security: pin setup-zig to a commit SHA; mark temp-dir vuln reviewed

Resolve the SECURITY-category Sonar findings:

- S7637: pin the third-party mlugg/setup-zig action to a full commit SHA
  (d1434d0, v2) in ci/sonar/publish workflows, so a moved tag can't swap
  the action under us. The first-party actions/* are not flagged.
- S5443: NativeLibrary extracts the bundled library into an owner-only
  directory (Files.createTempDirectory, 0700 on POSIX) — the rule's
  warning is already mitigated with no further code change available, so
  suppress it for that file via sonar.issue.ignore with a documented why.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: dfa1

.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
           cache: maven
 
       - name: Set up Zig
-        uses: mlugg/setup-zig@v2
+        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
         with:
           version: 0.16.0
 

.github/workflows/publish.yml

@@ -31,7 +31,7 @@ jobs:
           gpg-passphrase: GPG_PASSPHRASE
 
       - name: Set up Zig
-        uses: mlugg/setup-zig@v2
+        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
         with:
           version: 0.16.0
 

.github/workflows/sonar.yml

@@ -28,7 +28,7 @@ jobs:
           cache: maven
 
       - name: Set up Zig
-        uses: mlugg/setup-zig@v2
+        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
         with:
           version: 0.16.0
 

pom.xml

@@ -63,6 +63,14 @@
 		<sonar.host.url>https://sonarcloud.io</sonar.host.url>
 		<sonar.organization>dfa11</sonar.organization>
 		<sonar.projectKey>dfa1_zstd-java</sonar.projectKey>
+		<!-- S5443 (temp dir in a publicly-writable location) on NativeLibrary is a
+		     reviewed false positive: the bundled library is extracted into a private
+		     directory created with Files.createTempDirectory, which is owner-only
+		     (0700) on POSIX, closing the swap/symlink window the rule warns about.
+		     There is no further code mitigation, so suppress it for that file. -->
+		<sonar.issue.ignore.multicriteria>tempdir</sonar.issue.ignore.multicriteria>
+		<sonar.issue.ignore.multicriteria.tempdir.ruleKey>java:S5443</sonar.issue.ignore.multicriteria.tempdir.ruleKey>
+		<sonar.issue.ignore.multicriteria.tempdir.resourceKey>**/NativeLibrary.java</sonar.issue.ignore.multicriteria.tempdir.resourceKey>
 		<!-- The benchmark module is a JMH harness, not shipped runtime: its
 		     @Setup/@TearDown lifecycle trips false "resource not closed" reports and
 		     it has no tests by design. Exclude from analysis entirely (which also

zstd/src/main/java/io/github/dfa1/zstd/ZstdFrame.java

@@ -14,7 +14,7 @@
 public final class ZstdFrame {
 
     /// Sentinel returned by `ZSTD_decompressBound` when the input is not valid.
-    private static final long CONTENTSIZE_ERROR = -2L;
+    private static final long CONTENT_SIZE_ERROR = -2L;
 
     /// Tests whether `data` begins with a valid zstd frame (standard or skippable).
     ///
@@ -213,7 +213,7 @@ private static long decompressedBound(MemorySegment data, long size) {
         } catch (Throwable t) {
             throw NativeCall.rethrow(t);
         }
-        if (bound == CONTENTSIZE_ERROR) {
+        if (bound == CONTENT_SIZE_ERROR) {
             throw new ZstdException("not valid zstd data");
         }
         return bound;