ci: SHA-pin all actions + drop ci-java path filter to unblock required check

Two fixes flagged by code review of PR #131:

1. **Pin every `uses:` to a 40-char commit SHA** (Scorecard
   Pinned-Dependencies rule). New workflows landed with `@v4`/`@v5`/etc
   tags. Resolved each to the latest release commit SHA via
   `gh api repos/<owner>/<repo>/releases/latest`. Comments preserve
   the tag for readability:

       actions/checkout@de0fac2e... # v6.0.2
       actions/setup-go@4a360112... # v6.4.0
       actions/upload-artifact@043fb46d... # v7.0.1
       actions/download-artifact@3e5f45b2... # v8.0.1
       actions/attest-build-provenance@a2bbfa25... # v4.1.0
       anchore/sbom-action@e22c3899... # v0.24.0
       sigstore/cosign-installer@6f9f1778... # v4.1.2
       goreleaser/goreleaser-action@1a80836c... # v7.2.1

2. **Remove `paths:` filter from ci-java.yml.** The `build` job
   name is a required check on main's branch protection. With the
   path filter, PRs that don't touch `src/**` or `pom.xml` (like the
   phase-5 release PR) cause the workflow to be skipped, which never
   reports a status — leaving "build" stuck at "Waiting for status
   to be reported" indefinitely and blocking merge.

   Java compile is ~1 minute with the Maven cache. The cost is worth
   the always-on signal until Phase 6 cutover deletes the Java tree.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: aksOps

.github/workflows/ci-java.yml

@@ -14,16 +14,15 @@ name: Java CI
 on:
   push:
     branches: [main]
-    paths:
-      - 'src/**'
-      - 'pom.xml'
-      - '.github/workflows/ci-java.yml'
   pull_request:
     branches: [main]
-    paths:
-      - 'src/**'
-      - 'pom.xml'
-      - '.github/workflows/ci-java.yml'
+  # NOTE: no `paths:` filter. The `build` job name is a required check
+  # on main's branch protection, and a `paths:` filter would cause the
+  # check to be skipped on PRs that don't touch Java — leaving the
+  # required check stuck at "Waiting for status to be reported", which
+  # blocks merge of every non-Java PR (e.g. PR #131 phase 5 release infra).
+  # Java compile is ~1 minute; the cost is worth the always-on signal
+  # until Phase 6 cutover deletes the Java tree entirely.
 
 permissions: read-all
 

.github/workflows/perf-gate.yml

@@ -41,8 +41,8 @@ jobs:
       MIN_NODES: '40'
       MAX_PHANTOM_DROP_RATIO: '50'
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: '1.25.10'
           cache: true

.github/workflows/release-go.yml

@@ -45,10 +45,10 @@ jobs:
             goarch: arm64
             runner: macos-14
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: '1.25.10'
           cache: true
@@ -57,10 +57,10 @@ jobs:
         if: runner.os == 'Linux'
         run: sudo apt-get update -y && sudo apt-get install -y build-essential
       - name: Install Syft (SBOM)
-        uses: anchore/sbom-action/download-syft@v0
+        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
       - name: Install Cosign (signing)
-        uses: sigstore/cosign-installer@v3
-      - uses: goreleaser/goreleaser-action@v6
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 # v7.2.1
         with:
           distribution: goreleaser
           version: '~> v2'
@@ -71,7 +71,7 @@ jobs:
           GOOS: ${{ matrix.os }}
           GOARCH: ${{ matrix.goarch }}
       - name: Upload binary artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: codeiq-${{ matrix.os }}-${{ matrix.goarch }}
           path: dist/codeiq_*/codeiq*
@@ -85,26 +85,26 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: '1.25.10'
           cache: true
           cache-dependency-path: go/go.sum
       - name: Install build deps
         run: sudo apt-get update -y && sudo apt-get install -y build-essential
       - name: Install Syft (SBOM)
-        uses: anchore/sbom-action/download-syft@v0
+        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
       - name: Install Cosign (signing)
-        uses: sigstore/cosign-installer@v3
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
       - name: Download pre-built binaries
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: codeiq-*
           path: prebuilt
-      - uses: goreleaser/goreleaser-action@v6
+      - uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 # v7.2.1
         with:
           distribution: goreleaser
           version: '~> v2'
@@ -119,6 +119,6 @@ jobs:
           HOMEBREW_TAP_REPO: homebrew-codeiq
           HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
       - name: Attest release artifacts (build provenance)
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
         with:
           subject-path: 'dist/codeiq_*.tar.gz'