build(deps): dependency-submission action v6, and record that main does not build

[bernardladenthin]

Two commits from a cross-repo dependency sweep on 2026-09-09. The second one matters far more than the first.

⚠️ main has not been buildable since 2026-09-01

srcmorph/pom.xml pins <llama.version>5.2.0</llama.version> (commit 5b4abeb, "pin net.ladenthin:llama to the 5.2.0 release, not the snapshot") — but that release was never published. Central's newest net.ladenthin:llama is 5.1.0, and llama-5.2.0.pom returns HTTP 404. This reactor declares no repository besides Central, so nothing can resolve it.

Proven two independent ways:

$ mvn -Dmaven.repo.local=/tmp/empty dependency:get -Dartifact=net.ladenthin:llama:5.2.0
[ERROR] Could not find artifact net.ladenthin:llama:jar:5.2.0 in central

and in CI — run 33962068246, job 101297417993:

[ERROR] dependency: net.ladenthin:llama:jar:5.2.0 (compile)
[ERROR] 	Could not find artifact net.ladenthin:llama:jar:5.2.0 in central
[INFO] BUILD FAILURE ... Total time: 3.350 s

Why it stayed invisible for eight days. Every PR run since 2026-09-01 dies at that first Maven step, but the merge commits' main runs were all cancelled by the start gate — so the repo never showed a red main, and the PR failures were attributed to whatever else was in flight. It also passes on any machine where an earlier mvn install of java-llama.cpp left 5.2.0 in ~/.m2, which is exactly the state a local mvn verify runs in; that is why "verified locally: reactor mvn clean verify green" appears, in good faith, in commit messages from that window.

Recorded, not fixed — the fix is a decision, not a revert. 229903c had raised the pin from 5.1.0 to 5.2.0-SNAPSHOT precisely because the newer binding "can express" flashAttn, so dropping back to 5.1.0 may not compile. java-llama.cpp's main sits at 5.2.0-SNAPSHOT, so publishing that release is the likelier fix. That call is the owner's, so this PR adds a TODO.md entry with the reproduction rather than guessing.

advanced-security/maven-dependency-submission-action v5 → v6

Closing cross-repo drift: Dependabot opened this in streambuffer only (bernardladenthin/streambuffer#156, merged), leaving the other three on v5 until their own staggered weekly run. v6.0.0 moves the runtime from Node 20 to Node 24, and streambuffer's Report job — where the action actually runs, no continue-on-error — went green on it first.

Expect this PR's CI to fail on the dependency resolution above; that failure is the subject of the second commit, not a regression from either change here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AnNYn8W1xuVxVJtyL34GyH

---

Generated by Claude Code

[claude]

Review Summary

✅ Excellent documentation of a critical blocker

Both commits are well-executed:

1. Action version bump (publish.yml) — solid maintenance:

• v6 migration is low-risk and already proven working in streambuffer
• Minimal change: single line, no logic alterations
• continue-on-error: true correctly isolates this step from blocking the pipeline
• No security or compatibility concerns

2. Build blocker documentation (TODO.md) — exemplary issue recording:

• Clear reproduction steps with specific evidence (run IDs, job numbers, HTTP 404 error)
• Explains why the failure remained undetected for 8 days (cancelled merge commits, warm local caches)
• Correctly identifies that simple reversion to 5.1.0 may not be safe (flashAttn API dependency)
• Appropriately flags this as the repo's Add comprehensive code and test writing guides #1 blocker
• Well-structured narrative that future contributors can follow

Technical assessment

• No bugs, security issues, or code quality problems
• The TODO entry correctly captures that the decision belongs to the java-llama.cpp owner (publishing 5.2.0 release vs. settling for 5.1.0)
• Re-running CI post-fix will confirm whether the chosen path compiles and passes the full PIT gate

Ready to merge. The critical fix step (updating java-llama.cpp or reverting the pin) is separate, but documenting the problem this thoroughly unblocks whoever takes that decision.