Merge pull request #11084 from chainguardian/cve-pulumi-language-java-G…

…HSA-9763-4f94-gfch

GHSA-9763-4f94-gfch: fix CVE for Wolfi package pulumi-language-java

pulumi-language-java.yaml

@@ -1,7 +1,7 @@
 package:
   name: pulumi-language-java
   version: 0.9.9
-  epoch: 1
+  epoch: 2
   description: Pulumi Language SDK for Java
   copyright:
     - license: Apache-2.0
@@ -17,21 +17,21 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
+      expected-commit: e40b98d061194998c2ade7a7ec4b726e0f0c2af6
       repository: https://github.com/pulumi/pulumi-java.git
       tag: v${{package.version}}
-      expected-commit: e40b98d061194998c2ade7a7ec4b726e0f0c2af6
 
   - uses: go/bump
     with:
-      deps: golang.org/x/[email protected] github.com/go-git/go-git/[email protected]
+      deps: golang.org/x/[email protected] github.com/go-git/go-git/[email protected] github.com/cloudflare/[email protected]
       modroot: pkg
 
   - uses: go/build
     with:
+      ldflags: -s -w -X github.com/pulumi/pulumi-java/pkg/version.Version=v${{package.version}}
       modroot: pkg
-      packages: ./cmd/pulumi-language-java
       output: pulumi-language-java
-      ldflags: -s -w -X github.com/pulumi/pulumi-java/pkg/version.Version=v${{package.version}}
+      packages: ./cmd/pulumi-language-java
 
   - uses: strip