[CHORE](ci) Bump setup-java to v5 (Node 24) in publish-maven-to-codeartifact

[John McCall (lowlydba)]

What

Bumps actions/setup-java from c1e323688fd81a25caa38c78aa6df2d33d3e20d9 (v4.8.0, Node 20) to be666c2fcd27ec809703dec50e508c2fdc7f6654 (v5.2.0, Node 24) in the publish-maven-to-codeartifact composite action.

Why

This setup-java step was the last residual Node 20 source in the centralized CodeArtifact composite actions. A real dev-publish deploy during overture-matchers #287 testing surfaced a single Node 20 deprecation annotation traced to it. GitHub forces the Node 20 cutover on 2026-06-16.

Compatibility

The step's inputs (distribution: temurin, java-version-file, cache: maven, cache-dependency-path) are unchanged in setup-java v5 — v5's breaking changes are runner-version/runtime only, not these inputs. So this is a drop-in with no with: changes. It also matches the consumer's own setup-java v5.2.0 pin (be666c2), which already runs warning-free.

Validation

• action.yml parses (YAML safe_load OK).
• zizmor --persona=pedantic clean: no findings, 1 ignored (the pre-existing justified setup-codeartifact@main self-reference).
• git diff is exactly one line (the setup-java uses: line).

Closes #30
Part of #28
Part of OvertureMaps/ops-team#384

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[overture-projection]

Overture PRojection Review

This PR updates the actions/setup-java step in the publish-maven-to-codeartifact composite action from v4.8.0 (Node 20) to v5.2.0 (Node 24), addressing Node 20 deprecation and aligning with consumer workflows.

✅ Checks Passed

• The change is a direct pin update to the latest compatible version (setup-java v5.2.0).
• Inputs and workflow logic remain unchanged, matching compatibility notes.
• Linked issue present ([CHORE] Bump setup-java to v5 (Node 24) in publish-maven-to-codeartifact #30), following org process.
• License is MIT, consistent with org guidance.

🚩 Flags

• .github/actions/publish-maven-to-codeartifact/action.yml:49 No tests in diff (Tests: ❌), but this is a CI workflow version bump with no behavioral changes. If possible, validate the action runs as expected in a real publish scenario post-merge.

❓ Open Questions

• None — the rationale and compatibility are clearly explained.

---

No blocking issues found. The update is safe and aligns with org standards for CI maintenance. Recommend merge after confirming a successful publish run.

[John McCall (lowlydba)]

Not in use yet, going to merge to iterate on downstream development.

[Copilot]

Pull request overview

Updates the publish-maven-to-codeartifact composite action to use actions/setup-java v5 (Node 24) so the last remaining Node 20-based action dependency is removed ahead of GitHub’s Node 20 runtime cutoff.

Changes:

• Bump actions/setup-java from v4.8.0 (c1e3236…, Node 20) to v5.2.0 (be666c2…, Node 24) in the JDK setup step.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.