chore(deps): update actions/setup-java action to v5.7.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-java	action	minor	v5.2.0 → v5.7.0

---

Release Notes

actions/setup-java (actions/setup-java)

v5.7.0

Compare Source

v5.6.0

Compare Source

What's Changed

• Backport to v5: Add Maven compiler problem matcher for javac diagnostics by @​brunoborges in #​1087
• feat: expose cache-primary-key output (#​597) [v5 backport] by @​brunoborges in #​1089
• dist: Cover Tencent Kona JDK 25 (#​1108) [v5 backport] by @​brunoborges in #​1110
• Backport #​1111: Preserve Maven toolchains across repeated setup-java runs (#​1099) by @​brunoborges in #​1113
• Backport #​1097/#​1098 to v5: cache Maven and Gradle wrapper distributions separately by @​brunoborges in #​1122

Full Changelog: actions/setup-java@v5...v5.6.0

v5.5.0

Compare Source

v5.4.0

Compare Source

What's Changed

• Bump @​typescript-eslint/parser from 8.48.0 to 8.61.1 by @​dependabot[bot] in #​1021
• Fix codeql workflow permissions by @​jsoref in #​993
• fix CodeQL permissions by @​gdams in #​1025
• fix: reject non-semver candidate versions in isVersionSatisfies by @​sproctor in #​1009
• Bump @​actions/cache to 5.1.0, handle cache write denied by @​jasongin in #​1026
• Add Maven Wrapper cache feature by @​mahabaleshwars in #​1027
• Spelling by @​jsoref in #​713
• add link to advanced configuration for JetBrains by @​robstoll in #​850
• docs(action): fix missing required or default fields by @​kranthipoturaju in #​1007
• feat: add microsoft openjdk 17.0.18 by @​al-kau in #​1002
• Update README.md - use "alert syntax for Markdown" for notes by @​mhoffrog in #​924
• Bump undici from 6.24.1 to 6.27.0 by @​dependabot[bot] in #​1033
• Update contributor guide with emoji for clarity by @​brunoborges in #​1028
• add javac problem matcher by @​Trass3r in #​562
• Clarify README version syntax and migration guidance by @​brunoborges with @​Copilot in #​1038
• Update undici artifacts to 6.27.0 (license cache + dist) by @​brunoborges in #​1040
• docs: enhance custom jdk file installation by @​stephanabel in #​996
• Templates for new Java distributions by @​panticmilos in #​429
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​1032
• Bump @​types/node from 25.9.3 to 26.0.0 by @​dependabot[bot] in #​1031
• docs: replace non-existent HelloWorldApp references with java --version by @​brunoborges with @​Copilot in #​1043
• docs: add JavaFX Maven project configuration instructions by @​brunoborges with @​Copilot in #​1044
• docs: self-signed certificate / internal CA handling for GitHub Enterprise by @​brunoborges in #​1050
• docs: document importing an internal CA into the installed JDK (cacerts) by @​brunoborges in #​1051
• chore: Harden workflows: least-privilege permissions + zizmor integration by @​brunoborges in #​1039
• dist: Add GraalVM Community distribution support by @​brunoborges with @​Copilot in #​1042
• docs: note jdkfile approach for Early Access / unreleased JDK builds by @​brunoborges in #​1058
• dist: Apply Copilot review suggestions from PR #​1042 (GraalVM Community) by @​brunoborges in #​1059

New Contributors

• @​jsoref made their first contribution in #​993
• @​sproctor made their first contribution in #​1009
• @​jasongin made their first contribution in #​1026
• @​robstoll made their first contribution in #​850
• @​kranthipoturaju made their first contribution in #​1007
• @​al-kau made their first contribution in #​1002
• @​mhoffrog made their first contribution in #​924
• @​brunoborges made their first contribution in #​1028
• @​Trass3r made their first contribution in #​562
• @​stephanabel made their first contribution in #​996

Full Changelog: actions/setup-java@v5...v5.4.0

v5.3.0

Compare Source

What's Changed

• chore: update Java version to 25 in setup examples by @​alaahong in #​969
• Bump minimatch from 3.1.2 to 3.1.5 by @​dependabot[bot] in #​984
• Refactor error handling and improve test logging for installers by @​chiranjib-swain in #​989
• chore: upgrade dependencies (@​actions/core, cache, glob, http-client, tool-cache, xmlbuilder2) by @​Copilot in #​999
• Add Oracle JDK 17 licensing limitation note by @​mahabaleshwars in #​1001
• Update readme for ubuntu sudo java_home behavior by @​mahabaleshwars in #​1013
• temurin: add support for Alpine Linux by @​gdams in #​674
• fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parser by @​gdams in #​1015
• Bump @​typescript-eslint/eslint-plugin from 8.35.1 to 8.48.0 by @​dependabot[bot] in #​952
• Bump eslint-config-prettier from 8.10.0 to 10.1.8 by @​dependabot[bot] in #​881
• Bump picomatch, @​types/jest, jest, jest-circus and ts-jest by @​dependabot[bot] in #​1016
• Bump @​types/node from 24.1.0 to 25.9.3 by @​dependabot[bot] in #​950
• Implement pagination with link headers for Adoptium based apis by @​johnoliver in #​1014
• Make the Adoptopenjdk package type look at the Temurin repo first for latest assets by @​johnoliver in #​522
• Bump @​vercel/ncc from 0.38.1 to 0.44.0 by @​dependabot[bot] in #​1018

New Contributors

• @​alaahong made their first contribution in #​969
• @​Copilot made their first contribution in #​999
• @​johnoliver made their first contribution in #​1014

Full Changelog: actions/setup-java@v5...v5.3.0

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • Between 08:00 AM and 11:59 AM, only on Monday (* 8-11 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[bito-code-review]

Code Review Agent Run #d72847

Actionable Suggestions - 0

Review Details

• Files reviewed - 2 · Commit Range: 47a3326..47a3326

  • .github/workflows/main-pipeline.yaml
  • .github/workflows/publish-android.yaml
• Files skipped - 0
• Tools

  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers a full AI review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at jared.jolton@contentful.com.

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by

[bito-code-review]

Functional Validation by Bito

Source	Requirement / Code Area	Status	Notes
JAVA-5	Create structural simplified version of Android app skeleton	❌ Missed	No Android app skeleton structure found in the PR diff. The diff only contains changes to .github/workflows/main-pipeline.yaml and .github/workflows/publish-android.yaml, which update GitHub Actions Java setup versions. No app structure or source code was added.
JAVA-5	Add common libraries required for the application	❌ Missed	No common libraries were added in the PR diff. The changes are limited to updating the actions/setup-java action version from v5.2.0 to v5.7.0 across workflow files. No dependency additions or library integrations are present.
JAVA-5	Integrate Contentful SDK into the application	❌ Missed	No Contentful SDK integration found in the PR diff. The JIRA ticket JAVA-5 explicitly requires adding Contentful to the app, but no Contentful SDK or related code was added to the repository.
JAVA-5	Setup configuration management from source	❌ Missed	No configuration management setup found in the PR diff. The ticket requires setting up configuration from source, but no configuration files, source-based config management, or related code changes are present in the diff.
JAVA-5	Request and log first elements from TEA-space	❌ Missed	No code for requesting or logging elements from TEA-space found in the PR diff. The JIRA ticket requires fetching initial data elements from TEA-space and logging them, but no such functionality was implemented or added.
main-pipeline.yaml, publish-android.yaml	Updated actions/setup-java action version from v5.2.0 to v5.7.0 in .github/workflows/main-pipeline.yaml (applied in 7 locations) and .github/workflows/publish-android.yaml (1 location). This workflow version update is not part of any JIRA requirement.	⭕ Out of Scope	Updated actions/setup-java action version from v5.2.0 to v5.7.0 in .github/workflows/main-pipeline.yaml (applied in 7 locations) and .github/workflows/publish-android.yaml (1 location). This workflow version update is not part of any JIRA requirement.

[bito-code-review]

Impact Analysis by Bito

Cross-Repository Impact Analysis

What Changed	Impact of Change	Suggested Review Actions
Bumped actions/setup-java from v5.2.0 to v5.7.0 in 7 places across main-pipeline.yaml and publish-android.yaml.	- intra-repo: .github/workflows/main-pipeline.yaml (6 jobs) and .github/workflows/publish-android.yaml (1 job): CI-only change. No application code, no exported APIs, no DB schemas, no event topics, no env vars. The optimization repo is not indexed in BitoAIArchitect (search returned no match), so no cross-repo consumers can be enumerated; however, GitHub Actions workflows are not consumed by other repositories.	- Verify v5.7.0 release notes for any breaking input changes to 'distribution' or 'java-version' (none expected for temurin/JDK 17). - Confirm the SHA b6effb05e454b25005698d916606bdc6ffcbf961 resolves to the official actions/setup-java v5.7.0 tag before merge. - Optionally pin via Renovate (already configured for github-actions in renovate.json) so future bumps are automated.

Code Paths Analyzed

Impact:
Pure CI tooling upgrade. No runtime, build-output, or product behavior change. JDK 17 (temurin) configuration is unchanged.

Flow:
GitHub Actions runner → actions/setup-java@v5.7.0 → JDK 17 toolchain → existing gradle/pnpm build/test/publish steps (unchanged).

Direct Changes (Diff Files):
• .github/workflows/main-pipeline.yaml [lines 9, 18, 27, 36, 45, 54 (six 'Setup Java' steps across distinct jobs)] — Pinned actions/setup-java to v5.7.0 SHA across all six JDK-setup steps.
• .github/workflows/publish-android.yaml [line 51] — Pinned actions/setup-java to v5.7.0 SHA in the Android publish job.

Repository Impact:
• CI/CD pipelines only: No source code, SDK packages, or runtime configuration touched. Only GitHub Actions step references updated.

Cross-Repository Dependencies:
• None: GitHub Actions workflows are not consumed by other repositories. The optimization repo is not indexed in BitoAIArchitect, so no incoming/outgoing dependency edges are available to enumerate.

Database/Caching Impact:
• None

API Contract Violations:
• No API contracts affected.

Infrastructure Dependencies:
• GitHub Actions runner environment: actions/setup-java v5.7.0 requires the same Node.js runtime supported by GitHub-hosted runners as v5.2.0; no infrastructure migration needed.

Additional Insights:
• Renovate automation: renovate.json already enables the 'github-actions' manager with a Monday maintenance window, so this manual bump will be superseded by the next scheduled Renovate PR unless the SHA is intentionally pinned.

Testing Recommendations

Frontend Impact:
• No frontend impact.

Service Integration:
• Trigger a dry-run of the affected workflows (or rely on PR branch checks) to confirm JDK 17 setup still succeeds with v5.7.0.

Data Serialization:
• No data serialization changes.

Privacy Compliance:
• No privacy/compliance changes.

Backward Compatibility:
• No backward-compatibility risk; the 'distribution: temurin' and 'java-version: 17' inputs are unchanged.

OAuth Functionality:
• None

Cross-Service Communication:
• No cross-service communication changes.

Reliability Testing:
• None

Additional Insights:
• If Renovate is desired to manage this bump automatically, no further action is needed; otherwise document why the SHA is pinned.

_{Analysis based on known dependency patterns and edges. Actual impact may vary.}

[bito-code-review]

Code Review Agent Run #78e613

Actionable Suggestions - 0

Review Details

• Files reviewed - 2 · Commit Range: a0d01ac..a0d01ac

  • .github/workflows/main-pipeline.yaml
  • .github/workflows/publish-android.yaml
• Files skipped - 0
• Tools

  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers a full AI review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at jared.jolton@contentful.com.

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by

[bito-code-review]

Code Review Agent Run #f300dc

Actionable Suggestions - 0

Review Details

• Files reviewed - 2 · Commit Range: 543ec66..543ec66

  • .github/workflows/main-pipeline.yaml
  • .github/workflows/publish-android.yaml
• Files skipped - 0
• Tools

  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers a full AI review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at jared.jolton@contentful.com.

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by