Watch the release lines only

main is the old line and gets nothing new, so the workflows stop
watching it: CI, CodeQL, the dependency graph, the SHA-pinning and
zizmor checks run on '*.X.X' alone. dependabot names 21.X.X outright
instead of following the default branch, and moves when the next line
starts.

Author: abashev

.github/dependabot.yml

@@ -2,19 +2,20 @@ version: 2
 # A release is proposed only once it is a week old: a compromised or broken release is usually pulled
 # within days. The cooldown holds back version updates only; security updates still come at once.
 #
-# No target-branch: the pull requests go to the default branch, which is the current release line,
-# 21.X.X today.
+# target-branch names the current release line; it moves when the next line starts.
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    target-branch: "21.X.X"
     cooldown:
       default-days: 7
 
   - package-ecosystem: "gradle"
     directory: "/"
     schedule:
       interval: "weekly"
+    target-branch: "21.X.X"
     cooldown:
       default-days: 7

.github/workflows/ci.yml

@@ -3,7 +3,6 @@ name: CI
 on:
   push:
     branches:
-      - main
       - '*.X.X' # a release line is named after the Java version it is built for: 21.X.X
   pull_request:
 

.github/workflows/codeql-analysis.yml

@@ -2,9 +2,9 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ 'main', '*.X.X' ]
+    branches: [ '*.X.X' ]
   pull_request:
-    branches: [ 'main', '*.X.X' ]
+    branches: [ '*.X.X' ]
   schedule:
     - cron: '33 9 * * 6'
 

.github/workflows/dependency-submission.yml

@@ -2,7 +2,7 @@ name: Submit dependency graph
 
 on:
   push:
-    branches: [ 'main', '*.X.X' ]
+    branches: [ '*.X.X' ]
 
 permissions:
   contents: write

.github/workflows/sha-pinning-check.yml

@@ -2,9 +2,9 @@ name: Ensure SHA-pinned actions
 
 on:
   pull_request:
-    branches: [ 'main', '*.X.X' ]
+    branches: [ '*.X.X' ]
   push:
-    branches: [ 'main', '*.X.X' ]
+    branches: [ '*.X.X' ]
 
 permissions:
   contents: read

.github/workflows/zizmor.yml

@@ -2,7 +2,7 @@ name: GitHub Actions Security Analysis with zizmor 🌈
 
 on:
   push:
-    branches: ["main", "*.X.X"]
+    branches: ["*.X.X"]
   pull_request:
     branches: ["**"]