build(deps): bump the github-actions group with 2 updates

[dependabot]

Bumps the github-actions group with 2 updates: actions/setup-java and azure/login.

Updates actions/setup-java from 6.0.0 to 6.0.1

Release notes

Sourced from actions/setup-java's releases.

v6.0.1

What's Changed

• Fix failing GitHub Actions job for temurin 17 by @​brunoborges with @​Copilot in actions/setup-java#1259
• Fix Temurin EA E2E signature verification by @​brunoborges with @​Copilot in actions/setup-java#1260
• Fix Alpine GPG verification failures and support multiple keys by @​brunoborges in actions/setup-java#1262
• Fix import-safe checks when scripts are run from a path with symlinks by @​otaconix in actions/setup-java#1265
• Avoid macOS GPG socket overflow on long runner paths by @​brunoborges with @​Copilot in actions/setup-java#1266
• Complete v6 release highlights in README by @​brunoborges in actions/setup-java#1254
• Group and slow routine Dependabot updates by @​brunoborges in actions/setup-java#1255
• chore(deps-dev): update eslint and globals by @​dependabot[bot] in actions/setup-java#1256

New Contributors

• @​otaconix made their first contribution in actions/setup-java#1265

Full Changelog: actions/setup-java@v6.0.0...v6.0.1

Commits

• de7274f Avoid macOS GPG socket overflow on long runner paths (#1266)
• 134912a Fix import-safe checks when scripts are run from a path with symlinks (#1265)
• 0781fc6 Fix alpine failures by switching default back to only warn on verification fa...
• 4889c4a Fix Temurin EA E2E signature verification (#1260)
• 8fd3240 [WIP] Fix failing GitHub Actions job for temurin 17 (#1259)
• 2732291 chore(deps-dev): update eslint and globals (#1256)
• 1a8f22b chore: streamline Dependabot updates (#1255)
• 85030b7 docs: complete v6 release highlights (#1254)
• See full diff in compare view

Updates azure/login from 3.0.2 to 3.1.0

Release notes

Sourced from azure/login's releases.

Azure Login Action v3.1.0

What's Changed

• Pin GitHub Actions to full-length commit SHAs by @​danfiedler-msft in Azure/login#636
• Add the ability to prevent the masking of clientId by @​the-coding-cuzzy in Azure/login#634
• Automate release tagging via deploy key + self-pin bump by @​MaddyMicrosoft in Azure/login#638
• docs: document immutable release model and correct branch reference by @​MaddyMicrosoft in Azure/login#640
• ci: reduce scheduled test frequency and clarify workflow names by @​MaddyMicrosoft in Azure/login#639
• Bump js-yaml from 3.14.2 to 3.15.2 by @​dependabot[bot] in Azure/login#643
• Bump browserslist from 4.21.4 to 4.28.8 by @​dependabot[bot] in Azure/login#637
• Add max-context-population input to override Azure PowerShell MaxCont… by @​MaddyMicrosoft in Azure/login#642

New Contributors

• @​danfiedler-msft made their first contribution in Azure/login#636
• @​the-coding-cuzzy made their first contribution in Azure/login#634

Full Changelog: Azure/login@v3.0.2...v3.1.0

Commits

• a641126 prepare release v3.1.0
• 3c5b5ce Add max-context-population input to override Azure PowerShell MaxCont… (#642)
• fcd0340 Bump browserslist from 4.21.4 to 4.28.8 (#637)
• 5a8018f Bump js-yaml from 3.14.2 to 3.15.2 (#643)
• a23dddf ci: reduce scheduled test frequency and clarify workflow names (#639)
• 4c016e0 docs: document immutable release model and correct branch reference (#640)
• 63f3c38 Automate release tagging via deploy key + self-pin bump (#638)
• 92a0b67 Add the ability to prevent the masking of clientId (#634)
• 5cb857d Pin GitHub Actions to full-length commit SHAs (#636)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[Changyong Gong (chagong)]

Decision: NOT_MERGED

Dependabot PR Manager result

Repository: microsoft/vscode-java-pack
Pull request: microsoft/vscode-java-pack#1762 — build(deps): bump the github-actions group with 2 updates
Update: Grouped workflow-action update: actions/setup-java 6.0.0 -> 6.0.1 (patch) and azure/login 3.0.2 -> 3.1.0 (minor).
Safety assessment: One verified Dependabot commit; the current base is an ancestor of the head; the compatibility-remediation gate applies because a third-party action is included. Both direct workflow actions remain necessary, all references are immutable 40-character SHAs matching their release tags, release/interface review found the existing inputs compatible, and the diff contains only three pinned uses: replacements with adjacent version comments. Risk is low; no remediation was warranted.
Final state: Head cacdb229560b56fc915a52d3756c0da05d5bd576; mergeable MERGEABLE, merge state BLOCKED, review decision REVIEW_REQUIRED; CI totals: 52 successful, 1 neutral, 1 skipped, 6 failed, 0 non-terminal. Failed as UNRELATED: e2e-test (windows-latest, java-go-to-super-implementation), e2e-test (ubuntu-latest, java-go-to-super-implementation), e2e-test (macos-latest, java-go-to-super-implementation), e2e-test (windows-latest, java-test-navigation), e2e-test (ubuntu-latest, java-test-navigation), and e2e-test (macos-latest, java-test-navigation); every failure occurred after successful Java setup and timed out waiting for the language server, while 48 other E2E matrix jobs using the same action passed.
Actions taken: Verified target, bot-only provenance, complete diff, release tags and notes, action interfaces, dependency necessity, branch freshness (behind_by: 0), reviews, threads, and checks. Reran failed jobs once (run attempt 2); all six reproduced the same language-server timeout signatures. Made no branch edits, did not approve, and did not attempt merge.
Reason: Six current-head E2E checks remain failed after the one authorized rerun; unsuccessful checks block unattended approval and merge even though the failures are unrelated to the dependency update.
Next action: Repair the language-server readiness failures (or apply the repository's accepted CI override), rerun the six E2E jobs to green, then obtain the required code-owner/last-push approval and merge.