chore: release 4.2.1

.github/actions/setup-wheels-test-env/action.yml

@@ -33,6 +33,32 @@ runs:
     - name: Install LuCLI
       uses: ./.github/actions/setup-lucli
 
+    - name: Cache Lucee Express
+      id: express-cache
+      uses: actions/cache@v5
+      with:
+        path: ~/.lucli/express
+        key: lucee-express-${{ runner.os }}-${{ hashFiles('tools/ci/lucee.ci.json', 'lucee.json', 'cli/lucli/templates/app/lucee.json') }}
+        restore-keys: |
+          lucee-express-${{ runner.os }}-
+
+    - name: Report Lucee Express cache
+      shell: bash
+      run: echo "Lucee Express cache hit=${{ steps.express-cache.outputs.cache-hit || 'false' }}"
+
+    - name: Cache Lucee Maven repository
+      id: maven-cache
+      uses: actions/cache@v5
+      with:
+        path: ${{ runner.temp }}/.lucee-mvn
+        key: lucee-mvn-${{ runner.os }}-${{ hashFiles('.env', 'tools/ci/lucee.ci.json', 'lucee.json') }}
+        restore-keys: |
+          lucee-mvn-${{ runner.os }}-
+
+    - name: Report Lucee Maven cache
+      shell: bash
+      run: echo "Lucee Maven cache hit=${{ steps.maven-cache.outputs.cache-hit || 'false' }}"
+
     - name: Create test databases
       shell: bash
       run: |
@@ -81,13 +107,13 @@ runs:
     - name: Download SQLite JDBC driver
       shell: bash
       run: |
-        curl -sL --retry 3 --retry-delay 2 --retry-all-errors "https://repo1.maven.org/maven2/org/xerial/sqlite-jdbc/3.50.3.0/sqlite-jdbc-3.50.3.0.jar" \
-          -o /tmp/sqlite-jdbc.jar
+        bash tools/ci/fetch-sqlite-jdbc.sh /tmp/sqlite-jdbc.jar
 
     - name: Start Lucee server
       shell: bash
       env:
         WHEELS_PORT: ${{ inputs.port }}
+        LUCEE_MAVEN_LOCAL_REPOSITORY: ${{ runner.temp }}/.lucee-mvn
       run: |
         cp tools/ci/lucee.ci.json lucee.json
 
@@ -112,20 +138,19 @@ runs:
       shell: bash
       env:
         WHEELS_PORT: ${{ inputs.port }}
+        LUCEE_MAVEN_LOCAL_REPOSITORY: ${{ runner.temp }}/.lucee-mvn
       run: |
         LUCEE_LIB=$(find ~/.lucli/express -path "*/lib/ext" -type d 2>/dev/null | head -1)
         if [ -z "$LUCEE_LIB" ]; then
           LUCEE_LIB=$(find ~/.lucli/express -maxdepth 2 -name "lib" -type d 2>/dev/null | head -1)
         fi
-        if [ -n "$LUCEE_LIB" ]; then
-          cp /tmp/sqlite-jdbc.jar "$LUCEE_LIB/"
-          echo "SQLite JDBC installed to: $LUCEE_LIB"
-        else
+        if [ -z "$LUCEE_LIB" ]; then
           echo "::error::Could not find Lucee lib directory"
           find ~/.lucli/express -type d | head -20
           exit 1
         fi
 
+        # Stop the first (Express-downloading) start before touching the install.
         kill $(cat /tmp/lucli-server.pid) 2>/dev/null || true
         lucli server stop 2>/dev/null || true
         for i in $(seq 1 15); do
@@ -137,14 +162,34 @@ runs:
         fuser -k "${WHEELS_PORT}/tcp" 2>/dev/null || true
         sleep 2
 
-        nohup lucli server run --port="${WHEELS_PORT}" --force > /tmp/lucli-server.log 2>&1 &
+        # Install the driver after the stop, so the restart picks it up.
+        cp /tmp/sqlite-jdbc.jar "$LUCEE_LIB/"
+        echo "SQLite JDBC installed to: $LUCEE_LIB"
+
+        # No --force here: keep ~/.lucli/servers (and the Lucee extensions installed in it).
+        nohup lucli server run --port="${WHEELS_PORT}" > /tmp/lucli-server.log 2>&1 &
         echo $! > /tmp/lucli-server.pid
 
         echo "Waiting for Lucee to restart..."
+        RESTARTED=0
         for i in $(seq 1 60); do
           if curl -s -o /dev/null --connect-timeout 2 --max-time 3 "http://localhost:${WHEELS_PORT}/" 2>/dev/null; then
             echo "Lucee restarted with SQLite JDBC"
+            RESTARTED=1
             break
           fi
           sleep 2
         done
+        if [ "$RESTARTED" != "1" ]; then
+          echo "::error::Lucee did not restart"
+          cat /tmp/lucli-server.log
+          exit 1
+        fi
+
+        H2_EXT=$(find ~/.lucli/servers -iname '*h2*' 2>/dev/null | head -5)
+        if [ -n "$H2_EXT" ]; then
+          echo "H2 extension preserved after the no-force restart:"
+          echo "$H2_EXT"
+        else
+          echo "::warning::No H2 extension found under ~/.lucli/servers after the no-force restart"
+        fi

.github/workflows/bump-develop-version.yml

@@ -102,8 +102,13 @@ jobs:
           jq '.version' wheels.json
 
       - name: Open bump PR
+        # add-paths: commit only wheels.json, whatever else is in the tree.
+        # CI: a PR opened with GITHUB_TOKEN does not trigger workflows. Whoever
+        # handles the bump PR pushes a commit (an empty one is fine) to its
+        # branch to start CI.
         uses: peter-evans/create-pull-request@v8.1.1
         with:
+          add-paths: wheels.json
           branch: "auto-bump/develop-${{ env.NEW_VERSION }}"
           title: "chore: bump develop snapshot target to ${{ env.NEW_VERSION }}"
           body: |

.github/workflows/cold-start-smoke.yml

@@ -89,9 +89,13 @@ jobs:
                 disable: true
           YAML
           cat "$OVERRIDE"
-          echo "COMPOSE_FILE=compose.yml:$OVERRIDE" >> "$GITHUB_ENV"
+          # compose.ci.yml re-binds each engine's .engine/<engine> home to the
+          # host, reversing the named volume in compose.yml, so the log-collection
+          # step can read ./.engine/<engine> on the host. (No-op for engines not
+          # in the override, e.g. lucee7.)
+          echo "COMPOSE_FILE=compose.yml:compose.ci.yml:$OVERRIDE" >> "$GITHUB_ENV"
           echo "SMOKE_OUT_DIR=$RUNNER_TEMP/cold-start-artifacts" >> "$GITHUB_ENV"
-          COMPOSE_FILE="compose.yml:$OVERRIDE" docker compose config "${{ matrix.engine }}" | grep -A2 'healthcheck:' || true
+          COMPOSE_FILE="compose.yml:compose.ci.yml:$OVERRIDE" docker compose config "${{ matrix.engine }}" | grep -A2 'healthcheck:' || true
 
       # The probes run in development (config/environment.cfm as checked in):
       # `/` renders the welcome page and /wheels/core/tests is available. Point

.github/workflows/commandbox-install-smoke.yml

@@ -73,7 +73,7 @@ jobs:
     # for ForgeBox publishing (its "Install CommandBox" step), just containerized
     # so the box server boots in the same userland it serves from.
     container:
-      image: ortussolutions/commandbox:latest
+      image: ghcr.io/wheels-dev/mirror/ortussolutions/commandbox:latest
     env:
       # Throwaway values for the CI app; not secrets.
       SMOKE_RELOAD_PASSWORD: "wheels-dev"

.github/workflows/compat-matrix.yml

@@ -142,6 +142,12 @@ jobs:
       fail-fast: false
       matrix: ${{ fromJSON(needs.plan.outputs.matrix) }}
     env:
+      # Re-bind each engine's .engine/<engine> home to the host (compose.ci.yml),
+      # reversing the named volume in compose.yml: this job downloads the Oracle
+      # JDBC driver into ./.engine/<engine> on the host before `docker compose
+      # up`, so the engine must read that path through the bind mount. Job-level
+      # so every `docker compose` call (build, up, crash-recovery up) layers it.
+      COMPOSE_FILE: compose.yml:compose.ci.yml
       # The engine container's time zone (compose.yml reads it; UTC when empty, as on every leg
       # but the TZ lanes). Job-level so a crash-recovery `docker compose up` keeps it too.
       # EngineTimeZoneSpec fails the leg if the JVM or the engine didn't take it.

.github/workflows/compat-pr.yml

@@ -52,6 +52,10 @@ jobs:
           - cfengine: lucee7
             database: h2
     env:
+      # Re-bind each engine's .engine/<engine> home to the host (compose.ci.yml),
+      # reversing the named volume in compose.yml, so CI's host-side engine-home
+      # access keeps working. Harmless for engines not in the override.
+      COMPOSE_FILE: compose.yml:compose.ci.yml
       PORT_boxlang: 60001
       PORT_adobe2023: 62023
       PORT_lucee7: 60007

.github/workflows/deploy-ci.yml

@@ -78,7 +78,7 @@ jobs:
           #   vendor/wheels/migrator/, Seeder.cfc, JobWorker.cfc  what CliBridge calls
           # Wider framework boot breakage is caught by the core suite, which is
           # required on its own.
-          PATTERN='^(cli/lucli/|tools/test-cli-local\.sh$|tools/ci/testbox_results\.py$|tools/ci/test_testbox_results\.py$|tools/ci/fallback_port_sentinel\.py$|tools/ci/test_fallback_port_sentinel\.py$|tools/ci/testbox_junit\.py$|tools/ci/test_testbox_junit\.py$|tools/ci/fixtures/testbox/|tools/deploy-[^/]*\.sh$|tools/deploy-dry-run-normalize\.py$|\.github/workflows/deploy-ci\.yml$|\.github/actions/setup-lucli/|tools/lucli\.json$|lucee\.json$|public/|config/|app/(events|global|migrator)/|vendor/wheels/(public/|Public\.cfc$|events/|wheelstest/|migrator/|Seeder\.cfc$|JobWorker\.cfc$))'
+          PATTERN='^(cli/lucli/|tools/test-cli-local\.sh$|tools/ci/testbox_results\.py$|tools/ci/test_testbox_results\.py$|tools/ci/fallback_port_sentinel\.py$|tools/ci/test_fallback_port_sentinel\.py$|tools/ci/testbox_junit\.py$|tools/ci/test_testbox_junit\.py$|tools/ci/cli-suite-request\.sh$|tools/ci/fetch-sqlite-jdbc\.sh$|tools/ci/fixtures/testbox/|tools/deploy-[^/]*\.sh$|tools/deploy-dry-run-normalize\.py$|\.github/workflows/deploy-ci\.yml$|\.github/actions/setup-lucli/|tools/lucli\.json$|lucee\.json$|public/|config/|app/(events|global|migrator)/|vendor/wheels/(public/|Public\.cfc$|events/|wheelstest/|migrator/|Seeder\.cfc$|JobWorker\.cfc$))'
           if [ "$EVENT_NAME" = "pull_request" ]; then
             # fetch-depth: 0 already holds the base commit; fetch it (with full
             # history, never --depth) only if it is somehow missing.

.github/workflows/distribution-install-smoke.yml

@@ -526,9 +526,9 @@ jobs:
       matrix:
         include:
           - label: "rocky 10, rpm 4.19"
-            image: rockylinux/rockylinux:10
+            image: ghcr.io/wheels-dev/mirror/rockylinux/rockylinux:10
           - label: "rocky 9, rpm 4.16"
-            image: rockylinux/rockylinux:9
+            image: ghcr.io/wheels-dev/mirror/rockylinux/rockylinux:9
     container:
       image: ${{ matrix.image }}
     env:
@@ -576,7 +576,7 @@ jobs:
     # Gates (hard-fail): as of 4.0.5 the rpm's wrapper resolves the RHEL/Fedora
     # Java-21 layout, so `wheels --version` works on Rocky 9 (was the 4.0.4 bug).
     container:
-      image: rockylinux:9
+      image: ghcr.io/wheels-dev/mirror/rockylinux:9
     env:
       EXPECTED: ${{ needs.resolve.outputs.version }}
     steps:
@@ -643,7 +643,7 @@ jobs:
     # dependency (#4237) is what makes it installable. Bleeding-edge only for
     # now; a stable Fedora leg is owed once 4.2.0 ships with that dependency.
     container:
-      image: fedora:44
+      image: ghcr.io/wheels-dev/mirror/fedora:44
     steps:
       - name: Add yum.wheels.dev bleeding-edge + install (the documented path)
         run: |

.github/workflows/pr.yml

@@ -48,6 +48,30 @@ jobs:
       - name: Install LuCLI
         uses: ./.github/actions/setup-lucli
 
+      - name: Cache Lucee Express
+        id: express-cache
+        uses: actions/cache@v5
+        with:
+          path: ~/.lucli/express
+          key: lucee-express-${{ runner.os }}-${{ hashFiles('tools/ci/lucee.ci.json', 'lucee.json', 'cli/lucli/templates/app/lucee.json') }}
+          restore-keys: |
+            lucee-express-${{ runner.os }}-
+
+      - name: Report Lucee Express cache
+        run: echo "Lucee Express cache hit=${{ steps.express-cache.outputs.cache-hit || 'false' }}"
+
+      - name: Cache Lucee Maven repository
+        id: maven-cache
+        uses: actions/cache@v5
+        with:
+          path: ${{ runner.temp }}/.lucee-mvn
+          key: lucee-mvn-${{ runner.os }}-${{ hashFiles('.env', 'tools/ci/lucee.ci.json', 'lucee.json') }}
+          restore-keys: |
+            lucee-mvn-${{ runner.os }}-
+
+      - name: Report Lucee Maven cache
+        run: echo "Lucee Maven cache hit=${{ steps.maven-cache.outputs.cache-hit || 'false' }}"
+
       - name: Create test databases
         run: |
           sudo apt-get update -y && sudo apt-get install -y --no-install-recommends sqlite3
@@ -92,10 +116,11 @@ jobs:
 
       - name: Download SQLite JDBC driver
         run: |
-          curl -sL --retry 3 --retry-delay 2 --retry-all-errors "https://repo1.maven.org/maven2/org/xerial/sqlite-jdbc/3.50.3.0/sqlite-jdbc-3.50.3.0.jar" \
-            -o /tmp/sqlite-jdbc.jar
+          bash tools/ci/fetch-sqlite-jdbc.sh /tmp/sqlite-jdbc.jar
 
       - name: Start Lucee server
+        env:
+          LUCEE_MAVEN_LOCAL_REPOSITORY: ${{ runner.temp }}/.lucee-mvn
         run: |
           cp tools/ci/lucee.ci.json lucee.json
 
@@ -118,46 +143,63 @@ jobs:
           done
 
       - name: Install SQLite JDBC into Lucee
+        env:
+          LUCEE_MAVEN_LOCAL_REPOSITORY: ${{ runner.temp }}/.lucee-mvn
         run: |
           # Find where LuCLI placed the Lucee Express lib directory
           LUCEE_LIB=$(find ~/.lucli/express -path "*/lib/ext" -type d 2>/dev/null | head -1)
           if [ -z "$LUCEE_LIB" ]; then
             LUCEE_LIB=$(find ~/.lucli/express -maxdepth 2 -name "lib" -type d 2>/dev/null | head -1)
           fi
-          if [ -n "$LUCEE_LIB" ]; then
-            cp /tmp/sqlite-jdbc.jar "$LUCEE_LIB/"
-            echo "SQLite JDBC installed to: $LUCEE_LIB"
-          else
+          if [ -z "$LUCEE_LIB" ]; then
             echo "::error::Could not find Lucee lib directory"
             find ~/.lucli/express -type d | head -20
             exit 1
           fi
 
-          # Stop server fully and restart to pick up the new JDBC driver
+          # Stop the first (Express-downloading) start before touching the install.
           kill $(cat /tmp/lucli-server.pid) 2>/dev/null || true
           lucli server stop 2>/dev/null || true
-          # Wait for port to be freed
           for i in $(seq 1 15); do
             if ! curl -s -o /dev/null --connect-timeout 1 "http://localhost:30007/" 2>/dev/null; then
               break
             fi
             sleep 1
           done
-          # Also kill any lingering java processes on the port
           fuser -k 30007/tcp 2>/dev/null || true
           sleep 2
 
-          nohup lucli server run --port=30007 --force > /tmp/lucli-server.log 2>&1 &
+          # Install the driver after the stop, so the restart picks it up.
+          cp /tmp/sqlite-jdbc.jar "$LUCEE_LIB/"
+          echo "SQLite JDBC installed to: $LUCEE_LIB"
+
+          # No --force here: keep ~/.lucli/servers (and the Lucee extensions installed in it).
+          nohup lucli server run --port=30007 > /tmp/lucli-server.log 2>&1 &
           echo $! > /tmp/lucli-server.pid
 
           echo "Waiting for Lucee to restart..."
+          RESTARTED=0
           for i in $(seq 1 60); do
             if curl -s -o /dev/null --connect-timeout 2 --max-time 3 "http://localhost:30007/" 2>/dev/null; then
               echo "Lucee restarted with SQLite JDBC"
+              RESTARTED=1
               break
             fi
             sleep 2
           done
+          if [ "$RESTARTED" != "1" ]; then
+            echo "::error::Lucee did not restart"
+            cat /tmp/lucli-server.log
+            exit 1
+          fi
+
+          H2_EXT=$(find ~/.lucli/servers -iname '*h2*' 2>/dev/null | head -5)
+          if [ -n "$H2_EXT" ]; then
+            echo "H2 extension preserved after the no-force restart:"
+            echo "$H2_EXT"
+          else
+            echo "::warning::No H2 extension found under ~/.lucli/servers after the no-force restart"
+          fi
 
       - name: Run tests
         run: |
@@ -211,5 +253,31 @@ jobs:
       - name: Install LuCLI
         uses: ./.github/actions/setup-lucli
 
+      - name: Cache Lucee Express
+        id: express-cache
+        uses: actions/cache@v5
+        with:
+          path: ~/.lucli/express
+          key: lucee-express-${{ runner.os }}-${{ hashFiles('tools/ci/lucee.ci.json', 'lucee.json', 'cli/lucli/templates/app/lucee.json') }}
+          restore-keys: |
+            lucee-express-${{ runner.os }}-
+
+      - name: Report Lucee Express cache
+        run: echo "Lucee Express cache hit=${{ steps.express-cache.outputs.cache-hit || 'false' }}"
+
+      - name: Cache Lucee Maven repository
+        id: maven-cache
+        uses: actions/cache@v5
+        with:
+          path: ${{ runner.temp }}/.lucee-mvn
+          key: lucee-mvn-${{ runner.os }}-${{ hashFiles('.env', 'tools/ci/lucee.ci.json', 'lucee.json') }}
+          restore-keys: |
+            lucee-mvn-${{ runner.os }}-
+
+      - name: Report Lucee Maven cache
+        run: echo "Lucee Maven cache hit=${{ steps.maven-cache.outputs.cache-hit || 'false' }}"
+
       - name: Run tutorial e2e
+        env:
+          LUCEE_MAVEN_LOCAL_REPOSITORY: ${{ runner.temp }}/.lucee-mvn
         run: bash tools/test-tutorial-e2e.sh

.github/workflows/rustcfml-version-check.yml

@@ -54,9 +54,23 @@ jobs:
       - name: Open bump PR
         # Only from develop: a branch dispatch that happens to go green must not
         # open a bump PR built on a feature branch.
+        #
+        # add-paths: the suite run leaves logs and caches in the working tree
+        # (public/logs/, tools/ci/__pycache__/), and create-pull-request stages
+        # every change by default, so commit only the files bump-pin.sh and
+        # --write-baseline produce (#4577).
+        #
+        # CI: a PR opened with GITHUB_TOKEN does not trigger workflows. Whoever
+        # handles the bump PR pushes a commit (an empty one is fine) to its
+        # branch to start CI, as for the develop version bump.
         if: env.RUSTCFML_LATEST != '' && github.ref == 'refs/heads/develop'
         uses: peter-evans/create-pull-request@v8.1.1
         with:
+          add-paths: |
+            tools/rustcfml/ENGINE_VERSION
+            tools/rustcfml/ENGINE_SHA256
+            tools/rustcfml/baseline.json
+            cli/lucli/services/rustcfml/RustCFMLEngine.cfc
           branch: "auto-bump/rustcfml-${{ env.RUSTCFML_LATEST }}"
           title: "chore(rustcfml): bump engine pin to ${{ env.RUSTCFML_LATEST }}"
           body: |

.github/workflows/smoke-env.yml

@@ -108,6 +108,10 @@ jobs:
         wheels_env: [production, testing]
     env:
       WHEELS_CI: "true"
+      # Re-bind adobe2023's .engine home to the host (compose.ci.yml), reversing
+      # the named volume in compose.yml, so CI's host-side engine-home access
+      # keeps working. Job-level so every `docker compose` call layers it.
+      COMPOSE_FILE: compose.yml:compose.ci.yml
     steps:
       - uses: actions/checkout@v5