chore: CI Improvements (#139)

Merge pull request #139 from adangel:chore/ci-improvements

Author: adangel

.github/workflows/build.yml

@@ -23,14 +23,14 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 #v4.7.1
         with:
           distribution: 'temurin'
           java-version: '11'
       - name: Prepare HOME/openjdk11
         run: ln -sfn "${JAVA_HOME_11_X64}" "${HOME}/openjdk11"
-      - uses: actions/cache@v4
+      - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 #v4.2.4
         with:
           path: |
             ~/.m2/repository
@@ -42,7 +42,7 @@ jobs:
           restore-keys: |
             v4-${{ runner.os }}-
       - name: Set up Ruby 3.3
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@2a7b30092b0caf9c046252510f9273b4875f3db9 #v1.254.0
         with:
           ruby-version: 3.3
       - name: Install dependencies (bundler)

.github/workflows/manual-integration-tests.yml

@@ -18,14 +18,14 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: false
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 #v4.7.1
         with:
           distribution: 'temurin'
           java-version: '11'
       - name: Prepare HOME/openjdk11
         run: ln -sfn "${JAVA_HOME_11_X64}" "${HOME}/openjdk11"
-      - uses: actions/cache@v4
+      - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 #v4.2.4
         with:
           path: |
             ~/.m2/repository
@@ -37,7 +37,7 @@ jobs:
           restore-keys: |
             v4-${{ runner.os }}-
       - name: Set up Ruby 3.3
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@2a7b30092b0caf9c046252510f9273b4875f3db9 #v1.254.0
         with:
           ruby-version: 3.3
       - name: Install dependencies (bundler)

.github/workflows/publish-release.yml

@@ -30,11 +30,11 @@ jobs:
     outputs:
       VERSION: ${{ steps.version.outputs.VERSION }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
         with:
           ref: ${{ github.event.workflow_run.head_branch }}
       - name: Set up Ruby 3.3
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@2a7b30092b0caf9c046252510f9273b4875f3db9 #v1.254.0
         with:
           ruby-version: 3.3
       - name: Install dependencies (bundler)
@@ -92,7 +92,7 @@ jobs:
         shell: bash
     steps:
       - name: Set up Ruby 3.3
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@2a7b30092b0caf9c046252510f9273b4875f3db9 #v1.254.0
         with:
           ruby-version: 3.3
       - name: Install dependencies (bundler)
@@ -116,10 +116,18 @@ jobs:
           gem build pmdtester.gemspec
           gempkgfile="$(echo pmdtester-*.gem)"
           gem push "${gempkgfile}"
+      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e #v2.0.6
+        id: pmd-actions-helper-app-token
+        with:
+          app-id: ${{ secrets.PMD_ACTIONS_HELPER_ID }}
+          private-key: ${{ secrets.PMD_ACTIONS_HELPER_PRIVATE_KEY }}
+          owner: pmd
+          repositories: pmd-regression-tester
+          permission-contents: write # create a release
       - name: Create GitHub Release
         env:
           # Token required for GH CLI:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.pmd-actions-helper-app-token.outputs.token }}
           TAG_NAME: ${{ github.event.workflow_run.head_branch }}
           VERSION: ${{ needs.check-version.outputs.VERSION }}
         run: |

History.md

@@ -5,6 +5,7 @@
 ## Enhancements
 
 ## Fixed Issues
+* [#139](https://github.com/pmd/pmd-regression-tester/pull/139): chore: CI Improvements
 
 ## Dependency Updates