ci: consolidate CI matrix, fix workflow_dispatch, add CodeQL and dependency report

- Merge the four per-JDK CI workflows into one matrix build
  (ubuntu-latest/windows-latest x JDK 11/17/21) for full OS/JDK parity
- Align all CI jobs on `clean verify` so integration tests run
  consistently across JDK versions.
- Remove the invalid `branches` filter under `workflow_dispatch` in the
  Sonar workflow (that key only applies to push/pull_request triggers).
- Add 'concurrency' (cancel superseded runs) and least-privilege
  `permissions: contents: read` to all workflows.
- Bump actions/checkout and actions/setup-java to their current major
  versions (v7/v6).
- Add scheduled CodeQL analysis and a dependency/plugin update report,
  mirroring the setup already in use in the figlet project.

Author: spannm

.github/workflows/ci_jdk11_ubuntu.yml .github/workflows/ci.yml.github/workflows/ci_jdk11_ubuntu.yml renamed to .github/workflows/ci.yml

@@ -1,4 +1,4 @@
-name: Build with JDK 11 on Ubuntu
+name: Build & Deploy
 
 on:
     push:
@@ -7,23 +7,37 @@ on:
     pull_request:
         branches:
         - master
-    workflow_dispatch:
+    workflow_dispatch: {}
+
+# cancel superseded runs on the same branch/PR to save CI minutes.
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
+
+permissions:
+    contents: read
 
 jobs:
+
     build:
-        runs-on: ubuntu-latest
+        strategy:
+            fail-fast: false
+            matrix:
+                os: [ubuntu-latest, windows-latest]
+                java: ['11', '17', '21']
+        runs-on: ${{ matrix.os }}
         steps:
-        -   uses: actions/checkout@v4
+        -   uses: actions/checkout@v7
 
-        -   name: Set up JDK 11
-            uses: actions/setup-java@v3
+        -   name: Set up JDK ${{ matrix.java }}
+            uses: actions/setup-java@v6
             with:
-                java-version: '11'
+                java-version: ${{ matrix.java }}
                 distribution: temurin
                 cache: maven
 
-        -   name: Build with Maven/JDK 11
-            run: mvn --batch-mode --file pom.xml clean package
+        -   name: Build with Maven/JDK ${{ matrix.java }} on ${{ matrix.os }}
+            run: mvn --batch-mode --file pom.xml clean verify
 
     deploy:
         needs: build
@@ -34,12 +48,12 @@ jobs:
             contents: read
             packages: write
         steps:
-        -   uses: actions/checkout@v4
+        -   uses: actions/checkout@v7
         -   name: Set up Java for deployment to Sonatype snapshot repo
-            uses: actions/setup-java@v3
+            uses: actions/setup-java@v6
             with:
                 java-version: '11'
-                distribution: temurin
+                distribution: 'temurin'
                 cache: maven
                 # Sonatype Central Snapshots
                 # must match distributionManagement/snapshotRepository/id in pom:

.github/workflows/ci_jdk11_win.yml

@@ -0,0 +1,60 @@
+name: CodeQL
+
+on:
+    push:
+        branches:
+        - master
+    pull_request:
+        branches:
+        - master
+    schedule:
+    -   cron: '30 3 * * 1'
+    workflow_dispatch: {}
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
+
+permissions:
+    contents: read
+
+jobs:
+
+    analyze:
+        name: Analyze (java-kotlin)
+        runs-on: ubuntu-latest
+        permissions:
+            actions: read
+            contents: read
+            security-events: write
+
+        steps:
+        -   uses: actions/checkout@v7
+
+        -   name: Set up JDK 17
+            uses: actions/setup-java@v6
+            with:
+                java-version: '17'
+                distribution: 'temurin'
+                cache: maven
+
+        -   name: Initialize CodeQL
+            uses: github/codeql-action/init@v4
+            with:
+                languages: java-kotlin
+                build-mode: manual
+
+        # Skip checkstyle/tests here: this build only needs to produce compiled
+        # classes for CodeQL to analyze, not to enforce project lint rules.
+        -   name: Build for CodeQL analysis
+            run: >
+                mvn --batch-mode --file pom.xml
+                -Dcheckstyle.skip=true
+                -Dmaven.test.skip=true
+                clean compile
+
+        -   name: Perform CodeQL Analysis
+            uses: github/codeql-action/analyze@v4
+            with:
+                category: "/language:java-kotlin"
+

.github/workflows/ci_jdk17_ubuntu.yml

@@ -0,0 +1,36 @@
+name: Dependency Report
+
+on:
+    schedule:
+    -   cron: '0 6 * * 1'
+    workflow_dispatch: {}
+
+permissions:
+    contents: read
+
+jobs:
+
+    report:
+        runs-on: ubuntu-latest
+        steps:
+        -   uses: actions/checkout@v7
+
+        -   name: Set up JDK 17
+            uses: actions/setup-java@v6
+            with:
+                java-version: '17'
+                distribution: 'temurin'
+                cache: maven
+
+        # Report-only: versions-maven-plugin never fails the build, it only prints
+        # what's outdated. No pull requests, no issues - just a workflow summary.
+        -   name: Report outdated dependencies & plugins
+            run: |
+                {
+                    echo "## Outdated dependencies & plugins"
+                    echo
+                    echo '```text'
+                    mvn --batch-mode --file pom.xml versions:display-dependency-updates versions:display-plugin-updates
+                    echo '```'
+                } >> "$GITHUB_STEP_SUMMARY"
+

.github/workflows/ci_jdk21_ubuntu.yml

@@ -8,8 +8,14 @@ on:
         branches:
         - master
     workflow_dispatch:
-        branches:
-        - master
+
+# cancel superseded runs on the same branch/PR to save CI minutes.
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
+
+permissions:
+    contents: read
 
 jobs:
 
@@ -18,13 +24,13 @@ jobs:
         # skip the analysis job for contributors/forks who lack the required sonar token
         if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
         steps:
-        -   uses: actions/checkout@v4
+        -   uses: actions/checkout@v7
             with:
                 # disabling shallow clone is recommended for improving relevancy of reporting
                 fetch-depth: 0
 
         -   name: Set up JDKs (17 for build, 21 for sonarcloud)
-            uses: actions/setup-java@v4
+            uses: actions/setup-java@v6
             with:
                 java-version: |
                     17