ci: comply with enterprise Actions policy

Author: farbodsalimi

.github/workflows/delete-old-branches.yml

@@ -8,14 +8,38 @@ jobs:
   delete-old-branches:
     name: Delete old branches
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: read
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v2
-      - name: Run delete-old-branches-action
-        uses: beatlabs/delete-old-branches-action@v0.0.10
-        with:
-          repo_token: ${{ github.token }}
-          date: '7 days ago'
-          dry_run: false
-          default_branches: main,master,staging
-          exclude_open_pr_branches: true
+      - name: Delete branches with no activity in 7+ days
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PROTECTED: 'main master staging'
+          CUTOFF_DAYS: '7'
+        run: |
+          set -euo pipefail
+
+          cutoff_epoch=$(date -u -d "${CUTOFF_DAYS} days ago" +%s)
+
+          # Branches with open PRs (head refs) — never delete these.
+          open_pr_branches=$(gh api --paginate "repos/${REPO}/pulls?state=open&per_page=100" \
+            --jq '.[].head.ref' | sort -u)
+
+          # All branches with their tip commit date, paginated.
+          gh api --paginate "repos/${REPO}/branches?per_page=100" --jq '.[].name' | while read -r branch; do
+            case " ${PROTECTED} " in *" ${branch} "*) continue ;; esac
+            if grep -Fxq "${branch}" <<< "${open_pr_branches}"; then
+              continue
+            fi
+
+            committed_at=$(gh api "repos/${REPO}/branches/${branch}" \
+              --jq '.commit.commit.committer.date')
+            committed_epoch=$(date -u -d "${committed_at}" +%s)
+
+            if [ "${committed_epoch}" -lt "${cutoff_epoch}" ]; then
+              echo "Deleting ${branch} (last commit ${committed_at})"
+              gh api -X DELETE "repos/${REPO}/git/refs/heads/${branch}"
+            fi
+          done

.github/workflows/maven.yml

@@ -10,7 +10,7 @@ on:
 jobs:
   publish:
     name: Publish to Maven Central
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-large
     permissions:
       contents: read
 
@@ -21,10 +21,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
       - name: Set up Java & Maven for Central
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@d7793b545071e98d581d3bf084a51c3213318a07 # v4
         with:
           distribution: 'temurin'
           java-version: '8'