Add dependabot config and pin GitHub Actions to a commit SHA (#1073)

Valery Kharseko

7 hours ago f5dc1c1ad32d1df08ceb40f590d1b1952dbb4a2d

Add dependabot config and pin GitHub Actions to a commit SHA (#1073)

 .github/dependabot.yml

New file
@@ -0,0 +1,28 @@
# The contents of this file are subject to the terms of the Common Development and
# Distribution License (the License). You may not use this file except in compliance with the
# License.
#
# You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
# specific language governing permission and limitations under the License.
#
# When distributing Covered Software, include this CDDL Header Notice in each file and include
# the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
# Header, with the fields enclosed by brackets [] replaced by your own identifying
# information: "Portions copyright [year] [name of copyright owner]".
#
# Copyright 2026 3A Systems, LLC.
version: 2
updates:
  # Keeps the SHA-pinned third-party actions in .github/workflows up to date: Dependabot
  # bumps the commit hash and the trailing "# vX.Y.Z" version comment together.
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    groups:
      # One pull request per week for all action updates instead of one per action.
      github-actions:
        patterns: ["*"]
    labels:
      - "ci"
      - "dependencies"

 .github/workflows/benchmark.yml

@@ -75,10 +75,10 @@
      SAMPLE_FILTER: '^(?!ADMIN_CONNECT).*'
      HEAP: -Xms1g -Xmx2g
    steps:
      - uses: actions/checkout@v6
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0

      - name: Cache JMeter
        uses: actions/cache@v5
        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
        with:
          path: ~/jmeter
          key: jmeter-${{ env.JMETER }}
@@ -258,7 +258,7 @@

      - name: Upload JMeter reports
        if: always()
        uses: actions/upload-artifact@v7
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: jmeter-reports
          path: |
@@ -270,7 +270,7 @@

      - name: Upload OpenLDAP logs
        if: always()
        uses: actions/upload-artifact@v7
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: logs-openldap
          path: logs/openldap/
@@ -279,7 +279,7 @@

      - name: Upload OpenDJ logs
        if: always()
        uses: actions/upload-artifact@v7
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: logs-opendj
          path: logs/opendj/

 .github/workflows/build.yml

@@ -52,17 +52,17 @@
      run:   |
        sudo apt-get update
        sudo apt-get install -y rpm
    - uses: actions/checkout@v6
    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      with:
        fetch-depth: 0
        submodules: recursive
    - name: Java ${{ matrix.Java }} (${{ matrix.os }})
      uses: actions/setup-java@v5
      uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
      with:
        java-version: ${{ matrix.java }}
        distribution: 'zulu'
    - name: Cache Maven packages
      uses: actions/cache@v5
      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
      with:
         path: ~/.m2/repository
         key: ${{ runner.os }}-m2-repository-${{ hashFiles('**/pom.xml') }}
@@ -91,7 +91,7 @@
    # so a byte-for-byte gate would fire without a source change.
    - name: Upload Windows exe artifacts
      if: runner.os == 'Windows'
      uses: actions/upload-artifact@v7
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: windows-exe-${{ matrix.java }}
        retention-days: 5
@@ -413,7 +413,7 @@
        opendj-server-legacy\target\package\opendj\bat\windows-service.bat --disableService

    - name: Upload artifacts OpenDJ Server
      uses: actions/upload-artifact@v7
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: ${{ matrix.os }}-${{ matrix.java }}
        retention-days: 5
@@ -440,11 +440,11 @@
        ports:
          - 5000:5000
    steps:
      - uses: actions/checkout@v6
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          sparse-checkout: .github/benchmark
      - name: Download artifacts
        uses: actions/download-artifact@v8
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ubuntu-latest-11
      - name: Get latest release version
@@ -528,7 +528,7 @@
          scanners: vuln
          cache: false
      - name: Upload Trivy report to GitHub Security
        uses: github/codeql-action/upload-sarif@v4
        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
        # upload even if a preceding step failed, but not without a report to upload
        if: ${{ always() && hashFiles('trivy-results.sarif') != '' }}
        with:
@@ -536,7 +536,7 @@
          # distinct from the docker-scan.yml categories, which track the published images
          category: trivy-build-default
      - name: Cache JMeter
        uses: actions/cache@v5
        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
        with:
          path: ~/jmeter
          key: jmeter-5.6.3
@@ -548,7 +548,7 @@
            "PDB" localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }}
      - name: Upload benchmark artifacts (PDB vs JE)
        if: always()
        uses: actions/upload-artifact@v7
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: benchmark-pdb-vs-je
          path: |
@@ -567,7 +567,7 @@
            "Release" openidentityplatform/opendj:latest
      - name: Upload benchmark artifacts
        if: always()
        uses: actions/upload-artifact@v7
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: benchmark-build-vs-release
          path: |
@@ -591,11 +591,11 @@
        ports:
          - 5000:5000
    steps:
      - uses: actions/checkout@v6
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          sparse-checkout: .github/benchmark
      - name: Download artifacts
        uses: actions/download-artifact@v8
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ubuntu-latest-11
      - name: Get latest release version
@@ -680,7 +680,7 @@
          scanners: vuln
          cache: false
      - name: Upload Trivy report to GitHub Security
        uses: github/codeql-action/upload-sarif@v4
        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
        # upload even if a preceding step failed, but not without a report to upload
        if: ${{ always() && hashFiles('trivy-results.sarif') != '' }}
        with:
@@ -688,7 +688,7 @@
          # distinct from the docker-scan.yml categories, which track the published images
          category: trivy-build-alpine
      - name: Cache JMeter
        uses: actions/cache@v5
        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
        with:
          path: ~/jmeter
          key: jmeter-5.6.3
@@ -700,7 +700,7 @@
            "Release-alpine" openidentityplatform/opendj:alpine
      - name: Upload benchmark artifacts
        if: always()
        uses: actions/upload-artifact@v7
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: benchmark-build-vs-release-alpine
          path: |
@@ -716,9 +716,9 @@
    needs: build-maven
    runs-on: 'ubuntu-latest'
    steps:
      - uses: actions/checkout@v6
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Download artifacts
        uses: actions/download-artifact@v8
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ubuntu-latest-11
      - name: Clean-room install + SysV start/stop (debian:12 container)
@@ -798,9 +798,9 @@
    needs: build-maven
    runs-on: 'ubuntu-latest'
    steps:
      - uses: actions/checkout@v6
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Download artifacts
        uses: actions/download-artifact@v8
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ubuntu-latest-11
      - name: Install and start/stop in Rocky Linux 9
@@ -849,9 +849,9 @@
    needs: build-maven
    runs-on: 'ubuntu-latest'
    steps:
      - uses: actions/checkout@v6
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Download artifacts
        uses: actions/download-artifact@v8
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ubuntu-latest-11
      - name: Download released 5.1.2 deb
@@ -899,9 +899,9 @@
    needs: build-maven
    runs-on: 'ubuntu-latest'
    steps:
      - uses: actions/checkout@v6
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Download artifacts
        uses: actions/download-artifact@v8
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ubuntu-latest-11
      - name: Download released 5.1.2 rpm
@@ -1033,17 +1033,17 @@
      # Only for .github/scripts/wait-server-stopped.ps1 and the MSI authoring the guard
      # step below reads, and it has to come first: checkout cleans the workspace the
      # artifact is unpacked into. Sparse because those two are the entire reason for it.
      - uses: actions/checkout@v6
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          sparse-checkout: |
            .github/scripts
            opendj-packages/opendj-msi/opendj-msi-standard/resources/msi
      - name: Download artifacts
        uses: actions/download-artifact@v8
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: windows-latest-11
      - name: Set up Java
        uses: actions/setup-java@v5
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: '25'
          distribution: 'zulu'
@@ -1227,11 +1227,11 @@
      contents: read
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v8
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: windows-latest-11
      - name: Set up Java
        uses: actions/setup-java@v5
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: '25'
          distribution: 'zulu'

 .github/workflows/codeql.yml

@@ -80,12 +80,12 @@

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: recursive

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
@@ -120,13 +120,13 @@
      # --- Java manual build (only used if the java entry is set to 'manual')
      # - name: Set up JDK 11
      #   if: matrix.language == 'java-kotlin'
      #   uses: actions/setup-java@v5
      #   uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
      #   with:
      #     java-version: '11'
      #     distribution: 'zulu'
      # - name: Cache Maven packages
      #   if: matrix.language == 'java-kotlin'
      #   uses: actions/cache@v6
      #   uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      #   with:
      #     path: ~/.m2/repository
      #     key: ${{ runner.os }}-m2-repository-${{ hashFiles('**/pom.xml') }}
@@ -139,6 +139,6 @@
      # ---------------------------------------------------------------------

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
        with:
          category: "/language:${{ matrix.language }}"

 .github/workflows/deploy.yml

@@ -54,7 +54,7 @@
        run:   |
          sudo apt-get update
          sudo apt-get install -y rpm
      - uses: actions/checkout@v6
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          fetch-depth: 0
          submodules: recursive
@@ -82,7 +82,7 @@
      # not start new workflow runs, so this cannot loop; a PAT would break that.
      - name: Download the launchers built by the triggering Build run
        continue-on-error: true
        uses: actions/download-artifact@v8
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: windows-exe-11
          run-id: ${{ github.event.workflow_run.id }}
@@ -176,7 +176,7 @@
          done
          echo "::warning title=Could not refresh the launcher binaries::$BRANCH kept moving under this job. Refresh opendj-server-legacy/lib/*.exe from the windows-exe-11 artifact of Build run ${RUN_ID} and commit them."
      - name: Set up Java for publishing to Maven Central Repository OSS
        uses: actions/setup-java@v5
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: ${{ github.event.workflow_run.head_branch == 'sustaining/4.10.x' && '8' || '11'}}
          distribution: 'temurin'
@@ -184,7 +184,7 @@
          server-username: MAVEN_USERNAME
          server-password: MAVEN_PASSWORD
      - name: Cache Maven packages
        uses: actions/cache@v5
        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
        with:
         path: ~/.m2/repository
         key: ${{ runner.os }}-m2-repository-${{ hashFiles('**/pom.xml') }}
@@ -214,22 +214,22 @@
        continue-on-error: true
        run: mvn javadoc:aggregate
      - name: Upload artifacts OpenDJ Server
        uses: actions/upload-artifact@v7
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
         name: OpenDJ Server
         path: opendj-server-legacy/target/package/*.zip
      - name: Upload artifacts OpenDJ SDK Toolkit
        uses: actions/upload-artifact@v7
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
         name: OpenDJ SDK Toolkit
         path: opendj-ldap-toolkit/target/*.zip
      - name: Upload artifacts OpenDJ Debian Package
        uses: actions/upload-artifact@v7
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
         name: OpenDJ Debian Package
         path: opendj-packages/opendj-deb/opendj-deb-standard/target/*.deb
      - name: Upload artifacts OpenDJ RPM Package
        uses: actions/upload-artifact@v7
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
         name: OpenDJ RPM Package
         path: opendj-packages/opendj-rpm/opendj-rpm-standard/target/rpm/opendj/RPMS/noarch/*.rpm
@@ -237,7 +237,7 @@
      # Build run (windows-latest-11 artifact) instead of rebuilding it here.
      - name: Download Windows build artifact (contains the MSI)
        continue-on-error: true
        uses: actions/download-artifact@v8
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: windows-latest-11
          run-id: ${{ github.event.workflow_run.id }}
@@ -245,7 +245,7 @@
          path: windows-build
      - name: Upload artifacts OpenDJ MSI Package
        continue-on-error: true
        uses: actions/upload-artifact@v7
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
         name: OpenDJ MSI Package
         path: windows-build/opendj-packages/opendj-msi/opendj-msi-standard/target/*.msi
@@ -253,27 +253,27 @@
         # continue-on-error) instead of warning and publishing nothing.
         if-no-files-found: error
      - name: Upload artifacts OpenDJ Docker Packages
        uses: actions/upload-artifact@v7
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
         name: OpenDJ Docker Packages
         path: opendj-packages/opendj-docker/target/Dockerfile.zip
      - name: Upload artifacts OpenDJ Openshift template
        uses: actions/upload-artifact@v7
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
         name: OpenDJ Openshift template
         path: opendj-packages/opendj-openshift-template/*.yaml
      - name: Upload artifacts OpenDJ Doc Generated Reference
        uses: actions/upload-artifact@v7
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
         name: OpenDJ Doc Generated References
         path: opendj-doc-generated-ref/target/*.zip
      - name: Upload artifacts OpenDJ DSML Gateway
        uses: actions/upload-artifact@v7
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
         name: OpenDJ DSML Gateway
         path: opendj-dsml-servlet/target/*.war
      - name: Upload artifacts OpenDJ Commons REST LDAP Gateway
        uses: actions/upload-artifact@v7
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
         name: OpenDJ Commons REST LDAP Gateway
         path: opendj-rest2ldap-servlet/target/*.war
@@ -282,7 +282,7 @@
          git config --global user.name "Open Identity Platform Community"
          git config --global user.email "open-identity-platform-opendj@googlegroups.com"
          cd ..
      - uses: actions/checkout@v6
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        continue-on-error: true
        with:
          repository: ${{ github.repository }}.wiki
@@ -302,7 +302,7 @@
          git commit -a -m "upload docs after deploy ${{ github.sha }}"
          git push --quiet --force

      - uses: actions/checkout@v6
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        continue-on-error: true
        with:
          repository: OpenIdentityPlatform/doc.openidentityplatform.org

 .github/workflows/docker-scan.yml

@@ -37,7 +37,7 @@
      matrix:
        tag: [ 'latest', 'alpine' ]
    steps:
      - uses: actions/checkout@v6
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Scan openidentityplatform/opendj:${{ matrix.tag }} (Trivy)
        # unlike the build.yml gate, unfixed CVEs are reported too: surfacing them in
        # already-released images is the point of this workflow
@@ -51,7 +51,7 @@
          scanners: vuln
          cache: false
      - name: Upload report to GitHub Security
        uses: github/codeql-action/upload-sarif@v4
        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
        # upload even if a preceding step failed, but not without a report to upload
        if: ${{ always() && hashFiles(format('trivy-{0}.sarif', matrix.tag)) != '' }}
        with:

 .github/workflows/release.yml

@@ -50,12 +50,12 @@
        run:   |
          sudo apt-get update
          sudo apt-get install -y rpm
      - uses: actions/checkout@v6
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          fetch-depth: 0
          submodules: recursive
      - name: Set up Java for publishing to Maven Central Repository OSS
        uses: actions/setup-java@v5
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: ${{ github.event.workflow_run.head_branch == 'sustaining/4.10.x' && '8' || '11'}}
          distribution: 'temurin'
@@ -63,7 +63,7 @@
          server-username: MAVEN_USERNAME
          server-password: MAVEN_PASSWORD
      - name: Cache Maven packages
        uses: actions/cache@v5
        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
        with:
         path: ~/.m2/repository
         key: ${{ runner.os }}-m2-repository-${{ hashFiles('**/pom.xml') }}
@@ -93,7 +93,7 @@
      # built on Windows), so it does not have to rebuild opendj-server-legacy.
      - name: Upload the server zip for the MSI job
        continue-on-error: true
        uses: actions/upload-artifact@v7
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-server-zip
          retention-days: 1
@@ -120,7 +120,7 @@
            target/checkout/opendj-doc-generated-ref/target/*.zip
            target/checkout/opendj-dsml-servlet/target/*.war
            target/checkout/opendj-rest2ldap-servlet/target/*.war
      - uses: actions/checkout@v6
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        continue-on-error: true
        with:
          repository: ${{ github.repository }}.wiki
@@ -143,7 +143,7 @@
           git push --quiet --force
           git push --quiet --force origin ${{ github.event.inputs.releaseVersion }}

      - uses: actions/checkout@v6
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        continue-on-error: true
        with:
          repository: OpenIdentityPlatform/doc.openidentityplatform.org
@@ -174,12 +174,12 @@
    needs:
      - release-maven
    steps:
      - uses: actions/checkout@v6
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: ${{ github.event.inputs.releaseVersion }}
          submodules: recursive
      - name: Set up Java
        uses: actions/setup-java@v5
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: '11'
          distribution: 'temurin'
@@ -188,7 +188,7 @@
      # and saving that under the key build-maven restores from would seed every later
      # Windows build with it.
      - name: Cache Maven packages
        uses: actions/cache/restore@v5
        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
        with:
         path: ~/.m2/repository
         key: ${{ runner.os }}-m2-repository-${{ hashFiles('**/pom.xml') }}
@@ -204,7 +204,7 @@
          wix --version
          wix extension add -g WixToolset.UI.wixext/5.0.2 || true
      - name: Download the server zip built by release-maven
        uses: actions/download-artifact@v8
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: release-server-zip
          path: server-zip
@@ -246,7 +246,7 @@
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v6
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: ${{ github.event.inputs.releaseVersion }}
          fetch-depth: 1
@@ -298,7 +298,7 @@
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v6
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          ref: ${{ github.event.inputs.releaseVersion }}
          fetch-depth: 1