[bernardladenthin]

Three commits.

1. Pin bernardladenthin/actions at v1.1.0. Every pin moves from v1.0.3 (23543c85) to v1.1.0 (44390bd4, bernardladenthin/actions#5). v1.1.0 adds java/audit-publication, which audits a published release from the outside. This repository does not use it yet, and nothing changes for the actions in use. The templates check reports 0 problems.

2. net.ladenthin:llama 6.0.0 is on Maven Central (e77e3ae). srcmorph/pom.xml has named 6.0.0 since b710796, and every CI run was red at the first Maven step until that release existed. It reached Central on 2026-10-25.

• A clean mvn verify from an empty local repository (maven:3.9-eclipse-temurin-25) passes all three modules: 668 + 39 + 32 tests, BUILD SUCCESS.
• The TODO item is deleted, and the pom comment and one CHANGELOG sentence that pointed at it now say when the release arrived.

3. Two CI defects that the unresolvable release had hidden (fba309b). The first run past the dependency step (40307430012) went further and failed in two jobs:

• Test: verify packages srcmorph-cli, and its license collector comes from bernardladenthin/actions. Unlike build, the job had no common/setup, so the collector stopped with "set ACTIONS_DIR to a checkout of it". The job runs common/setup now. The 668 + 39 tests before the collector had passed.
• Plugin integration test: srcmorph.modelDirectory (d981d63) was missing from the script's deliberate property list. It is listed now, and all six steps pass locally (20 properties).

Still red as on #241 and #242, so not caused by this PR: FOSSA License Compliance, claude-review (the action fails with "directory mismatch … tsconfig.json"), and both GPG preflights (no secret on PR runs).

🤖 Generated with Claude Code

https://claude.ai/code/session_01AJGh28Gu8pLWYbTCqG1LZf

Summary by CodeRabbit

• Chores
  • Updated the automation for code analysis, dependency scanning, quality checks, and publishing. Workflow triggers and conditions remain unchanged.
  • Corrected CI setup and plugin integration-test checks.
• Documentation
  • Updated release notes and build documentation to reflect the dependency’s availability and current build status.
  • Removed the TODO noting that the dependency release was blocking builds.

[coderabbitai]

Caution

Review failed

The pull request is closed.

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 071afa35-6619-4193-a9c1-d19d5ccedd9a

Commits

Reviewing files that changed from the base of the PR and between c951aef and e77e3ae.

Files selected for processing: 3

• CHANGELOG.md
• TODO.md
• srcmorph/pom.xml

Files with no reviewable changes: 1

• TODO.md

Files skipped from review as they are similar to previous changes: 1

• CHANGELOG.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.

Walkthrough

The pull request updates shared workflow and action references from v1.0.3 to v1.1.0. It also revises dependency build-status notes and adds srcmorph.modelDirectory to the plugin integration test’s expected property set.

Changes: CI and build updates

Layer / File(s)	Summary
Shared action pins .github/workflows/codeql.yml, .github/workflows/dependency-submission.yml, .github/workflows/osv-scanner.yml, .github/workflows/reuse.yml, .github/workflows/sonarqube.yml, .github/workflows/publish.yml, CHANGELOG.md	Reusable workflow and publication action references now point to v1.1.0. The changelog records the pin update and notes that java/audit-publication is not used.
Dependency status records TODO.md, srcmorph/pom.xml, CHANGELOG.md	The TODO entry about llama 6.0.0 is removed. The POM comment and changelog state that the dependency reached Maven Central and describe the reactor build status.
Plugin integration test property check .github/plugin-it.sh, CHANGELOG.md	The expected property set adds srcmorph.modelDirectory. The changelog also records that the Test job now runs common/setup.

Priority: Not assessed

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Possibly related PRs

• bernardladenthin/srcmorph#241: Updates the same shared action references from v1.0.1 to v1.0.2.
• bernardladenthin/srcmorph#238: Adds the release and snapshot workflow implementation that uses these shared actions.

Suggested reviewers: claude

Merge Risk: Minimal · up to fba30

The PR aligns CI action pins and integration-test expectations without an identified functional regression; it is mergeable with normal CI checks.

Security architecture risk: Low · up to fba30

The workflow changes retain existing publication gates and permissions, and no introduced vulnerability was established. However, the upgraded automation handles release credentials and signing material, and its internal behavior could not be independently compared.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — If the upgraded automation mishandles its existing authority, potential exposure includes signing identity, this repository's release assets and attestations, and Maven publication destinations authorized by the supplied credentials. The exact credential scope and any reuse outside this repository are unknown; no such misuse was established.

Trust Boundaries and Controls

• observed — The caller keeps artifact preparation read-only for repository contents, grants contents: write to GitHub publication, supplies Central credentials to transfer jobs, and grants identity-token and attestation writes to attestation jobs. Full-SHA pinning remains in place. These controls limit caller-declared authority but do not verify how the newly trusted implementation uses it.

Resilience and Maintainability Implications

• inferred — Completion gating and unchanged ordering provide counterevidence against a caller-side publication regression. However, they cannot establish artifact identity, idempotency, cleanup, or externally visible state after partial failure, retry, concurrent execution or interruption. Those guarantees depend on unavailable external setup, finalization and publication implementations, so no lifecycle defect is asserted.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title names two changes: the pin of bernardladenthin/actions from v1.0.3 to v1.1.0, and the llama 6.0.0 release on Maven Central. The objectives confirm both. The pin covers every workflow referen…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names two changes: the pin of bernardladenthin/actions from v1.0.3 to v1.1.0, and the llama 6.0.0 release on Maven Central. The objectives confirm both. The pin covers every workflow reference, and the llama item removes the TODO and updates the pom comment and CHANGELOG. The title is specific and matches the main changes, though the llama part is secondary to the workflow pin in volume. The title is 65 characters and 9 words, which is slightly long but still readable.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud