Bump gradle/actions from 3.3.2 to 3.4.0 (#934)

Bumps [gradle/actions](https://github.com/gradle/actions) from 3.3.2 to 3.4.0.
- [Release notes](https://github.com/gradle/actions/releases)
- [Commits](gradle/actions@db19848...d9336da)

---
updated-dependencies:
- dependency-name: gradle/actions
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/linux.yml

@@ -199,4 +199,4 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: gradle/actions/wrapper-validation@db19848a5fa7950289d3668fb053140cf3028d43 # v3.3.2
+      - uses: gradle/actions/wrapper-validation@d9336dac04dea2507a617466bc058a3def92b18b # v3.4.0

.github/workflows/pkgbuild.yml

@@ -0,0 +1,64 @@
+name: macOS
+on:
+  workflow_dispatch:
+  pull_request:
+    branches: [ master ]
+    paths:
+      - 'pkgbuild/**'
+      - '.github/workflows/pkgbuild.yml'
+permissions:
+  contents: read
+
+jobs:
+  pkgbuild:
+    strategy:
+      fail-fast: false
+      matrix:
+        jdk: [8, 11, 17, 21]
+        architecture: [x64, aarch64]
+        exclude:
+          - jdk: 8
+            architecture: aarch64
+    name: pkgbuild
+    runs-on: macos-latest
+    steps:
+
+    - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+
+    - name: Install dependencies
+      run: brew install --cask packages
+
+    - name: Fetch latest macOS version from Adoptium API
+      run: |
+        response=$(curl -s "https://api.adoptium.net/v3/assets/feature_releases/${{ matrix.jdk }}/ga?architecture=${{ matrix.architecture }}&image_type=jdk&os=mac&page=0&page_size=1")
+        json=$(echo "$response" | jq '.[0]')
+
+        major=$(echo "$json" | jq -r '.version_data.major')
+        echo "MAJOR_VERSION=$major" >> $GITHUB_ENV
+        echo "TAG=$(echo "$json" | jq -r '.release_name')" >> $GITHUB_ENV
+
+        # SUB_TAG is used to create the file name of the JDK/JRE zip file
+        release_name=$(echo "$json" | jq -r '.release_name')
+        if [[ "$major" -eq 8 ]]; then
+          subTag=$(echo "$release_name" | sed -e 's/jdk//' -e 's/-//')
+        else
+          subTag=$(echo "$release_name" | sed -e 's/jdk-//' -e 's/+/_/')
+        fi
+        echo "FULL_VERSION=$subTag" >> $GITHUB_ENV
+        echo "SUB_TAG=$subTag" >> $GITHUB_ENV
+
+    - name: Download prebuilt binaries
+      run: |
+        mkdir -p workspace/target/
+        cd workspace/target/
+        wget -q "https://github.com/adoptium/temurin${{ env.MAJOR_VERSION }}-binaries/releases/download/${{ env.TAG }}/OpenJDK${{ env.MAJOR_VERSION }}U-jdk_${{ matrix.architecture }}_mac_hotspot_${{ env.SUB_TAG }}.tar.gz"
+
+    - name: Create Package
+      run: |
+        export WORKSPACE=$PWD
+        bash pkgbuild/create-installer-mac.sh
+
+    - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+      with:
+        name: macos-${{ env.MAJOR_VERSION }}-${{ matrix.architecture }}
+        path: workspace/target/*.pkg

.github/workflows/semgrep_diff.yml

@@ -15,6 +15,10 @@ name: Semgrep Differential Scan
 on:
   pull_request:
 
+permissions:
+  contents: read
+  statuses: write
+
 jobs:
   semgrep-diff:
     uses: adoptium/.github/.github/workflows/semgrep_diff.yml@main