Run CI on the release-line branches

The default branch is 21.X.X now, and a release line is named after the
Java version it is built for, so the workflows that watched main alone
also take '*.X.X': CI, CodeQL, the dependency graph, the SHA-pinning and
zizmor checks. The PR updater follows 21.X.X, the base of every pull
request, and dependabot loses its target-branch so that it opens its
pull requests against the default branch, whichever line that is.

Releases need nothing: release.yml runs on a tag, and JReleaser never
compares the branch.

Author: abashev

.github/dependabot.yml

@@ -1,19 +1,20 @@
 version: 2
 # A release is proposed only once it is a week old: a compromised or broken release is usually pulled
 # within days. The cooldown holds back version updates only; security updates still come at once.
+#
+# No target-branch: the pull requests go to the default branch, which is the current release line,
+# 21.X.X today.
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
-    target-branch: "main"
     cooldown:
       default-days: 7
 
   - package-ecosystem: "gradle"
     directory: "/"
     schedule:
       interval: "weekly"
-    target-branch: "main"
     cooldown:
       default-days: 7

.github/workflows/ci.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+      - '*.X.X' # a release line is named after the Java version it is built for: 21.X.X
   pull_request:
 
 permissions:
@@ -48,7 +49,7 @@ jobs:
   # jobs and nothing they build is kept. The code is still compiled for Java 21 by JDK 21, as in the
   # release; -PjavaRuntime moves only the test JVMs, and with them the javac whose internals the
   # formatter parses with. The IntelliJ plugin's tests stay on the runtime of the IDE they start.
-  # JDK 21 itself is `build`, the check the main branch requires.
+  # JDK 21 itself is `build`, the check the default branch requires.
   jdk:
     name: build (JDK ${{ matrix.jdk }})
     runs-on: ubuntu-latest

.github/workflows/codeql-analysis.yml

@@ -2,9 +2,9 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ 'main' ]
+    branches: [ 'main', '*.X.X' ]
   pull_request:
-    branches: [ 'main' ]
+    branches: [ 'main', '*.X.X' ]
   schedule:
     - cron: '33 9 * * 6'
 

.github/workflows/dependency-submission.yml

@@ -2,7 +2,7 @@ name: Submit dependency graph
 
 on:
   push:
-    branches: [ 'main' ]
+    branches: [ 'main', '*.X.X' ]
 
 permissions:
   contents: write

.github/workflows/sha-pinning-check.yml

@@ -2,9 +2,9 @@ name: Ensure SHA-pinned actions
 
 on:
   pull_request:
-    branches: [ 'main' ]
+    branches: [ 'main', '*.X.X' ]
   push:
-    branches: [ 'main' ]
+    branches: [ 'main', '*.X.X' ]
 
 permissions:
   contents: read

.github/workflows/update-pr-branch.yml

@@ -2,7 +2,7 @@ name: Update PR branches
 
 on:
   push:
-    branches: [ 'main' ]
+    branches: [ '21.X.X' ] # the default branch, the base of every pull request
   schedule:
     # Run every hour to catch stuck PRs
     - cron: '0 * * * *'
@@ -18,6 +18,6 @@ jobs:
       - uses: adRise/update-pr-branch@e96e796f4ab23ab388016fdaed7092de99bd71cf # v0.11.1
         with:
           token: ${{ secrets.BOT_PAT }}
-          base: 'main'
+          base: '21.X.X'
           required_approval_count: 1
           require_passed_checks: true

.github/workflows/zizmor.yml

@@ -2,7 +2,7 @@ name: GitHub Actions Security Analysis with zizmor 🌈
 
 on:
   push:
-    branches: ["main"]
+    branches: ["main", "*.X.X"]
   pull_request:
     branches: ["**"]