Enhance CI/CD workflows

.github/dependabot.yml

@@ -9,3 +9,7 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/Continuous.yml

@@ -8,34 +8,66 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
+concurrency:
+  group: continuous-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
-  ubuntu-latest:
-    name: ubuntu-latest
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
+  verify:
+    name: Verify
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - name: Set up JDK 21
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           java-version: '21'
-          distribution: 'temurin'
+          distribution: temurin
           cache: maven
       - name: Run the Maven verify phase
-        run: mvn verify jacoco:report -e --update-snapshots --no-transfer-progress
-        env:
-          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
+        run: mvn --batch-mode --no-transfer-progress verify jacoco:report -Dgpg.skip=true
       - name: Report Coveralls
-        uses: coverallsapp/github-action@v2
-      - run: mkdir staging && cp target/*.jar staging
-      - uses: actions/upload-artifact@v4
+        uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2.3.8
+      - name: Stage package artifacts
+        run: mkdir staging && cp target/*.jar staging/
+      - name: Upload package artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: Package
-          path: staging
+          name: java-tool-package
+          path: staging/*.jar
+          if-no-files-found: error
+
+  publish-github-packages:
+    name: Publish to GitHub Packages
+    if: github.repository == 'dendrodocs/java-tool' && github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: verify
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - name: Set up JDK 21 and GitHub Packages credentials
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        with:
+          java-version: '21'
+          distribution: temurin
+          server-id: github
+          server-username: GITHUB_ACTOR
+          server-password: GITHUB_TOKEN
       - name: Publish package
-        if: "${{ github.head_ref == '' }}"
-        run: mvn deploy -Dmaven.install.skip=true --no-transfer-progress
+        run: mvn --batch-mode --no-transfer-progress deploy -Dmaven.install.skip=true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_ACTOR: ${{ github.actor }}

.github/workflows/Release.yml

@@ -1,27 +1,45 @@
 name: Publish package to the Maven Central Repository
+
 on:
   release:
     types: [created]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.event.release.tag_name }}
+  cancel-in-progress: false
+
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    if: github.repository == 'dendrodocs/java-tool'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - name: Set up Maven Central Repository
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           java-version: '21'
-          distribution: 'temurin'
-          server-id: 'central'
+          distribution: temurin
+          server-id: central
           server-username: MAVEN_USERNAME
           server-password: MAVEN_PASSWORD
           gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
       - name: Update version in pom.xml
-        run: mvn versions:set -DnewVersion=${{ github.event.release.tag_name }} -DgenerateBackupPoms=false
+        run: mvn --batch-mode --no-transfer-progress versions:set "-DnewVersion=$RELEASE_TAG" -DgenerateBackupPoms=false
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
       - name: Publish package
-        run: mvn deploy -P publish -Dmaven.install.skip=true --no-transfer-progress
+        run: mvn --batch-mode --no-transfer-progress deploy -P publish -Dmaven.install.skip=true
         env:
           MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
           MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_GPG_PASSPHRASE : ${{ secrets.MAVEN_GPG_PASSPHRASE }}
+          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}