ci: release and verify through metio/ci, files from krei

.github/workflows/release.yml

@@ -1,117 +1,23 @@
 # SPDX-FileCopyrightText: The devcontainer.java Authors
 # SPDX-License-Identifier: 0BSD
 
-name: Automated Release
+name: Release
 on:
   schedule:
-    - cron: 35 3 2 * *
+    - cron: 23 4 2 * *
   workflow_dispatch:
-# Serialize release runs. Each run's release-notes lower bound is the latest tag
-# at the time its prepare job runs; two runs in quick succession would both
-# read that bound before either run has tagged, producing overlapping notes.
-# Queueing (no cancel) lets the earlier release finish and create its tag first,
-# so the next run's notes start from that tag and carry only its own commits.
+
+permissions:
+  contents: write
+
 concurrency:
   group: ${{ github.workflow }}
   cancel-in-progress: false
+
 jobs:
-  prepare:
-    name: Prepare Release
-    runs-on: ubuntu-latest
-    outputs:
-      needed: ${{ steps.gate.outputs.needed == 'true' && steps.quota.outputs.available == 'true' }}
-      version: ${{ steps.version.outputs.version }}
-      previous: ${{ steps.gate.outputs.last }}
-    steps:
-      - name: Clone Git Repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-      - id: gate
-        name: Check whether a release is needed
-        uses: metio/ci/needs-release@4e1bc9f3d854998e07b63b20a49dd60e652c0d32 # 2026.10.30204559
-        with:
-          paths: src/main/java pom.xml
-      - id: quota
-        name: Check Maven Central quota
-        if: steps.gate.outputs.needed == 'true'
-        uses: metio/ci/central-quota@4e1bc9f3d854998e07b63b20a49dd60e652c0d32 # 2026.10.30204559
-      - id: version
-        name: Compute the next version
-        if: steps.gate.outputs.needed == 'true' && steps.quota.outputs.available == 'true'
-        uses: metio/ci/calver@4e1bc9f3d854998e07b63b20a49dd60e652c0d32 # 2026.10.30204559
   release:
-    needs: [prepare]
-    if: needs.prepare.outputs.needed == 'true'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write # create the GitHub Release
-    steps:
-      - id: checkout
-        name: Clone Git Repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-      - id: timestamp
-        name: Build Timestamp
-        run: echo "iso8601=$(date --utc --iso-8601=seconds)" >> $GITHUB_OUTPUT
-      - id: notes
-        name: Generate Release Notes
-        uses: metio/ci/release-notes@4e1bc9f3d854998e07b63b20a49dd60e652c0d32 # 2026.10.30204559
-        with:
-          version: ${{ needs.prepare.outputs.version }}
-          previous: ${{ needs.prepare.outputs.previous }}
-      - name: Append usage and verification footer
-        env:
-          VERSION: ${{ needs.prepare.outputs.version }}
-          NOTES: ${{ steps.notes.outputs.file }}
-        run: |
-          cat >> "$NOTES" <<EOF
-
-          ## Usage
-
-          Pull the library from [Maven Central](https://central.sonatype.com/artifact/wtf.metio.devcontainer/devcontainer.java).
-      - id: setup-java
-        name: Set up Java
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
-        with:
-          java-version: 25
-          distribution: temurin
-          cache: maven
-          server-id: central
-          server-username: MAVEN_CENTRAL_USERNAME
-          server-password: MAVEN_CENTRAL_TOKEN
-      - id: gpg
-        name: GPG Key
-        uses: timheuer/base64-to-file@dfa5a5dd38803cb4f5c3a081eeb28e8362d43e9c # v2
-        with:
-          fileName: signing.key.asc
-          fileDir: ${{ github.workspace }}
-          encodedString: ${{ secrets.GPG_SECRET_KEY_BASE64 }}
-      - id: pom-version
-        name: Set Release Version
-        run: mvn --batch-mode --define newVersion=${{ needs.prepare.outputs.version }} --define generateBackupPoms=false versions:set
-      - id: deploy-maven
-        name: Deploy Maven Artifact
-        run: >
-          mvn
-          --batch-mode
-          --activate-profiles release
-          --define scmTag=${{ steps.sha.outputs.sha }}
-          --define sign.keyFile=${{ steps.gpg.outputs.filePath }}
-          --define sign.keyPass=${{ secrets.GPG_SECRET_KEY_PASSWORD }}
-          --define project.build.outputTimestamp=${{ steps.timestamp.outputs.iso8601 }}
-          deploy
-        env:
-          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
-          MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
-      - id: create_release
-        name: Create Release
-        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
-        with:
-          tag_name: ${{ needs.prepare.outputs.version }}
-          name: ${{ needs.prepare.outputs.version }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          draft: false
-          prerelease: false
-          body_path: ${{ steps.notes.outputs.file }}
+    name: Release
+    uses: metio/ci/.github/workflows/maven-central-release.yml@033a5108141e6ad5a42fe4c793641043f6d57b0e # main
+    with:
+      paths: src/main/java pom.xml
+    secrets: inherit

.github/workflows/verify.yml

@@ -1,60 +1,47 @@
 # SPDX-FileCopyrightText: The devcontainer.java Authors
 # SPDX-License-Identifier: 0BSD
+
 name: Verify
 on:
   pull_request:
     branches: [main]
+
 permissions:
   contents: read
+
 jobs:
-  github-actions:
-    name: github-actions
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: reviewdog/action-actionlint@48e36f54d8da326b83ab061aee2cc5e01b5ca46f # v1
-        with:
-          fail_on_error: true
-          filter_mode: nofilter
+  maven:
+    name: Maven
+    uses: metio/ci/.github/workflows/maven.yml@033a5108141e6ad5a42fe4c793641043f6d57b0e # main
+    with:
+      goals: --activate-profiles=native verify
   reuse:
     name: reuse
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6
-  mvn:
+  github-actions:
+    name: github-actions
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
-      - id: checkout
-        name: Clone Git Repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - id: graal
-        name: Set up GraalVM
-        uses: graalvm/setup-graalvm@f70bc8032f90a104502824a54bcb94b6f01715bc # v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
-          version: latest
-          java-version: 25
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-      - id: cache
-        name: Cache Maven Repository
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+          persist-credentials: false
+      - uses: reviewdog/action-actionlint@48e36f54d8da326b83ab061aee2cc5e01b5ca46f # v1
         with:
-          path: ~/.m2/repository
-          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
-          restore-keys: |
-            ${{ runner.os }}-maven-
-      # The native profile runs PMD + SpotBugs (bound to verify) and builds and runs the
-      # native-image smoke check, so a green run proves both code quality and native compatibility.
-      - id: verify
-        name: Verify Project
-        run: mvn --batch-mode --activate-profiles=native verify
+          fail_on_error: true
+          filter_mode: nofilter
   verify:
-    # Single required check: mark only this one required in branch protection and
-    # new jobs are covered automatically.
     name: Verify
-    needs: [github-actions, reuse, mvn]
+    needs: [maven, reuse, github-actions]
     if: always()
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - name: Verify every job succeeded or skipped
         env:

.gitignore

@@ -1,42 +1,30 @@
 # SPDX-FileCopyrightText: The devcontainer.java Authors
 # SPDX-License-Identifier: 0BSD
 
-########################################################################################################################
-# Java GitIgnore                                                                                                       #
-# Based on: https://github.com/toptal/gitignore/blob/master/templates/Java.gitignore                                   #
-########################################################################################################################
-
-# Compiled class file
+.idea/
+*.iml
+*.ipr
+*.iws
+.vscode/
+.project
+.classpath
+.DS_Store
+.claude/settings.local.json
+.breto.local.edn
+target/
 *.class
-
-# Log file
 *.log
-
-# BlueJ files
 *.ctxt
-
-# Mobile Tools for Java (J2ME)
 .mtj.tmp/
-
-# Package Files #
 *.jar
 *.war
 *.nar
 *.ear
 *.zip
 *.tar.gz
 *.rar
-
-# virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
 hs_err_pid*
 replay_pid*
-
-########################################################################################################################
-# Maven GitIgnore                                                                                                      #
-# Based on: https://github.com/toptal/gitignore/blob/master/templates/Maven.gitignore                                  #
-########################################################################################################################
-
-target/
 pom.xml.tag
 pom.xml.releaseBackup
 pom.xml.versionsBackup
@@ -45,95 +33,3 @@ release.properties
 dependency-reduced-pom.xml
 buildNumber.properties
 .mvn/timing.properties
-
-########################################################################################################################
-# JetBrains IntelliJ IDEA GitIgnore                                                                                    #
-# Based on: https://github.com/toptal/gitignore/blob/master/templates/JetBrains.gitignore                              #
-########################################################################################################################
-
-# User-specific stuff
-.idea/**/workspace.xml
-.idea/**/tasks.xml
-.idea/**/misc.xml
-.idea/**/usage.statistics.xml
-.idea/**/dictionaries
-.idea/**/shelf
-
-# AWS User-specific
-.idea/**/aws.xml
-
-# Generated files
-.idea/**/contentModel.xml
-
-# Sensitive or high-churn files
-.idea/**/dataSources/
-.idea/**/dataSources.ids
-.idea/**/dataSources.local.xml
-.idea/**/dataSources.xml
-.idea/**/sqlDataSources.xml
-.idea/**/sqldialects.xml
-.idea/**/dynamic.xml
-.idea/**/uiDesigner.xml
-.idea/**/dbnavigator.xml
-
-# Random stuff
-.idea/**/libraries-with-intellij-classes.xml
-.idea/**/encodings.xml
-
-# Markdown
-.idea/markdown.xml
-
-# VCS
-.idea/vcs.xml
-
-# Gradle
-.idea/**/gradle.xml
-.idea/**/libraries
-
-# Gradle and Maven with auto-import
-.idea/artifacts
-.idea/compiler.xml
-.idea/jarRepositories.xml
-.idea/modules.xml
-.idea/*.iml
-.idea/modules
-*.iml
-*.ipr
-
-# CMake
-cmake-build-*/
-
-# Mongo Explorer plugin
-.idea/**/mongoSettings.xml
-
-# File-based project format
-*.iws
-
-# IntelliJ
-out/
-
-# mpeltonen/sbt-idea plugin
-.idea_modules/
-
-# JIRA plugin
-atlassian-ide-plugin.xml
-
-# Cursive Clojure plugin
-.idea/replstate.xml
-
-# SonarLint plugin
-.idea/sonarlint/
-
-# Crashlytics plugin (for Android Studio and IntelliJ)
-com_crashlytics_export_strings.xml
-crashlytics.properties
-crashlytics-build.properties
-fabric.properties
-
-# Editor-based Rest Client
-.idea/httpRequests
-
-# Android studio 3.1+ serialized cache file
-.idea/caches/build_file_checksums.ser
-
-.claude/settings.local.json

.markdownlint.yaml

@@ -0,0 +1,13 @@
+# SPDX-FileCopyrightText: The devcontainer.java Authors
+# SPDX-License-Identifier: 0BSD
+
+default: true
+MD010:
+  code_blocks: false
+MD013: false
+MD024:
+  siblings_only: true
+MD025:
+  front_matter_title: ""
+MD033: false
+MD060: false

.typos.toml

@@ -0,0 +1,13 @@
+# SPDX-FileCopyrightText: The devcontainer.java Authors
+# SPDX-License-Identifier: 0BSD
+
+[default]
+extend-ignore-re = []
+
+[default.extend-words]
+edn = "edn"
+
+[default.extend-identifiers]
+
+[files]
+extend-exclude = ["LICENSES/"]