Use workflows of https://github.com/cap-java/.github

[lisajulia]

No description provided.

[lisajulia]

@markusbucher: Can you have a look at this? Thanks!

[markusbucher]

The overall direction is good — centralizing CI actions, pinning SHAs, adding least-privilege permissions: blocks, and adding security scans to PRs are all the right moves. A few issues need to be resolved before this is safe to merge.

[markusbucher]

Review done, some corrections of AI assumptions were needed. Findings seem to be accurate now

[markusbucher]

Thanks for addressing all the previous comments. I've verified the updated PR against the actual shared action definitions in cap-java/.github at the pinned SHA — here is my re-review.

All previous findings resolved ✅

• gpg-* input names — confirmed correct. The shared deploy-release action uses gpg-pub-key, gpg-private-key, gpg-passphrase exactly as called here.
• rapid_compare_mode: BOM_COMPARE + scan_mode: RAPID on PRs — confirmed correct and intentional. The shared BlackDuck action's documentation explicitly recommends this combination for PR scans.
• upload-artifact #v7 — SHA 043fb46d... resolves to v7.0.1 ✓ (was #v6 before, now fixed)
• build and deploy jobs missing permissions: — both now have contents: read ✓
• deploy-snapshot unpinned actions — now pinned ✓
• continue-on-error: true on CodeQL — removed ✓

One remaining minor observation

deploy-snapshot job in main-build.yml has no permissions: block (unlike every other updated job).

All other jobs across all three workflow files now have explicit permissions: blocks, but deploy-snapshot does not. It will inherit the workflow-level default (contents: read is set at workflow level in main-build.yml, so it is not a security risk — just inconsistent). A permissions: contents: read block here would make the pattern uniform.

Overall

The implementation is clean and correct. The consolidation to shared actions, SHA pinning, and least-privilege permissions are all well done. The minor deploy-snapshot inconsistency is the only thing left — feel free to fix or leave it, it does not block merging.

[markusbucher]

LGTM, thank you