ci: standardize CI/CD onto the golden path

.github/workflows/ci.yml

@@ -0,0 +1,53 @@
+# Continuous Integration — kvalitet golden-path variant (JVM library, Template E).
+#
+# Reusable (workflow_call) AND directly triggered on pull_request. Runs the multi-module
+# Gradle build and publishes the JUnit test results. This library publishes to Maven Central
+# (JReleaser / gha-maven-central) via the manual deploy workflows, NOT Artifactory, so no
+# ARTIFACTORY_AUTH_* env is set here (none exists in build.gradle).
+name: CI
+
+on:
+  pull_request:
+    branches: [main, 5.x, 6.x]
+  workflow_call:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Build and Test
+    if: github.actor != 'dependabot[bot]'
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      checks: write
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
+        with:
+          distribution: temurin
+          java-version: "25"
+      - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+      - name: Build and test
+        run: ./gradlew build
+      - uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # 3.0.0
+        if: always()
+        with:
+          name: reports-${{ github.job }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: "**/build/test-results/test/*.xml"
+          reporter: java-junit
+
+  ci:
+    name: CI
+    needs: [test]
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-24.04
+    steps:
+      - name: All required CI jobs passed
+        run: |
+          if [[ "${{ contains(needs.*.result, 'failure') }}" == "true" ]]; then
+            echo "::error::A required CI job failed"
+            exit 1
+          fi

.github/workflows/copilot-setup-steps.yml

@@ -21,7 +21,7 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
             - name: Set up Java 25
               uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0

.github/workflows/dependabot-pr.yml

@@ -0,0 +1,15 @@
+# Dependabot PRs don't receive secrets by default. After a human approves the PR,
+# re-run CI by calling the reusable ci.yml. CI only builds and tests — it needs no
+# secrets (Maven Central publishing happens in the separate manual deploy workflows),
+# so permissions here mirror ci.yml's own (contents: read, checks: write).
+name: Dependabot CI (post-approval)
+on:
+  pull_request_review:
+    types: [submitted]
+permissions:
+  contents: read
+  checks: write
+jobs:
+  ci:
+    if: github.event.review.state == 'approved' && github.event.pull_request.user.login == 'dependabot[bot]'
+    uses: ./.github/workflows/ci.yml

.github/workflows/pr.yml

@@ -0,0 +1,16 @@
+name: PR
+on:
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, reopened, edited]
+permissions:
+  contents: read
+  pull-requests: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  verify-pr:
+    name: PR
+    if: ${{ github.event_name == 'pull_request' }}
+    uses: entur/gha-meta/.github/workflows/verify-pr.yml@v1