Bump actions/checkout to v7 and actions/setup-java to v6

[dmccoystephenson]

Summary

• actions/checkout is bumped from v4 to v7 and actions/setup-java from v4 to v6 in .github/workflows/build.yml. Both v4 tags target the deprecated Node.js 20 runtime, and setup-java v4 no longer receives updates (see Bump actions/checkout and actions/setup-java off deprecated v4 (Node.js 20) #3).
• The new major tags were confirmed to exist with git ls-remote --tags against both action repositories (v7 is the newest actions/checkout major, v6 the newest actions/setup-java major).
• No library, test, or documentation file is changed. The matrix (Java 8, 17, 21), the Temurin distribution, and the Maven cache setting are unchanged.

The ubuntu-latest → Ubuntu 26 migration noted in #3 (starting October 19, 2026) is not addressed here. runs-on is left as ubuntu-latest. If the Java 8 leg behaves differently on the new image, that would be handled separately.

Test plan

• build (8) is green on this head, which confirms Temurin 8 is still installable through setup-java@v6
• build (17) is green
• build (21) is green
• The run shows no Node.js 20 or setup-java v4 deprecation annotation

This PR modifies .github/workflows/*, which is on the dev loop's do-not-auto-merge list, so it is left open for human review and merge.

Closes #3

This PR description was drafted during a Gardener session (https://github.com/Stephenson-Software/gardener).

🤖 Generated with Claude Code

---

drafted by Claude on behalf of Daniel Stephenson

[dmccoystephenson]

Self-review rubric (run 36697420247, head of feature/bump-ci-actions):

• Scope: PASS — the diff is two lines in .github/workflows/build.yml (checkout@v4→@v7, setup-java@v4→@v6), both named in Bump actions/checkout and actions/setup-java off deprecated v4 (Node.js 20) #3.
• Tests-new: PASS (not applicable) — no public method was added.
• Tests-fix: PASS (not applicable) — no production bug fix; the change is CI configuration only.
• Sibling structure / renames: PASS (not applicable) — no new files or identifiers.
• Docs: PASS — the README "Building" section says CI runs on Java 8, 17 and 21; the matrix is unchanged, and the workflow comment ("8 is the floor ... 21 is what the servers run") still holds. No doc names the action versions.
• Issue resolution: PASS — both pinned actions named in Bump actions/checkout and actions/setup-java off deprecated v4 (Node.js 20) #3 are bumped, and the Node.js 20 / setup-java v4 deprecation annotations no longer appear on the run. The ubuntu-latest migration annotation remains; Bump actions/checkout and actions/setup-java off deprecated v4 (Node.js 20) #3 raises it only as a watch item, and the PR body says it is not addressed.
• CI: PASS — build (8), build (17) and build (21) are green, each reporting Tests run: 46, Failures: 0, Errors: 0, Skipped: 0. The Java 8 leg confirms Temurin 8 still installs through setup-java@v6.
• No dependencies / single file / Java 8 / never throws / bounded / environment seam / version agreement / opt-out contract: PASS (not applicable) — pom.xml and src/ are untouched.

Judgment call flagged: both bumps skip majors (checkout v5 and v6, setup-java v5). The green matrix shows the defaults this workflow relies on still work. The upstream release notes for the skipped majors were not reviewed in this session.

.github/workflows/build.yml is on the do-not-auto-merge list, so this PR is left open for a human to review and merge.

This review comment was drafted during a Gardener session (https://github.com/Stephenson-Software/gardener).

---

drafted by Claude on behalf of Daniel Stephenson