Repository navigation
Pin bernardladenthin/actions at v1.1.0 - #195
Conversation
v1.1.0 (44390bd4) adds java/audit-publication, an audit of a published release from the outside: the run and its jobs, the files against the contract, Maven Central, the signatures, the provenance, the bytecode floors and the next version. This repository does not use it yet; nothing changes for the actions in use. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AJGh28Gu8pLWYbTCqG1LZf
GitHub Actions
Failure
GitHub Actions
Failure
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Reusable workflows and changelog .github/workflows/codeql.yml, .github/workflows/dependency-submission.yml, .github/workflows/osv-scanner.yml, .github/workflows/reuse.yml, .github/workflows/sonarqube.yml, CHANGELOG.md |
Reusable workflows now reference v1.1.0. The changelog updates the shared-actions pin and notes the new unused java/audit-publication action. |
Verification and publication checks .github/workflows/formal-verification.yml, .github/workflows/publish.yml |
Formal-verification host-information steps and publication checks, signing-key checks, code-style checks, bytecode checks, and diagnostics now reference v1.1.0. |
Release publication actions .github/workflows/publish.yml |
Snapshot and release reference checks, publication finalization, GitHub and Maven Central publishing, and publication attestations now reference v1.1.0. |
Priority:
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Other
Possibly related PRs
- bernardladenthin/streambuffer#194: This PR set the v1.0.3 references and changelog entry that this update replaces.
Suggested reviewers: claude
Merge Risk: 
12876
-
No actionable merge-blocking risk remains.
Security architecture risk: 
12876
-
Existing permissions, credential inputs, and publication gates remain unchanged. No introduced security defect was established, but the behavior of the newly pinned external actions could not be independently verified.
Retained concerns
No architecture-level concerns identified.Security review details
-
Security Blast Radius
- inferred — A defect or compromise in the newly selected external code could affect this repository's signing material, release assets, Central transfers, or provenance within the permissions and credentials already supplied. This is the relevant trust scope, not an observed attack path or demonstrated expansion to other repositories.
Trust Boundaries and Controls
- observed — The external-action trust boundary remains in place, with full-commit pinning, explicit credential inputs, job permissions, maven-central environment references, and publication gates retained. These are counterevidence to a caller-side authority expansion, but do not prove that the new external implementation uses its authority identically.
-
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely describes the main change: updating all bernardladenthin/actions pins to v1.1.0. Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (8 skipped: 8 unsupported.)
-
Finishing Touches: 💡 1
-
🛠️ Fix failing CI checks: 💡
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #195 +/- ##
=========================================
Coverage 98.89% 98.89%
Complexity 119 119
=========================================
Files 1 1
Lines 271 271
Branches 28 28
=========================================
Hits 268 268
Partials 3 3 ☔ View full report in Codecov by Harness. |
|
Coverage is 100.0% — chore/actions-v1.1.0 into main. No base build found for |
Moves every
bernardladenthin/actionspin from v1.0.3 (23543c85) to v1.1.0 (44390bd4, bernardladenthin/actions#5). The only other change is the CHANGELOG entry.v1.1.0 adds
java/audit-publication, which audits a published release from the outside: the run and its jobs, the files againstrelease-assets.json, Maven Central, the signatures, the provenance, the bytecode floors and the next version. java-llama.cpp uses it in its newpost-release.yml(bernardladenthin/java-llama.cpp#573). This repository does not use it yet; nothing changes for the actions in use.Local checks: the templates have 0 problems, and no
23543c85is left.🤖 Generated with Claude Code
https://claude.ai/code/session_01AJGh28Gu8pLWYbTCqG1LZf
Summary by CodeRabbit