Pin bernardladenthin/actions at v1.0.3

.github/workflows/codeql.yml

@@ -18,7 +18,7 @@ permissions:
 
 jobs:
   analyze:
-    uses: bernardladenthin/actions/.github/workflows/java-codeql.yml@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
+    uses: bernardladenthin/actions/.github/workflows/java-codeql.yml@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
     permissions:
       actions: read
       contents: read

.github/workflows/dependency-submission.yml

@@ -16,6 +16,6 @@ permissions:
 
 jobs:
   submit:
-    uses: bernardladenthin/actions/.github/workflows/java-maven-dependency-submission.yml@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
+    uses: bernardladenthin/actions/.github/workflows/java-maven-dependency-submission.yml@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
     permissions:
       contents: write

.github/workflows/java-tests.yml

@@ -43,7 +43,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Display CPU Info
-        uses: bernardladenthin/actions/common/print-host-info@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
+        uses: bernardladenthin/actions/common/print-host-info@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: ${{ inputs.natives-artifact }}
@@ -116,7 +116,7 @@ jobs:
       # Echo the crash logs into the job log (workspace/policies/ci-test-diagnostics.md 3.1).
       - name: Print crash logs (on failure)
         if: failure()
-        uses: bernardladenthin/actions/java/print-crash-logs@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
+        uses: bernardladenthin/actions/java/print-crash-logs@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
         with:
           modules: llama
       - if: failure()

.github/workflows/osv-scanner.yml

@@ -19,7 +19,7 @@ permissions:
 
 jobs:
   scan:
-    uses: bernardladenthin/actions/.github/workflows/osv-scanner.yml@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
+    uses: bernardladenthin/actions/.github/workflows/osv-scanner.yml@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3
     permissions:
       actions: read
       contents: read

.github/workflows/reuse.yml

@@ -14,4 +14,4 @@ permissions:
 
 jobs:
   test:
-    uses: bernardladenthin/actions/.github/workflows/reuse.yml@40191d24afef2c99260bfacb27f269b95563e4bc # v1.0.2
+    uses: bernardladenthin/actions/.github/workflows/reuse.yml@23543c8554ca9de6792a1b8d8aae0bcd001d8508 # v1.0.3

CHANGELOG.md

@@ -435,7 +435,11 @@ the first two items break every existing consumer at upgrade.
   translation.
 
 ### Changed
-- **`bernardladenthin/actions` pinned at v1.0.2.** The release carries a documentation change only:
+- **`bernardladenthin/actions` pinned at v1.0.3.** v1.0.3 makes the snapshot publication survive
+  GitHub: the Central snapshot transfer lists the jobs of older runs 50 per page and repeats GitHub
+  reads on a server error, and a refused move of the `snapshot` tag deletes and re-creates it (both
+  failed in java-llama.cpp's first snapshot dispatch on v1.0.1). v1.0.2 before it carried a
+  documentation change only:
   the license collector's `python3 -c` guard must use single-quoted Python string literals, because
   `exec-maven-plugin` drops a double quote out of an argument on Windows. This repository does not use
   that construct, so nothing changes here; the pin moves so all four repositories stay on the same tag.

TODO.md

@@ -41,11 +41,13 @@ and footer, `SECURITY.md` on `6.x`) is the pull request `release/6.0.0`.
         token was refused (`Resource not accessible by integration`, 403), so the `snapshot` tag and
         notes still name `53f307ac` (May) and nothing was pruned. Presumably the workflow token may
         not move a ref across commits that change `.github/workflows/` (12 files between the two);
-        not verified. Fix in actions v1.0.3: delete and re-create the tag, then point the release at
-        it. `github-release` does not move a tag (the owner's `v6.0.0` exists already).
+        not verified. actions v1.0.3 (pinned) deletes and re-creates the tag on that 403 and points
+        the release at it; whether GitHub accepts that shows only the next snapshot dispatch.
+        `github-release` does not move a tag (the owner's `v6.0.0` exists already).
       - `central-snapshot`: `superseded()` died on a GitHub API `502` listing the jobs of an older
-        run; a transient error, re-run the job. Fix in actions v1.0.3: retry GitHub API calls on 5xx.
-        `central-release` does not call it.
+        run, in the re-run too: with 100 per page GitHub fails that listing for large runs, with 50
+        it answered every try. actions v1.0.3 (pinned) lists 50 per page and repeats GitHub reads on
+        5xx. `central-release` does not call it.
 - [ ] **Owner: settings of bernardladenthin/actions** like the four repositories: a ruleset on `main`
       (pull request required, no force push, no deletion), Dependabot alerts and security updates,
       secret scanning; tags `v*` protected. Its releases are what every repository's Dependabot
@@ -69,7 +71,8 @@ and footer, `SECURITY.md` on `6.x`) is the pull request `release/6.0.0`.
       build stops at its license collector against a llama snapshot older than the natives license
       texts. Re-run its checks once the release is on Central.
 - [ ] After publication: the first snapshot dispatches of BitcoinAddressFinder and streambuffer on
-      actions v1.0.2 (none has run on `main` since the pin bump).
+      actions v1.0.3 (none has run on `main` since the pin bumps), and the next one of this
+      repository, which shows whether the re-created `snapshot` tag is accepted.
 
 ## Delivery roadmap — remaining work