ci: pin GitHub Actions to full-length commit SHAs

[maxandersen]

Pin all action references to full-length commit SHAs for supply chain security.

This is required for enabling the org-level policy:
Require actions to be pinned to a full-length commit SHA

Original version tags are preserved as comments for readability.
Consider adding Dependabot for GitHub Actions to keep pins updated:

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

Summary by CodeRabbit

• Chores
  • CI workflow updated to pin third‑party workflow actions to fixed commits and standardize Java setup across jobs.
  • Build job now uses matrix-driven Java versions; deploy job uses Java 11 with the Temurin distribution.
  • These changes improve reproducibility and security of CI runs.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 014fe5ce-d701-453d-9f05-d82a63c06324

📥 Commits

Reviewing files that changed from the base of the PR and between 94d1a7b and 6a22ca4.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

---

📝 Walkthrough

Walkthrough

Pins GitHub Actions to specific commit SHAs in the CI workflow. Build job pins actions/checkout and actions/cache, and replaces joschi/setup-jdk with a pinned actions/setup-java using matrix.java and distribution: temurin. Deploy job pins actions/checkout and sets actions/setup-java to java-version: 11 and distribution: temurin.

Changes

GitHub Actions Pinning

Layer / File(s)	Summary
Pin workflow actions and update Java setup .github/workflows/ci.yml	Build job: actions/checkout and actions/cache pinned to specific commit SHAs; joschi/setup-jdk@v2 replaced by pinned actions/setup-java with java-version: ${{ matrix.java }} and distribution: temurin. Deploy job: actions/checkout pinned and Java/Maven setup switched to the pinned actions/setup-java with java-version: 11 and distribution: temurin.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 I hopped through YAML lines so fine,
I tucked the SHAs where versions shine,
Temurin set, no drifting tag,
CI steady, no more lag 🥕

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: pinning GitHub Actions to full-length commit SHAs, which matches the primary objective and all modifications in the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch pin-actions-to-sha

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/ci.yml (1)

48-53: ⚡ Quick win

Align deploy job to actions/setup-java v5 for consistency and reduced risk.

Build is already on setup-java v5, but deploy is still pinned to v1. Using one major version across jobs simplifies maintenance and avoids older-action drift on the release path.

♻️ Proposed change

-      - name: Set up Java/Maven
-        uses: actions/setup-java@b6e674f4b717d7b0ae3baee0fbe79f498905dfde # v1
+      - name: Set up Java/Maven
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
-          java-version: 1.8
+          java-version: 8
+          distribution: temurin
           server-id: ossrh
           server-username: MAVEN_USERNAME
           server-password: MAVEN_PASSWORD

Maven publishing inputs (server-id, server-username, server-password) remain supported in v5, so no changes to the publish step are needed.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 48 - 53, Update the deploy job's setup
action to use actions/setup-java v5 instead of the pinned v1 (replace the uses
value referencing actions/setup-java@b6e674f4b7... with a v5 release tag),
keeping the existing inputs (java-version: 1.8, server-id: ossrh,
server-username: MAVEN_USERNAME, server-password: MAVEN_PASSWORD) unchanged
since those Maven publishing inputs are supported in v5.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 48-53: Update the deploy job's setup action to use
actions/setup-java v5 instead of the pinned v1 (replace the uses value
referencing actions/setup-java@b6e674f4b7... with a v5 release tag), keeping the
existing inputs (java-version: 1.8, server-id: ossrh, server-username:
MAVEN_USERNAME, server-password: MAVEN_PASSWORD) unchanged since those Maven
publishing inputs are supported in v5.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: df6d5b32-1d32-40d6-a64d-1d0c7303302f

📥 Commits

Reviewing files that changed from the base of the PR and between 5dda1c8 and 483e7bc.

📒 Files selected for processing (1)

• .github/workflows/ci.yml