Merge branch 'master' into RRCache

Author: DenizAltunkapan

.github/workflows/build.yml

@@ -1,6 +1,9 @@
 name: Build
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/clang-format-lint.yml

@@ -3,6 +3,9 @@ on:
   push: {}
   pull_request: {}
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/codeql.yml

@@ -10,12 +10,9 @@ on:
   schedule:
     - cron: '53 3 * * 0'
 
-env:
-  LANGUAGE: 'java-kotlin'
-
 jobs:
-  analyze:
-    name: Analyze
+  analyzeJava:
+    name: AnalyzeJava
     runs-on: 'ubuntu-latest'
     permissions:
       actions: read
@@ -35,13 +32,35 @@ jobs:
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3
         with:
-          languages: ${{ env.LANGUAGE }}
+          languages: 'java-kotlin'
 
       - name: Build
         run: mvn --batch-mode --update-snapshots verify
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v3
         with:
-          category: "/language:${{env.LANGUAGE}}"
+          category: "/language:java-kotlin"
+
+  analyzeActions:
+    name: AnalyzeActions
+    runs-on: 'ubuntu-latest'
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: 'actions'
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:actions"
 ...

.github/workflows/infer.yml

@@ -8,6 +8,9 @@ name: Infer
       - master
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   run_infer:
     runs-on: ubuntu-latest

.github/workflows/project_structure.yml

@@ -8,6 +8,9 @@ name: ProjectStructure
       - master
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   check_structure:
     runs-on: ubuntu-latest

.github/workflows/stale.yml

@@ -2,8 +2,13 @@ name: 'Close stale issues and PRs'
 on:
   schedule:
     - cron: '0 0 * * *'
+permissions:
+  contents: read
 jobs:
   stale:
+    permissions:
+      issues: write
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/stale@v9

.gitpod.dockerfile

@@ -1,4 +1,4 @@
-FROM gitpod/workspace-java-21:2025-05-14-07-50-25
+FROM gitpod/workspace-java-21:2025-06-18-16-47-14
 
 ENV LLVM_SCRIPT="tmp_llvm.sh"
 

pom.xml

@@ -20,7 +20,7 @@
             <dependency>
                 <groupId>org.junit</groupId>
                 <artifactId>junit-bom</artifactId>
-                <version>5.13.1</version>
+                <version>5.13.2</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
@@ -113,14 +113,14 @@
                     <dependency>
                     <groupId>com.puppycrawl.tools</groupId>
                     <artifactId>checkstyle</artifactId>
-                    <version>10.25.0</version>
+                    <version>10.26.0</version>
                     </dependency>
                 </dependencies>
             </plugin>
             <plugin>
                 <groupId>com.github.spotbugs</groupId>
                 <artifactId>spotbugs-maven-plugin</artifactId>
-                <version>4.9.3.0</version>
+                <version>4.9.3.1</version>
                 <configuration>
                     <excludeFilterFile>spotbugs-exclude.xml</excludeFilterFile>
                     <includeTests>true</includeTests>
@@ -141,7 +141,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-pmd-plugin</artifactId>
-                <version>3.26.0</version>
+                <version>3.27.0</version>
                 <configuration>
                     <rulesets>
                         <ruleset>/rulesets/java/maven-pmd-plugin-default.xml</ruleset>