Repository: SchweizerischeBundesbahnen/markdown2html-maven-plugin
Pull request #60: chore: GitHub workflow update
Author: login: Jumas
Created: 2025-04-18T13:20:04Z | Merged: 2025-04-24T13:52:28Z

### Proposed changes

Fix all problems found by newly added CodeQL checks for Github workflows (the feature is turned off only for newly created repos and when CodeQL was turned off and on again which triggered the automatic configuration for this check)

### Checklist

Before creating a PR, run through this checklist and mark each as complete:
- [x] I have read the [`CONTRIBUTING`](CONTRIBUTING.md) document
- [ ] If applicable, I have added tests that prove my fix is effective or that my feature works
- [x] If applicable, I have checked that any relevant tests pass after adding my changes
- [ ] I have updated any relevant documentation



Diff:
diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
new file mode 100644
index 0000000..5c1afde
--- /dev/null
+++ b/.github/workflows/actionlint.yml
@@ -0,0 +1,37 @@
+---
+name: ActionLint
+on:
+  # Run on push to main/master branch
+  push:
+    branches: [main]
+  # Run on all pull requests
+  pull_request:
+    branches: ['**']
+  # Allow manual triggering
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  actionlint:
+    name: Check GitHub Actions Workflows
+    runs-on: ubuntu-latest
+    permissions:
+      checks: write
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+      - name: Run actionlint
+        uses: reviewdog/action-actionlint@a5524e1c19e62881d79c1f1b9b6f09f16356e281  # v1.65.2
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          # Report all findings as annotations directly on GitHub
+          reporter: github-check
+          # Error on warnings as well as errors
+          fail_level: error
+          # Comment on the pull request
+          level: error
+          filter_mode: nofilter
diff --git a/.github/workflows/maven-build.yml b/.github/workflows/maven-build.yml
index d543b1f..897ca3d 100644
--- a/.github/workflows/maven-build.yml
+++ b/.github/workflows/maven-build.yml
@@ -1,5 +1,5 @@
 ---
-name: maven-build
+name: Build & Release
 on:
   push:
     branches: ['**']
@@ -7,9 +7,16 @@ on:
     branches: [main]
     types: [opened, synchronize, reopened, ready_for_review]
   workflow_dispatch:
+# Set default permissions for all jobs
+permissions:
+  contents: read
+  packages: read
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
     env:
       COM_SONATYPE_CENTRAL_POLARION_OPENSOURCE_USERNAME: ${{ secrets.COM_SONATYPE_CENTRAL_POLARION_OPENSOURCE_USERNAME }}
       COM_SONATYPE_CENTRAL_POLARION_OPENSOURCE_TOKEN: ${{ secrets.COM_SONATYPE_CENTRAL_POLARION_OPENSOURCE_TOKEN }}
@@ -20,7 +27,8 @@ jobs:
       - name: 📄 Checkout the repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
-          fetch-depth: 0
+          fetch-depth: 1
+          persist-credentials: false
       - name: 🧱 Set up JDK and Maven
         uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00  # v4.7.1
         with:
@@ -29,10 +37,10 @@ jobs:
           gpg-private-key: ${{ secrets.COM_SONATYPE_CENTRAL_POLARION_OPENSOURCE_GPG_PRIVATE_KEY }}
       - name: 📝 Get the project version
         id: project_version
-        run: echo "project_version=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)" >> $GITHUB_OUTPUT
+        run: echo "project_version=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)" >> "$GITHUB_OUTPUT"
       - name: 📝 Store cache key
         id: cache_key
-        run: echo "cache_key=${{ runner.os }}-mvn-${{ hashFiles('**/pom.xml') }}-${{ github.sha }}" >> $GITHUB_OUTPUT
+        run: echo "cache_key=${{ runner.os }}-mvn-${{ hashFiles('**/pom.xml') }}-${{ github.sha }}" >> "$GITHUB_OUTPUT"
       - name: 💾 Prepare cache using cache key
         id: prepare-cache
         uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4.2.3
@@ -75,10 +83,16 @@ jobs:
         run: cat /home/runner/.m2/settings.xml
       - name: 📦 Build with Maven for Pushes
         if: github.event_name == 'push'
-        run: mvn --batch-mode clean package sonar:sonar -Dsonar.branch.name=${{ github.head_ref }}
+        env:
+          GITHUB_HEAD_REF: ${{ github.head_ref }}
+        run: mvn --batch-mode clean package sonar:sonar -Dsonar.branch.name="${GITHUB_HEAD_REF}"
       - name: 📦 Build with Maven for PRs
         if: github.event_name == 'pull_request'
-        run: mvn --batch-mode clean package sonar:sonar -Dsonar.pullrequest.base=${{ github.base_ref }} -Dsonar.pullrequest.branch=${{ github.head_ref }} -Dsonar.pullrequest.key=${{ github.event.pull_request.number }}
+        env:
+          GITHUB_HEAD_REF: ${{ github.head_ref }}
+          GITHUB_BASE_REF: ${{ github.base_ref }}
+          GITHUB_PR_NUMBER_REF: ${{ github.event.pull_request.number }}
+        run: mvn --batch-mode clean package sonar:sonar -Dsonar.pullrequest.base="${GITHUB_HEAD_REF}" -Dsonar.pullrequest.branch="${GITHUB_BASE_REF}" -Dsonar.pullrequest.key="${GITHUB_PR_NUMBER_REF}"
     outputs:
       project_version: ${{ steps.project_version.outputs.project_version }}
       cache_key: ${{ steps.cache_key.outputs.cache_key }}
@@ -87,6 +101,9 @@ jobs:
   deploy-maven-central:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
     if: ${{ !endsWith(needs.build.outputs.project_version, '-SNAPSHOT') && github.ref == 'refs/heads/main' }}
     env:
       COM_SONATYPE_CENTRAL_POLARION_OPENSOURCE_USERNAME: ${{ secrets.COM_SONATYPE_CENTRAL_POLARION_OPENSOURCE_USERNAME }}
@@ -137,5 +154,8 @@ jobs:
       - name: 📦 Deploy artifacts to GitHub Packages
         run: mvn --batch-mode -Dmaven.test.skip=true -Dmaven.javadoc.skip=true -Dmaven.source.skip=true deploy -P deploy-github-packages
       - name: 📦 Upload assets to GitHub Release
+        env:
+          RELEASE_VERSION: ${{ needs.build.outputs.project_version }}
+        if: ${{ !endsWith(env.RELEASE_VERSION, '-SNAPSHOT') }}
         run: |-
-          gh release upload v${{ needs.build.outputs.project_version }} target/*-${{ needs.build.outputs.project_version }}.jar
+          gh release upload "v${RELEASE_VERSION}" "target/*-${RELEASE_VERSION}.jar" --clobber
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index a2fa5ce..a351f5f 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -12,12 +12,11 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
-          ref: ${{ github.event.pull_request.head.ref }}
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
           fetch-depth: 0
+          persist-credentials: false
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
           python-version: 3.x
       - run: pip install commitizen
       - name: Check commit messages
-        run: cz check --rev-range origin/${GITHUB_BASE_REF}..
+        run: cz check --rev-range "FETCH_HEAD~.."
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index de963f4..1ea24fb 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -4,14 +4,15 @@ on:
   push:
     branches: [main]
   workflow_dispatch:
-permissions:
-  contents: write
-  pull-requests: write
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
     steps:
-      - name: release-please
+      - name: 🚀 release-please
         id: release
         uses: googleapis/release-please-action@a02a34c4d625f9be7cb89156071d8567266a2445  # v4.2.0
         with:
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 99a0dbe..5f01c1d 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -44,3 +44,11 @@ repos:
     rev: v4.6.0
     hooks:
       - id: commitizen
+  - repo: https://github.com/woodruffw/zizmor-pre-commit
+    rev: v1.5.2
+    hooks:
+      - id: zizmor
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.7
+    hooks:
+      - id: actionlint


Reviews:
user: login: ariwk
body: missing pre-commit config update too
state: CHANGES_REQUESTED
author_association: COLLABORATOR
submitted_at: 2025-04-18T16:25:57Z
user: login: ariwk
state: APPROVED
author_association: COLLABORATOR
submitted_at: 2025-04-24T13:50:55Z

Review comments:
diff_hunk: @@ -44,8 +55,25 @@ jobs:
       - name: 🔘 Generate settings.xml for Maven
         uses: whelk-io/maven-settings-xml-action@9dc09b23833fa9aa7f27b63db287951856f3433d  # v22
         with:
+          repositories: >
path: .github/workflows/maven-build.yml
user: login: ariwk
body: not needed
created_at: 2025-04-18T16:24:17Z
author_association: COLLABORATOR
diff_hunk: @@ -87,8 +121,13 @@ jobs:
   deploy-maven-central:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
     if: ${{ !endsWith(needs.build.outputs.project_version, '-SNAPSHOT') && github.ref == 'refs/heads/main' }}
     env:
+      S3_SBB_POLARION_MAVEN_REPO_RW_ACCESS_KEY: ${{ secrets.S3_SBB_POLARION_MAVEN_REPO_RW_ACCESS_KEY }}
path: .github/workflows/maven-build.yml
user: login: ariwk
body: not needed
created_at: 2025-04-18T16:24:46Z
author_association: COLLABORATOR
diff_hunk: @@ -108,17 +147,19 @@ jobs:
             /home/runner/work
           key: ${{ needs.build.outputs.cache_key }}
       - name: 📦 Deploy artifacts to Maven Central
-        run: mvn --batch-mode -Dmaven.test.skip=true deploy -P gpg-sign -P nexus-staging
+        run: mvn --batch-mode -Dmaven.test.skip=true deploy -P gpg-sign -P nexus-staging -Dnexus-staging-maven-plugin.autoReleaseAfterClose=false
path: .github/workflows/maven-build.yml
user: login: ariwk
body: we want to release automatically --> remove it again
created_at: 2025-04-18T16:25:24Z
author_association: COLLABORATOR

PR comments:
user: login: sonarqubecloud[bot]
created_at: 2025-04-24T13:51:26Z
body: ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=SchweizerischeBundesbahnen_markdown2html-maven-plugin&pullRequest=60) **Quality Gate passed**  
Issues  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 New issues](https://sonarcloud.io/project/issues?id=SchweizerischeBundesbahnen_markdown2html-maven-plugin&pullRequest=60&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=SchweizerischeBundesbahnen_markdown2html-maven-plugin&pullRequest=60&issueStatuses=ACCEPTED)

Measures  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=SchweizerischeBundesbahnen_markdown2html-maven-plugin&pullRequest=60&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=SchweizerischeBundesbahnen_markdown2html-maven-plugin&pullRequest=60&metric=new_coverage&view=list)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=SchweizerischeBundesbahnen_markdown2html-maven-plugin&pullRequest=60&metric=new_duplicated_lines_density&view=list)  
  
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=SchweizerischeBundesbahnen_markdown2html-maven-plugin&pullRequest=60)


author_association: NONE