Use new release workflow of cap-java/.github and update shas

[lisajulia]

Update cap-java/.github Shared Workflow References to New Release

🔧 Chore: Updated all references to the cap-java/.github shared workflows and actions from the old SHA (5fc795c5049bb4d49e957346df2e5d6d7c0c23b9) to the new SHA (b5eb1ad6341e9fd1d681c42f3b36c4b750a7dac2).

Changes

• .github/workflows/issue.yml: Updated shared workflow SHA for issue labeling.
• .github/workflows/main.yml: Updated scan-with-blackduck action SHA.
• .github/workflows/pipeline.yml: Updated SHAs for scan-with-sonar and scan-with-codeql actions.
• .github/workflows/pr.yml: Updated scan-with-blackduck action SHA.
• .github/workflows/prevent-issue-labeling.yml: Updated shared workflow SHA.
• .github/workflows/stale.yml: Updated shared workflow SHA for stale issue handling.
• .github/workflows/release.yml: Major refactor — replaced the inline, multi-job release workflow (approval, version verification, BlackDuck scan, build, and deploy steps) with a single delegated call to the new centralized release.yml reusable workflow from cap-java/.github. The JAVA_VERSION and MAVEN_VERSION environment variables are removed, as they are now managed by the shared workflow. BlackDuck project configuration is passed as inputs, and secrets are inherited.

• 🔄 Regenerate and Update Summary

PR Bot Information

Version: 1.29.45

• Summary Prompt: Default Prompt
• Event Trigger: pull_request.opened
• LLM: anthropic--claude-4.6-sonnet
• File Content Strategy: Full file content
• Output Template: Default Template
• Correlation ID: 38294090-a0ad-11f1-94f2-61bdacc8c052

[hyperspace-pr-bot]

The PR is a clean SHA bump across all workflow files plus a significant simplification of release.yml by delegating to the centralized cap-java/.github reusable workflow. The main concern raised is that the new release.yml is missing the #main comment tag (present on all other SHA-pinned references), and the implicit removal of the local requires-approval and verify-version gates should be verified as equivalent functionality exists in the shared workflow before merging.

PR Bot Information

Version: 1.29.45

• Event Trigger: pull_request.opened
• Agent Instructions:
  • CLAUDE.md
• LLM: anthropic--claude-4.6-sonnet
• File Content Strategy: Full file content
• Correlation ID: 38294090-a0ad-11f1-94f2-61bdacc8c052

[hyperspace-pr-bot]

Bug: release.yml is missing the #main comment tag and, more importantly, the new reusable workflow call is not pinned with a comment, unlike every other SHA reference in this repository. While this is a minor consistency issue, the more notable concern is that the old release.yml had explicit requires-approval (manual gate via environment: release-approval) and verify-version (pom.xml revision vs tag check) jobs. If the new centralized cap-java/.github release workflow does not replicate these gates, releases could be deployed without approval or version verification. Confirm that the referenced shared workflow includes equivalent release-approval environment gate and version-tag verification steps before merging.

Suggested change

	uses: cap-java/.github/.github/workflows/release.yml@b5eb1ad6341e9fd1d681c42f3b36c4b750a7dac2
	uses: cap-java/.github/.github/workflows/release.yml@b5eb1ad6341e9fd1d681c42f3b36c4b750a7dac2 #main

Double-check suggestion before committing. Edit this comment for amendments.

---

Please provide feedback on the review comment by checking the appropriate box:

• 🌟 Awesome comment, a human might have missed that.
• ✅ Helpful comment
• 🤷 Neutral
• ❌ This comment is not helpful