Harden SimpleAPI GitHub workflows

Author: BenCodez

.github/workflows/maven.yml

@@ -10,16 +10,16 @@ on:
     branches: [ "main" ]
 
 permissions:
-  contents: write   # required for dependency submission
+  contents: read
 
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
           java-version: '21'
           distribution: 'temurin'
@@ -28,10 +28,18 @@ jobs:
       - name: Build with Maven
         run: mvn -B -f SimpleAPI/pom.xml package
 
-      # Only run dependency graph submission on push (not pull_request)
+  # Dependency submission needs write access, so keep it out of the build job.
+  submit-dependency-snapshot:
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
       - name: Submit Dependency Snapshot
-        if: github.event_name == 'push'
-        uses: advanced-security/maven-dependency-submission-action@v5
+        uses: advanced-security/maven-dependency-submission-action@b275d12641ac2d2108b2cbb7598b154ad2f2cee8 # v5.0.0
         with:
-          directory: SimpleAPI   # path to pom.xml
-          # optional: maven-args: "-DskipTests"
+          directory: SimpleAPI

.github/workflows/publish-javadoc.yml

@@ -3,22 +3,87 @@ name: Deploy Javadoc
 on:
   release:
     types: [published]
-    branches:
-      - master
-      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: github-pages
+  cancel-in-progress: false
 
 jobs:
-  publish:
+  verify-release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      eligible: ${{ steps.eligibility.outputs.eligible }}
+      commit: ${{ steps.eligibility.outputs.commit }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: main
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Verify release tag is on main
+        id: eligibility
+        env:
+          PRERELEASE: ${{ github.event.release.prerelease }}
+          TAG_NAME: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          if [[ "$PRERELEASE" == "true" ]]; then
+            echo "eligible=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          tag_commit="$(git rev-parse --verify "refs/tags/${TAG_NAME}^{commit}")"
+          if git merge-base --is-ancestor "$tag_commit" origin/main; then
+            echo "eligible=true" >> "$GITHUB_OUTPUT"
+            echo "commit=$tag_commit" >> "$GITHUB_OUTPUT"
+          else
+            echo "eligible=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  build:
+    needs: verify-release
+    if: needs.verify-release.outputs.eligible == 'true'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - name: Deploy JavaDoc 🚀
-        uses: MathieuSoysal/Javadoc-publisher.yml@main
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          javadoc-branch: gh-pages
-          java-version: 21
-          target-folder: ''
-          project: maven # or gradle
-          # subdirectories: moduleA moduleB #for subdirectories support, needs to be run with custom command
-          custom-command: mvn -f SimpleAPI/pom.xml deploy -P javadoc javadoc:aggregate
-          javadoc-source-folder: 'SimpleAPI/target/reports/apidocs'
+          ref: ${{ needs.verify-release.outputs.commit }}
+          persist-credentials: false
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          java-version: '21'
+          distribution: temurin
+          cache: maven
+
+      - name: Build Javadoc
+        run: mvn -B -f SimpleAPI/pom.xml clean package -P javadoc javadoc:aggregate
+
+      - name: Upload Pages artifact
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
+        with:
+          path: SimpleAPI/target/reports/apidocs
+
+  deploy:
+    needs: [verify-release, build]
+    if: needs.verify-release.outputs.eligible == 'true'
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    permissions:
+      pages: write
+      id-token: write
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5