chore: CI Improvements (#216)

Merge pull request #216 from adangel:chore/ci-improvements

Author: adangel

.github/dependabot.yml

@@ -5,12 +5,11 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+      day: "wednesday"
     # Allow up to 10 open pull requests for maven dependencies
     open-pull-requests-limit: 10
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
-    groups:
-      all-actions:
-        patterns: [ "*" ]
+      day: "wednesday"

.github/workflows/build.yml

@@ -22,8 +22,8 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 #v4.7.1
         with:
           distribution: 'temurin'
           java-version: '11'
@@ -33,7 +33,7 @@ jobs:
           ./mvnw --show-version --errors --batch-mode \
               -Pshading \
               verify
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2
         with:
           name: compile-artifact
           if-no-files-found: error

.github/workflows/publish-release.yml

@@ -32,10 +32,10 @@ jobs:
     outputs:
       VERSION: ${{ steps.version.outputs.VERSION }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
         with:
           ref: ${{ github.event.workflow_run.head_branch }}
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 #v4.7.1
         with:
           distribution: 'temurin'
           java-version: '11'
@@ -88,10 +88,10 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
         with:
           ref: ${{ github.event.workflow_run.head_branch }}
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 #v4.7.1
         with:
           distribution: 'temurin'
           java-version: '11'
@@ -118,10 +118,18 @@ jobs:
           END_LINE=$((END_LINE - 1))
           RELEASE_BODY="$(head -$END_LINE CHANGELOG.md | tail -$((END_LINE - BEGIN_LINE)))"
           echo "$RELEASE_BODY" > release_notes.md
+      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e #v2.0.6
+        id: pmd-actions-helper-app-token
+        with:
+          app-id: ${{ secrets.PMD_ACTIONS_HELPER_ID }}
+          private-key: ${{ secrets.PMD_ACTIONS_HELPER_PRIVATE_KEY }}
+          owner: pmd
+          repositories: pmd
+          permission-contents: write # create a release
       - name: Create Release
         env:
           # Token required for GH CLI:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.pmd-actions-helper-app-token.outputs.token }}
           TAG_NAME: ${{ github.event.workflow_run.head_branch }}
           VERSION: ${{ needs.check-version.outputs.VERSION }}
         run: |

.github/workflows/publish-snapshot.yml

@@ -30,10 +30,10 @@ jobs:
     outputs:
       VERSION: ${{ steps.version.outputs.VERSION }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
         with:
           ref: main
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 #v4.7.1
         with:
           distribution: 'temurin'
           java-version: '11'
@@ -77,10 +77,10 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
         with:
           ref: main
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 #v4.7.1
         with:
           distribution: 'temurin'
           java-version: '11'

CHANGELOG.md

@@ -11,6 +11,7 @@
 * [#169](https://github.com/pmd/pmd-designer/pull/169): \[ci] publish-snapshot/release: migrate to central portal - [Andreas Dangel](https://github.com/adangel) (@adangel)
 * [#170](https://github.com/pmd/pmd-designer/pull/170): \[ci] Make build a reuseable workflow - [Andreas Dangel](https://github.com/adangel) (@adangel)
 * [#207](https://github.com/pmd/pmd-designer/pull/207): \[ci] Cleanup old scripts - [Andreas Dangel](https://github.com/adangel) (@adangel)
+* [#216](https://github.com/pmd/pmd-designer/pull/216): chore: CI Improvements - [Andreas Dangel](https://github.com/adangel) (@adangel)
 
 **📦 Dependency updates:**
 <details>