Add shared GH workflows

.github/workflows/maven-mend-pr.yml

@@ -0,0 +1,34 @@
+name: Mend CLI scan for Maven PR
+
+on:
+  workflow_run: # zizmor: ignore[dangerous-triggers]
+    workflows: ["Java CI with Maven"]
+    types: [completed]
+
+permissions:
+  contents: read
+  actions: read
+  checks: write
+  pull-requests: write
+  security-events: write
+
+concurrency:
+  group: mend-scan-${{ github.event.workflow_run.pull_requests[0].number || github.event.workflow_run.head_sha }}
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request'
+    uses: project-ncl/shared-github-actions/.github/workflows/mend-ci.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23
+    with:
+      project_name: "Commonjava/atlas"
+      SCA: true
+      SAST: true
+      triggering_run_id: ${{ github.event.workflow_run.id }}
+      pr_feedback: true
+    secrets:
+      MEND_URL: ${{ secrets.MEND_URL }}
+      MEND_USER_KEY: ${{ secrets.MEND_USER_KEY }}
+      MEND_EMAIL: ${{ secrets.MEND_EMAIL }}
+      MEND_ORGNAME: ${{ secrets.MEND_ORGNAME }}
+      MEND_PRODUCTNAME: ${{ secrets.MEND_PRODUCTNAME }}

.github/workflows/maven-mend.yml

@@ -0,0 +1,37 @@
+name: Mend CLI scan for Maven
+
+on:
+  push:
+    branches:
+      - master
+  schedule:
+    - cron: "0 22 * * 0"
+
+permissions:
+  contents: read
+  actions: read
+  checks: write
+  pull-requests: write
+  security-events: write
+
+jobs:
+  build:
+    uses: project-ncl/shared-github-actions/.github/workflows/maven-ci.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23
+    with:
+      java_version: "11"
+      build_command: "MAVEN_OPTS='-Xmx4096m -Xms2048m -XX:MaxMetaspaceSize=4096m -Xss8m' mvn -B -V clean verify -Prun-its -Pci"
+      upload_artifacts: true
+
+  call-mend-ci:
+    needs: build
+    uses: project-ncl/shared-github-actions/.github/workflows/mend-ci.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23
+    with:
+      project_name: "Commonjava/atlas"
+      SCA: true
+      SAST: true
+    secrets:
+      MEND_URL: ${{ secrets.MEND_URL }}
+      MEND_USER_KEY: ${{ secrets.MEND_USER_KEY }}
+      MEND_EMAIL: ${{ secrets.MEND_EMAIL }}
+      MEND_ORGNAME: ${{ secrets.MEND_ORGNAME }}
+      MEND_PRODUCTNAME: ${{ secrets.MEND_PRODUCTNAME }}

.github/workflows/maven-pr.yml

@@ -0,0 +1,16 @@
+name: Java CI with Maven
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    branches: ["*"]
+
+jobs:
+  call-maven-ci:
+    uses: project-ncl/shared-github-actions/.github/workflows/maven-ci.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23
+    with:
+      java_version: "11"
+      build_command: "MAVEN_OPTS='-Xmx4096m -Xms2048m -XX:MaxMetaspaceSize=4096m -Xss8m' mvn -B -V clean verify -Prun-its -Pci"
+      upload_artifacts: true

.github/workflows/maven-release.yml

@@ -0,0 +1,23 @@
+name: "0 Central Release Job" # Adding the 0 so that it's on top of the list of github actions
+on:
+  workflow_dispatch: # Manual trigger so you don't release on every push
+    inputs:
+      ref_to_release:
+        description: "[Optional] Branch or commit to release. Default: Github default branch"
+        required: false
+        type: string
+        # default has to be a static string, no variables allowed
+        default: ""
+
+jobs:
+  call-release-job:
+    permissions:
+      contents: write # needed to push commit and tag back to the repository
+    uses: project-ncl/shared-github-actions/.github/workflows/maven-release.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23
+    with:
+      ref_to_release: ${{ inputs.ref_to_release }}
+    secrets:
+      SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
+      SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
+      GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+      GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

.github/workflows/maven-set-version.yml

@@ -0,0 +1,24 @@
+name: "0 Maven Set Version Job" # Adding the 0 so that it's on top of the list of github actions
+on:
+  workflow_dispatch: # Manual trigger
+    inputs:
+      new_version:
+        description: "[Required] Version to set"
+        required: true
+        type: string
+
+      ref_for_version:
+        description: "[Optional] Branch or commit to change version. Default: Github default branch"
+        required: false
+        type: string
+        # default has to be a static string, no variables allowed
+        default: ""
+
+jobs:
+  call-maven-set-version-job:
+    permissions:
+      contents: write # needed to push commit and tag back to the repository
+    uses: project-ncl/shared-github-actions/.github/workflows/maven-set-version.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23
+    with:
+      new_version: ${{ inputs.new_version }}
+      ref_for_version: ${{ inputs.ref_for_version }}

.github/workflows/maven-snapshot.yml

@@ -0,0 +1,18 @@
+name: Build snapshot version and upload to Maven Central
+
+on:
+  push:
+    branches: ["master"]
+
+permissions: {}
+
+jobs:
+  call-snapshot-job:
+    uses: project-ncl/shared-github-actions/.github/workflows/maven-snapshot.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23
+    with:
+      project_name: "Commonjava/atlas"
+      snapshot_deploy_command: "mvn help:effective-settings -B -V clean deploy -e"
+      jboss_parent_override: "-DaltSnapshotDeploymentRepository=central-publisher::https://central.sonatype.com/repository/maven-snapshots/"
+    secrets:
+      SONATYPE_USERNAME: ${{ secrets.SONATYPE_BOT_USERNAME }}
+      SONATYPE_PASSWORD: ${{ secrets.SONATYPE_BOT_TOKEN }}

.github/workflows/validate-gh-action.yml

@@ -0,0 +1,11 @@
+name: Validate GitHub Actions Workflows
+permissions: {}
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/*.yml"
+
+jobs:
+  validate:
+    uses: project-ncl/shared-github-actions/.github/workflows/validate-gh-action.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23