[bernardladenthin]

Summary

• Pins bernardladenthin/actions at v1.0.2 (40191d24afef2c99260bfacb27f269b95563e4bc), up from v1.0.1 (df774809). All 31 references in .github/ move; nothing else changes.
• v1.0.2 carries a documentation change only: the license collector's python3 -c guard must use single-quoted Python string literals, because exec-maven-plugin drops a double quote out of an argument on Windows (measured with 3.6.4: print("x") reaches Python as print(x), a SyntaxError). It records the trap this repository's own POM just stepped out of, so the next copy of that one-liner is not double-quoted again. The shared CI behaviour is unchanged.

Test plan

• Every reference moved, none left behind: 0 occurrences of the old SHA, 31 of the new one, all in *.yml under .github/.
• The tag exists and is annotated, pointing at 40191d2 on main of the actions repository.
• CI on this branch is the real check — the bump only changes which commit of the shared actions is resolved.
• CHANGELOG updated

Related issues / PRs

bernardladenthin/actions#3 is the change v1.0.2 contains.

🤖 Generated with Claude Code

https://claude.ai/code/session_01E2h8gXyyE5UeimkL9vQv9G

Summary by CodeRabbit

• Chores

  • Updated the automation used for code analysis, dependency checks, builds, testing, and publishing.
  • No changes to product functionality or release workflow conditions.

• Documentation

  • Added an Unreleased changelog note about a Windows-specific quoting requirement in the license-collection process.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

The CI and publication workflows now reference bernardladenthin/actions v1.0.2 instead of v1.0.1. The changelog records the update and describes a Windows quoting issue addressed by a repository POM fix.

Changes: CI and publication workflow updates

Layer / File(s)	Summary
Shared CI workflow references .github/workflows/codeql.yml, .github/workflows/dependency-submission.yml, .github/workflows/osv-scanner.yml, .github/workflows/reuse.yml, .github/workflows/sonarqube.yml	The CodeQL, dependency submission, OSV scanning, testing, and SonarQube workflows now reference v1.0.2.
Publication action references .github/workflows/publish.yml, CHANGELOG.md	Publication workflow actions now reference v1.0.2. The changelog describes the release and the Windows quoting issue.

Priority: Not assessed

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Possibly related PRs

• bernardladenthin/srcmorph#240: Fixes the Windows quoting issue documented in this PR’s changelog.

Suggested reviewers: claude

Merge Risk: Minimal · up to dd996

No actionable merge-blocking risk is evident from these isolated pin updates.

Security architecture risk: Low · up to dd996

Local permissions, credential wiring and release gates are unchanged. However, the updated code runs with signing and publication authority, and the claim that its upstream changes are documentation-only could not be independently verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — The updated action revision executes in existing signing-key checks and publication jobs. Delegated authority includes GPG private-key inputs, Central credentials, repository-content write access, and OIDC and attestation write permissions. These are pre-existing trust relationships, not demonstrated privilege increases.

Trust Boundaries and Controls

• observed — The caller retains explicit snapshot/tag routing, version-check action calls, and the maven-central environment on signing and Central-transfer jobs. Enforcement inside the referenced actions and protection rules configured outside the repository remain unverified.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}