Address zizmor findings

[msridhar]

• Pin SHAs of actions
• Narrow permissions

We also update to setup-gradle v6.3.0.

Summary by CodeRabbit

• Chores
  • Improved automated workflow security by limiting permissions to required operations.
  • Pinned workflow actions to immutable revisions for more predictable, secure builds.
  • Disabled persistent checkout credentials in continuous integration and benchmark workflows.
  • Restricted benchmark workflow access and removed obsolete configuration.
  • Standardized workflow validation for pull-request permissions.

[msridhar]

This change is part of the following stack:

• Address zizmor findings #1676 ◀

_{Change managed by git-spice.}

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

The GitHub Actions workflows now define explicit permissions. They pin external actions to immutable commit hashes. Checkout steps disable credential persistence. The continuous integration workflow applies these changes across its jobs. The JMH benchmark workflow applies the same controls while retaining its existing benchmark, cleanup, formatting, and comment steps.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main changes: addressing zizmor findings by pinning action SHAs and narrowing workflow permissions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch zizmor

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/jmh-benchmark.yml:
- Around line 16-19: Document the issues: write entry in the workflow
permissions block with an inline comment referencing the later
github.rest.issues.createComment call, while leaving the other permission
entries unchanged.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 38c77c2d-4180-42c1-b4e3-a523a940841d

📥 Commits

Reviewing files that changed from the base of the PR and between b9809cd and 0932d8a.

📒 Files selected for processing (2)

• .github/workflows/continuous-integration.yml
• .github/workflows/jmh-benchmark.yml

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.67%. Comparing base (b9809cd) to head (8915424).

Additional details and impacted files

@@            Coverage Diff            @@
##             master    #1676   +/-   ##
=========================================
  Coverage     87.67%   87.67%           
  Complexity     3138     3138           
=========================================
  Files           109      109           
  Lines         10619    10619           
  Branches       2147     2147           
=========================================
  Hits           9310     9310           
  Misses          628      628           
  Partials        681      681           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

Permission test succeeded: pull-requests: write can post PR comments.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/jmh-benchmark.yml:
- Line 50: Move the github.event.number and github.repository expressions into
the workflow job or step’s existing env block, then update the
get_repo_details.sh invocation to pass the corresponding shell environment
variables instead of inline template expressions; preserve the GITHUB_TOKEN
secret handling unless the existing env block already provides it.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c5910bc5-a116-45fb-b6e3-ea2166956b94

📥 Commits

Reviewing files that changed from the base of the PR and between f7f7985 and 9eaeaeb.

📒 Files selected for processing (1)

• .github/workflows/jmh-benchmark.yml

[github-actions]

Main Branch:

Benchmark                          Mode  Cnt   Score   Error  Units
AutodisposeBenchmark.compile      thrpt   25  10.157 ± 0.070  ops/s
CaffeineBenchmark.compile         thrpt   25   2.242 ± 0.015  ops/s
DFlowMicroBenchmark.compile       thrpt   25  39.761 ± 0.274  ops/s
NullawayReleaseBenchmark.compile  thrpt   25   1.623 ± 0.017  ops/s

With This PR:

Benchmark                          Mode  Cnt   Score   Error  Units
AutodisposeBenchmark.compile      thrpt   25  10.438 ± 0.051  ops/s
CaffeineBenchmark.compile         thrpt   25   2.231 ± 0.016  ops/s
DFlowMicroBenchmark.compile       thrpt   25  40.178 ± 0.330  ops/s
NullawayReleaseBenchmark.compile  thrpt   25   1.611 ± 0.018  ops/s