[bernardladenthin]

Summary

• Pins bernardladenthin/actions at v1.0.2 (40191d24afef2c99260bfacb27f269b95563e4bc), up from v1.0.1 (df774809). All 30 references in .github/ move; nothing else changes.
• v1.0.2 carries a documentation change only: the license collector's python3 -c guard must use single-quoted Python string literals, because exec-maven-plugin drops a double quote out of an argument on Windows (measured with 3.6.4: print("x") reaches Python as print(x), a SyntaxError). This repository does not use that construct (checked by parsing every POM here for an <argument>/<commandlineArgs> containing a double quote: no hits), so nothing changes here. The pin moves so all four repositories stay on the same tag.

Test plan

• Every reference moved, none left behind: 0 occurrences of the old SHA, 30 of the new one, all in *.yml under .github/.
• The tag exists and is annotated, pointing at 40191d2 on main of the actions repository.
• CI on this branch is the real check — the bump only changes which commit of the shared actions is resolved.
• CHANGELOG updated

Related issues / PRs

bernardladenthin/actions#3 is the change v1.0.2 contains.

🤖 Generated with Claude Code

https://claude.ai/code/session_01E2h8gXyyE5UeimkL9vQv9G

Summary by CodeRabbit

• Chores
  • Updated the shared automation workflows used for security scanning, dependency submission, formal verification, code analysis, testing, and publishing.
  • No changes to end-user product functionality.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

The workflows now pin shared actions and reusable workflows to v1.0.2. The changelog notes an upstream Windows quoting documentation change that this repository does not use.

Changes: Shared actions update

Layer / File(s)	Summary
Reusable workflow pins .github/workflows/{codeql,dependency-submission,osv-scanner,reuse,sonarqube}.yml, CHANGELOG.md	Reusable workflow references now use v1.0.2. The Unreleased changelog records the version update and describes the upstream documentation change.
Formal verification action pins .github/workflows/formal-verification.yml	The OpenJML ESC, OpenJML RAC, and JPF jobs now use the v1.0.2 host-information action.
Publication workflow action pins .github/workflows/publish.yml	The workflow’s checks, verification, publication, artifact transfer, and attestation steps now use the v1.0.2 action commit.

Priority: Not assessed

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Possibly related PRs

• bernardladenthin/streambuffer#192: Updated the same shared action references from v1.0.0 to v1.0.1.
• bernardladenthin/streambuffer#191: Introduced shared release and publication actions in publish.yml, which this change updates to v1.0.2.

Suggested reviewers: claude

Merge Risk: Minimal · up to 78ea2

The workflows consistently use the intended immutable v1.0.2 pin without other behavioral configuration changes.

Security architecture risk: Low · up to 78ea2

The workflows retain their existing permissions, release checks and publication gates. No introduced security defect was established. However, the documentation-only release claim could not be independently verified against the shared actions’ source, including actions that receive signing and publication credentials.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The evidenced exposure includes repository CI results, signing material, release assets, Central publication and attestations, plus the explicitly forwarded Sonar token. A compromised dependency could affect those resources within the credentials’ effective authority and potentially affect consumers of published artifacts. Credential scope beyond these declarations was not established.

Trust Boundaries and Controls

• observed — The caller retains explicit job permissions, named secret forwarding, the maven-central environment association, channel checks and completion gates. These constrain the existing trust boundary but do not prove that the newly selected upstream implementation handles credentials and artifacts equivalently. No newly reachable attacker-controlled input was established by the local diff.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud