Bump actions/setup-java from 5.5.0 to 5.6.0

[dependabot]

Bumps actions/setup-java from 5.5.0 to 5.6.0.

Release notes

Sourced from actions/setup-java's releases.

v5.6.0

What's Changed

• Backport to v5: Add Maven compiler problem matcher for javac diagnostics by @​brunoborges in actions/setup-java#1087
• feat: expose cache-primary-key output (#597) [v5 backport] by @​brunoborges in actions/setup-java#1089
• dist: Cover Tencent Kona JDK 25 (#1108) [v5 backport] by @​brunoborges in actions/setup-java#1110
• Backport #1111: Preserve Maven toolchains across repeated setup-java runs (#1099) by @​brunoborges in actions/setup-java#1113
• Backport #1097/#1098 to v5: cache Maven and Gradle wrapper distributions separately by @​brunoborges in actions/setup-java#1122

Full Changelog: actions/setup-java@v5...v5.6.0

Commits

• 03ad4de Backport #1097/#1098: cache Maven and Gradle wrapper distributions separately...
• d229d2e Backport #1111: Preserve Maven toolchains across repeated setup-java runs (#1...
• bbf0f69 dist: Cover Tencent Kona JDK 25 (#1110)
• 513edc4 feat: expose cache-primary-key output (#597) [v5 backport] (#1089)
• 62df799 Add Maven compiler problem matcher for javac diagnostics (#1087)
• 176156a chore: bump version to 5.6.0 for v5 release line
• bf7b8de build: rebuild dist for backported changes (#1079, #1083, #1084)
• 0173e6d Infer distribution from asdf .tool-versions vendor prefix (#1084)
• f45cd82 Rename jdkFile input to jdk-file with deprecated alias (#1083)
• e2863ad Map Zulu x86 architecture to i686 for Azul Metadata API (#1079)
• Additional commits viewable in compare view

[github-actions]

🤖 Claude Code Review

PR Code Review

Scope: This PR bumps actions/setup-java from v5.5.0 to v5.6.0 across three GitHub Actions workflows (Darwin, Linux, Windows). It's a mechanical dependency-bump PR (likely Dependabot-authored, consistent with the repo's recent commit history).

Code Quality

• ✅ Style conventions — Change is a single-line version bump per file, consistent with existing YAML formatting/indentation.
• ✅ No commented-out code — N/A, no code touched.
• ✅ Meaningful variable names — N/A.
• ✅ DRY principle — The same pin is duplicated across three workflow files (java-darwin-snippets.yaml:43, java-linux-snippets.yaml:46, java-windows-snippets.yaml:43), but this is pre-existing structure, not something introduced by this PR — out of scope to flag as a defect.
• ✅ Defects — No logic changes; a version-pin bump on a widely-used, actively maintained GitHub Action. Low risk. Recommend confirming CI runs green for all three OS matrices (Darwin/Linux/Windows) before merge, since setup-java version bumps have occasionally changed default caching or JDK resolution behavior.
• ✅ CLAUDE.md consideration — No changes to .claude/CLAUDE.md in this diff; existing project instructions are appropriately environment-agnostic and unaffected.

Testing

• N/A — No application code changed; nothing to unit/integration test. CI workflow execution itself is the validation for this change.

Documentation

• N/A — No README, API docs, or CHANGELOG entries needed for a CI action version bump. No markdown files touched.

Security

• ✅ No hardcoded credentials — None present.
• ✅ Input validation — N/A.
• ✅ Error handling — N/A.
• ✅ No sensitive data in logs — N/A.
• ✅ License files (.lic) check — No .lic files or AQAAAD-prefixed strings present in this diff.

Summary

No issues found. This is a low-risk, routine dependency version bump with no functional code changes. Safe to merge pending green CI across all three platform workflows.

Automated code review analyzing defects and coding standards

[github-actions]

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter

[github-actions]

🤖 Claude Code Review

Review Summary

Verdict: ✅ Approve — This is an automated Dependabot dependency bump with no findings.

Checklist Assessment

Code Quality: ✅ N/A — This is a version pin update (actions/setup-java@v5.5.0 → v5.6.0) across three CI workflow files (darwin, linux, windows). No application code, logic, or style is affected. Consistent with 4+ prior identical bumps in git history (5.2.0→5.3.0→5.4.0→5.5.0→5.6.0).

Testing: ✅ N/A — No testable logic introduced. The bump will implicitly be exercised the next time these CI workflows run.

Documentation: ✅ N/A — No README/API/CHANGELOG impact expected for a CI action version bump.

Security: ✅ No hardcoded credentials, no license files, no sensitive data. Bumping a pinned action version to a newer minor release is a normal maintenance action; no vulnerability introduced.

CLAUDE.md: Not implicated — this PR doesn't touch project instructions or environment-specific configuration.

No issues found; safe to merge.

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

Dependabot version bumps for CI actions in this repo's history aren't recorded in CHANGELOG.md (checked prior entries — none mention actions/setup-java or similar dependency bumps), so that's consistent with existing convention, not a gap.

Review Summary

This PR is a minimal, mechanical dependabot dependency bump: actions/setup-java v5.5.0 → v5.6.0 across three workflow files (darwin, linux, windows). All three are updated consistently.

Code Quality

• ✅ Consistent formatting/indentation preserved in all three files (.github/workflows/java-darwin-snippets.yaml:43, .github/workflows/java-linux-snippets.yaml:46, .github/workflows/java-windows-snippets.yaml:43)
• ✅ No commented-out code
• ✅ N/A — no variable names involved
• ✅ N/A — DRY not applicable to a version pin bump
• ✅ No defects found — this is a pure version string change with no logic, no behavioral risk beyond whatever setup-java@v5.6.0 itself changes upstream
• ✅ No .claude/CLAUDE.md changes in this diff; the existing project instructions remain generic/local-dev-agnostic

Testing

• ✅ N/A — CI workflow version bump, no application code changed; existing workflow runs (triggered by this PR itself) serve as the test

Documentation

• ✅ No README/API doc changes needed
• ✅ No inline comments needed
• ✅ CHANGELOG.md not updated, but consistent with repo convention — prior dependency/CI bumps (e.g. Bump actions/setup-python from 6.3.0 to 7.0.0 #211 Python setup bump, Bump coverage from 7.15.1 to 7.15.2 #209 coverage bump, Bump cryptography from 49.0.0 to 50.0.0 #208 cryptography bump) are also absent from CHANGELOG.md, which tracks snippet-level changes only
• ✅ N/A — no markdown content changes

Security

• ✅ No hardcoded credentials
• ✅ N/A — no input handling changed
• ✅ N/A — no error handling changed
• ✅ No sensitive data/logging changes
• ✅ No .lic files or AQAAAD-prefixed strings present in this diff

Overall: No issues found. This is a low-risk, routine dependency bump appropriate for automated merge.

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

PR Code Review

Summary: This PR bumps actions/setup-java from v5.5.0 to v5.6.0 across three CI workflow files (Darwin, Linux, Windows). Purely a routine dependency version bump — no application code, no CLAUDE.md changes, no license files.

Code Quality

• ✅ Style conventions: YAML formatting/indentation is consistent with the rest of each file.
• ✅ No commented-out code.
• ✅ Meaningful variable names: N/A (no variables introduced).
• ⚠️ DRY: The same pinned version string (v5.6.0) is now duplicated across .github/workflows/java-darwin-snippets.yaml:43, java-linux-snippets.yaml:46, and java-windows-snippets.yaml:43. This isn't new to this PR (the prior version was duplicated too, per the diff), so not a blocker — but if this repo does frequent dependabot bumps like this (git history shows many), consider centralizing the version via a reusable workflow or repo variable to reduce future 3-file diffs. Non-blocking observation.
• ✅ Defects: This is a mechanical version bump consistent with the existing dependabot pattern seen in git history (e.g. 02f31b8, af4a0b8 are prior actions/setup-java bumps of the identical shape). No logic changes, no behavioral risk expected. I don't have network access to independently confirm v5.6.0 is a published/valid tag for actions/setup-java — worth a quick sanity check that CI actually resolves this action version before merging (dependabot-authored PRs are normally reliable here, but flagging since I can't verify from the diff alone).
• ✅ CLAUDE.md: No changes to .claude/CLAUDE.md in this diff — not applicable to this review.

Testing

• ✅ N/A — CI workflow dependency bump, no application logic added. Existing CI runs for Java Darwin/Linux/Windows will exercise the new action version.

Documentation

• ✅ CHANGELOG.md: Not updated, but consistent with project convention — checked git history and none of the prior actions/setup-java, actions/checkout, actions/setup-python, or actions/setup-dotnet dependabot bumps updated CHANGELOG.md either. No action needed.
• ✅ N/A for README/API docs/inline comments — no relevant surface changed.

Security

• ✅ No hardcoded credentials.
• ✅ No input validation concerns (CI config only).
• ✅ No error handling concerns.
• ✅ No sensitive data in logs.
• ✅ No .lic files or AQAAAD-prefixed strings present in this diff.

Verdict

✅ Approve — low-risk, mechanical dependency bump following the established pattern in this repository's history. No blocking issues found.

Automated code review analyzing defects and coding standards