.github/workflows/ci.yml (5)

9-11: Consider adding explicit permissions for enhanced security.

Modern GitHub Actions workflows should explicitly declare permissions following the principle of least privilege. This prevents potential security issues from token misuse.

🔒 Proposed addition of permissions configuration

 jobs:
   build-and-test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yml around lines 9 - 11, The workflow currently lacks
an explicit permissions block for the "build-and-test" job; add a permissions
mapping under that job (or top-level) to follow least-privilege principles by
explicitly granting only the scopes required (e.g., contents: read, checks:
write) and deny others (set others to none), and ensure the "build-and-test" job
references that permissions block so the runner uses the restricted GITHUB_TOKEN
privileges.

---

9-11: Consider adding a job timeout to prevent resource waste.

Jobs without explicit timeouts can run indefinitely if they hang, consuming CI minutes. Adding a timeout-minutes is a best practice for CI workflows.

⏱️ Proposed addition of timeout configuration

 jobs:
   build-and-test:
     runs-on: ubuntu-latest
+    timeout-minutes: 30

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yml around lines 9 - 11, Add an explicit job timeout to
prevent indefinite runs by adding a timeout-minutes setting to the
build-and-test job; update the jobs -> build-and-test block (the job named
"build-and-test" that currently has "runs-on: ubuntu-latest") to include a
timeout-minutes: <value> (e.g., 30) so the CI workflow aborts hung jobs and
frees resources.

---

25-32: Consider using the built-in cache parameter in setup-java.

The actions/setup-java@v5 action has a built-in cache parameter that can handle Maven dependency caching automatically. This simplifies the workflow by eliminating the need for a separate cache action.

♻️ Alternative approach using built-in caching

Remove the separate cache step and add the cache parameter to the setup-java step:

       - name: Set up JDK
         uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: '25'
+          cache: 'maven'

-      # 3. Cache (snabbar upp builds)
-      - name: Cache Maven dependencies
-        uses: actions/cache@v5
-        with:
-          path: ~/.m2
-          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
-          restore-keys: |
-            ${{ runner.os }}-maven

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yml around lines 25 - 32, The separate "Cache Maven
dependencies" step using actions/cache@v5 should be removed and replaced by
using the built-in cache parameter on the existing actions/setup-java@v5 step;
update the setup-java invocation to include cache: 'maven' (and optionally
cache-dependency-paths if custom) so Maven dependencies are cached automatically
instead of keeping the standalone Cache Maven dependencies step.

---

14-14: Consider using English for step comments.

The workflow uses Swedish comments (e.g., "Hämta koden", "Installera Java"). While this is not incorrect, using English is the standard practice for CI/CD configurations in international projects, improving accessibility for contributors from different regions.

🌍 Proposed translation to English

-      # 1. Hämta koden
+      # 1. Checkout code
       - name: Checkout code
         uses: actions/checkout@v5

-      # 2. Installera Java
+      # 2. Set up Java
       - name: Set up JDK
         uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: '25'

-      # 3. Cache (snabbar upp builds)
+      # 3. Cache Maven dependencies (speeds up builds)
       - name: Cache Maven dependencies
         uses: actions/cache@v5
         with:
           path: ~/.m2
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
           restore-keys: |
             ${{ runner.os }}-maven

-      # 4. Build + Test
+      # 4. Build and run tests
       - name: Build and run tests
         run: mvn clean verify

Also applies to: 18-18, 25-25, 34-34

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yml at line 14, Replace the Swedish step comments in
the CI workflow with English equivalents to improve accessibility; specifically
update strings like "Hämta koden" to "Checkout code", "Installera Java" to
"Install Java" and other Swedish comments found in the file so all step
descriptions are in English (search for those exact Swedish phrases to locate
the comments and update their text).

---

22-23: Consider using a Long-Term Support (LTS) Java version.

JDK 25 is not an LTS version and receives only 6 months of support. For production CI pipelines, using an LTS version like JDK 21 provides better long-term stability and extended support.

🔄 Proposed change to use JDK 21 LTS

         with:
           distribution: 'temurin'
-          java-version: '25'
+          java-version: '21'

Note: You would also need to update the java.version property in pom.xml to match.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yml around lines 22 - 23, Update the CI to use a Java
LTS release by changing the java-version value from '25' to '21' in the workflow
where the distribution is 'temurin' (keys: distribution and java-version); also
update the corresponding java.version property in pom.xml so the build and CI
use the same JDK version.