CI: Bump allow-list pin and quieten repeat summaries

[ModeSevenIndustrialSolutions]

CI: Bump allow-list pin and quieten repeat summaries

Two pieces of workflow housekeeping, applied identically across the
*-workflows estate.

1. Allow-list pin → v0.16.1

Repoints the shared lfreleng-actions/.github allow-list at
ec0736244fc776e326283c6af6840e30f316f63c (v0.16.1), up from v0.16.0.

Both forms that carry the reference move together:

Form	Where
allow_list.txt@<sha>	the harden_runner_allowlist input default
config: '@<sha>'	workflows that take no such input (release-drafter.yaml)

2. One allow-list summary per workflow

Every job loads the allow-list, and each invocation wrote the same static
block to the job summary — once per job rather than once per run.

The action already exposes allow_list_summary for exactly this, so this
is configuration rather than a change to it. Suppressed everywhere except
the first invocation in each file.

invocations=11  emitting=3  (one per workflow file)

Both gradle-build-test.yaml and maven-build-test.yaml go from 5
blocks to 1.

Scope note: once per workflow, not once per run

These are workflow_call reusable workflows, so they cannot see beyond
themselves. A caller invoking several still receives one block from each.
That is as far as a reusable workflow can enforce on its own behalf — a
large reduction on one per job, but not literally one per run, so worth
stating rather than implying.

Validation

actionlint clean on every workflow; zizmor reports no findings; all
prek hooks pass; aislop ci --changes --base upstream/main → 0 errors,
0 warnings. Verified that no stale allow-list SHA remains and that
exactly one invocation per file still emits.

[Copilot]

🟢 Approval recommended

The pin is valid, all references are consistent, and each workflow retains exactly one summary emitter.

Pull request overview

Updates CI workflow hardening configuration and reduces duplicate allow-list summaries.

Changes:

• Pins the shared allow-list to v0.16.1.
• Suppresses summaries after each workflow’s first invocation.

File summaries

File	Description
.github/workflows/release-drafter.yaml	Updates the allow-list pin.
.github/workflows/maven-build-test.yaml	Updates the pin and suppresses repeated summaries.
.github/workflows/gradle-build-test.yaml	Updates the pin and suppresses repeated summaries.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[zxiiro]

🤖 Auto-approved by agent: code-reviewed low risk. Allow-list pin v0.16.0→v0.16.1 plus allow_list_summary:false on harden-runner-block; no permission/secret/trigger changes.