Skip to content

Bump actions/setup-java from 5.6.0 to 6.0.0 - #219

Merged
docktermj merged 4 commits into
mainfrom
dependabot/github_actions/actions/setup-java-6.0.0
Sep 4, 2026
Merged

Bump actions/setup-java from 5.6.0 to 6.0.0#219
docktermj merged 4 commits into
mainfrom
dependabot/github_actions/actions/setup-java-6.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 27, 2026

Copy link
Copy Markdown
Contributor

Bumps actions/setup-java from 5.6.0 to 6.0.0.

Release notes

Sourced from actions/setup-java's releases.

v6.0.0

What's Changed

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump actions/setup-java from 5.6.0 to 6.0.0
d48884a 
Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5.6.0 to 6.0.0.
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@v5.6.0...v5.7.0)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner August 27, 2026 17:44
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 27, 2026
@dependabot dependabot Bot mentioned this pull request Aug 27, 2026
Closed
@github-actions

github-actions Bot commented Aug 27, 2026

Copy link
Copy Markdown

🤖 Claude Code Review

PR Code Review

Summary: Three-file GitHub Actions dependency bump — actions/setup-java from v5.6.0 → v5.7.0 in the Darwin, Linux, and Windows Java snippet workflows. Purely mechanical (looks like a Dependabot bump), no application code touched.

Code Quality

  • ✅ Style conventions — Consistent with existing YAML formatting in all three files.

  • ✅ No commented-out code — N/A, diff only changes a version pin.

  • ✅ Meaningful variable names — N/A.

  • ✅ DRY — N/A, this is a version string repeated across three separate workflow files (unavoidable given GitHub Actions has no shared-config mechanism for this).

  • ✅ Defects — No logic changes. Verified the same tag bump was applied consistently in all three files:

    • .github/workflows/java-darwin-snippets.yaml:43
    • .github/workflows/java-linux-snippets.yaml:46
    • .github/workflows/java-windows-snippets.yaml:43

    No stray/missed occurrence left at the old version.

  • ✅ CLAUDE.md — Not touched by this diff; existing .claude/CLAUDE.md content is generic/environment-agnostic and unaffected.

Testing

  • N/A — Version bump of a CI action reference; no application logic to unit/integration test. Correctness is validated by the CI workflows themselves running successfully (this is exactly the kind of change CI is designed to catch if the new action version breaks something).

Documentation

  • N/A — No README/API/CHANGELOG impact for a CI dependency bump. No markdown files changed.

Security

  • ✅ No hardcoded credentials
  • ✅ No sensitive data
  • ✅ No .lic files or AQAAAD-prefixed license strings present in this diff
  • ⚠️ Minor note (not blocking): the action is pinned by mutable tag (@v5.7.0) rather than a pinned commit SHA. This is pre-existing convention in the repo (already used @v5.6.0), not something introduced by this PR, so it's a non-issue for this review — just flagging as an existing pattern if the team ever wants tighter supply-chain pinning for actions.

Verdict

✅ Approve. Clean, low-risk, consistent version bump with no functional or security concerns.

Automated code review analyzing defects and coding standards

@github-actions

github-actions Bot commented Aug 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Super-linter summary

Language Validation result
CHECKOV Pass ✅
GITHUB_ACTIONS Pass ✅
GITHUB_ACTIONS_ZIZMOR Pass ✅
GITLEAKS Pass ✅
GIT_MERGE_CONFLICT_MARKERS Pass ✅
JSCPD Pass ✅
PRE_COMMIT Pass ✅
SPELL_CODESPELL Pass ✅
TRIVY Pass ✅
YAML Pass ✅
YAML_PRETTIER Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter

@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown

🤖 Claude Code Review

This is a minimal, low-risk CI dependency bump (actions/setup-java v5.6.0 → v5.7.0) applied consistently across the three platform workflow files. Review below.

Code Quality

  • ✅ Style/consistency: Change applied uniformly to all three workflows (java-darwin-snippets.yaml:43, java-linux-snippets.yaml:46, java-windows-snippets.yaml:43). No formatting issues.
  • ✅ No commented-out code
  • N/A Meaningful variable names — no code, just a pinned version bump
  • ✅ DRY — same edit mirrored correctly in all three files; nothing to consolidate here (the three workflows are pre-existing separate files, not introduced by this diff)
  • ⚠️ Defects: I have no network access to confirm v5.7.0 is an actual published tag of actions/setup-java or to check its release notes for breaking changes. This looks like a routine Dependabot-style bump, but worth a sanity check before merge that the tag exists and didn't introduce action-input changes (none of the with: blocks changed here, so risk is low).
  • N/A CLAUDE.md — not touched by this PR

Testing

  • N/A — CI workflow version bump, no application code changed. The workflows themselves will validate the bump when they run (Java build/test snippets on Darwin/Linux/Windows).

Documentation

  • N/A — no README/API/CHANGELOG impact expected for a CI action version bump. Not flagging CHANGELOG.md absence since this repo doesn't appear to track CI-only bumps there (consistent with the other recent dependency-bump commits in history, e.g. d48884a, b4bc6d7).

Security

  • ✅ No hardcoded credentials
  • ✅ No input validation concerns (no new inputs)
  • N/A error handling
  • ✅ No sensitive data in logs
  • ✅ No .lic files or AQAAAD-prefixed strings present in this diff

Summary

No issues found. This is a clean, consistent three-file version bump with no functional or security concerns.

Automated code review analyzing defects and coding standards

@docktermj
docktermj enabled auto-merge (squash) September 4, 2026 12:21
@docktermj docktermj self-assigned this Sep 4, 2026
@github-actions

github-actions Bot commented Sep 4, 2026

Copy link
Copy Markdown

🤖 Claude Code Review

All three occurrences of setup-java in the repo were updated consistently — no stragglers left at the old version.

Review Summary

This is a routine dependency bump (Dependabot-style): actions/setup-java pinned tag v5.6.0 → v5.7.0 across three workflow files (java-darwin-snippets.yaml, java-linux-snippets.yaml, java-windows-snippets.yaml). No source code, tests, or docs are touched.

Code Quality

  • ✅ Style/formatting consistent with surrounding YAML.
  • ✅ No commented-out code.
  • ✅ N/A — no variable names introduced.
  • ✅ DRY — same version bump applied identically to all three matrix workflows (darwin/linux/windows), no divergence.
  • ✅ No defects — verified via grep that all setup-java references in .github/workflows/ were updated to v5.7.0 consistently; none left on the old version.
  • ✅ .claude/CLAUDE.md not modified by this PR; no concerns to raise there.

Testing

  • ✅ N/A — CI action version bump only, no new functions/endpoints/logic to test. The Java workflows themselves (mvn package + snippet runs) serve as the de facto validation once this runs on GitHub.

Documentation

  • ✅ N/A — no README/API-facing change.
  • ⚠️ No CHANGELOG.md entry, but this repo doesn't appear to track CI/tooling bumps in CHANGELOG (consistent with other recent dependency-bump commits in the log, e.g. 88358fb, 45cacf1, 441b5ce) — not a blocker.

Security

  • ✅ No hardcoded credentials.
  • ✅ N/A — input validation/error handling not applicable to a version bump.
  • ✅ No sensitive data in logs.
  • ✅ No .lic files or AQAAAD-prefixed license strings present in this diff.
  • ℹ️ Advisory (pre-existing pattern, not introduced by this PR): the action is pinned by version tag (@v5.7.0) rather than by commit SHA. Tag-pinning is less resistant to upstream tag-mutation supply-chain attacks than SHA-pinning, but since this matches the repo's existing convention for this action, it's not a blocking issue for this PR.

Verdict: ✅ Approve. Clean, minimal, consistent version bump with no risk to functionality.

Automated code review analyzing defects and coding standards

@github-actions

github-actions Bot commented Sep 4, 2026

Copy link
Copy Markdown

🤖 Claude Code Review

PR Code Review

Summary: Bumps actions/setup-java from v5.6.0 to v5.7.0 across three GitHub Actions workflow files (Darwin, Linux, Windows). This is a mechanical dependency version bump (dependabot-style) with no application code changes.

Code Quality

  • ✅ Style conventions: Consistent formatting maintained in all three files; indentation and YAML structure unchanged.
  • ✅ No commented-out code
  • ✅ Meaningful variable names: N/A (no variables changed)
  • ⚠️ DRY principle: The same uses: actions/setup-java@v5.7.0 pin is duplicated across .github/workflows/java-darwin-snippets.yaml:43, .github/workflows/java-linux-snippets.yaml:46, and .github/workflows/java-windows-snippets.yaml:43. This duplication is pre-existing (not introduced by this PR) and consistent with how the repo already manages per-platform workflows, so not a blocker — just noting all three were updated in lockstep, which is correct.
  • ✅ Defects: No logic errors, crashes, race conditions, or security issues possible from a version-pin bump. Note: I do not have network access to confirm v5.7.0 is a legitimate, published tag of actions/setup-java — this should be verified against the actions/setup-java releases before merge (standard due diligence for any Action version bump, to guard against a malicious or yanked tag).
  • ✅ CLAUDE.md: Not touched by this diff; no concerns.

Testing

  • ✅ N/A — CI workflow version bump, no new functions/endpoints. The workflows themselves (java-darwin/linux/windows-snippets.yaml) will validate the new action version by running the actual CI jobs.

Documentation

  • ✅ N/A — no README, API docs, or CHANGELOG changes needed for a CI action bump.

Security

  • ✅ No hardcoded credentials
  • ✅ No input validation concerns (static YAML config)
  • ✅ No error handling changes
  • ✅ No sensitive data in logs
  • ✅ No .lic files or AQAAAD-prefixed license strings present in this diff

Verdict

✅ Approve. Low-risk, mechanical version bump applied consistently across all three platform-specific workflows. Only recommendation: confirm v5.7.0 is a valid, official actions/setup-java release tag before merging (can't verify this myself without network access).

Automated code review analyzing defects and coding standards

@docktermj
docktermj merged commit b37354e into main Sep 4, 2026
73 checks passed
@docktermj
docktermj deleted the dependabot/github_actions/actions/setup-java-6.0.0 branch September 4, 2026 12:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@docktermj docktermj docktermj approved these changes

Assignees

@docktermj docktermj

@kernelsam kernelsam

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@docktermj @kernelsam @senzingdevops