[sebas2409]

Follow-up to #2, which deliberately stopped at v5 — the version the deprecation notice asked for. These are the current majors: actions/checkout@v7 (2026-06) and actions/setup-java@v6 (2026-08).

Four lines, two files: ci.yml and release.yml.

Inputs

Checked against the action.yml of each action at v7 and v6, not from memory. All still present with the same meaning:

• setup-java: java-version, distribution, cache, server-id, server-username, server-password, gpg-private-key, gpg-passphrase.
• checkout: fetch-depth.

The one change that touches this repo's release path

setup-java@v6 changed how it wires the GPG passphrase into the generated settings.xml: from the deprecated gpg.passphrase server entry to gpg.passphraseEnvName (actions/setup-java#1123), alongside an update to the recommended GPG signing configuration (#608).

This repository is unaffected, and the reason is worth writing down: the Publish to Maven Central step already exports the passphrase into the environment,

env:
  MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

which is exactly where maven-gpg-plugin 3.2.7 reads it from by default. The settings.xml entry that v6 changed was never the path doing the work here.

checkout@v6 also changed credential persistence, which matters because Create the version tag pushes with those credentials. persist-credentials keeps its default, so the tag push is unaffected.

What CI proves, and what it does not

CI exercises checkout and setup-java with cache: maven, so a green run covers the compile/test path in both workflows.

It does not cover the release path: the GPG import, the Central credentials in settings.xml and the tag push only run in release.yml. Two notes on that:

• A manual workflow_dispatch is not a clean smoke test either. The gate deliberately exit 1s on a manual run when the version is a SNAPSHOT ("A manual run expects a publication, so this is a failure"), so it would go red by design after exercising the interesting steps.
• The workflow is fail-safe, which is what makes this acceptable to merge unverified: Create the version tag and Publish the release are both gated on steps.gate.outputs.publish == 'true' and run after mvn deploy. If v6 mishandled the signing, deploy fails, no tag is created and nothing reaches Central. A broken bump costs a red run, not a bad publication.

The real verification is the next release commit.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YXic3YsBbjWrRtGnEBxuxt

[Copilot]

🟢 Approval recommended

The change is limited to action major version bumps in workflows, and the referenced major tags exist with no functional workflow logic changes introduced.

Pull request overview

Updates the repository’s GitHub Actions workflows to the current major versions of actions/checkout and actions/setup-java, keeping CI and release automation on supported, maintained action releases without changing workflow logic.

Changes:

• Bump actions/checkout from @v5 to @v7 in CI and release workflows.
• Bump actions/setup-java from @v5 to @v6 in CI and release workflows.

File summaries

File	Description
.github/workflows/ci.yml	Updates checkout and setup-java action majors used by CI.
.github/workflows/release.yml	Updates checkout and setup-java action majors used by the release pipeline (tagging + Maven Central publish path).

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.