ci: consolidate GitHub workflows, add CodeQL and dependency report

Merge the three separate JDK/OS build workflows into a single ci.yml
with a build matrix (ubuntu/windows x JDK 17/21) plus a deploy job,
add concurrency cancellation and fork-safe guards, and bring in
CodeQL and a weekly dependency-report workflow, mirroring the setup
already used in ucanaccess and jackcess.

Author: spannm

.github/workflows/ci.yml

@@ -0,0 +1,68 @@
+name: Build & Deploy
+
+on:
+    push:
+        branches:
+        - master
+    pull_request:
+        branches:
+        - master
+    workflow_dispatch: {}
+
+# cancel superseded runs on the same branch/PR to save CI minutes.
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
+
+permissions:
+    contents: read
+
+jobs:
+
+    build:
+        strategy:
+            fail-fast: false
+            matrix:
+                os: [ubuntu-latest, windows-latest]
+                java: ['17', '21']
+        runs-on: ${{ matrix.os }}
+        steps:
+        -   uses: actions/checkout@v7
+
+        -   name: Set up JDK ${{ matrix.java }}
+            uses: actions/setup-java@v6
+            with:
+                java-version: ${{ matrix.java }}
+                distribution: temurin
+                cache: maven
+
+        -   name: Build with Maven/JDK ${{ matrix.java }} on ${{ matrix.os }}
+            run: mvn --batch-mode --file pom.xml clean verify
+
+    deploy:
+        needs: build
+        # skip the deploy job for contributors/forks who lack the required secrets
+        if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            packages: write
+        steps:
+        -   uses: actions/checkout@v7
+        -   name: Set up Java for deployment to Sonatype snapshot repo
+            uses: actions/setup-java@v6
+            with:
+                java-version: '17'
+                distribution: 'temurin'
+                cache: maven
+                # Sonatype Central Snapshots
+                # must match distributionManagement/snapshotRepository/id in pom:
+                server-id: central
+                server-username: SONATYPE_CENTRAL_USERNAME
+                server-password: SONATYPE_CENTRAL_PASSWORD
+
+        -   name: Deploy to Sonatype Central snapshot repo
+            run: mvn --batch-mode --file pom.xml deploy
+            env:
+                SONATYPE_CENTRAL_USERNAME: ${{ secrets.SONATYPE_CENTRAL_USERNAME }}
+                SONATYPE_CENTRAL_PASSWORD: ${{ secrets.SONATYPE_CENTRAL_PASSWORD }}

.github/workflows/ci_jdk17_ubuntu.yml

@@ -0,0 +1,59 @@
+name: CodeQL
+
+on:
+    push:
+        branches:
+        - master
+    pull_request:
+        branches:
+        - master
+    schedule:
+    -   cron: '30 3 * * 1'
+    workflow_dispatch: {}
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
+
+permissions:
+    contents: read
+
+jobs:
+
+    analyze:
+        name: Analyze (java-kotlin)
+        runs-on: ubuntu-latest
+        permissions:
+            actions: read
+            contents: read
+            security-events: write
+
+        steps:
+        -   uses: actions/checkout@v7
+
+        -   name: Set up JDK 17
+            uses: actions/setup-java@v6
+            with:
+                java-version: '17'
+                distribution: 'temurin'
+                cache: maven
+
+        -   name: Initialize CodeQL
+            uses: github/codeql-action/init@v4
+            with:
+                languages: java-kotlin
+                build-mode: manual
+
+        # Skip checkstyle/tests here: this build only needs to produce compiled
+        # classes for CodeQL to analyze, not to enforce project lint rules.
+        -   name: Build for CodeQL analysis
+            run: >
+                mvn --batch-mode --file pom.xml
+                -Dcheckstyle.skip=true
+                -Dmaven.test.skip=true
+                clean compile
+
+        -   name: Perform CodeQL Analysis
+            uses: github/codeql-action/analyze@v4
+            with:
+                category: "/language:java-kotlin"

.github/workflows/ci_jdk17_win.yml

@@ -0,0 +1,35 @@
+name: Dependency Report
+
+on:
+    schedule:
+    -   cron: '0 6 * * 1'
+    workflow_dispatch: {}
+
+permissions:
+    contents: read
+
+jobs:
+
+    report:
+        runs-on: ubuntu-latest
+        steps:
+        -   uses: actions/checkout@v7
+
+        -   name: Set up JDK 17
+            uses: actions/setup-java@v6
+            with:
+                java-version: '17'
+                distribution: 'temurin'
+                cache: maven
+
+        # Report-only: versions-maven-plugin never fails the build, it only prints
+        # what's outdated. No pull requests, no issues - just a workflow summary.
+        -   name: Report outdated dependencies & plugins
+            run: |
+                {
+                    echo "## Outdated dependencies & plugins"
+                    echo
+                    echo '```text'
+                    mvn --batch-mode --file pom.xml versions:display-dependency-updates versions:display-plugin-updates
+                    echo '```'
+                } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/ci_jdk21_ubuntu.yml

@@ -0,0 +1,55 @@
+name: SonarCloud analysis with JDK 21 on Ubuntu
+
+on:
+    push:
+        branches:
+        - master
+    pull_request:
+        branches:
+        - master
+    workflow_dispatch: {}
+
+# cancel superseded runs on the same branch/PR to save CI minutes.
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
+
+permissions:
+    contents: read
+
+jobs:
+
+    build:
+        runs-on: ubuntu-latest
+        # skip the analysis job for contributors/forks who lack the required sonar token
+        if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
+        steps:
+        -   uses: actions/checkout@v7
+            with:
+                # disabling shallow clone is recommended for improving relevancy of reporting
+                fetch-depth: 0
+
+        -   name: Set up JDK 21
+            uses: actions/setup-java@v6
+            with:
+                java-version: '21'
+                distribution: zulu
+                cache: maven
+
+        -   name: Cache SonarQube packages
+            uses: actions/cache@v4
+            with:
+                path: ~/.sonar/cache
+                key: ${{ runner.os }}-sonar
+                restore-keys: ${{ runner.os }}-sonar
+
+        -   name: Build with Maven/JDK 21, test with SonarCloud
+            env:
+                GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+            run: >
+                mvn --batch-mode --file pom.xml verify
+                org.sonarsource.scanner.maven:sonar-maven-plugin:5.5.0.6356:sonar
+                -Dsonar.organization=speedbankingde
+                -Dsonar.projectKey=SpeedBankingDe_iban-commons
+                -Dsonar.host.url=https://sonarcloud.io