -s https://codecov.io/bash);
+        if: (github.ref == 'refs/heads/main') && (steps.checksecrets.outputs.secretspresent == 'YES')
+        run: xvfb-run --auto-servernum ./gradlew jacocoTestReport
         env:
           CI: "true"
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
           DBMS: "postgresql"
+      - uses: codecov/codecov-action@v3
+        if: (github.ref == 'refs/heads/main') && (steps.checksecrets.outputs.secretspresent == 'YES')
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
   # This is https://github.com/marketplace/actions/gradle-wrapper-validation
   # It ensures that the jar file is from gradle and not by a strange third party.
   gradlevalidation: