chore: update github workflow and readme

Author: nsingh-bd

.github/workflows/codeql-analysis.yml

@@ -39,11 +39,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@7fd177fa680c9881b53cdab4d346d32574c9f7f4 #v3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -54,7 +54,7 @@ jobs:
         # queries: security-extended,security-and-quality
 
     - name: Set up JDK ${{ matrix.java }}
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 #v5
       with:
         distribution: 'zulu'
         java-version: 8
@@ -88,4 +88,4 @@ jobs:
         atlas-package
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@7fd177fa680c9881b53cdab4d346d32574c9f7f4 #v3

README.md

@@ -12,6 +12,30 @@ codedx-bamboo-plugin
 
  3. If needed, update the Swagger client [following the instructions here](SwaggerSetup.md).  This shouldn't be needed but may be necessary if there is a version mismatch with the Code Dx server.
 
+## Building the Plugin
+
+### ⚠️ Important: Build `jersey-shaded` First
+
+This project depends on a local shaded JAR (`jersey-shaded`) that is **not published to any remote Maven repository**. It must be installed into your local Maven repository before building the main plugin.
+
+**Always follow this two-step build order:**
+
+**Step 1 — Install `jersey-shaded` into your local Maven repository:**
+
+```bash
+cd jersey-shaded
+atlas-mvn clean install
+cd ..
+```
+
+**Step 2 — Build the main plugin:**
+
+```bash
+atlas-mvn clean install
+```
+
+> **Why?** `jersey-shaded` relocates Jersey 3.x and HK2 classes into the `com.codedx.shaded.*` namespace to avoid classloader conflicts with Bamboo's own Jersey packages.
+
 ## Running the Plugin
 
  * It is recommended to run and debug the plugin from IntelliJ.  Alternatively, it can be done from the command line.
@@ -20,6 +44,8 @@ codedx-bamboo-plugin
 
  * First, open the Maven window on the right side of IntelliJ.  If the window doesn't show any commands, use the `Reimport all Maven Projects` button and the `Generate Source and Update Folders for All Projects` button to populate the list.
 
+ * **Before running any lifecycle command from IntelliJ**, ensure `jersey-shaded` is already installed in your local Maven repository (see [Building the Plugin](#building-the-plugin) above). If you run the `clean` lifecycle from IntelliJ without doing this first, subsequent builds will fail until you re-install `jersey-shaded`.
+
  * To clean the project, run the `codedx-bamboo-plugin/Lifecycle/clean` maven command.
 
  * To run the project, run the `codedx-bamboo-plugin/Plugins/bamboo/bamboo:run` maven command.

jersey-shaded/pom.xml

@@ -6,7 +6,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>com.codedx</groupId>
     <artifactId>jersey-shaded</artifactId>
-    <version>3.0.0</version>
+    <version>3.0.1</version>
     <packaging>jar</packaging>
     <name>Jersey 3.x Shaded (relocated to com.codedx.shaded.*)</name>
     <description>

pom.xml

@@ -7,7 +7,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>com.codedx</groupId>
     <artifactId>codedx-bamboo-plugin</artifactId>
-    <version>3.0.0</version>
+    <version>3.0.1</version>
 
     <organization>
         <name>Code Dx</name>
@@ -49,14 +49,14 @@
             Build this module first: cd jersey-shaded && atlas-mvn install
 
             All original Jersey/HK2 JARs are excluded here because they are already shaded
-            (relocated) inside jersey-shaded-2.0.1.jar. Without these exclusions, Maven
+            (relocated) inside jersey-shaded-3.0.1.jar. Without these exclusions, Maven
             would resolve the transitive deps and AMPS would embed the original
             org.glassfish.jersey.* classes alongside the shaded ones.
         -->
         <dependency>
             <groupId>com.codedx</groupId>
             <artifactId>jersey-shaded</artifactId>
-            <version>3.0.0</version>
+            <version>3.0.1</version>
             <exclusions>
                 <exclusion>
                     <groupId>org.glassfish.jersey.core</groupId>