ci: bootstrap CI + activate build matrix, OWASP and SBOM workflows (NOVA-SEMVER-19/20/21)

.github/workflows/ci.yml

@@ -0,0 +1,40 @@
+name: CI/CD Pipeline
+
+on:
+  pull_request:
+    branches:
+      - main
+    types:
+      - opened
+      - synchronize
+      - reopened
+  push:
+    branches:
+      - main
+
+jobs:
+  build:
+    if: github.event_name == 'pull_request'
+    uses: ahincho/nova-devops/.github/workflows/reusable-build-maven.yml@main
+    secrets: inherit
+
+  matrix:
+    if: github.event_name == 'pull_request'
+    uses: ahincho/nova-devops/.github/workflows/reusable-build-matrix.yml@main
+    with:
+      build-tool: maven
+    secrets: inherit
+
+  owasp:
+    if: github.event_name == 'pull_request'
+    uses: ahincho/nova-devops/.github/workflows/reusable-owasp-check.yml@main
+    with:
+      build-tool: maven
+    secrets: inherit
+
+  sbom:
+    if: github.event_name == 'pull_request'
+    uses: ahincho/nova-devops/.github/workflows/reusable-sbom.yml@main
+    with:
+      build-tool: maven
+    secrets: inherit

pom.xml

@@ -19,14 +19,32 @@
         <maven.compiler.target>${java.version}</maven.compiler.target>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <!-- Nova Platform -->
-        <nova-bom.version>0.1.0-SNAPSHOT</nova-bom.version>
-        <nova-starter.version>0.1.0-SNAPSHOT</nova-starter.version>
+        <nova-bom.version>1.0.0</nova-bom.version>
+        <nova-starter.version>1.0.1</nova-starter.version>
         <!-- Plugins -->
         <maven-compiler-plugin.version>3.14.0</maven-compiler-plugin.version>
         <maven-surefire-plugin.version>3.5.3</maven-surefire-plugin.version>
         <spring-boot-maven-plugin.version>4.0.5</spring-boot-maven-plugin.version>
     </properties>
 
+    <!-- Repositorios de lectura — GitHub Packages de otros repos Nova.
+         Requiere credenciales (GitHub Packages exige auth incluso en repos
+         publicos); ver settings.xml generado por nova-setup-java (server ids
+         "nova-packages-read-bom" / "nova-packages-read-starter", token
+         NOVA_PACKAGES_READ_TOKEN). Maven exige id unico por repository, por
+         eso son 2 ids distintos aunque compartan las mismas credenciales.
+         Heredado por todos los proyectos hijos que usen este parent. -->
+    <repositories>
+        <repository>
+            <id>nova-packages-read-bom</id>
+            <url>https://maven.pkg.github.com/ahincho/nova-bom</url>
+        </repository>
+        <repository>
+            <id>nova-packages-read-starter</id>
+            <url>https://maven.pkg.github.com/ahincho/nova-java-spring-boot-starter</url>
+        </repository>
+    </repositories>
+
     <!-- Gestión de dependencias — importa el BOM -->
     <dependencyManagement>
         <dependencies>
@@ -93,7 +111,7 @@
     <distributionManagement>
         <repository>
             <id>github</id>
-            <url>https://maven.pkg.github.com/OWNER/nova-spring-boot-parent</url>
+            <url>https://maven.pkg.github.com/ahincho/nova-java-spring-boot-parent</url>
         </repository>
     </distributionManagement>