[bernardladenthin]

Summary

• Pins bernardladenthin/actions at v1.0.2 (40191d24afef2c99260bfacb27f269b95563e4bc), up from v1.0.1 (df774809). All 34 references in .github/ move; nothing else changes.
• v1.0.2 carries a documentation change only: the license collector's python3 -c guard must use single-quoted Python string literals, because exec-maven-plugin drops a double quote out of an argument on Windows (measured with 3.6.4: print("x") reaches Python as print(x), a SyntaxError). It records the trap this repository's own POM just stepped out of, so the next copy of that one-liner is not double-quoted again. The shared CI behaviour is unchanged.

Test plan

• Every reference moved, none left behind: 0 occurrences of the old SHA, 34 of the new one, all in *.yml under .github/.
• The tag exists and is annotated, pointing at 40191d2 on main of the actions repository.
• CI on this branch is the real check — the bump only changes which commit of the shared actions is resolved.
• CHANGELOG updated

Related issues / PRs

bernardladenthin/actions#3 is the change v1.0.2 contains.

🤖 Generated with Claude Code

https://claude.ai/code/session_01E2h8gXyyE5UeimkL9vQv9G

Summary by CodeRabbit

• Chores
  • Updated the project’s automated checks and publishing workflows.
• Documentation
  • Added a changelog note about a Windows-specific issue affecting license collection.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

The CI workflows now pin bernardladenthin/actions references to v1.0.2, replacing v1.0.1. Workflow settings remain unchanged. CHANGELOG.md records the release note about Windows argument quoting in the license-collector guard.

Changes: CI action update

Layer / File(s)	Summary
Update reusable workflow pins .github/workflows/codeql.yml, .github/workflows/dependency-submission.yml, .github/workflows/osv-scanner.yml, .github/workflows/reuse.yml	The CodeQL, dependency-submission, OSV-scanner, and test jobs now reference the v1.0.2 reusable workflows.
Update publication action pins and changelog .github/workflows/publish.yml, CHANGELOG.md	The publication workflow’s action references now use v1.0.2. The changelog records the release note about Windows argument quoting in the license collector.

Priority: Not assessed

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Possibly related PRs

• bernardladenthin/BitcoinAddressFinder#397: Introduced shared release checks and publication workflows that this change updates to v1.0.2.
• bernardladenthin/BitcoinAddressFinder#399: Fixes the local POM license-collector guard referenced in the v1.0.2 changelog note.

Suggested reviewers: claude

Merge Risk: Minimal · up to d5f39

No actionable merge-blocking risk is evident in the reviewed changes.

Security architecture risk: Low · up to d5f39

The update retains immutable commit pins and does not expand workflow permissions or change publication gates. No introduced vulnerability was established. Some uncertainty remains because the shared actions’ old and new implementations were unavailable for comparison.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — A compromised shared-action implementation could affect signing credentials, repository release assets, Central publication, or attestations through existing authority. Published artifacts could affect downstream consumers. The maximum scope of the GPG key and Central credentials is not established by the workflow, so exposure cannot be confidently bounded to this repository alone. No such compromise was established.

Trust Boundaries and Controls

• observed — The workflow accepts pull requests, main pushes, version-tag pushes, and manual dispatches. Publication preparation requires successful channel checks and publish_to_central; downstream jobs use explicit completion gates. GitHub release jobs receive contents-write authority, Central uploads receive publication credentials, and attestation jobs receive OIDC and attestation-write permissions. These grants are unchanged by the PR.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud