chore: optimize CI/CD pipeline configuration

.github/actions/scan-with-sonar/action.yml

@@ -32,7 +32,7 @@ runs:
         maven-version: ${{inputs.maven-version}}
 
     - name: Set up Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with:
         node-version: '22'
         cache: 'npm'

.github/actions/test/action.yml

@@ -1,5 +1,5 @@
-name: 'Test Plugin and Sample'
-description: 'Tests emoji plugin, bookshop, and integration tests'
+name: 'Test Notifications Plugin and Sample'
+description: 'Builds and tests the notifications plugin, then runs sample app tests'
 inputs:
   java-version:
     description: 'Java version to use'
@@ -14,24 +14,24 @@ runs:
   using: 'composite'
   steps:
     - name: Set up Java
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
       with:
         distribution: 'temurin'
         java-version: ${{ inputs.java-version }}
         cache: maven
 
     - name: Set up Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with:
         node-version: ${{ inputs.node-version }}
         cache: 'npm'
 
-    - name: Build, Install and Test Emoji Plugin
+    - name: Build, Install and Test Notifications Plugin
       shell: bash
       run: |
         mvn clean install -B -V
 
-    - name: Test Bookshop App (Integration Tests)
+    - name: Test Sample App (Integration Tests)
       shell: bash
       working-directory: sample-app/srv
       run: |

.github/dependabot.yml

@@ -3,10 +3,11 @@ updates:
   - package-ecosystem: maven
     directories:
       - "/"
-      - "/tests/bookshop"
     schedule:
-      interval: daily
+      interval: weekly
     open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
     ignore:
     - dependency-name:  com.sap.cds:*
       versions:
@@ -15,12 +16,19 @@ updates:
   - package-ecosystem: npm
     directories:
       - "/"
-      - "/tests/bookshop"
     schedule:
-      interval: daily
+      interval: weekly
     open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: github-actions
     directory: "/"
     schedule:
-      interval: daily
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/check-changelog.yml

@@ -9,6 +9,6 @@ jobs:
     name: Check Changelog Action
     runs-on: ubuntu-latest
     steps:
-      - uses: tarides/changelog-check-action@v3
+      - uses: tarides/changelog-check-action@0189fc7eedec3ef3e9648c713908f6f2a6e99057 # v3
         with:
           changelog: CHANGELOG.md

.github/workflows/issue.yml

@@ -1,5 +1,7 @@
 name: Label issues
 
+permissions: {}
+
 on:
   issues:
     types:

.github/workflows/linter.yml

@@ -3,15 +3,15 @@ name: Linting
 on: [pull_request]
 
 jobs:
-  build:
+  lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           java-version: '17'
           distribution: 'temurin'
 
       - name: Run Spotless
-        run: mvn spotless:check
+        run: mvn spotless:check -Dspotless.check.skip=false

.github/workflows/prevent-issue-labeling.yml

@@ -1,5 +1,7 @@
 name: Prevent "New" Label on Issues
 
+permissions: {}
+
 on:
   issues:
     types: [labeled]

.github/workflows/test.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
     - name: Test CAP Projects
       uses: ./.github/actions/test

cds-feature-notifications/pom.xml

@@ -1,4 +1,5 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?><project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
   <modelVersion>4.0.0</modelVersion>
 
   <parent>
@@ -214,4 +215,4 @@
     </plugins>
   </build>
 
-</project>
+</project>

cds-feature-notifications/src/main/java/com/sap/cds/notifications/assemblers/NotificationAssembler.java

@@ -110,7 +110,8 @@ public List<NotificationBuildResult> buildNotifications(EventContext context) {
             "Batch notification emit for event '{}' with empty data list, skipping", eventName);
         return List.of();
       }
-      logger.debug("Batch notification emit for event '{}': {} entries", eventName, dataList.size());
+      logger.debug(
+          "Batch notification emit for event '{}': {} entries", eventName, dataList.size());
       List<NotificationBuildResult> results = new ArrayList<>();
       for (Object item : dataList) {
         if (!(item instanceof CdsData cdsData)) {
@@ -274,7 +275,8 @@ public CqnPredicate containment(
    * @param serviceCatalog service catalog to obtain the persistence service
    * @return query result containing a single row with column "result"
    */
-  public static Result executeDummySelect(CqnValue resolvedExpression, ServiceCatalog serviceCatalog) {
+  public static Result executeDummySelect(
+      CqnValue resolvedExpression, ServiceCatalog serviceCatalog) {
     Value<?> expr = ExpressionBuilder.create(resolvedExpression).value();
     PersistenceService ps =
         serviceCatalog.getService(PersistenceService.class, PersistenceService.DEFAULT_NAME);

cds-feature-notifications/src/main/java/com/sap/cds/notifications/assemblers/NotificationTemplateAssembler.java

@@ -7,6 +7,7 @@
 import cds.gen.notificationtemplateproviderservice.NotificationTemplates;
 import cds.gen.notificationtemplateproviderservice.Tags;
 import cds.gen.notificationtemplateproviderservice.Translations;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import com.sap.cds.Struct;
 import com.sap.cds.notifications.helpers.I18nHelper;
 import com.sap.cds.reflect.CdsBaseType;
@@ -16,13 +17,12 @@
 import com.sap.cds.reflect.CdsSimpleType;
 import com.sap.cds.reflect.CdsType;
 import com.sap.cds.services.runtime.CdsRuntime;
-import com.fasterxml.jackson.databind.ObjectMapper;
 import java.util.*;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 /**
- * Helper class to build standalone NotificationTemplate objects from CDS event annotations. 
+ * Helper class to build standalone NotificationTemplate objects from CDS event annotations.
  *
  * <p>Annotation mapping to standalone template fields:
  *
@@ -55,7 +55,8 @@ public List<NotificationTemplates> buildAllNotificationTemplates() {
     List<NotificationTemplates> templates = new ArrayList<>();
     CdsModel model = runtime.getCdsModel();
 
-    model.events()
+    model
+        .events()
         .filter(event -> event.findAnnotation("notification.template.title").isPresent())
         .forEach(event -> extractTemplateFromEvent(event).ifPresent(templates::add));
 
@@ -121,7 +122,8 @@ private Translations createTranslation(
     translation.setDisplayName(eventName);
 
     // Title (required) - from @notification.template.title
-    String title = i18nHelper.resolveAnnotationValue(event, "notification.template.title", i18nTexts);
+    String title =
+        i18nHelper.resolveAnnotationValue(event, "notification.template.title", i18nTexts);
     if (title == null || title.trim().isEmpty()) {
       throw new IllegalStateException(
           String.format(
@@ -132,19 +134,22 @@ private Translations createTranslation(
     translation.setTitle(title);
 
     // Preview - from @notification.template.publicTitle
-    String preview = i18nHelper.resolveAnnotationValue(event, "notification.template.publicTitle", i18nTexts);
+    String preview =
+        i18nHelper.resolveAnnotationValue(event, "notification.template.publicTitle", i18nTexts);
     if (preview != null && !preview.trim().isEmpty()) {
       translation.setPreview(preview);
     }
 
     // Body - from @notification.template.subtitle
-    String body = i18nHelper.resolveAnnotationValue(event, "notification.template.subtitle", i18nTexts);
+    String body =
+        i18nHelper.resolveAnnotationValue(event, "notification.template.subtitle", i18nTexts);
     if (body != null && !body.trim().isEmpty()) {
       translation.setBody(body);
     }
 
     // Description - from @notification.template.description or @description
-    String description = i18nHelper.resolveAnnotationValue(event, "notification.template.description", i18nTexts);
+    String description =
+        i18nHelper.resolveAnnotationValue(event, "notification.template.description", i18nTexts);
     if (description == null) {
       description = i18nHelper.resolveAnnotationValue(event, "description", i18nTexts);
     }
@@ -198,15 +203,14 @@ private Email buildEmail(CdsEvent event, Map<String, String> i18nTexts) {
   }
 
   private String extractVisibility(CdsEvent event) {
-    return Boolean.TRUE.equals(
-            event.getAnnotationValue("notification.customizable", Boolean.FALSE))
+    return Boolean.TRUE.equals(event.getAnnotationValue("notification.customizable", Boolean.FALSE))
         ? "PUBLIC"
         : null;
   }
 
   /**
-   * Extract source (service name) from the event's qualified name. E.g. "CatalogService.BookOrdered"
-   * → "CatalogService".
+   * Extract source (service name) from the event's qualified name. E.g.
+   * "CatalogService.BookOrdered" → "CatalogService".
    */
   private String extractSource(String qualifiedName) {
     int lastDot = qualifiedName.lastIndexOf('.');
@@ -289,5 +293,4 @@ private String cdsTypeToJsonSchemaType(CdsElementDefinition element) {
       return "string";
     }
   }
-
 }

cds-feature-notifications/src/main/java/com/sap/cds/notifications/assemblers/NotificationTypeAssembler.java

@@ -29,9 +29,11 @@ public List<NotificationTypes> buildAllNotificationTypes() {
     List<NotificationTypes> notificationTypes = new ArrayList<>();
     CdsModel model = runtime.getCdsModel();
 
-    model.events()
+    model
+        .events()
         .filter(event -> event.findAnnotation("notification.template.title").isPresent())
-        .forEach(event -> extractNotificationTypeFromEvent(event).ifPresent(notificationTypes::add));
+        .forEach(
+            event -> extractNotificationTypeFromEvent(event).ifPresent(notificationTypes::add));
 
     return notificationTypes;
   }

cds-feature-notifications/src/main/java/com/sap/cds/notifications/handlers/EntityNotificationHandler.java

@@ -406,7 +406,8 @@ public CqnPredicate containment(
                 }
               });
 
-      Result result = NotificationAssembler.executeDummySelect(resolved, context.getServiceCatalog());
+      Result result =
+          NotificationAssembler.executeDummySelect(resolved, context.getServiceCatalog());
 
       boolean conditionMet =
           result

cds-feature-notifications/src/main/java/com/sap/cds/notifications/handlers/LocalHandler.java

@@ -6,7 +6,6 @@
 import cds.gen.notificationproviderservice.NotificationProperties;
 import cds.gen.notificationproviderservice.Notifications;
 import cds.gen.notificationproviderservice.Recipients;
-
 import com.sap.cds.notifications.assemblers.NotificationAssembler;
 import com.sap.cds.services.EventContext;
 import com.sap.cds.services.cds.ApplicationService;

cds-feature-notifications/src/main/java/com/sap/cds/notifications/handlers/LocalNotificationTemplateAutoProvisionerHandler.java

@@ -5,7 +5,6 @@
 
 import cds.gen.notificationtemplateproviderservice.NotificationTemplates;
 import cds.gen.notificationtemplateproviderservice.Translations;
-
 import com.sap.cds.notifications.assemblers.NotificationTemplateAssembler;
 import com.sap.cds.services.application.ApplicationLifecycleService;
 import com.sap.cds.services.handler.EventHandler;
@@ -99,7 +98,8 @@ private void logTemplate(NotificationTemplates template) {
                   ? translation
                           .getEmail()
                           .getBodyHtml()
-                          .substring(0, Math.min(100, translation.getEmail().getBodyHtml().length()))
+                          .substring(
+                              0, Math.min(100, translation.getEmail().getBodyHtml().length()))
                       + "..."
                   : "null",
               translation.getEmail().getBodyText());
@@ -108,6 +108,7 @@ private void logTemplate(NotificationTemplates template) {
     }
 
     logger.info("===============================================================");
-    logger.info("Standalone template '{}' logged (LOCAL MODE - not sent to ANS)", template.getKey());
+    logger.info(
+        "Standalone template '{}' logged (LOCAL MODE - not sent to ANS)", template.getKey());
   }
 }

cds-feature-notifications/src/main/java/com/sap/cds/notifications/handlers/LocalNotificationTypeAutoProvisionerHandler.java

@@ -6,7 +6,6 @@
 import cds.gen.notificationtypeproviderservice.DeliveryChannels;
 import cds.gen.notificationtypeproviderservice.NotificationTypes;
 import cds.gen.notificationtypeproviderservice.Templates;
-
 import com.sap.cds.notifications.assemblers.NotificationTypeAssembler;
 import com.sap.cds.services.application.ApplicationLifecycleService;
 import com.sap.cds.services.handler.EventHandler;