From e0b46fe0a6d2e0d08a39e2ef6667debd20f3c0e3 Mon Sep 17 00:00:00 2001 From: Kyle Aure Date: Mon, 8 Dec 2025 16:14:54 -0600 Subject: [PATCH] security: update github actions and keep updated --- .github/dependabot.yml | 8 ++++++++ .github/workflows/maven.yml | 6 +++--- 2 files changed, 11 insertions(+), 3 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..7038eba1 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,8 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: daily + +# TODO - add maven dependabot if community agrees it's useful \ No newline at end of file diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml index 4f5adfe6..1fa0af19 100644 --- a/.github/workflows/maven.yml +++ b/.github/workflows/maven.yml @@ -1,5 +1,5 @@ # -# Copyright (c) 2021, 2024 Oracle and/or its affiliates. All rights reserved. +# Copyright (c) 2021, 2025 Oracle and/or its affiliates. All rights reserved. # # This program and the accompanying materials are made available under the # terms of the Eclipse Public License v. 2.0 which is available at @@ -25,11 +25,11 @@ jobs: steps: - name: Checkout for build - uses: actions/checkout@v4 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: fetch-depth: 0 - name: Set up compile JDK - uses: actions/setup-java@v4 + uses: actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e # v5.1.0 with: #Compile java needs to be the highest to ensure proper compilation of the multi-release jar distribution: 'temurin' java-version: 17