chore(deps): bump actions/setup-java from 4.0.0 to 4.5.0

[dependabot]

Bumps actions/setup-java from 4.0.0 to 4.5.0.

Release notes

Sourced from actions/setup-java's releases.

v4.5.0

What's Changed

• Upgrade IA Publish by @​Jcambass in #686

Bug fixes:

• Improve archive extraction on windows runners without powershell core and Update micromatch dependency by @​priyagupta108 in #689
• Update workflows for GraalVM and Version Enhancements by @​mahabaleshwars in #699
• Refine isGhes logic by @​jww3 in #697

New Contributors:

• @​priyagupta108 made their first contribution in actions/setup-java#689
• @​jww3 made their first contribution in actions/setup-java#697

Full Changelog: actions/setup-java@v4...v4.5.0

v4.4.0

What's Changed

Add-ons :

• Add support for Oracle GraalVM by @​fniephaus in actions/setup-java#501

steps:
 - name: Checkout
   uses: actions/checkout@v4
 - name: Setup-java
   uses: actions/setup-java@v4
   with:
     distribution: 'graalvm'
     java-version: '21'

• Add workflow file for publishing releases to immutable action package by @​Jcambass in actions/setup-java#684

Bug fixes :

• Add architecture to cache key by @​Zxilly in actions/setup-java#664 This addresses issues with caching by adding the architecture (arch) to the cache key, ensuring that cache keys are accurate to prevent conflicts. Note: This change may break previous cache keys as they will no longer be compatible with the new format.
• Resolve check failures by @​aparnajyothi-y in actions/setup-java#687

New Contributors

• @​Jcambass made their first contribution in actions/setup-java#684
• @​Zxilly made their first contribution in actions/setup-java#664

Full Changelog: actions/setup-java@v4...v4.4.0

v4.3.0

What's Changed

... (truncated)

Commits

• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dryrunsecurity]

DryRun Security Summary

The pull request updates GitHub Actions workflows for the Janssen project, focusing on improving code quality, security, and build processes by updating JDK, hardening the runner environment, cleaning up nightly packages, and configuring Git with a GPG key for signed commits.

Expand for full summary

Summary:

The code changes in this pull request are focused on updating the GitHub Actions workflows for the Janssen project. The key changes include updating the Java Development Kit (JDK) version used in the "Code quality check" workflow, hardening the runner environment, cleaning up nightly packages, and configuring Git with a GPG key for signed commits. These changes aim to maintain the quality, security, and integrity of the project's codebase.

From an application security perspective, the changes appear to be positive steps towards improving the project's security posture. The integration with SonarCloud for code quality and security analysis, the conditional nature of the workflow steps, and the caching of SonarCloud packages are all good practices that can help identify and address potential security issues. Additionally, the hardening of the runner environment, the cleanup of nightly packages, and the signing of commits contribute to a more secure and reliable build and deployment process.

However, it's important to ensure that the disabled tests in the "build-with-disabled-tests" job are regularly run and that the overall security of the project is not compromised. Additionally, the handling of sensitive information in the build artifacts should be carefully reviewed to prevent any unintended data exposure.

Files Changed:

1. .github/workflows/scan-sonar.yml:

   • Updates the JDK version used in the "Code quality check" workflow from 4.0.0 to 4.0.0.
   • Implements conditional JDK setup based on changed directories and project modules.
   • Integrates with SonarCloud for code quality and security analysis.
   • Caches SonarCloud packages to improve the performance of the code analysis process.
   • Performs conditional Sonar analysis based on changed directories and project modules.

2. .github/workflows/build-test.yml:

   • Uses the step-security/harden-runner action to harden the runner environment.
   • Includes a "cleanup" job that removes "0.0.0-nightly" versions of the Janssen project packages from the GitHub Package Registry.
   • Includes a "build-with-disabled-tests" job that skips the execution of tests during the build process.
   • Configures Git with a GPG key and signs the commits made during the workflow execution.
   • Includes the DEPENDENCY_CHECK environment variable, indicating that dependency checks are performed as part of the build process.
   • Uploads build artifacts and test results as GitHub Actions artifacts.

Code Analysis

We ran 9 analyzers against 2 files and 0 analyzers had findings. 9 analyzers had no findings.

View PR in the DryRun Dashboard.

[dependabot]

Superseded by #10451.