[lhotari]

Motivation

gradle/actions 6.4.1 fixes GHSA-chpw-2mqm-95cc in dependency-submission / setup-gradle (affected: 3.0.0 to 6.4.0). Pulsar uses 6.3.0.

The advisory concerns the two-workflow download-and-submit setup, where a fork PR's dependency-graph artifact is submitted from a workflow_run job. Pulsar's ci-gradle-dependency-submission.yaml generates and submits in a single job that runs only on pushes to master, so it doesn't use download-and-submit. The upgrade keeps the action on a fixed version regardless.

While at it, gradle/develocity-actions/setup-docker is upgraded to the latest version on the ASF allowlist.

Modifications

• gradle/actions/setup-gradle and gradle/actions/dependency-submission: v6.3.0 → v6.4.1 (8da46b539cd8fe6ab27ca75128919a18d757604c).
  6.4.0 also bumps the GitHub Dependency Graph Gradle plugin to 1.5.0, which reports the Gradle version itself (org.gradle:gradle-core) in the dependency graph, and adds Gradle version-support annotations to the job summary.
• gradle/develocity-actions/setup-docker: v2.4 → v2.5 (9d8792ab22712b19790c2abce53e9ebb2694c312). v2.6 is not on the ASF allowlist yet, and its security fix is for maven-publish-build-scan, which Pulsar doesn't use.

ASF allowlist: gradle/actions v6.4.1 is not yet on the ASF actions allowlist. It is pending in apache/infrastructure-actions#1452 (dependency-submission) and apache/infrastructure-actions#1457 (setup-gradle), which pin the same commit SHA. CI on this PR is expected to fail at startup until those are merged; this PR should be merged only after that.

Verifying this change

• Make sure that the change passes the CI checks.

This change is a trivial rework / code cleanup without any test coverage.

Does this pull request potentially affect one of the following parts:

If the box was checked, please highlight the changes

• Dependencies (add or upgrade a dependency)
• The public API
• The schema
• The default values of configurations
• The threading model
• The binary protocol
• The REST endpoints
• The admin CLI options
• The metrics
• Anything that affects deployment

[codelipenghui]

Reviewed head 75df641297972355afc49bf1f45b8e8b0575a3d4. No actionable findings identified within the reviewed scope.

Approval is based on source inspection. Please ensure required CI passes with the updated ASF allowlist before merging.