chore(ci): adopt shared workflows and central Renovate preset

.github/workflows/build-pr.yml

@@ -1,22 +1,19 @@
-name: Build Pull Request
-on: [pull_request]
+name: Build PR
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  checks: write
+  pull-requests: write
+
 jobs:
-  build_pr:
-    name: Check PR if can build
-    if: github.repository_owner == 'OneLiteFeatherNET'
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v7
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
-      - name: Setup Java
-        uses: actions/setup-java@v5
-        with:
-          distribution: temurin
-          java-version: 21
-      - name: Build on ${{ matrix.os }}
-        run: ./gradlew clean build
+  build:
+    # Shared org build: Temurin toolchain, 3-OS matrix, tests and coverage.
+    uses: OneLiteFeatherNET/workflows/.github/workflows/gradle-build-pr.yml@v2.8.1
+    with:
+      java-version: "21"
+      java-distribution: "temurin"
+      run-tests: false
+    secrets: inherit

.github/workflows/close_invalid_prs.yml

@@ -1,14 +1,10 @@
-name: Close invalid Pull Requests
+name: Close invalid PRs
 
 on:
   pull_request_target:
-    types: [ opened ]
+    types: [opened]
 
 jobs:
-  run:
-    if: ${{ github.repository != github.event.pull_request.head.repo.full_name && github.head_ref == 'main' }}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: superbrothers/close-pull-request@v3
-        with:
-          comment: "Please do not open pull requests from the `main` branch, create a new branch instead."
+  close:
+    uses: OneLiteFeatherNET/workflows/.github/workflows/close-invalid-prs.yml@v2.8.1
+    secrets: inherit

.github/workflows/security.yml

@@ -0,0 +1,55 @@
+name: Security
+
+# Trivy vulnerability gate plus a CycloneDX SBOM of the repository. Self-contained
+# on purpose: it needs no build tool and no registry credentials, so it is the
+# baseline security gate for every repository regardless of language.
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "37 3 * * 1"
+  workflow_dispatch:
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  trivy:
+    name: Trivy scan
+    uses: OneLiteFeatherNET/workflows/.github/workflows/security-scan.yml@v2.8.1
+    with:
+      scan-type: "fs"
+      scanners: "vuln,secret"
+      severity: "CRITICAL,HIGH"
+      # Report-only for now, so adopting this does not turn CI red on day one.
+      fail-on-findings: false
+      upload-sarif: true
+    secrets: inherit
+
+  sbom:
+    name: CycloneDX SBOM
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Generate SBOM
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: cyclonedx
+          output: bom.json
+          # An SBOM is an inventory, not a finding list - never fail on it.
+          exit-code: '0'
+
+      - name: Upload SBOM
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom-cyclonedx
+          path: bom.json
+          if-no-files-found: error
+          retention-days: 90

renovate.json

@@ -1,7 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "github>OneLiteFeatherNET/renovate:default(OneLiteFeatherNET/attollo-maintainers)",
-    "github>OneLiteFeatherNET/renovate:paper"
+    "github>OneLiteFeatherNET/renovate:default(OneLiteFeatherNET/attollo-maintainers)"
   ]
 }