[bernardladenthin]

Moves every bernardladenthin/actions pin from v1.0.2 (40191d24) to v1.0.3 (23543c85, bernardladenthin/actions#4); no other change than the pins and the CHANGELOG entry.

v1.0.3 fixes the two GitHub-facing snapshot consumers that failed in java-llama.cpp's first snapshot dispatch on v1.0.1 (40227501358):

• central-snapshot: the jobs of older runs are listed 50 per page (with 100 GitHub answered a large run with HTTP 502), and GitHub reads are repeated on 5xx or a dropped stream.
• github-snapshot: a 403 on moving the snapshot tag deletes and re-creates the tag, and the release is pointed at it again.

Local checks: templates 0 problems, publication wiring 0 problems; no 40191d24 left.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VszvDmRRPP1UcwozsUMY1L

Summary by CodeRabbit

• Chores
  • Updated automated workflows to use the latest shared action release.
• Bug Fixes
  • Improved reliability of snapshot transfers with pagination, retries after server errors, and recovery when updating the snapshot tag is refused.
• Documentation
  • Updated the unreleased changelog with the shared action release notes.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

The workflows now reference bernardladenthin/actions v1.0.3 instead of v1.0.2. The changelog describes updates included in v1.0.3.

Changes: Shared action pin update

Layer / File(s)	Summary
CI and analysis workflow pins .github/workflows/codeql.yml, .github/workflows/dependency-submission.yml, .github/workflows/formal-verification.yml, .github/workflows/osv-scanner.yml, .github/workflows/reuse.yml, .github/workflows/sonarqube.yml	Reusable workflow and host-information action references change from v1.0.2 to v1.0.3.
Publishing workflow pins and changelog .github/workflows/publish.yml, CHANGELOG.md	Publishing action references change to v1.0.3. The changelog lists snapshot-transfer pagination, retries after GitHub server errors, and recovery when moving the snapshot tag is refused.

Priority: Not assessed

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Possibly related PRs

• bernardladenthin/streambuffer#193 updates the same action references from v1.0.1 to v1.0.2. This PR continues that pin sequence with v1.0.3.

Suggested reviewers: claude

Merge Risk: Minimal · up to 3cf65

This PR updates the shared action pins without identified workflow or publication regressions.

Security architecture risk: Low · up to 3cf65

The update retains the existing publication permissions, completion gates, and snapshot serialization. No introduced vulnerability is established, but the upstream implementation of snapshot-tag recovery was unavailable to verify its behavior after interruption or partial failure.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The dependency trust surface includes repository publication state, supplied GPG signing material, and the authority of the Central publication account. A compromised selected action could affect those assets within its job's effective authority. The workflow does not establish the full account scope or environment protections, and this is an existing trust relationship rather than a demonstrated attack path introduced by the update.

Trust Boundaries and Controls

• observed — Shared actions remain pinned to an exact commit. The workflow defaults to contents-read permission, grants contents-write explicitly to GitHub snapshot publication, and supplies Central credentials through the maven-central environment.

Resilience and Maintainability Implications

• observed — GitHub snapshot updates and Central snapshot transfers use separate per-repository concurrency groups with cancel-in-progress disabled. These controls serialize participating jobs within each group, but do not establish protection against external writers or recovery inside the shared actions.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud