Add macaron

.github/macaron/defaults.ini

@@ -0,0 +1,13 @@
+[analysis.checks]
+exclude =
+    mcn_build_as_code_1
+    mcn_build_service_1
+    mcn_find_artifact_pipeline_1
+    mcn_provenance_available_1
+    mcn_provenance_verified_1
+    mcn_provenance_derived_commit_1
+    mcn_provenance_derived_repo_1
+    mcn_provenance_witness_level_one_1
+    mcn_provenance_expectation_1
+    mcn_trusted_builder_level_three_1
+include = *

.github/workflows/build-trivy.yaml

@@ -37,14 +37,17 @@ on:
     # Every day at midnight
     - cron: '0 0 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
 
 #   Checkout the source, we need a depth of zero to fetch all the history otherwise
 #   the copyright check cannot work out the date of the files from Git.
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         fetch-depth: 0
 

.github/workflows/macaron-check-github-actions.yml

@@ -0,0 +1,39 @@
+name: Macaron check-github-actions
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+  workflow_dispatch:
+  schedule:
+    - cron: "17 4 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  macaron-check-github-actions:
+    name: Macaron policy verification
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Run Macaron check-github-actions policy
+        uses: oracle/macaron@b31acfe389133a5587d9639063ec70cb84e7bc47 # v0.23.0
+        with:
+          repo_path: ./
+          defaults_path: .github/macaron/defaults.ini
+          policy_file: check-github-actions
+          policy_purl: pkg:github.com/${{ github.repository }}@.*
+          reports_retention_days: 90

.github/workflows/test-against-released.yml

@@ -34,6 +34,9 @@ on:
     branches:
     - '*'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -50,17 +53,17 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Cache Maven packages
-      uses: actions/cache@v4
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ~/.m2
         key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
         restore-keys: ${{ runner.os }}-m2
 
     - name: Set up JDK 11 for Build
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
       with:
         java-version: '17'
         distribution: 'zulu'
@@ -80,20 +83,20 @@ jobs:
         mvn --file coherence-visualvm-tests/coherence-visualvm-tests-ce/pom.xml --batch-mode -e -Dcoherence.version=${{ matrix.version }} clean install
 
     - name: Build Artifacts test logs
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: failure()
       with:
         name: test-output-${{ matrix.version }}
         path: coherence-visualvm-tests/**/target/test-output/**/*
 
     - name: Coherence VisualVM Plugin NBM
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: coherence-visualvm-plugin-nbm-${{ matrix.version }}
         path: coherence-visualvm-plugin/target/coherence-visualvm-plugin*.nbm
 
     - name: Coherence VisualVM Plugin Javadoc
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: coherence-visualvm-plugin-javadoc-${{ matrix.version }}
         path: coherence-visualvm-plugin/target/coherence-visualvm-plugin*javadoc.jar

.github/workflows/test-against-snapshot-1440.yml

@@ -37,21 +37,24 @@ on:
     # Every day at midnight
     - cron: '0 0 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         coherenceVersion:
-          - 14.1.1-0-23-SNAPSHOT
+          - 14.1.1-0-25-SNAPSHOT
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Cache Maven packages
-      uses: actions/cache@v4
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ~/.m2
         key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
@@ -61,7 +64,7 @@ jobs:
       run: mvn -version && ant -version
 
     - name: Set up JDK 11 for Plugin
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
       with:
         java-version: 11
         distribution: 'zulu'
@@ -80,20 +83,20 @@ jobs:
         mvn --file coherence-visualvm-tests/coherence-visualvm-tests-ce/pom.xml --batch-mode -nsu -e -Dcoherence.version=$COH_VERSION clean install
 
     - name: Build Artifacts test logs
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: failure()
       with:
         name: test-output-${{ matrix.coherenceVersion }}
         path: coherence-visualvm-tests/**/target/test-output/**/*
 
     - name: Coherence VisualVM Plugin NBM
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: coherence-visualvm-plugin-nbm-${{ matrix.coherenceVersion }}
         path: coherence-visualvm-plugin/target/coherence-visualvm-plugin*.nbm
 
     - name: Coherence VisualVM Plugin Javadoc
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: coherence-visualvm-plugin-javadoc-${{ matrix.coherenceVersion }}
         path: coherence-visualvm-plugin/target/coherence-visualvm-plugin*javadoc.jar

.github/workflows/test-against-snapshot.yml

@@ -37,31 +37,34 @@ on:
     # Every day at midnight
     - cron: '0 0 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         coherenceVersion:
-          - 25.03.3-SNAPSHOT
+          - 15.1.1-0-2-SNAPSHOT
           - 25.09-SNAPSHOT
-          - 22.06.14-SNAPSHOT
-          - 14.1.2-0-4-SNAPSHOT
+          - 22.06.16-SNAPSHOT
+          - 14.1.2-0-6-SNAPSHOT
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Cache Maven packages
-      uses: actions/cache@v4
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # 5.0.5
       with:
         path: ~/.m2
         key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
         restore-keys: ${{ runner.os }}-m2-snapshots
 
     - name: Set up JDK 17 for Build
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
       with:
         java-version: 17
         distribution: 'zulu'
@@ -86,20 +89,20 @@ jobs:
         mvn --file coherence-visualvm-tests/coherence-visualvm-tests-topics/pom.xml -P topics --batch-mode -nsu -e -Dcoherence.version=$COH_VERSION clean install
 
     - name: Build Artifacts test logs
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       if: failure()
       with:
         name: test-output-${{ matrix.coherenceVersion }}
         path: coherence-visualvm-tests/**/target/test-output/**/*
 
     - name: Coherence VisualVM Plugin NBM
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: coherence-visualvm-plugin-nbm-${{ matrix.coherenceVersion }}
         path: coherence-visualvm-plugin/target/coherence-visualvm-plugin*.nbm
 
     - name: Coherence VisualVM Plugin Javadoc
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: coherence-visualvm-plugin-javadoc-${{ matrix.coherenceVersion }}
         path: coherence-visualvm-plugin/target/coherence-visualvm-plugin*javadoc.jar

pom.xml

@@ -63,7 +63,7 @@
       --add-opens=java.base/java.net=ALL-UNNAMED
     </failsafe.argLine>
     <groovy.version>3.0.12</groovy.version>
-    <jackson.version>2.16.2</jackson.version>
+    <jackson.version>2.18.6</jackson.version>
     <jackson.databind.version>${jackson.version}</jackson.databind.version>
     <java.version>1.8</java.version>
     <java.version.eight>1.8</java.version.eight>