chore: fix SonarCloud security hotspots in sonar-scan and huggingface (#22480)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: gnodet

.github/workflows/sonar-scan.yml

@@ -129,8 +129,11 @@ jobs:
           path: ~/.sonar/cache
           key: ${{ runner.os }}-sonar
 
-      - id: install-packages
-        uses: ./.github/actions/install-packages
+      - name: Install packages
+        shell: bash
+        run: |
+          sudo apt-get update
+          sudo apt-get install -qqy --no-install-recommends libtinfo6
 
       - name: Run Sonar Analysis
         shell: bash
@@ -145,10 +148,10 @@ jobs:
           -Dsonar.pullrequest.github.summary_comment=true
           -Dsonar.projectKey=apache_camel
           -Dsonar.organization=apache
-          -Dsonar.token=${{ secrets.SONARCLOUD_TOKEN }}
           -B -V
         env:
           MAVEN_OPTS: "-XX:+UseG1GC -XX:InitialHeapSize=2g -XX:MaxHeapSize=6g -XX:+UseStringDeduplication"
+          SONAR_TOKEN: ${{ secrets.SONARCLOUD_TOKEN }}
 
       - name: Update PR check status
         uses: actions/github-script@v7

components/camel-ai/camel-huggingface/src/main/java/org/apache/camel/component/huggingface/tasks/AbstractTaskPredictor.java

@@ -18,11 +18,15 @@
 
 import java.io.IOException;
 import java.io.InputStream;
+import java.nio.file.FileSystems;
 import java.nio.file.FileVisitResult;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.SimpleFileVisitor;
 import java.nio.file.attribute.BasicFileAttributes;
+import java.nio.file.attribute.PosixFilePermission;
+import java.nio.file.attribute.PosixFilePermissions;
+import java.util.EnumSet;
 
 import ai.djl.inference.Predictor;
 import ai.djl.modality.Input;
@@ -57,7 +61,14 @@ protected AbstractTaskPredictor() {
 
     @Override
     public void loadModel() throws Exception {
-        tmpDir = Files.createTempDirectory("hf_model");
+        if (FileSystems.getDefault().supportedFileAttributeViews().contains("posix")) {
+            tmpDir = Files.createTempDirectory("hf_model",
+                    PosixFilePermissions.asFileAttribute(
+                            EnumSet.of(PosixFilePermission.OWNER_READ, PosixFilePermission.OWNER_WRITE,
+                                    PosixFilePermission.OWNER_EXECUTE)));
+        } else {
+            tmpDir = Files.createTempDirectory("hf_model");
+        }
         Path handlerPath = tmpDir.resolve("handler.py");
         String pythonScript = getPythonScript();
         Files.writeString(handlerPath, pythonScript);