build(deps): bump actions/setup-java from 6.0.0 to 6.0.1

[dependabot]

Bumps actions/setup-java from 6.0.0 to 6.0.1.

Release notes

Sourced from actions/setup-java's releases.

v6.0.1

What's Changed

• Fix failing GitHub Actions job for temurin 17 by @​brunoborges with @​Copilot in actions/setup-java#1259
• Fix Temurin EA E2E signature verification by @​brunoborges with @​Copilot in actions/setup-java#1260
• Fix Alpine GPG verification failures and support multiple keys by @​brunoborges in actions/setup-java#1262
• Fix import-safe checks when scripts are run from a path with symlinks by @​otaconix in actions/setup-java#1265
• Avoid macOS GPG socket overflow on long runner paths by @​brunoborges with @​Copilot in actions/setup-java#1266
• Complete v6 release highlights in README by @​brunoborges in actions/setup-java#1254
• Group and slow routine Dependabot updates by @​brunoborges in actions/setup-java#1255
• chore(deps-dev): update eslint and globals by @​dependabot[bot] in actions/setup-java#1256

New Contributors

• @​otaconix made their first contribution in actions/setup-java#1265

Full Changelog: actions/setup-java@v6.0.0...v6.0.1

Commits

• de7274f Avoid macOS GPG socket overflow on long runner paths (#1266)
• 134912a Fix import-safe checks when scripts are run from a path with symlinks (#1265)
• 0781fc6 Fix alpine failures by switching default back to only warn on verification fa...
• 4889c4a Fix Temurin EA E2E signature verification (#1260)
• 8fd3240 [WIP] Fix failing GitHub Actions job for temurin 17 (#1259)
• 2732291 chore(deps-dev): update eslint and globals (#1256)
• 1a8f22b chore: streamline Dependabot updates (#1255)
• 85030b7 docs: complete v6 release highlights (#1254)
• See full diff in compare view

[github-actions]

🤖 Claude Code Review

PR Code Review: bump actions/setup-java 6.0.0 → 6.0.1

Scope: One-line version bump in three workflows (java-darwin-snippets.yaml, java-linux-snippets.yaml, java-windows-snippets.yaml), each at line 43 or 44 of the actions/setup-java step. This is a Dependabot-style change. I reviewed only the diff and didn't open the files.

Code Quality

• ✅ Style conventions: The YAML formatting and indentation are unchanged.
• ✅ No commented-out code: None was added.
• ✅ Variable names: Not applicable. No names were added or changed.
• ✅ DRY: The same bump appears in three files, which is inherent to having one workflow per OS. Merging them into a matrix or reusable workflow would be a separate refactor, outside this PR.
• ✅ Defects: I found none. This is a patch-level bump with the same inputs (distribution, java-version), so it shouldn't break anything. The action is referenced by a version tag (@v6.0.1), not a commit SHA. That matches the existing convention in the diff, but SHA pinning is more secure against tag mutation. The workflows already use persist-credentials: false, so the repo seems security-conscious, and pinning by SHA might be worth considering as a follow-up.
• ✅ .claude/CLAUDE.md: It isn't modified in this PR. It has no local-environment-specific content (paths are placeholders such as /path/to/data).

Testing

• ✅ Unit and integration tests: Not applicable to a CI dependency bump. The three Java snippet workflows will exercise the new version when they run on this PR.
• ✅ Edge cases: All three OS runners (Linux, macOS, Windows) are updated together, so they stay consistent.
• ✅ Coverage: No source code changed.

Documentation

• ✅ README and API docs: No update needed.
• ✅ Inline comments: No complex logic was added.
• ✅ CHANGELOG.md: Dependency bumps to CI tooling don't usually need an entry, so I'm not flagging this.
• ✅ Markdown: No Markdown files changed.

Security

• ✅ No hardcoded credentials: None.
• ✅ Input validation and error handling: Not applicable.
• ✅ No sensitive data in logs: None added.
• ✅ License files: No .lic files, and no strings starting with AQAAAD, appear in the diff.

Summary

Approve. The change is minimal, consistent across all three platform workflows, and has no defects or security concerns. Before merging, confirm the CI runs pass on all three OS workflows.

Automated code review analyzing defects and coding standards

[senzingdevops]

Automated: approving this pull request because it includes a patch update

[github-actions]

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter

[github-actions]

🤖 Claude Code Review

PR Review: bump actions/setup-java from 6.0.0 to 6.0.1

The PR changes three workflow files, one line each. It moves actions/setup-java from v6.0.0 to v6.0.1 in the Darwin, Linux and Windows Java snippet workflows. I reviewed the diff only and did not open the workflow files or the untracked files in the working tree.

Code Quality

• ✅ Style conventions: The YAML formatting and indentation are unchanged.
• ✅ No commented-out code: None added.
• ✅ Variable names: Not applicable.
• ✅ DRY: The same bump is applied identically to each of the three per-OS workflows, which is expected for this kind of change.
• ✅ Defects: None found. This is a patch-level bump and the with: inputs (distribution, java-version) are untouched.
• ⚠️ Version pinning: The action is referenced by a mutable tag (@v6.0.1) rather than a commit SHA. This is consistent with the existing style, so it is not a regression. Pinning to a SHA would harden the supply chain, and Dependabot can keep SHA pins updated.
• ✅ .claude/CLAUDE.md: Not modified. Its content is generic, with no local-environment specifics.

Testing

• ✅ Unit and integration tests: No new functions or endpoints, so none are needed.
• ✅ Edge cases and coverage: Not applicable. The Java workflows themselves exercise the bump when CI runs, so confirm they pass on all three OSes.

Documentation

• ✅ README and API docs: No updates needed.
• ✅ Inline comments: Not needed.
• ⚪ CHANGELOG.md: Dependabot CI-only bumps usually don't need an entry. Check whether this repo's convention requires one.
• ✅ Markdown: No Markdown files changed.

Security

• ✅ No hardcoded credentials and ✅ no sensitive data in logs.
• ✅ Input validation and error handling: Not applicable.
• ✅ License files: No .lic files or AQAAAD strings in the diff. The untracked files in the working tree (build-resources/, pr_diff.txt, prompt-*.md, review.txt) are not part of this PR, but make sure they aren't committed.
• ✅ Checkout hardening: The surrounding persist-credentials: false on checkout is retained.

Summary

This is a routine, low-risk dependency bump with no blocking issues. I recommend approving once CI passes on all three OS workflows.

Automated code review analyzing defects and coding standards

[senzingdevops]

Automated: approving this pull request because it includes a patch update