Harden Maven/Java workflows against zizmor findings (#6546)

Address all zizmor 1.25.2 findings in the Maven/Java-themed workflows with no behavioral change: - template-injection: move attacker-controllable ${{ }} expressions (matrix.*, runner.workspace, github.actor, github.base_ref, steps.*.outputs.*, needs.*.outputs.*) out of run: script bodies into step-level env: blocks referenced as shell/pwsh variables. - artipacked: add persist-credentials: false to all actions/checkout steps (none of these workflows push to git). - excessive-permissions: add/tighten explicit permissions. Reduce overly broad workflow-level packages:/pull-requests: grants to contents: read, granting minimal packages: read/write only to the specific jobs that need it. - secrets-inherit (release.yml): remove secrets: inherit on the test-maven-packages.yml call, which declares no workflow_call secrets. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: Larry Knox <lrknox@hdfgroup.org>
2026-09-25 04:09:44 +03:00 · 2026-08-04 16:42:12 -04:00
parent 3131956eb0
commit f9ba955fb3
6 changed files with 139 additions and 58 deletions
@@ -55,6 +55,9 @@ on:
          - 'macos-latest'
          - 'all-platforms'

+permissions:
+  contents: read
+
 env:
  CMAKE_GENERATOR: Ninja

@@ -123,6 +126,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: recursive
+          persist-credentials: false

      - name: Set up Java ${{ matrix.java-version }} (${{ matrix.implementation }})
        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
@@ -216,6 +220,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false

      - name: Download all Maven artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -42,7 +42,6 @@ on:

 permissions:
  contents: read
-  packages: write

 jobs:
  build-maven-packages:
@@ -69,6 +68,8 @@ jobs:
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false

      - name: Download all Maven staging artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6
@@ -117,26 +118,32 @@ jobs:
                  mvn deploy:deploy-file \
                    -DgroupId=org.hdfgroup \
                    -DartifactId="$ARTIFACT_ID" \
-                    -Dversion="${{ needs.build-maven-packages.outputs.version }}" \
+                    -Dversion="$PACKAGE_VERSION" \
                    -Dpackaging=jar \
                    -Dfile="$jar_file" \
                    -Dclassifier="$CLASSIFIER" \
                    -DpomFile="$POM_FILE" \
                    -DrepositoryId=github \
-                    -Durl=${{ format('https://maven.pkg.github.com/{0}', github.repository) }} \
-                    -Dusername=${{ github.actor }} \
-                    -Dpassword=${{ secrets.GITHUB_TOKEN }}
+                    -Durl="$REPOSITORY_URL" \
+                    -Dusername="$GITHUB_ACTOR" \
+                    -Dpassword="$GITHUB_TOKEN"
                fi
              done
            fi
          done
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_ACTOR: ${{ github.actor }}
+          PACKAGE_VERSION: ${{ needs.build-maven-packages.outputs.version }}
+          REPOSITORY_URL: ${{ format('https://maven.pkg.github.com/{0}', github.repository) }}

  test-jni-package:
    name: Test JNI Maven Package
    needs: [build-maven-packages, deploy-to-packages]
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
    if: |
      inputs.test_deployment &&
      needs.deploy-to-packages.result == 'success' &&
@@ -144,6 +151,8 @@ jobs:
    steps:
      - name: Checkout HDF5 repository (contains HDF5Examples)
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false

      - name: Set up Java 21 for JNI
        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
@@ -158,22 +167,26 @@ jobs:
          path: ${{ runner.workspace }}/hdf5-install

      - name: Verify HDF5 installation
+        env:
+          RUNNER_WORKSPACE: ${{ runner.workspace }}
        run: |
          echo "HDF5 installation contents:"
-          ls -la "${{ runner.workspace }}/hdf5-install"
-          if [ -d "${{ runner.workspace }}/hdf5-install/lib" ]; then
+          ls -la "$RUNNER_WORKSPACE/hdf5-install"
+          if [ -d "$RUNNER_WORKSPACE/hdf5-install/lib" ]; then
            echo "Libraries:"
-            ls -la "${{ runner.workspace }}/hdf5-install/lib" | grep -E '\.so' || echo "No shared libraries found"
+            ls -la "$RUNNER_WORKSPACE/hdf5-install/lib" | grep -E '\.so' || echo "No shared libraries found"
          fi

      - name: Test JNI examples
        run: |
          cd HDF5Examples/JAVA
-          ./test-maven-jni.sh "${{ needs.build-maven-packages.outputs.version }}" "${{ format('https://maven.pkg.github.com/{0}', github.repository) }}"
+          ./test-maven-jni.sh "$PACKAGE_VERSION" "$REPOSITORY_URL"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_ACTOR: ${{ github.actor }}
          HDF5_HOME: ${{ runner.workspace }}/hdf5-install
+          PACKAGE_VERSION: ${{ needs.build-maven-packages.outputs.version }}
+          REPOSITORY_URL: ${{ format('https://maven.pkg.github.com/{0}', github.repository) }}

      - name: Upload test artifacts (JNI)
        if: always()
@@ -187,6 +200,9 @@ jobs:
    name: Test FFM Maven Package
    needs: [build-maven-packages, deploy-to-packages]
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
    if: |
      inputs.test_deployment &&
      needs.deploy-to-packages.result == 'success' &&
@@ -194,6 +210,8 @@ jobs:
    steps:
      - name: Checkout HDF5 repository (contains HDF5Examples)
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false

      - name: Set up Java 25 for FFM
        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
@@ -208,22 +226,26 @@ jobs:
          path: ${{ runner.workspace }}/hdf5-install

      - name: Verify HDF5 installation
+        env:
+          RUNNER_WORKSPACE: ${{ runner.workspace }}
        run: |
          echo "HDF5 installation contents:"
-          ls -la "${{ runner.workspace }}/hdf5-install"
-          if [ -d "${{ runner.workspace }}/hdf5-install/lib" ]; then
+          ls -la "$RUNNER_WORKSPACE/hdf5-install"
+          if [ -d "$RUNNER_WORKSPACE/hdf5-install/lib" ]; then
            echo "Libraries:"
-            ls -la "${{ runner.workspace }}/hdf5-install/lib" | grep -E '\.so' || echo "No shared libraries found"
+            ls -la "$RUNNER_WORKSPACE/hdf5-install/lib" | grep -E '\.so' || echo "No shared libraries found"
          fi

      - name: Test FFM examples
        run: |
          cd HDF5Examples/JAVA
-          ./test-maven-ffm.sh "${{ needs.build-maven-packages.outputs.version }}" "${{ format('https://maven.pkg.github.com/{0}', github.repository) }}"
+          ./test-maven-ffm.sh "$PACKAGE_VERSION" "$REPOSITORY_URL"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_ACTOR: ${{ github.actor }}
          HDF5_HOME: ${{ runner.workspace }}/hdf5-install
+          PACKAGE_VERSION: ${{ needs.build-maven-packages.outputs.version }}
+          REPOSITORY_URL: ${{ format('https://maven.pkg.github.com/{0}', github.repository) }}

      - name: Upload test artifacts (FFM)
        if: always()
@@ -245,6 +267,7 @@ jobs:
          INPUT_JAVA_IMPL: ${{ inputs.java_implementation }}
          INPUT_TEST_DEPLOYMENT: ${{ inputs.test_deployment }}
          INPUT_TEST_EXAMPLES: ${{ inputs.test_examples }}
+          PACKAGE_VERSION: ${{ needs.build-maven-packages.outputs.version }}
        run: |
          echo "# Maven Build and Test Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
@@ -261,7 +284,7 @@ jobs:
          # Build results
          if [ "${{ needs.build-maven-packages.result }}" == "success" ]; then
            echo "✅ **Maven Package Build:** PASSED" >> $GITHUB_STEP_SUMMARY
-            echo "   - Version: ${{ needs.build-maven-packages.outputs.version }}" >> $GITHUB_STEP_SUMMARY
+            echo "   - Version: $PACKAGE_VERSION" >> $GITHUB_STEP_SUMMARY
          else
            echo "❌ **Maven Package Build:** FAILED" >> $GITHUB_STEP_SUMMARY
          fi
@@ -74,8 +74,6 @@ on:

 permissions:
  contents: read
-  packages: write
-  pull-requests: write

 jobs:
  detect-changes:
@@ -89,9 +87,12 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
+          persist-credentials: false

      - name: Detect changes in Maven-related files
        id: changes
+        env:
+          BASE_REF: ${{ github.base_ref }}
        run: |
          # Check if this is a manual trigger
          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
@@ -108,9 +109,9 @@ jobs:
          fi

          # For pull requests, check changed files
-          if [ -n "${{ github.base_ref }}" ]; then
-            git fetch origin ${{ github.base_ref }}
-            MAVEN_FILES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD | grep -E "(java/src/hdf/hdf5lib/|HDF5Examples/JAVA/|maven|pom\.xml|CMakePresets\.json)" || true)
+          if [ -n "$BASE_REF" ]; then
+            git fetch origin "$BASE_REF"
+            MAVEN_FILES=$(git diff --name-only "origin/$BASE_REF...HEAD" | grep -E "(java/src/hdf/hdf5lib/|HDF5Examples/JAVA/|maven|pom\.xml|CMakePresets\.json)" || true)
          else
            # Fallback: assume changes if base_ref not available
            MAVEN_FILES="true"
@@ -268,6 +269,8 @@ jobs:

      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false

      - name: Setup jextract (FFM builds only)
        if: ${{ matrix.implementation == 'ffm' }}
@@ -280,9 +283,12 @@ jobs:
        shell: bash
        env:
          USE_SNAPSHOT_VERSION: ${{ inputs.use_snapshot_version }}
+          MATRIX_IMPLEMENTATION: ${{ matrix.implementation }}
+          MATRIX_COMPILER: ${{ matrix.compiler }}
+          MATRIX_PLATFORM: ${{ matrix.platform }}
        run: |
          # Determine implementation suffix for preset based on matrix
-          JAVA_IMPL="${{ matrix.implementation }}"
+          JAVA_IMPL="$MATRIX_IMPLEMENTATION"
          case "$JAVA_IMPL" in
            "ffm")
              IMPL_SUFFIX="-FFM"
@@ -301,15 +307,17 @@ jobs:

          # Build preset name: ci-MinShar-{COMPILER}-Maven{-FFM}{-Snapshot}
          # Note: Generic Maven presets default to JNI (no suffix needed)
-          PRESET_NAME="ci-MinShar-${{ matrix.compiler }}-Maven${IMPL_SUFFIX}${SNAPSHOT_SUFFIX}"
+          PRESET_NAME="ci-MinShar-${MATRIX_COMPILER}-Maven${IMPL_SUFFIX}${SNAPSHOT_SUFFIX}"

          echo "preset=$PRESET_NAME" >> $GITHUB_OUTPUT
          echo "Using preset: $PRESET_NAME"
-          echo "Platform: ${{ matrix.platform }}, Compiler: ${{ matrix.compiler }}, Implementation: $JAVA_IMPL"
+          echo "Platform: ${MATRIX_PLATFORM}, Compiler: ${MATRIX_COMPILER}, Implementation: $JAVA_IMPL"

      - name: Build HDF5 with Maven support
        id: buildhdf5
        shell: bash
+        env:
+          PRESET: ${{ steps.set-preset.outputs.preset }}
        run: |
          # macOS: Disable Spotlight indexing to prevent file locking during CPack
          if [[ "$RUNNER_OS" == "macOS" ]]; then
@@ -322,22 +330,25 @@ jobs:
          # Run workflow with retry logic for macOS CPack failures
          if [[ "$RUNNER_OS" == "macOS" ]]; then
            echo "Running CMake workflow with macOS retry logic..."
-            if ! cmake --workflow --preset="${{ steps.set-preset.outputs.preset }}" --fresh; then
+            if ! cmake --workflow --preset="$PRESET" --fresh; then
              echo "⚠️ First attempt failed, retrying in 5 seconds..."
              sleep 5
-              cmake --workflow --preset="${{ steps.set-preset.outputs.preset }}" --fresh
+              cmake --workflow --preset="$PRESET" --fresh
            fi
          else
            # Non-macOS: run normally without retry
-            cmake --workflow --preset="${{ steps.set-preset.outputs.preset }}" --fresh
+            cmake --workflow --preset="$PRESET" --fresh
          fi

      - name: Extract version information
        id: version-info
        shell: bash
+        env:
+          RUNNER_WORKSPACE: ${{ runner.workspace }}
+          PRESET: ${{ steps.set-preset.outputs.preset }}
        run: |
          # Find the generated POM file across all possible locations
-          BUILD_ROOT="${{ runner.workspace }}/build/${{ steps.set-preset.outputs.preset }}"
+          BUILD_ROOT="$RUNNER_WORKSPACE/build/$PRESET"
          echo "Looking for POM file in: $BUILD_ROOT"

          # Try multiple search patterns for cross-platform compatibility
@@ -353,8 +364,8 @@ jobs:
          fi

          # Try Maven artifacts directory if build structure differs
-          if [ -z "$POM_FILE" ] && [ -d "${{ runner.workspace }}/maven-artifacts" ]; then
-            POM_FILE=$(find "${{ runner.workspace }}/maven-artifacts" -name "pom.xml" 2>/dev/null | head -1)
+          if [ -z "$POM_FILE" ] && [ -d "$RUNNER_WORKSPACE/maven-artifacts" ]; then
+            POM_FILE=$(find "$RUNNER_WORKSPACE/maven-artifacts" -name "pom.xml" 2>/dev/null | head -1)
          fi

          if [ -n "$POM_FILE" ] && [ -f "$POM_FILE" ]; then
@@ -381,11 +392,14 @@ jobs:

      - name: Collect Maven artifacts
        shell: bash
+        env:
+          RUNNER_WORKSPACE: ${{ runner.workspace }}
+          PRESET: ${{ steps.set-preset.outputs.preset }}
        run: |
          echo "Collecting Maven artifacts for testing..."
-          mkdir -p "${{ runner.workspace }}/maven-artifacts"
+          mkdir -p "$RUNNER_WORKSPACE/maven-artifacts"

-          BUILD_ROOT="${{ runner.workspace }}/build/${{ steps.set-preset.outputs.preset }}"
+          BUILD_ROOT="$RUNNER_WORKSPACE/build/$PRESET"
          echo "Looking for Maven artifacts in build root: $BUILD_ROOT"

          if [ ! -d "$BUILD_ROOT" ]; then
@@ -443,21 +457,21 @@ jobs:
          find "$BUILD_DIR" -name "*slf4j*.jar" -type f

          # Copy JAR files (excluding test and H5Ex_ example JARs)
-          find "$BUILD_DIR" -name "*.jar" -not -name "*test*" -not -name "*H5Ex_*" -exec cp {} "${{ runner.workspace }}/maven-artifacts/" \;
+          find "$BUILD_DIR" -name "*.jar" -not -name "*test*" -not -name "*H5Ex_*" -exec cp {} "$RUNNER_WORKSPACE/maven-artifacts/" \;

          # Also look for Maven dependencies in common locations
          echo "Looking for Maven dependencies in additional locations..."

          # Check if there's a Maven repository in the build area
          if [ -d "$BUILD_ROOT" ]; then
-            find "$BUILD_ROOT" -name "*slf4j*.jar" -type f -exec cp {} "${{ runner.workspace }}/maven-artifacts/" \;
+            find "$BUILD_ROOT" -name "*slf4j*.jar" -type f -exec cp {} "$RUNNER_WORKSPACE/maven-artifacts/" \;
          fi

          # Check common Maven local repository locations
          MAVEN_REPO_PATHS=(
            "$HOME/.m2/repository"
            "$BUILD_ROOT/.m2/repository"
-            "${{ runner.workspace }}/.m2/repository"
+            "$RUNNER_WORKSPACE/.m2/repository"
          )

          for repo_path in "${MAVEN_REPO_PATHS[@]}"; do
@@ -466,25 +480,27 @@ jobs:
              find "$repo_path" -name "slf4j-api*.jar" -o -name "slf4j-simple*.jar" 2>/dev/null | head -2 | while read jar_file; do
                if [ -f "$jar_file" ]; then
                  echo "Found dependency: $jar_file"
-                  cp "$jar_file" "${{ runner.workspace }}/maven-artifacts/"
+                  cp "$jar_file" "$RUNNER_WORKSPACE/maven-artifacts/"
                fi
              done
            fi
          done

          # Copy POM files
-          find "$BUILD_DIR" -name "pom.xml" -exec cp {} "${{ runner.workspace }}/maven-artifacts/" \;
+          find "$BUILD_DIR" -name "pom.xml" -exec cp {} "$RUNNER_WORKSPACE/maven-artifacts/" \;

          # List collected artifacts
          echo "Collected Maven artifacts:"
-          ls -la "${{ runner.workspace }}/maven-artifacts/"
+          ls -la "$RUNNER_WORKSPACE/maven-artifacts/"

      - name: Validate artifacts
        id: artifacts-check
        shell: bash
+        env:
+          RUNNER_WORKSPACE: ${{ runner.workspace }}
        run: |
-          ARTIFACT_COUNT=$(find "${{ runner.workspace }}/maven-artifacts" -name "*.jar" | wc -l)
-          POM_COUNT=$(find "${{ runner.workspace }}/maven-artifacts" -name "pom.xml" | wc -l)
+          ARTIFACT_COUNT=$(find "$RUNNER_WORKSPACE/maven-artifacts" -name "*.jar" | wc -l)
+          POM_COUNT=$(find "$RUNNER_WORKSPACE/maven-artifacts" -name "pom.xml" | wc -l)

          echo "Found $ARTIFACT_COUNT JAR files and $POM_COUNT POM files"

@@ -499,15 +515,18 @@ jobs:

      - name: Verify JAR contents (CRITICAL - Prevents Incomplete Packages)
        shell: bash
+        env:
+          RUNNER_WORKSPACE: ${{ runner.workspace }}
+          MATRIX_IMPLEMENTATION: ${{ matrix.implementation }}
        run: |
          echo "::group::Verify JAR contents"
          echo "============================================"
          echo "Verifying Maven artifacts contain HDF5 classes"
          echo "============================================"

-          ARTIFACT_DIR="${{ runner.workspace }}/maven-artifacts"
+          ARTIFACT_DIR="$RUNNER_WORKSPACE/maven-artifacts"
          VERIFICATION_FAILED=false
-          IMPL="${{ matrix.implementation }}"
+          IMPL="$MATRIX_IMPLEMENTATION"

          # Find the main HDF5 JAR (not slf4j dependencies)
          HDF5_JAR=$(find "$ARTIFACT_DIR" -name "*hdf5*.jar" ! -name "*sources*" ! -name "*javadoc*" ! -name "*slf4j*" | head -1)
@@ -622,19 +641,24 @@ jobs:

      - name: Run validation script
        shell: bash
+        env:
+          RUNNER_WORKSPACE: ${{ runner.workspace }}
        run: |
          if [ -f .github/scripts/validate-maven-artifacts.sh ]; then
            echo "Running Maven artifact validation..."
-            .github/scripts/validate-maven-artifacts.sh "${{ runner.workspace }}/maven-artifacts"
+            .github/scripts/validate-maven-artifacts.sh "$RUNNER_WORKSPACE/maven-artifacts"
          else
            echo "Validation script not found - skipping validation"
          fi

      - name: Install HDF5 binaries for testing
        shell: bash
+        env:
+          RUNNER_WORKSPACE: ${{ runner.workspace }}
+          PRESET: ${{ steps.set-preset.outputs.preset }}
        run: |
-          BUILD_ROOT="${{ runner.workspace }}/build/${{ steps.set-preset.outputs.preset }}"
-          INSTALL_DIR="${{ runner.workspace }}/hdf5-install"
+          BUILD_ROOT="$RUNNER_WORKSPACE/build/$PRESET"
+          INSTALL_DIR="$RUNNER_WORKSPACE/hdf5-install"

          echo "Installing HDF5 binaries to: $INSTALL_DIR"
          cd "$BUILD_ROOT"
@@ -686,6 +710,7 @@ jobs:
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          path: source
+          persist-credentials: false

      - name: Extract version for testing
        id: extract-version
@@ -722,9 +747,11 @@ jobs:
          fi

      - name: Test Maven deployment (dry run)
+        env:
+          ARTIFACT_VERSION: ${{ steps.extract-version.outputs.version }}
        run: |
          echo "=== Maven Deployment Test (Dry Run) ==="
-          echo "Version: ${{ steps.extract-version.outputs.version }}"
+          echo "Version: $ARTIFACT_VERSION"

          echo "Repository: GitHub Packages (staging)"

@@ -794,6 +821,8 @@ jobs:
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false

      - name: Set up JDK (Java 25 for FFM builds)
        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
@@ -828,15 +857,17 @@ jobs:
        if: ${{ matrix.platform != 'Windows' }}
        id: test-examples-unix
        shell: bash
+        env:
+          MATRIX_PLATFORM: ${{ matrix.platform }}
        run: |
-          echo "=== Java Examples Maven Integration Test (${{ matrix.platform }}) ==="
+          echo "=== Java Examples Maven Integration Test (${MATRIX_PLATFORM}) ==="

          # Test one representative example from each category
          cd HDF5Examples/JAVA

          # Get absolute path to maven artifacts for this platform
-          MAVEN_ARTIFACTS_DIR="$(realpath ../../maven-artifacts/${{ matrix.platform }})"
-          echo "Maven artifacts directory (${{ matrix.platform }}): $MAVEN_ARTIFACTS_DIR"
+          MAVEN_ARTIFACTS_DIR="$(realpath ../../maven-artifacts/${MATRIX_PLATFORM})"
+          echo "Maven artifacts directory (${MATRIX_PLATFORM}): $MAVEN_ARTIFACTS_DIR"

          # Find HDF5 JAR files (not dependencies like slf4j) - use platform-specific artifacts
          HDF5_JAR=$(find "$MAVEN_ARTIFACTS_DIR" -name "*hdf5*.jar" -o -name "jarhdf5*.jar" 2>/dev/null | head -1)
@@ -1018,7 +1049,7 @@ jobs:
            fi
          done

-          echo "=== Java Examples Test Summary (${{ matrix.platform }}) ==="
+          echo "=== Java Examples Test Summary (${MATRIX_PLATFORM}) ==="
          echo "Total representative examples tested: $TOTAL_EXAMPLES"
          echo "Passed: $PASSED_EXAMPLES"
          echo "Failed: $((TOTAL_EXAMPLES - PASSED_EXAMPLES))"
@@ -1039,6 +1070,8 @@ jobs:
        if: ${{ matrix.platform == 'Windows' }}
        id: test-examples-windows
        shell: pwsh
+        env:
+          MATRIX_PLATFORM: ${{ matrix.platform }}
        run: |
          Write-Host "=== Java Examples Maven Integration Test (Windows) ==="

@@ -1046,7 +1079,7 @@ jobs:
          Set-Location HDF5Examples/JAVA

          # Get absolute path to maven artifacts for this platform
-          $MAVEN_ARTIFACTS_DIR = Resolve-Path "../../maven-artifacts/${{ matrix.platform }}"
+          $MAVEN_ARTIFACTS_DIR = Resolve-Path "../../maven-artifacts/$($env:MATRIX_PLATFORM)"
          Write-Host "Maven artifacts directory (Windows): $MAVEN_ARTIFACTS_DIR"

          # Find HDF5 JAR files (not dependencies like slf4j)
@@ -146,4 +146,3 @@ jobs:
      version: ${{ needs.call-workflow-maven-staging.outputs.version }}
      java_implementation: 'both'
      repository_url: ${{ inputs.maven_repository == 'github-packages' && format('https://maven.pkg.github.com/{0}', github.repository) || 'https://repo.maven.apache.org/maven2' }}
-    secrets: inherit
@@ -23,22 +23,28 @@ on:

 permissions:
  contents: read
-  packages: write

 jobs:
  generate-test-artifacts:
    name: Generate Test Artifacts
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false

      - name: Display test configuration
+        env:
+          GITHUB_ACTOR: ${{ github.actor }}
        run: |
          echo "=== Maven Deployment Test Configuration ==="
          echo "Test Mode: ${{ inputs.test_mode }}"
          echo "Target Repository: ${{ inputs.target_repository }}"
-          echo "GitHub Actor: ${{ github.actor }}"
+          echo "GitHub Actor: $GITHUB_ACTOR"
          echo "Repository: ${{ github.repository }}"
          echo "Expected packages URL: https://github.com/${{ github.repository }}/packages"
          echo ""
@@ -127,6 +133,9 @@ jobs:
  test-maven-deployment:
    name: Test Maven Deployment to HDFGroup Packages
    needs: generate-test-artifacts
+    permissions:
+      contents: read
+      packages: write
    uses: ./.github/workflows/maven-deploy.yml
    with:
      file_base: "hdf5-test"
@@ -146,6 +155,9 @@ jobs:
    needs: test-maven-deployment
    if: ${{ always() && inputs.test_mode == 'live-deployment' }}
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
    steps:
      - name: Validate deployment results
        run: |
@@ -59,6 +59,8 @@ jobs:
    steps:
      - name: Checkout HDF5 repository (contains HDF5Examples)
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false

      - name: Set up Java 21 for JNI
        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
@@ -290,12 +292,14 @@ jobs:
          path: ${{ runner.workspace }}/hdf5-install

      - name: Verify HDF5 installation
+        env:
+          RUNNER_WORKSPACE: ${{ runner.workspace }}
        run: |
          echo "HDF5 installation contents:"
-          ls -la "${{ runner.workspace }}/hdf5-install"
-          if [ -d "${{ runner.workspace }}/hdf5-install/lib" ]; then
+          ls -la "$RUNNER_WORKSPACE/hdf5-install"
+          if [ -d "$RUNNER_WORKSPACE/hdf5-install/lib" ]; then
            echo "Libraries:"
-            ls -la "${{ runner.workspace }}/hdf5-install/lib" | grep -E '\.so' || echo "No shared libraries found"
+            ls -la "$RUNNER_WORKSPACE/hdf5-install/lib" | grep -E '\.so' || echo "No shared libraries found"
          fi

      - name: Test JNI examples
@@ -326,6 +330,8 @@ jobs:
    steps:
      - name: Checkout HDF5 repository (contains HDF5Examples)
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false

      - name: Set up Java 25 for FFM
        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
@@ -558,12 +564,14 @@ jobs:
          path: ${{ runner.workspace }}/hdf5-install

      - name: Verify HDF5 installation
+        env:
+          RUNNER_WORKSPACE: ${{ runner.workspace }}
        run: |
          echo "HDF5 installation contents:"
-          ls -la "${{ runner.workspace }}/hdf5-install"
-          if [ -d "${{ runner.workspace }}/hdf5-install/lib" ]; then
+          ls -la "$RUNNER_WORKSPACE/hdf5-install"
+          if [ -d "$RUNNER_WORKSPACE/hdf5-install/lib" ]; then
            echo "Libraries:"
-            ls -la "${{ runner.workspace }}/hdf5-install/lib" | grep -E '\.so' || echo "No shared libraries found"
+            ls -la "$RUNNER_WORKSPACE/hdf5-install/lib" | grep -E '\.so' || echo "No shared libraries found"
          fi

      - name: Test FFM examples