ci: close verification and Central publication gaps

.github/CODEOWNERS

@@ -8,9 +8,15 @@
 
 # Critical resilience machinery — ordering, control flow, protection logic
 /src/main/java/io/github/davidhlp/spring/cache/redis/chain/       @davidhlp
-/src/main/java/io/github/davidhlp/spring/cache/redis/protection/  @davidhlp
+/src/main/java/io/github/davidhlp/spring/cache/redis/cache/       @davidhlp
 
 # Auto-configuration wiring + security-sensitive serialization
 /src/main/java/io/github/davidhlp/spring/cache/redis/config/          @davidhlp
 /src/main/java/io/github/davidhlp/spring/cache/redis/serialization/   @davidhlp
 /src/main/resources/META-INF/spring/                                  @davidhlp
+
+# CI, release and build contracts
+/.github/         @davidhlp
+/scripts/ci/      @davidhlp
+/pom.xml          @davidhlp
+/.mvn/            @davidhlp

.github/actions/setup-jdk-21/action.yml

@@ -35,7 +35,7 @@ runs:
   using: composite
   steps:
     - name: Setup JDK ${{ inputs.java-version }}
-      uses: actions/setup-java@v5
+      uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
       with:
         java-version: ${{ inputs.java-version }}
         distribution: ${{ inputs.distribution }}

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 3
+  - package-ecosystem: maven
+    directories:
+      - /
+      - /resicache-bench
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    ignore:
+      - dependency-name: org.springframework.boot:*
+        update-types: [version-update:semver-major]

.github/workflows/_bench.yml

@@ -1,43 +1,38 @@
-name: "Reusable · Bench"
-
+name: Reusable Bench
 on:
   workflow_call:
-
 permissions:
   contents: read
-
 jobs:
   bench-module:
-    name: JMH Bench Module
     runs-on: ubuntu-latest
     timeout-minutes: 10
-
     steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-
-      - name: Set up JDK 21
-        uses: ./.github/actions/setup-jdk-21
-
-      - name: Install Core to Local Repo
-        run: ./mvnw install -DskipTests -B
-
-      - name: Build resicache-bench Fat-JAR
-        run: mvn -f resicache-bench/pom.xml clean package -DskipTests -B
-
-      - name: Smoke-test v2 serializer and storage adaptation
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: ./.github/actions/setup-jdk-21
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
+        with:
+          name: core-candidate
+          path: candidate
+      - name: Install verified core
+        run: |
+          python3 scripts/ci/pipeline.py verify-candidate candidate
+          version=$(python3 -c 'import json; print(json.load(open("candidate/manifest.json"))["version"])')
+          ./mvnw org.apache.maven.plugins:maven-install-plugin:3.1.4:install-file -B \
+            -Dfile="candidate/ResiCache-$version.jar" -DpomFile="candidate/ResiCache-$version.pom"
+      - run: ./mvnw -f resicache-bench/pom.xml clean package -DskipTests -B
+      - name: Storage protocol smoke (no performance SLO)
         run: >-
           java -jar resicache-bench/target/resicache-bench.jar
           'CacheSerializationBenchmark.storageRoundTrip'
           -p payloadBytes=64 -wi 0 -i 1 -r 100ms -f 1 -foe true
           -jvmArgs '-Xms128m -Xmx256m'
           -rf json -rff resicache-bench/target/jmh-smoke.json
-
-      - name: Upload Benchmark Artifact
-        uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
-          name: resicache-bench-fatjar
+          name: benchmark-smoke
           path: |
             resicache-bench/target/resicache-bench.jar
             resicache-bench/target/jmh-smoke.json
+          if-no-files-found: error
           retention-days: 7

.github/workflows/_build.yml

@@ -1,60 +1,36 @@
-name: "Reusable · Build & Test"
-
+name: Reusable Build
 on:
   workflow_call:
-
 permissions:
   contents: read
-
 jobs:
   build-test:
-    name: Build & Verify (Java 21)
+    name: Build and Verify (Java 21)
     runs-on: ubuntu-latest
-    timeout-minutes: 20
-
+    timeout-minutes: 30
     steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-
-      - name: Set up JDK 21
-        uses: ./.github/actions/setup-jdk-21
-      - name: Validate integration-test naming
-        run: bash ./scripts/ci/check-test-names.sh
-
-      - name: Verify Core (Unit & Integration Tests, JaCoCo Gate)
-        run: ./mvnw clean verify -B
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: ./.github/actions/setup-jdk-21
+      - name: Require working Docker
+        run: docker info
+      - run: bash scripts/ci/check-test-names.sh
+      - name: Full tests, Javadoc and coverage
+        run: ./mvnw clean verify -Dtestcontainers.ryuk.disabled=false -B
         env:
           MAVEN_OPTS: '-Xmx1024m -XX:+UseParallelGC'
-
-      - name: Upload Test Results
-        if: always()
-        uses: actions/upload-artifact@v7
+      - run: python3 scripts/ci/pipeline.py reports
+      - run: python3 scripts/ci/pipeline.py candidate target/ci-candidate
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
-          name: surefire-test-results
-          path: target/surefire-reports/
-          retention-days: 7
-
-      - name: Upload JaCoCo Coverage Report
+          name: core-candidate
+          path: target/ci-candidate/
+          if-no-files-found: error
+          retention-days: 30
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         if: always()
-        uses: actions/upload-artifact@v7
         with:
-          name: jacoco-coverage-report
-          path: target/site/jacoco/
-          retention-days: 7
-
-  unit-test:
-    name: Unit Tests (no Docker)
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-
-      - name: Set up JDK 21
-        uses: ./.github/actions/setup-jdk-21
-
-      - name: Run unit tests without Docker
-        run: ./mvnw -Punit test -B
-        env:
-          DOCKER_HOST: unix:///nonexistent.sock
+          name: full-test-results
+          path: |
+            target/surefire-reports/
+            target/site/jacoco/
+          retention-days: 14

.github/workflows/_docs.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
       - name: Guard against removed-feature regressions in docs
         run: |

.github/workflows/_lint.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
       - name: Set up JDK 21
         uses: ./.github/actions/setup-jdk-21

.github/workflows/_quality.yml

@@ -21,8 +21,8 @@ permissions:
   contents: read
 
 jobs:
-  # Dependency scans and Qodana are advisory until their result aggregation is
-  # wired into the canonical blocking gate. They never represent release
+  # Scheduled dependency diagnostics and Qodana are advisory and stay outside
+  # the canonical blocking gate. They never represent release
   # compatibility or contract closure.
   dependency-analysis:
     name: "Advisory · Dependency Analysis"
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
       - name: Set up JDK 21
         uses: ./.github/actions/setup-jdk-21
@@ -56,11 +56,11 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
       - name: Qodana Scan
         if: ${{ inputs.qodana-enabled && env.QODANA_TOKEN != '' }}
-        uses: JetBrains/qodana-action@v2026.2.1
+        uses: JetBrains/qodana-action@10be11607eb323a180e2b76b26c9c5cdceac3e77 # v2026.2.1
         with:
           cache-dir: .qodana/cache
           use-caches: true
@@ -70,7 +70,7 @@ jobs:
 
       - name: Upload Qodana Report
         if: ${{ always() && inputs.qodana-enabled && env.QODANA_TOKEN != '' }}
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: qodana-report
           path: ./qodana/report/

.github/workflows/_verify.yml

@@ -0,0 +1,131 @@
+name: Reusable Verification
+on:
+  workflow_call:
+    inputs:
+      allow-docs-only:
+        type: boolean
+        default: false
+permissions:
+  contents: read
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      docs_only: ${{ steps.classify.outputs.docs_only }}
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          fetch-depth: 0
+      - id: classify
+        env:
+          ALLOW_DOCS: ${{ inputs.allow-docs-only }}
+          EVENT: ${{ github.event_name }}
+          BASE: ${{ github.event.pull_request.base.sha }}
+          HEAD: ${{ github.event.pull_request.head.sha }}
+        run: |
+          if [[ "$ALLOW_DOCS" == true && "$EVENT" == pull_request ]]; then
+            python3 scripts/ci/pipeline.py classify "$BASE" "$HEAD" >> "$GITHUB_OUTPUT"
+          else
+            echo 'docs_only=false' >> "$GITHUB_OUTPUT"
+          fi
+  workflow:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - run: bash scripts/ci/check-workflows.sh
+  docs:
+    uses: ./.github/workflows/_docs.yml
+  lint:
+    needs: changes
+    if: needs.changes.outputs.docs_only == 'false'
+    uses: ./.github/workflows/_lint.yml
+  unit:
+    needs: changes
+    if: needs.changes.outputs.docs_only == 'false'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: ./.github/actions/setup-jdk-21
+      - run: ./mvnw -Punit clean test -B
+        env:
+          DOCKER_HOST: unix:///nonexistent.sock
+      - run: python3 scripts/ci/pipeline.py reports --unit
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        if: always()
+        with:
+          name: unit-test-results
+          path: target/surefire-reports/
+          retention-days: 7
+  build:
+    needs: changes
+    if: needs.changes.outputs.docs_only == 'false'
+    uses: ./.github/workflows/_build.yml
+  consumer:
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: ./.github/actions/setup-jdk-21
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
+        with:
+          name: core-candidate
+          path: candidate
+      - run: bash scripts/ci/check-external-consumer.sh candidate
+  bench:
+    needs: build
+    uses: ./.github/workflows/_bench.yml
+  security:
+    needs: [changes, build]
+    if: needs.changes.outputs.docs_only == 'false'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-jdk-21
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
+        with:
+          name: core-candidate
+          path: candidate
+      - name: Dependency Review
+        if: github.event_name == 'pull_request'
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: high
+          comment-summary-in-pr: never
+      - name: Resolved core and benchmark dependency evidence
+        if: ${{ !cancelled() }}
+        env:
+          BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
+          EVENT: ${{ github.event_name }}
+        run: python3 scripts/ci/dependencies.py --base "$BASE" --event "$EVENT" --candidate candidate --output target/dependencies
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        if: always()
+        with:
+          name: dependency-evidence
+          path: target/dependencies/
+          retention-days: 14
+  verification-ok:
+    name: Verification gate
+    needs: [changes, workflow, docs, lint, unit, build, consumer, bench, security]
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - env:
+          RESULTS: ${{ toJSON(needs) }}
+          EXPECTED_JOBS: changes workflow docs lint unit build consumer bench security
+          DOCS_ONLY: ${{ needs.changes.outputs.docs_only }}
+        run: |
+          if [[ "$DOCS_ONLY" == true ]]; then
+            export ALLOWED_SKIPS='lint unit build consumer bench security'
+          elif [[ "$DOCS_ONLY" != false ]]; then
+            echo 'Missing change classification' >&2; exit 1
+          fi
+          bash scripts/ci/require-all-green.sh