Harden Maven/Java workflows against zizmor findings

[mkitti]

Hardens the Maven/Java-themed GitHub Actions workflows against all zizmor 1.25.2 static-analysis findings. No behavioral change: the same values and logic are preserved, just sourced via env: variables and explicit permissions/secrets.

Findings fixed (per file)

File	template-injection	artipacked	excessive-permissions	secrets-inherit
maven-staging.yml	37	4	2	-
maven-build-test.yml	11	3	1	-
test-maven-packages.yml	6	2	0	-
java-implementation-test.yml	0	2	5	-
test-maven-deployment.yml	1	1	1	-
release.yml	0	0	0	1

Total: 77 findings resolved. Final zizmor run reports zero findings across all six files.

What changed

• template-injection: attacker-controllable ${{ }} expressions used inside run: bodies (matrix.*, runner.workspace, github.actor, github.base_ref, steps.*.outputs.*, needs.*.outputs.*) moved into step-level env: blocks and referenced as $NAME (bash) or $env:NAME (pwsh). Non-run-body expressions (if:, with:, uses:, env: values) left untouched.
• artipacked: persist-credentials: false added to every actions/checkout step. None of these workflows push to git (verified: no git push/git commit/gh-pages/peaceiris/auto-commit/EndBug), so all checkouts were safe to harden.
• excessive-permissions: added explicit top-level permissions: contents: read. Overly broad workflow-level packages: write / pull-requests: write reduced; minimal packages: read/packages: write granted only to the specific jobs that actually consume/deploy packages. maven-staging.yml performs only a dry-run deployment (no real mvn deploy, PR writes, or package API calls), so its top level drops to contents: read.
• secrets-inherit (release.yml): the call to test-maven-packages.yml used secrets: inherit, but that reusable workflow declares no workflow_call secrets, so the line was removed entirely.

🤖 Generated with Claude Code

[mkitti]

Note: interaction with #6545 (checkout-hygiene + permissions hardening)

This PR reduces maven-staging.yml from top-level packages: write + pull-requests: write down to contents: read (the staging deployment is a dry run — it writes a settings.xml with literal Maven ${env.*} placeholders and never performs a real deploy or package API call; artifact handoff uses actions/upload-artifact, which needs no extra permission).

Separately, #6545 re-grants packages: write / pull-requests: write on call-workflows.yml's two maven-staging.yml caller jobs (required while develop's maven-staging.yml still declares them). After both PRs land, those caller grants are harmless but unused; a small follow-up can drop them to contents: read for full least-privilege. Flagging so the two are reviewed with the interaction in mind.

[Copilot]

Pull request overview

Note

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Hardens Maven/Java GitHub Actions workflows to resolve zizmor findings by reducing token permissions, preventing credential persistence on checkouts, and avoiding attacker-controllable expression interpolation inside run: bodies.

Changes:

• Add persist-credentials: false to actions/checkout steps to prevent token persistence.
• Replace ${{ ... }} usage inside run: blocks with step env: variables (bash / pwsh-safe).
• Tighten GITHUB_TOKEN permissions at workflow and job scope; remove secrets: inherit on reusable workflow call.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/test-maven-packages.yml	Adds checkout hardening and moves workspace expressions into step env vars.
.github/workflows/test-maven-deployment.yml	Scopes permissions per job and hardens checkout; moves actor into env for run steps.
.github/workflows/release.yml	Removes secrets: inherit from reusable workflow invocation.
.github/workflows/maven-staging.yml	Drops excessive permissions, hardens checkout, and shifts run-body expressions into env vars.
.github/workflows/maven-build-test.yml	Reduces top-level permissions, hardens checkout, and shifts run-body expressions into env vars.
.github/workflows/java-implementation-test.yml	Adds explicit permissions and hardens checkout.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Review Checklist

This PR touches the following areas. Each needs a sign-off
from its listed owners before merging.

• .github ✅ — @lrknox

✅ All areas have been signed off.

[mkitti]

Checked the Copilot comment about actions/checkout@9c091bb2... being annotated # v7.0.0. Verified against the actual actions/checkout v7.0.0 git tag — the SHA does correspond to v7.0.0, and this line is pre-existing (unchanged by this PR, and used the same way in ~a dozen other workflow files in the repo). No fix needed; the review comment was a false positive.