Pin bernardladenthin/actions at v1.0.2

.github/workflows/codeql.yml

@@ -18,7 +18,7 @@ permissions:
 
 jobs:
   analyze:
-    uses: bernardladenthin/actions/.github/workflows/java-codeql.yml@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+    uses: bernardladenthin/actions/.github/workflows/java-codeql.yml@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
     permissions:
       actions: read
       contents: read

.github/workflows/dependency-submission.yml

@@ -16,6 +16,6 @@ permissions:
 
 jobs:
   submit:
-    uses: bernardladenthin/actions/.github/workflows/java-maven-dependency-submission.yml@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+    uses: bernardladenthin/actions/.github/workflows/java-maven-dependency-submission.yml@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
     permissions:
       contents: write

.github/workflows/osv-scanner.yml

@@ -19,7 +19,7 @@ permissions:
 
 jobs:
   scan:
-    uses: bernardladenthin/actions/.github/workflows/osv-scanner.yml@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+    uses: bernardladenthin/actions/.github/workflows/osv-scanner.yml@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
     permissions:
       actions: read
       contents: read

.github/workflows/publish.yml

@@ -77,19 +77,19 @@ jobs:
         with:
           persist-credentials: false
       - name: Files equal their templates in bernardladenthin/actions
-        uses: bernardladenthin/actions/common/check-templates@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+        uses: bernardladenthin/actions/common/check-templates@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
       # This repository's own build checks build on actionlib (the setup step puts it on PYTHONPATH).
-      - uses: bernardladenthin/actions/common/setup@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+      - uses: bernardladenthin/actions/common/setup@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
       - name: Build-check tests of this repository
         run: python3 -m unittest discover -s .github/buildcheck/tests -t .github
       - name: Release gate (every job gates both publish jobs, or release-gate-exemptions.txt says why)
-        uses: bernardladenthin/actions/common/check-release-gate@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+        uses: bernardladenthin/actions/common/check-release-gate@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
       - name: Run scripts parse (bash -n over every bash run script of the workflows and actions)
-        uses: bernardladenthin/actions/common/check-run-scripts@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+        uses: bernardladenthin/actions/common/check-run-scripts@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
       - name: Maven versions (warns where a dependency or plugin differs from a sibling repository)
-        uses: bernardladenthin/actions/java/check-maven-versions@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+        uses: bernardladenthin/actions/java/check-maven-versions@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
       - name: Publication wiring and release asset contract (dry run)
-        uses: bernardladenthin/actions/java/check-publication@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+        uses: bernardladenthin/actions/java/check-publication@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
 
   # ---------------------------------------------------------------------------
   # GPG signing-key preflight (standalone, no `needs:` -- runs in parallel at the
@@ -105,7 +105,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: maven-central
     steps:
-      - uses: bernardladenthin/actions/common/verify-gpg-key@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+      - uses: bernardladenthin/actions/common/verify-gpg-key@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
         with:
           private-key: ${{ secrets.GPG_PRIVATE_KEY }}
           passphrase: ${{ secrets.GPG_PASSPHRASE }}
@@ -125,7 +125,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: bernardladenthin/actions/java/verify-signing-key-gradle@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+      - uses: bernardladenthin/actions/java/verify-signing-key-gradle@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
         with:
           private-key: ${{ secrets.GPG_PRIVATE_KEY }}
           passphrase: ${{ secrets.GPG_PASSPHRASE }}
@@ -180,7 +180,7 @@ jobs:
           cache: maven
       # srcmorph-cli runs the license collector of bernardladenthin/actions while packaging
       # (ACTIONS_DIR, exported here).
-      - uses: bernardladenthin/actions/common/setup@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+      - uses: bernardladenthin/actions/common/setup@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
       - name: Build
         run: mvn --batch-mode --no-transfer-progress -DskipTests package
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
@@ -203,7 +203,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Display CPU Info
-        uses: bernardladenthin/actions/common/print-host-info@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+        uses: bernardladenthin/actions/common/print-host-info@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
       - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
         with:
           java-version-file: .java-version
@@ -240,7 +240,7 @@ jobs:
       # Echo the crash logs into the job log (workspace/policies/ci-test-diagnostics.md 3.1).
       - name: Print crash logs (on failure)
         if: failure()
-        uses: bernardladenthin/actions/java/print-crash-logs@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+        uses: bernardladenthin/actions/java/print-crash-logs@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
         with:
           modules: srcmorph srcmorph-cli srcmorph-maven-plugin
       - name: Upload crash & surefire dumps
@@ -286,7 +286,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Display CPU Info
-        uses: bernardladenthin/actions/common/print-host-info@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+        uses: bernardladenthin/actions/common/print-host-info@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
       - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
         with: { java-version-file: .java-version, distribution: temurin, cache: maven }
       - name: Test under vmlens (one class — staged scope)
@@ -349,13 +349,13 @@ jobs:
       # jar; module-info.class and META-INF/versions/** are skipped unconditionally because a
       # classpath JVM never loads them. The java/verify-bytecode action of bernardladenthin/actions.
       - name: Verify Java 8 bytecode (no class newer than major 52)
-        uses: bernardladenthin/actions/java/verify-bytecode@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+        uses: bernardladenthin/actions/java/verify-bytecode@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
         with:
           max-major: "52"
           paths: |
             fatjar
       - name: Run fat-jar smoke test
-        uses: bernardladenthin/actions/java/smoke-fatjar-cli@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+        uses: bernardladenthin/actions/java/smoke-fatjar-cli@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
         with:
           jar-dir: fatjar
           jar-glob: 'srcmorph-cli-*-jar-with-dependencies.jar'
@@ -481,7 +481,7 @@ jobs:
       # a release is tagged on.
       - name: Require a SNAPSHOT version
         if: inputs.publish_to_central
-        uses: bernardladenthin/actions/java/check-release-ref@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+        uses: bernardladenthin/actions/java/check-release-ref@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
         with:
           channel: snapshot
 
@@ -496,7 +496,7 @@ jobs:
           persist-credentials: false
       # The tag names exactly the project version (v1.2.3 for 1.2.3), which is no SNAPSHOT.
       - name: Require the release version the tag names
-        uses: bernardladenthin/actions/java/check-release-ref@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+        uses: bernardladenthin/actions/java/check-release-ref@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
         with:
           channel: release
 
@@ -539,7 +539,7 @@ jobs:
           esac
       # srcmorph-cli runs the license collector of bernardladenthin/actions while packaging
       # (ACTIONS_DIR, exported here).
-      - uses: bernardladenthin/actions/common/setup@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+      - uses: bernardladenthin/actions/common/setup@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
       - name: Show effective POM (debug)
         run: mvn --batch-mode --no-transfer-progress -P release -DskipUpload=true help:effective-pom
       - name: Stage snapshot
@@ -586,7 +586,7 @@ jobs:
           bash .github/verify-classifier-fatjars.sh fatjar-assets "${CLASSIFIERS[@]}"
       - name: Finalize and secure the signed publication
         id: finalize
-        uses: bernardladenthin/actions/java/finalize-publication@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+        uses: bernardladenthin/actions/java/finalize-publication@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
         with:
           channel: snapshot
           maven-assets: central-assets
@@ -603,7 +603,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: bernardladenthin/actions/java/publish-github@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+      - uses: bernardladenthin/actions/java/publish-github@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
         with:
           channel: snapshot
           assets-complete: ${{ needs.publish-snapshot.outputs.assets_complete }}
@@ -639,7 +639,7 @@ jobs:
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
       # srcmorph-cli runs the license collector of bernardladenthin/actions while packaging
       # (ACTIONS_DIR, exported here).
-      - uses: bernardladenthin/actions/common/setup@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+      - uses: bernardladenthin/actions/common/setup@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
       - name: Show effective POM (debug)
         run: mvn --batch-mode --no-transfer-progress -P release -DskipUpload=true help:effective-pom
       - name: Stage release
@@ -686,7 +686,7 @@ jobs:
           bash .github/verify-classifier-fatjars.sh fatjar-assets "${CLASSIFIERS[@]}"
       - name: Finalize and secure the signed publication
         id: finalize
-        uses: bernardladenthin/actions/java/finalize-publication@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+        uses: bernardladenthin/actions/java/finalize-publication@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
         with:
           channel: release
           maven-assets: central-assets
@@ -700,7 +700,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: bernardladenthin/actions/java/publish-github@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+      - uses: bernardladenthin/actions/java/publish-github@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
         with:
           channel: release
           assets-complete: ${{ needs.publish-release.outputs.assets_complete }}
@@ -725,7 +725,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Transfer frozen artifacts (no rebuild, signing or validation polling)
-        uses: bernardladenthin/actions/java/publish-central@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+        uses: bernardladenthin/actions/java/publish-central@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
         with:
           channel: snapshot
           assets-complete: ${{ needs.publish-snapshot.outputs.assets_complete }}
@@ -746,7 +746,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Transfer frozen artifacts (no rebuild, signing or validation polling)
-        uses: bernardladenthin/actions/java/publish-central@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+        uses: bernardladenthin/actions/java/publish-central@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
         with:
           channel: release
           assets-complete: ${{ needs.publish-release.outputs.assets_complete }}
@@ -764,7 +764,7 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: bernardladenthin/actions/java/attest-publication@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+      - uses: bernardladenthin/actions/java/attest-publication@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
         with:
           channel: snapshot
           assets-complete: ${{ needs.publish-snapshot.outputs.assets_complete }}
@@ -780,7 +780,7 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: bernardladenthin/actions/java/attest-publication@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+      - uses: bernardladenthin/actions/java/attest-publication@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
         with:
           channel: release
           assets-complete: ${{ needs.publish-release.outputs.assets_complete }}

.github/workflows/reuse.yml

@@ -14,4 +14,4 @@ permissions:
 
 jobs:
   test:
-    uses: bernardladenthin/actions/.github/workflows/reuse.yml@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+    uses: bernardladenthin/actions/.github/workflows/reuse.yml@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2

.github/workflows/sonarqube.yml

@@ -18,6 +18,6 @@ permissions:
 
 jobs:
   build:
-    uses: bernardladenthin/actions/.github/workflows/java-sonarqube.yml@df774809fbe99a5adc7b1243d053692cd840fe05 # v1.0.1
+    uses: bernardladenthin/actions/.github/workflows/java-sonarqube.yml@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
     secrets:
       SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

CHANGELOG.md

@@ -12,6 +12,10 @@ The release procedure (prompt template and step-by-step instructions) lives in [
 ## [Unreleased]
 
 ### Changed
+- **`bernardladenthin/actions` pinned at v1.0.2.** The release carries a documentation change only:
+  the license collector's `python3 -c` guard must use single-quoted Python string literals, because
+  `exec-maven-plugin` drops a double quote out of an argument on Windows. It records the trap this
+  repository's own POM just stepped out of (see the Fixed entry); the shared CI behaviour is unchanged.
 - **The shared CI code moved to [bernardladenthin/actions](https://github.com/bernardladenthin/actions).**
   The build-check library, the publication gate and its consumers, the signing-key checks and the
   shared scripts and workflows are actions and reusable workflows there, pinned by commit; the