GeezerVison

Copy link

Copy Markdown

Contributor

brunoborges requested a review from a team as a code owner July 31, 2026 14:40

brunoborges requested review from Copilot and gdams July 31, 2026 14:51

Copilot started reviewing on behalf of brunoborges July 31, 2026 14:52

View session

Copilot AI approved these changes Jul 31, 2026

View reviewed changes

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

407 checks passed

brunoborges deleted the brunoborges-deprecate-adopt-v5 branch July 31, 2026 19:34

Bumps the github-actions group with 2 updates: [zgosalvez/github-actions-ensure-sha-pinned-actions](https://github.com/zgosalvez/github-actions-ensure-sha-pinned-actions) and [actions/setup-java](https://github.com/actions/setup-java).
Updates `zgosalvez/github-actions-ensure-sha-pinned-actions` from 5.0.5 to 5.0.6
Release notes

*Sourced from [zgosalvez/github-actions-ensure-sha-pinned-actions's releases](https://github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/releases).*

> v5.0.6
> ------
>
> What's Changed
> --------------
>
> * Bump eslint from 10.3.0 to 10.8.0 by [`@​dependabot`](https://github.com/dependabot)[bot] in [zgosalvez/github-actions-ensure-sha-pinned-actions#329](https://redirect.github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/pull/329)
> * Bump yaml from 2.8.4 to 2.9.0 by [`@​dependabot`](https://github.com/dependabot)[bot] in [zgosalvez/github-actions-ensure-sha-pinned-actions#326](https://redirect.github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/pull/326)
> * Bump zgosalvez/github-actions-get-action-runs-using-version from 3.0.1 to 3.0.2 by [`@​dependabot`](https://github.com/dependabot)[bot] in [zgosalvez/github-actions-ensure-sha-pinned-actions#324](https://redirect.github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/pull/324)
> * Bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 by [`@​dependabot`](https://github.com/dependabot)[bot] in [zgosalvez/github-actions-ensure-sha-pinned-actions#323](https://redirect.github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/pull/323)
> * Bump actions/checkout from 6.0.3 to 7.0.0 by [`@​dependabot`](https://github.com/dependabot)[bot] in [zgosalvez/github-actions-ensure-sha-pinned-actions#322](https://redirect.github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/pull/322)
> * Bump actions/cache from 5.0.5 to 6.1.0 by [`@​dependabot`](https://github.com/dependabot)[bot] in [zgosalvez/github-actions-ensure-sha-pinned-actions#321](https://redirect.github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/pull/321)
> * Bump `@​vercel/ncc` from 0.38.4 to 0.44.1 by [`@​dependabot`](https://github.com/dependabot)[bot] in [zgosalvez/github-actions-ensure-sha-pinned-actions#325](https://redirect.github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/pull/325)
> * Hotfix/dp61 by [`@​zgosalvez`](https://github.com/zgosalvez) in [zgosalvez/github-actions-ensure-sha-pinned-actions#330](https://redirect.github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/pull/330)
> * Fix invocations by [`@​zgosalvez`](https://github.com/zgosalvez) in [zgosalvez/github-actions-ensure-sha-pinned-actions#331](https://redirect.github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/pull/331)
> * Potential fix for code scanning alert no. 17: Shell command built from environment values by [`@​zgosalvez`](https://github.com/zgosalvez) in [zgosalvez/github-actions-ensure-sha-pinned-actions#332](https://redirect.github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/pull/332)
> * Potential fix by [`@​zgosalvez`](https://github.com/zgosalvez) in [zgosalvez/github-actions-ensure-sha-pinned-actions#333](https://redirect.github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/pull/333)
> * Another potential fix by [`@​zgosalvez`](https://github.com/zgosalvez) in [zgosalvez/github-actions-ensure-sha-pinned-actions#334](https://redirect.github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/pull/334)
>
> **Full Changelog**: <zgosalvez/github-actions-ensure-sha-pinned-actions@v5...v5.0.6>


Commits

* [`46cfe80`](zgosalvez/github-actions-ensure-sha-pinned-actions@46cfe80) Another potential fix ([#334](https://redirect.github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/issues/334))
* [`aebb5fc`](zgosalvez/github-actions-ensure-sha-pinned-actions@aebb5fc) Potential fix ([#333](https://redirect.github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/issues/333))
* [`2c4885a`](zgosalvez/github-actions-ensure-sha-pinned-actions@2c4885a) Potential fix for code scanning alert no. 17: Shell command built from enviro...
* [`6a25f4a`](zgosalvez/github-actions-ensure-sha-pinned-actions@6a25f4a) Fix invocations ([#331](https://redirect.github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/issues/331))
* [`0f97f22`](zgosalvez/github-actions-ensure-sha-pinned-actions@0f97f22) Hotfix/dp61 ([#330](https://redirect.github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/issues/330))
* [`1816ffb`](zgosalvez/github-actions-ensure-sha-pinned-actions@1816ffb) Bump `@​vercel/ncc` from 0.38.4 to 0.44.1 ([#325](https://redirect.github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/issues/325))
* [`4f14b1e`](zgosalvez/github-actions-ensure-sha-pinned-actions@4f14b1e) Bump actions/cache from 5.0.5 to 6.1.0 ([#321](https://redirect.github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/issues/321))
* [`76a5175`](zgosalvez/github-actions-ensure-sha-pinned-actions@76a5175) Bump actions/checkout from 6.0.3 to 7.0.0 ([#322](https://redirect.github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/issues/322))
* [`4f0210f`](zgosalvez/github-actions-ensure-sha-pinned-actions@4f0210f) Bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 ([#323](https://redirect.github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/issues/323))
* [`c616d20`](zgosalvez/github-actions-ensure-sha-pinned-actions@c616d20) Bump zgosalvez/github-actions-get-action-runs-using-version ([#324](https://redirect.github.com/zgosalvez/github-actions-ensure-sha-pinned-actions/issues/324))
* Additional commits viewable in [compare view](zgosalvez/github-actions-ensure-sha-pinned-actions@3db98c0...46cfe80)
  
Updates `actions/setup-java` from 5.6.0 to 5.7.0
Release notes

*Sourced from [actions/setup-java's releases](https://github.com/actions/setup-java/releases).*

> v5.7.0
> ------
>
> What's Changed
> --------------
>
> * Fix npm audit failures on releases/v5 by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1154](https://redirect.github.com/actions/setup-java/pull/1154)
> * Backport [#1151](https://redirect.github.com/actions/setup-java/issues/1151): Fix missing wrapper cache distributions by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1153](https://redirect.github.com/actions/setup-java/pull/1153)
> * Deprecate legacy Adopt distributions in v5 by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1186](https://redirect.github.com/actions/setup-java/pull/1186)
>
> **Full Changelog**: <actions/setup-java@v5.6.0...v5.7.0>


Commits

* [`b6effb0`](actions/setup-java@b6effb0) Deprecate legacy Adopt distributions in v5 ([#1186](https://redirect.github.com/actions/setup-java/issues/1186))
* [`e498d2a`](actions/setup-java@e498d2a) Backport [#1151](https://redirect.github.com/actions/setup-java/issues/1151): Fix missing wrapper cache distributions ([#1153](https://redirect.github.com/actions/setup-java/issues/1153))
* [`6a3384d`](actions/setup-java@6a3384d) Fix npm audit failures on releases/v5 ([#1154](https://redirect.github.com/actions/setup-java/issues/1154))
* See full diff in [compare view](actions/setup-java@03ad4de...b6effb0)
  
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore  major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore  minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore  ` will remove the ignore condition of the specified dependency and ignore conditions

### Description

Replace the deprecated AdoptOpenJDK distribution with Temurin in the
Maven verification workflow. Preserve `actions/setup-java@v5`, the Java
8/11/17 selections, and the Spark/Scala matrix.

The release workflow is intentionally unchanged and remains with its
existing owners.

### Validation

- YAML parsing and structural comparison passed: only the Java
distribution changes.
- `git diff --check` passed.
- Maven matrix execution remains to be validated in CI.

### Deprecation References

- [setup-java v5.7.0 release
announcement](https://github.com/actions/setup-java/releases/tag/v5.7.0):
deprecates legacy AdoptOpenJDK distributions. The [upstream migration
notice](actions/setup-java#1186) recommends
`temurin` for `adopt` before its removal in v6.

Signed-off-by: Peixin Li <[email protected]>

### Description

Replace the deprecated AdoptOpenJDK distribution with Temurin in the
Blossom vulnerability-scan job. Keep `actions/setup-java@v5`, Java 8,
and all other workflow settings unchanged.

### Validation

- YAML parsing and structural comparison passed: only the Java
distribution changes.
- `git diff --check` passed.
- The self-hosted Blossom job was not run locally.

### Deprecation References

- [setup-java v5.7.0 release
announcement](https://github.com/actions/setup-java/releases/tag/v5.7.0):
deprecates legacy AdoptOpenJDK distributions. The [upstream migration
notice](actions/setup-java#1186) recommends
`temurin` for `adopt` before its removal in v6.

Signed-off-by: Peixin Li <[email protected]>

### Description

Replace the deprecated AdoptOpenJDK distribution with Temurin in the
Blossom vulnerability-scan job. Keep `actions/setup-java@v5`, Java 8,
and all other workflow settings unchanged.

### Validation

- YAML parsing and structural comparison passed: only the Java
distribution changes.
- `git diff --check` passed.
- The self-hosted Blossom job was not run locally.

### Deprecation References

- [setup-java v5.7.0 release
announcement](https://github.com/actions/setup-java/releases/tag/v5.7.0):
deprecates legacy AdoptOpenJDK distributions. The [upstream migration
notice](actions/setup-java#1186) recommends
`temurin` for `adopt` before its removal in v6.

Signed-off-by: Peixin Li <[email protected]>

### Description

Resolve GitHub Actions deprecation warnings without changing CI
coverage:

- Upgrade the withResource report upload from
`actions/upload-artifact@v4` to the Node 24-based `v7`, preserving the
artifact name, path, and failure-handling settings.
- Replace the six deprecated AdoptOpenJDK distribution settings with
Temurin while preserving every Java version and build matrix.

No workflow triggers, audit rules, product code, or shared actions are
changed. This is a CI-only dependency update with no change to Spark
execution or performance-sensitive code, so runtime performance testing
is not required.

Validation:
- YAML parsing and structural comparison passed; only the intended
dependency settings changed.
- `git diff --check` passed.
- Verified the selected action runtime is Node 24. Live Maven and
Blossom workflow runs remain to be validated in CI.

### Checklists

Documentation
- [ ] Updated for new or modified user-facing features or behaviors
- [x] No user-facing change

Testing
- [ ] Added or modified tests to cover new code paths
- [x] Covered by existing tests
(Existing `mvn[compile,RAT,scalastyle,docgen]` and Blossom-CI workflows;
execution pending in CI.)
- [ ] Not required

Performance
- [ ] Tests ran and results are added in the PR description
- [ ] Issue filed with a link in the PR description
- [x] Not required

### Deprecation References

- [GitHub Actions Node 20 deprecation
announcement](https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/):
recommends updating to actions that run on Node 24; Node 20 removal is
scheduled for September 23, 2026.
- [setup-java v5.7.0 release
announcement](https://github.com/actions/setup-java/releases/tag/v5.7.0):
deprecates legacy AdoptOpenJDK distributions. The [upstream migration
notice](actions/setup-java#1186) recommends
`temurin` for `adopt` before its removal in v6.

Signed-off-by: Peixin Li <[email protected]>