chore(ci): adopt shared workflows and central Renovate preset

.github/workflows/build-pr.yml

@@ -0,0 +1,19 @@
+name: Build PR
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  checks: write
+  pull-requests: write
+
+jobs:
+  build:
+    # Shared org build: Temurin toolchain, 3-OS matrix, tests and coverage.
+    uses: OneLiteFeatherNET/workflows/.github/workflows/gradle-build-pr.yml@v2.8.1
+    with:
+      java-version: "25"
+      java-distribution: "temurin"
+      run-tests: true
+    secrets: inherit

.github/workflows/close_invalid_prs.yml

@@ -0,0 +1,10 @@
+name: Close invalid PRs
+
+on:
+  pull_request_target:
+    types: [opened]
+
+jobs:
+  close:
+    uses: OneLiteFeatherNET/workflows/.github/workflows/close-invalid-prs.yml@v2.8.1
+    secrets: inherit

.github/workflows/pr-lint.yml

@@ -0,0 +1,17 @@
+name: PR Lint
+
+# Conventional Commits on the PR title and every commit on the branch.
+# release-please parses those commit types to decide the version bump and to
+# build the changelog - a non-conventional commit silently produces neither.
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  lint:
+    uses: OneLiteFeatherNET/workflows/.github/workflows/pr-lint.yml@v2.8.1
+    secrets: inherit

.github/workflows/release-please.yml

@@ -0,0 +1,84 @@
+name: Release
+
+# release-please collects Conventional Commits into a release PR; merging it
+# tags the version and cuts the GitHub release. Everything that has to happen
+# for a release is chained into this same run on purpose: release-please tags
+# with GITHUB_TOKEN, and a tag pushed that way does NOT start a separate
+# `on: push: tags` workflow.
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    uses: OneLiteFeatherNET/workflows/.github/workflows/release-please.yml@v2.8.1
+    secrets: inherit
+
+  publish:
+    name: Attach the server JAR to the release
+    needs: release-please
+    if: needs.release-please.outputs.release_created == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    env:
+      ONELITEFEATHER_MAVEN_USERNAME: ${{ secrets.ONELITEFEATHER_MAVEN_USERNAME }}
+      ONELITEFEATHER_MAVEN_PASSWORD: ${{ secrets.ONELITEFEATHER_MAVEN_PASSWORD }}
+    steps:
+      - name: Checkout the released tag
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.release-please.outputs.tag_name }}
+
+      - name: Set up JDK
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 25
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v6
+
+      # semantic-release built this in its prepareCmd; release-please already
+      # wrote the version into gradle.properties via extra-files, so the build
+      # picks it up without a sed.
+      - name: Build the shadow JAR
+        run: ./gradlew :server:shadowJar
+
+      - name: Attach it to the release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ needs.release-please.outputs.tag_name }}
+        run: gh release upload "$TAG" server/build/libs/*.jar --clobber
+  sbom:
+    name: Attach SBOM to release
+    needs: release-please
+    if: needs.release-please.outputs.release_created == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.release-please.outputs.tag_name }}
+
+      - name: Generate CycloneDX SBOM
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: cyclonedx
+          output: bom.json
+          # An SBOM is an inventory, not a finding list - never fail on it.
+          exit-code: '0'
+
+      - name: Attach SBOM to the release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ needs.release-please.outputs.tag_name }}
+        run: gh release upload "$TAG" bom.json --clobber

.github/workflows/security.yml

@@ -0,0 +1,55 @@
+name: Security
+
+# Trivy vulnerability gate plus a CycloneDX SBOM of the repository. Self-contained
+# on purpose: it needs no build tool and no registry credentials, so it is the
+# baseline security gate for every repository regardless of language.
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "14 4 * * 1"
+  workflow_dispatch:
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  trivy:
+    name: Trivy scan
+    uses: OneLiteFeatherNET/workflows/.github/workflows/security-scan.yml@v2.8.1
+    with:
+      scan-type: "fs"
+      scanners: "vuln,secret"
+      severity: "CRITICAL,HIGH"
+      # Report-only for now, so adopting this does not turn CI red on day one.
+      fail-on-findings: false
+      upload-sarif: true
+    secrets: inherit
+
+  sbom:
+    name: CycloneDX SBOM
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Generate SBOM
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: cyclonedx
+          output: bom.json
+          # An SBOM is an inventory, not a finding list - never fail on it.
+          exit-code: '0'
+
+      - name: Upload SBOM
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom-cyclonedx
+          path: bom.json
+          if-no-files-found: error
+          retention-days: 90

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.8.8"
+}

build.gradle.kts

@@ -2,6 +2,8 @@ plugins {
     id("java")
 }
 
+version = "1.8.8" // x-release-please-version
+
 group = "net.onelitefeather"
 // version is managed by semantic-release via gradle.properties
 
@@ -27,3 +29,9 @@ subprojects {
         }
     }
 }
+
+// gradle.properties used to carry the version, which Gradle applies to every
+// project in the build. The version now lives above, so pass it down explicitly.
+allprojects {
+    version = rootProject.version
+}

commitlint.config.mjs

@@ -0,0 +1,3 @@
+export default {
+  extends: ['@commitlint/config-conventional'],
+};

gradle.properties

@@ -1,2 +1 @@
 org.gradle.welcome=never
-version=1.8.8