ci: standard v3 (action upgrades + cache-provider external)

.github/workflows/build.yml

@@ -2,7 +2,7 @@ name: Build
 
 on:
   push:
-    branches: [main]
+  pull_request:
   workflow_dispatch:
     inputs:
       module-ref:
@@ -34,25 +34,25 @@ env:
 
 jobs:
   build:
+    if: github.event_name != 'push' || github.ref_name == github.event.repository.default_branch
     runs-on: ubuntu-latest
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ inputs.module-ref || github.sha }}
           fetch-depth: 0 # the package version is derived from git history
           filter: blob:none
 
-      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6
+      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad
         with:
           distribution: zulu
           java-version: '25'
           cache-jdk: true
 
-      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb
+      - uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c
         with:
-          cache-provider: basic
-        cache-disabled: "${{ github.server_url != 'https://github.com' }}"
+          cache-provider: "${{ github.server_url == 'https://github.com' && 'basic' || 'external' }}"
 
       - name: Build
         env:
@@ -72,22 +72,21 @@ jobs:
       MAVEN_USER: ${{ secrets.MAVEN_USER }}
       MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
     steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: ${{ inputs.module-ref || github.sha }}
           fetch-depth: 0 # the package version is derived from git history
           filter: blob:none
 
-      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6
+      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad
         with:
           distribution: zulu
           java-version: '25'
           cache-jdk: true
 
-      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb
+      - uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c
         with:
-          cache-provider: basic
-        cache-disabled: "${{ github.server_url != 'https://github.com' }}"
+          cache-provider: "${{ github.server_url == 'https://github.com' && 'basic' || 'external' }}"
 
       - name: Check the publish credentials
         run: |