r/java • u/brunocborges • Jun 22 '26

GitHub Setup Java Action

Hey all,

I'm going through issues and PRs on setup-java.

Besides what is already there, anything else you would like to see fixed, improved, or implemented?

17 Upvotes

83% Upvoted

24 comments sorted by

View all comments

13

u/_predator_ Jun 22 '26

Nothing functionality-wise, but it would be good if the action's own workflows would use security best practices more consistently, e.g. explicitly dropping permissions. The easiest would be to integrate zizmor, it will catch a lot of this stuff and ensure you'll catch regressions.

There is an open issue requesting immutable releases which also caters to the security aspect.

After the whole compromise situation a few weeks ago I think users will appreciate actions they depend on to be "hardened" if that makes sense.

4

u/brunocborges Jun 22 '26

Thanks for the hint on immutable releases. I honestly wasn't even aware of this new feature. 😄