[bernardladenthin]

Moves every bernardladenthin/actions pin from v1.0.2 (40191d24) to v1.0.3 (23543c85, bernardladenthin/actions#4); no other change than the pins and the CHANGELOG entry.

v1.0.3 fixes the two GitHub-facing snapshot consumers that failed in java-llama.cpp's first snapshot dispatch on v1.0.1 (40227501358):

• central-snapshot: the jobs of older runs are listed 50 per page (with 100 GitHub answered a large run with HTTP 502), and GitHub reads are repeated on 5xx or a dropped stream.
• github-snapshot: a 403 on moving the snapshot tag deletes and re-creates the tag, and the release is pointed at it again.

6.0.0: the release commit is merged but not tagged yet, so the CHANGELOG entry sits in [6.0.0]. Merge this before tagging v6.0.0 (then the release carries v1.0.3), or tell me and the entry moves to [Unreleased]. TODO.md: the snapshot item names v1.0.3 as pinned; the next snapshot dispatch shows whether the re-created snapshot tag is accepted.

Local checks: templates 0 problems, publication wiring 0 problems; no 40191d24 left.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VszvDmRRPP1UcwozsUMY1L

Summary by CodeRabbit

• Chores
  • Updated the automated build, test, security scanning, dependency submission, and publishing workflows to newer versions of their automation.
• Release Notes
  • Snapshot transfers now support pagination and retries, including retries after server errors.
  • The release notes document recovery behavior when updating the snapshot tag is refused.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

The pull request updates GitHub Actions references from v1.0.2 to v1.0.3 across analysis, testing, and publishing workflows. It also updates changelog and TODO entries with details about snapshot transfers and tag handling.

Changes: Shared action pin update

Layer / File(s)	Summary
Update workflow pins and related notes .github/workflows/*.yml, CHANGELOG.md, TODO.md	Workflows pin shared actions and reusable workflows to v1.0.3. The changelog and TODO notes describe snapshot-transfer pagination, retries, and tag recreation behavior. The workflow job graph and other configuration remain unchanged.

Priority: Not assessed

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Other

Possibly related PRs

• bernardladenthin/java-llama.cpp#567: PR #567 introduced the v1.0.2 pins that this pull request updates to v1.0.3.

Suggested labels: github_actions, dependencies

Suggested reviewers: claude

Merge Risk: Minimal · up to 90a05

The pin update is internally consistent and the remaining snapshot-tag acceptance check is an operational follow-up, not an established merge risk.

Security architecture risk: Low · up to 90a05

Local permissions and publication gates are unchanged. However, the newly selected automation can delete and recreate the snapshot tag, and its authorization, interruption recovery and final release consistency remain unverified. No introduced vulnerability is established.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The selected upstream revision participates in a security-sensitive publication trust chain: signing-key checks receive private-key material and passphrases, GitHub publication can modify repository releases and refs, Central publication receives upload credentials, and attestation jobs carry identity-token and attestation-write permissions. This is inherited exposure, not evidence of newly granted privileges or credential misuse. The credentials' maximum downstream scope is unverified.

Trust Boundaries and Controls

• observed — Signing-key checks explicitly pass secrets to the pinned external actions within the maven-central environment. The revision change therefore changes trusted executable code at an existing secret boundary; naming that environment does not establish its approval or branch-protection settings.

Resilience and Maintainability Implications

• observed — GitHub and Central snapshot consumers each retain repository-scoped concurrency groups with cancel-in-progress disabled and complete-assets gates. These existing controls constrain simultaneous publication and incomplete input, but do not themselves prove stale-run rejection or recovery inside the remote tag transition.

Hardening Proposals

• proposed — Before treating snapshot recovery as proven, inspect the pinned upstream transition and validate refused recreation after deletion, interruption, repetition and stale queued runs. Confirm restoration behavior and agreement between the final tag, release target and uploaded build without broadening token permissions.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud