Deprecate setup-java v4 (#1194)

Add a deprecation message to the v4 action metadata and emit a runtime warning that v4 will no longer receive updates, directing users to migrate to setup-java v5.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: c8931f2e-fb40-497a-b529-be37cb97a0ae

.github/ISSUE_TEMPLATE/new_distribution_request.md

@@ -1,22 +0,0 @@
----
-name: New Java distribution template
-about: Suggest a new Java distribution
-title: ''
-labels: feature request, needs triage
-assignees: ''
----
-
-**Description:**
-Describe your proposal.
-
-**Justification:**
-Justification or a use case for your proposal.
-
-**Download URL:**
-Download URL for the new distribution.
-
-**License:**
-Link to the license for the new distribution.
-
-**Are you willing to submit a PR?**
-<!--- We accept contributions! -->

.github/PULL_REQUEST_TEMPLATE/new_distribution_pull_request_template.md

@@ -1,16 +0,0 @@
-**Description:**
-Describe your changes.
-
-**Related issue:**
-Add link to the related issue.
-
-**Download URL:**
-Download URL for the new distribution.
-
-**License:**
-Link to the license for the new distribution.
-
-**Check list:**
-- [ ] Mark if documentation changes are required.
-- [ ] Mark if tests were added or updated to cover the changes.
-- [ ] Mark if new distribution is being added.

.github/java.json

@@ -9,18 +9,6 @@
                     "message": 3
                 }
             ]
-        },
-        {
-            "owner": "javac",
-            "pattern": [
-                {
-                    "regexp": "^([^:]+):(\\d+): (warning|error): (.+?)$",
-                    "file": 1,
-                    "line": 2,
-                    "severity": 3,
-                    "message": 4
-                }
-            ]
         }
     ]
 }

.github/workflows/basic-validation.yml

@@ -11,12 +11,9 @@ on:
     paths-ignore:
       - '**.md'
 
-permissions:
-  contents: read
-
 jobs:
   call-basic-validation:
     name: Basic validation
     uses: actions/reusable-workflows/.github/workflows/basic-validation.yml@main
     with:
-      node-version: '24.x'
+      node-version: '20.x'

.github/workflows/check-dist.yml

@@ -11,12 +11,9 @@ on:
       - '**.md'
   workflow_dispatch:
 
-permissions:
-  contents: read
-
 jobs:
   call-check-dist:
     name: Check dist/
     uses: actions/reusable-workflows/.github/workflows/check-dist.yml@main
     with:
-      node-version: '24.x'
+      node-version: '20.x'

.github/workflows/codeql-analysis.yml

@@ -8,13 +8,7 @@ on:
   schedule:
     - cron: '0 3 * * 0'
 
-permissions: {}
-
 jobs:
   call-codeQL-analysis:
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
     name: CodeQL analysis
     uses: actions/reusable-workflows/.github/workflows/codeql-analysis.yml@main

.github/workflows/e2e-cache-dependency-path.yml

@@ -11,9 +11,6 @@ on:
     paths-ignore:
       - '**.md'
 
-permissions:
-  contents: read
-
 defaults:
   run:
     shell: bash
@@ -27,9 +24,7 @@ jobs:
         os: [macos-latest, windows-latest, ubuntu-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: Run setup-java with the cache for gradle
         uses: ./
         id: setup-java
@@ -56,15 +51,13 @@ jobs:
     needs: gradle1-save
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: Run setup-java with the cache for gradle
         uses: ./
         id: setup-java
         with:
           distribution: 'adopt'
-          java-version: '11'
+          java-version: '17'
           cache: gradle
           cache-dependency-path: __tests__/cache/gradle1/*.gradle*
       - name: Confirm that ~/.gradle/caches directory has been made
@@ -83,15 +76,13 @@ jobs:
     needs: gradle1-save
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: Run setup-java with the cache for gradle
         uses: ./
         id: setup-java
         with:
           distribution: 'adopt'
-          java-version: '11'
+          java-version: '17'
           cache: gradle
           cache-dependency-path: __tests__/cache/gradle2/*.gradle*
       - name: Confirm that ~/.gradle/caches directory has not been made

.github/workflows/e2e-cache.yml

@@ -11,9 +11,6 @@ on:
     paths-ignore:
       - '**.md'
 
-permissions:
-  contents: read
-
 defaults:
   run:
     shell: bash
@@ -27,9 +24,7 @@ jobs:
         os: [macos-15-intel, windows-latest, ubuntu-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: Run setup-java with the cache for gradle
         uses: ./
         id: setup-java
@@ -55,9 +50,7 @@ jobs:
     needs: gradle-save
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: Run setup-java with the cache for gradle
         uses: ./
         id: setup-java
@@ -80,9 +73,7 @@ jobs:
         os: [macos-15-intel, windows-latest, ubuntu-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: Run setup-java with the cache for maven
         uses: ./
         id: setup-java
@@ -106,9 +97,7 @@ jobs:
     needs: maven-save
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: Run setup-java with the cache for maven
         uses: ./
         id: setup-java
@@ -135,9 +124,7 @@ jobs:
         os: [macos-15-intel, windows-latest, ubuntu-22.04]
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: Run setup-java with the cache for sbt
         uses: ./
         id: setup-java
@@ -187,9 +174,7 @@ jobs:
     needs: sbt-save
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: Run setup-java with the cache for sbt
         uses: ./
         id: setup-java

.github/workflows/e2e-local-file.yml

@@ -11,9 +11,6 @@ on:
     paths-ignore:
       - '**.md'
 
-permissions:
-  contents: read
-
 jobs:
   setup-java-local-file-adopt:
     name: Validate installation from local file Adopt
@@ -24,9 +21,7 @@ jobs:
         os: [macos-latest, windows-latest, ubuntu-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: Download Adopt OpenJDK file
         run: |
           if ($IsLinux) {
@@ -51,9 +46,7 @@ jobs:
           java-version: '11.0.0-ea'
           architecture: x64
       - name: Verify Java version
-        env:
-          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
-        run: bash __tests__/verify-java.sh "11.0.10" "$JAVA_PATH"
+        run: bash __tests__/verify-java.sh "11.0.10" "${{ steps.setup-java.outputs.path }}"
         shell: bash
 
   setup-java-local-file-zulu:
@@ -65,9 +58,7 @@ jobs:
         os: [macos-latest, windows-latest, ubuntu-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: Download Zulu OpenJDK file
         run: |
           if ($IsLinux) {
@@ -92,9 +83,7 @@ jobs:
           java-version: '11.0.0-ea'
           architecture: x64
       - name: Verify Java version
-        env:
-          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
-        run: bash __tests__/verify-java.sh "11.0" "$JAVA_PATH"
+        run: bash __tests__/verify-java.sh "11.0" "${{ steps.setup-java.outputs.path }}"
         shell: bash
 
   setup-java-local-file-temurin:
@@ -106,9 +95,7 @@ jobs:
         os: [macos-latest, windows-latest, ubuntu-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: Download Eclipse Temurin file
         run: |
           if ($IsLinux) {
@@ -133,7 +120,5 @@ jobs:
           java-version: '11.0.0-ea'
           architecture: x64
       - name: Verify Java version
-        env:
-          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
-        run: bash __tests__/verify-java.sh "11.0.12" "$JAVA_PATH"
+        run: bash __tests__/verify-java.sh "11.0.12" "${{ steps.setup-java.outputs.path }}"
         shell: bash

.github/workflows/e2e-publishing.yml

@@ -11,9 +11,6 @@ on:
     paths-ignore:
       - '**.md'
 
-permissions:
-  contents: read
-
 defaults:
   run:
     shell: pwsh
@@ -28,9 +25,7 @@ jobs:
         os: [macos-latest, windows-latest, ubuntu-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: setup-java
         uses: ./
         id: setup-java
@@ -65,9 +60,7 @@ jobs:
         os: [macos-latest, windows-latest, ubuntu-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: Create fake settings.xml
         run: |
           $xmlDirectory = Join-Path $HOME ".m2"
@@ -103,9 +96,7 @@ jobs:
         os: [macos-latest, windows-latest, ubuntu-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: Create fake settings.xml
         run: |
           $xmlDirectory = Join-Path $HOME ".m2"
@@ -142,9 +133,7 @@ jobs:
         os: [macos-latest, windows-latest, ubuntu-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: setup-java
         uses: ./
         id: setup-java

.github/workflows/e2e-versions.yml

@@ -13,10 +13,6 @@ on:
   schedule:
     - cron: '0 */12 * * *'
   workflow_dispatch:
-
-permissions:
-  contents: read
-
 jobs:
   setup-java-major-versions:
     name: ${{ matrix.distribution }} ${{ matrix.version }} (jdk-x64) - ${{ matrix.os }}
@@ -45,15 +41,6 @@ jobs:
           - distribution: dragonwell
             os: macos-15-intel
         include:
-          - distribution: microsoft
-            os: windows-latest
-            version: 25
-          - distribution: microsoft
-            os: ubuntu-latest
-            version: 25
-          - distribution: microsoft
-            os: macos-latest
-            version: 25
           - distribution: oracle
             os: macos-15-intel
             version: 17
@@ -77,9 +64,7 @@ jobs:
             version: '24-ea'
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: setup-java
         uses: ./
         id: setup-java
@@ -89,41 +74,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Verify Java
-        env:
-          JAVA_VERSION: ${{ matrix.version }}
-          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
-        run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
-        shell: bash
-
-  setup-java-alpine-linux:
-    name: ${{ matrix.distribution }} ${{ matrix.version }} (jdk-x64) - alpine-linux - ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
-    container:
-      image: alpine:3.21
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest]
-        distribution: ['temurin', 'sapmachine']
-        version: ['21', '17']
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - name: Install bash
-        run: apk add --no-cache bash
-      - name: setup-java
-        uses: ./
-        id: setup-java
-        with:
-          java-version: ${{ matrix.version }}
-          distribution: ${{ matrix.distribution }}
-      - name: Verify Java
-        env:
-          JAVA_VERSION: ${{ matrix.version }}
-          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
-        run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
+        run: bash __tests__/verify-java.sh "${{ matrix.version }}" "${{ steps.setup-java.outputs.path }}"
         shell: bash
 
   setup-java-major-minor-versions:
@@ -163,9 +114,7 @@ jobs:
             version: '17.0.7'
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: setup-java
         uses: ./
         id: setup-java
@@ -173,12 +122,10 @@ jobs:
           java-version: ${{ matrix.version }}
           distribution: ${{ matrix.distribution }}
       - name: Verify Java
-        env:
-          JAVA_VERSION: ${{ matrix.version }}
-          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
+        run: bash __tests__/verify-java.sh "${{ matrix.version }}" "${{ steps.setup-java.outputs.path }}"
         shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   setup-java-check-latest:
     name: ${{ matrix.distribution }} ${{ matrix.version }} - check-latest flag - ${{ matrix.os }}
@@ -202,9 +149,7 @@ jobs:
             os: macos-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: setup-java
         uses: ./
         id: setup-java
@@ -215,9 +160,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Verify Java
-        env:
-          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
-        run: bash __tests__/verify-java.sh "11" "$JAVA_PATH"
+        run: bash __tests__/verify-java.sh "11" "${{ steps.setup-java.outputs.path }}"
         shell: bash
 
   setup-java-multiple-jdks:
@@ -242,9 +185,7 @@ jobs:
             os: macos-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: setup-java
         uses: ./
         id: setup-java
@@ -269,9 +210,7 @@ jobs:
           }
         shell: pwsh
       - name: Verify Java
-        env:
-          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
-        run: bash __tests__/verify-java.sh "17" "$JAVA_PATH"
+        run: bash __tests__/verify-java.sh "17" "${{ steps.setup-java.outputs.path }}"
         shell: bash
 
   setup-java-ea-versions-zulu:
@@ -285,9 +224,7 @@ jobs:
         version: ['17-ea', '15.0.0-ea.14']
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: setup-java
         uses: ./
         id: setup-java
@@ -295,10 +232,7 @@ jobs:
           java-version: ${{ matrix.version }}
           distribution: zulu
       - name: Verify Java
-        env:
-          JAVA_VERSION: ${{ matrix.version }}
-          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
-        run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
+        run: bash __tests__/verify-java.sh "${{ matrix.version }}" "${{ steps.setup-java.outputs.path }}"
         shell: bash
 
   setup-java-ea-versions-temurin:
@@ -312,9 +246,7 @@ jobs:
         version: ['17-ea']
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: setup-java
         uses: ./
         id: setup-java
@@ -322,10 +254,7 @@ jobs:
           java-version: ${{ matrix.version }}
           distribution: temurin
       - name: Verify Java
-        env:
-          JAVA_VERSION: ${{ matrix.version }}
-          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
-        run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
+        run: bash __tests__/verify-java.sh "${{ matrix.version }}" "${{ steps.setup-java.outputs.path }}"
         shell: bash
 
   setup-java-ea-versions-sapmachine:
@@ -339,9 +268,7 @@ jobs:
         version: ['17-ea', '21-ea']
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: setup-java
         uses: ./
         id: setup-java
@@ -349,10 +276,7 @@ jobs:
           java-version: ${{ matrix.version }}
           distribution: sapmachine
       - name: Verify Java
-        env:
-          JAVA_VERSION: ${{ matrix.version }}
-          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
-        run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
+        run: bash __tests__/verify-java.sh "${{ matrix.version }}" "${{ steps.setup-java.outputs.path }}"
         shell: bash
 
   setup-java-custom-package-type:
@@ -431,9 +355,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: setup-java
         uses: ./
         id: setup-java
@@ -444,10 +366,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Verify Java
-        env:
-          JAVA_VERSION: ${{ matrix.version }}
-          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
-        run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
+        run: bash __tests__/verify-java.sh "${{ matrix.version }}" "${{ steps.setup-java.outputs.path }}"
         shell: bash
 
   # Only Liberica and Zulu provide x86
@@ -464,9 +383,7 @@ jobs:
         version: ['11']
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: setup-java
         uses: ./
         id: setup-java
@@ -475,10 +392,7 @@ jobs:
           java-version: ${{ matrix.version }}
           architecture: 'x86'
       - name: Verify Java
-        env:
-          JAVA_VERSION: ${{ matrix.version }}
-          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
-        run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
+        run: bash __tests__/verify-java.sh "${{ matrix.version }}" "${{ steps.setup-java.outputs.path }}"
         shell: bash
 
   setup-java-version-both-version-inputs-presents:
@@ -492,9 +406,7 @@ jobs:
         java-version-file: ['.java-version', '.tool-versions']
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: Create .java-version file
         shell: bash
         run: echo "17" > .java-version
@@ -509,9 +421,7 @@ jobs:
           java-version: 11
           java-version-file: ${{matrix.java-version-file }}
       - name: Verify Java
-        env:
-          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
-        run: bash __tests__/verify-java.sh "11" "$JAVA_PATH"
+        run: bash __tests__/verify-java.sh "11" "${{ steps.setup-java.outputs.path }}"
         shell: bash
 
   setup-java-version-from-file-major-notation:
@@ -525,9 +435,7 @@ jobs:
         java-version-file: ['.java-version', '.tool-versions']
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: Create .java-version file
         shell: bash
         run: echo "11" > .java-version
@@ -541,9 +449,7 @@ jobs:
           distribution: ${{ matrix.distribution }}
           java-version-file: ${{matrix.java-version-file }}
       - name: Verify Java
-        env:
-          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
-        run: bash __tests__/verify-java.sh "11" "$JAVA_PATH"
+        run: bash __tests__/verify-java.sh "11" "${{ steps.setup-java.outputs.path }}"
         shell: bash
 
   setup-java-version-from-file-major-minor-patch-notation:
@@ -557,9 +463,7 @@ jobs:
         java-version-file: ['.java-version', '.tool-versions']
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: Create .java-version file
         shell: bash
         run: echo "17.0.10" > .java-version
@@ -573,34 +477,27 @@ jobs:
           distribution: ${{ matrix.distribution }}
           java-version-file: ${{matrix.java-version-file }}
       - name: Verify Java
-        env:
-          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
-        run: bash __tests__/verify-java.sh "17.0.10" "$JAVA_PATH"
+        run: bash __tests__/verify-java.sh "17.0.10" "${{ steps.setup-java.outputs.path }}"
         shell: bash
 
   setup-java-version-from-file-major-minor-patch-with-dist:
-    name: ${{ matrix.distribution }} version from file '${{ matrix.java-version-file }}' - ${{ matrix.os }}
+    name: ${{ matrix.distribution }} version from file 'openjdk64-17.0.10' - ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
         os: [macos-latest, windows-latest, ubuntu-latest]
         distribution: ['adopt', 'zulu', 'liberica']
-        java-version-file: ['.java-version', '.tool-versions', '.sdkmanrc']
+        java-version-file: ['.java-version', '.tool-versions']
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: Create .java-version file
         shell: bash
         run: echo "openjdk64-17.0.10" > .java-version
       - name: Create .tool-versions file
         shell: bash
         run: echo "java openjdk64-17.0.10" > .tool-versions
-      - name: Create .sdkmanrc file
-        shell: bash
-        run: echo "java=17.0.10-tem" > .sdkmanrc
       - name: setup-java
         uses: ./
         id: setup-java
@@ -608,7 +505,5 @@ jobs:
           distribution: ${{ matrix.distribution }}
           java-version-file: ${{matrix.java-version-file }}
       - name: Verify Java
-        env:
-          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
-        run: bash __tests__/verify-java.sh "17.0.10" "$JAVA_PATH"
+        run: bash __tests__/verify-java.sh "17.0.10" "${{ steps.setup-java.outputs.path }}"
         shell: bash

.github/workflows/licensed.yml

@@ -9,9 +9,6 @@ on:
       - main
   workflow_dispatch:
 
-permissions:
-  contents: read
-
 jobs:
   call-licensed:
     name: Licensed

.github/workflows/publish-immutable-actions.yml

@@ -2,10 +2,7 @@ name: 'Publish Immutable Action Version'
 
 on:
   release:
-    types: [released]
-  workflow_dispatch:
-
-permissions: {}
+    types: [published]
 
 jobs:
   publish:
@@ -17,9 +14,7 @@ jobs:
 
     steps:
       - name: Checking out
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4
       - name: Publish
         id: publish
         uses: actions/publish-immutable-action@v0.0.4

.github/workflows/release-new-action-version.yml

@@ -23,7 +23,7 @@ jobs:
     steps:
       - name: Update the ${{ env.TAG_NAME }} tag
         id: update-major-tag
-        uses: actions/publish-action@v0.4.0
+        uses: actions/publish-action@v0.3.0
         with:
           source-tag: ${{ env.TAG_NAME }}
           slack-webhook: ${{ secrets.SLACK_WEBHOOK }}

.github/workflows/update-config-files.yml

@@ -5,12 +5,7 @@ on:
     - cron: '0 3 * * 0'
   workflow_dispatch:
 
-permissions: {}
-
 jobs:
   call-update-configuration-files:
     name: Update configuration files
-    permissions:
-      contents: write # to push the branch with updated configuration files
-      pull-requests: write # to open/update the configuration update PR
     uses: actions/reusable-workflows/.github/workflows/update-config-files.yml@main

.github/workflows/zizmor.yml

@@ -1,48 +0,0 @@
-name: Security analysis with zizmor
-
-on:
-  push:
-    branches:
-      - main
-      - releases/*
-    paths-ignore:
-      - '**.md'
-  pull_request:
-    paths-ignore:
-      - '**.md'
-  workflow_dispatch:
-
-permissions: {}
-
-jobs:
-  zizmor:
-    name: Analyze workflows with zizmor
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      security-events: write # to upload SARIF results to code scanning
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.x'
-
-      - name: Install zizmor
-        run: pip install zizmor
-
-      - name: Run zizmor
-        run: zizmor --format sarif .github/workflows/ > zizmor.sarif
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Upload SARIF results to code scanning
-        if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: zizmor.sarif
-          category: zizmor

.github/zizmor.yml

@@ -1,11 +0,0 @@
-# Configuration for zizmor (https://docs.zizmor.sh)
-rules:
-  unpinned-uses:
-    config:
-      # First-party GitHub-maintained actions are trusted and referenced by
-      # major-version tags (the convention used across the actions org).
-      # Any third-party action must be pinned to a full commit SHA.
-      policies:
-        actions/*: ref-pin
-        github/*: ref-pin
-        '*': hash-pin

.licensed.yml

@@ -13,5 +13,3 @@ allowed:
 
 reviewed:
   npm:
-    - "@actions/http-client" # MIT (license text present), but detected as "other"
-    - "argparse" # Python Software Foundation License (PSF), but detected as "other"