chore(deps): pin dependencies

.gitea/workflows/ci.yml

@@ -5,14 +5,20 @@ on:
     branches:
       - "main"
     tags:
-      - '*'
+      - 'v*'
   pull_request:
     branches:
       - "main"
 
+env:
+  MAVEN_OPTS: "-Dhttps.protocols=TLSv1.2 -Dmaven.repo.local=${{ github.workspace }}/.m2/repository -Dorg.slf4j.simpleLogger.showDateTime=true -Djava.awt.headless=true"
+  MAVEN_CLI_OPTS: "--batch-mode --errors --fail-at-end --show-version --no-transfer-progress -DinstallAtEnd=true -DdeployAtEnd=true"
+  # Docker image name; expects REGISTRY_URL like registry.example.com
+  CI_REGISTRY_IMAGE: "${{ secrets.REGISTRY_URL }}/${{ github.repository }}"
+
 jobs:
-  package:
+  compile:
-    name: Package
+    name: Compile
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -23,23 +29,94 @@ jobs:
         with:
           distribution: 'temurin'
           java-version: '25'
+          cache: 'maven'
 
-      - name: Build package
+      - name: Cache Maven local repo and wrapper
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        with:
+          path: |
+            ${{ github.workspace }}/.m2/repository
+            .mvn
+          key: m2-${{ runner.os }}-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            m2-${{ runner.os }}-
+
+      - name: Compile
         run: |
           chmod +x ./mvnw
-          ./mvnw --batch-mode --update-snapshots verify
+          ./mvnw $MAVEN_CLI_OPTS compile
 
-      - name: Upload test reports
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    needs: compile
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Set up JDK
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+        with:
+          distribution: 'temurin'
+          java-version: '25'
+          cache: 'maven'
+
+      - name: Cache Maven local repo and wrapper
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        with:
+          path: |
+            ${{ github.workspace }}/.m2/repository
+            .mvn
+          key: m2-${{ runner.os }}-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            m2-${{ runner.os }}-
+
+      - name: Run tests
+        run: |
+          chmod +x ./mvnw
+          ./mvnw $MAVEN_CLI_OPTS test
+
+      - name: Upload test reports (artifact)
         if: always()
-        uses: actions/upload-artifact@c6a366c94c3e0affe28c06c8df20a878f24da3cf # v3
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
         with:
           name: junit-reports
           path: |
             **/target/*-reports/TEST-*.xml
           if-no-files-found: ignore
 
+  package:
+    name: Package
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Set up JDK
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+        with:
+          distribution: 'temurin'
+          java-version: '25'
+          cache: 'maven'
+
+      - name: Cache Maven local repo and wrapper
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+        with:
+          path: |
+            ${{ github.workspace }}/.m2/repository
+            .mvn
+          key: m2-${{ runner.os }}-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            m2-${{ runner.os }}-
+
+      - name: Build package (skip tests)
+        run: |
+          chmod +x ./mvnw
+          ./mvnw $MAVEN_CLI_OPTS package -DskipTests=true
+
       - name: Upload Maven artifacts
-        uses: actions/upload-artifact@c6a366c94c3e0affe28c06c8df20a878f24da3cf # v3
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
         with:
           name: maven-artifacts
           path: |
@@ -60,7 +137,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Download build artifacts
-        uses: actions/download-artifact@a9bc5e6ef2cb54c177f32aa5726adaa15e7e2d59 # v3
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: maven-artifacts
           path: .
@@ -93,7 +170,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Download build artifacts
-        uses: actions/download-artifact@a9bc5e6ef2cb54c177f32aa5726adaa15e7e2d59 # v3
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: maven-artifacts
           path: .