feat(ci): wire central ci-workflows@v1 non-NMS caller

[wisdommen]

Summary

Wire UltiEconomy to the shared ci-workflows repository.

Changes

• Create .github/workflows/maven-ci.yml with exact non-NMS caller (sha256: a6e6a2fcc8...)
• Byte-identical to 13 already-wired modules
• Uses UltiKits/ci-workflows/.github/workflows/maven-ci.yml@v1
• needs-nms: false (pure API module)

Verification

• Local: mvn -B test (322 tests pass), mvn -B package (success)
• SHA-256: a6e6a2fcc83bc5a28b749ee0300f05d9bcd729852a1a22a96c443590ff16fe2a

Scope

Single file change. No POM or source modifications.

Summary by CodeRabbit

• Chores
  • Added automated CI checks for pushes and pull requests to help keep builds validated more consistently.
  • Updated workflow permissions to follow a more restrictive default setup.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a new GitHub Actions workflow file (maven-ci.yml) that triggers on push and pull_request events, sets read-only content permissions, and delegates CI execution to a reusable external workflow with a fixed parameter.

Changes

CI Workflow Setup

Layer / File(s)	Summary
Maven CI workflow definition .github/workflows/maven-ci.yml	New workflow triggers on push (all branches) and pull_request events, restricts permissions to contents: read, and delegates to reusable workflow UltiKits/ci-workflows/.github/workflows/maven-ci.yml@v1 with needs-nms: false.

Estimated code review effort: 1 (Trivial) | ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes adding a CI workflow caller wired to the shared v1 reusable workflow for a non-NMS module.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/central-ci-non-nms-caller

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/maven-ci.yml (1)

10-11: 🔒 Security & Privacy | 🔵 Trivial | ⚖️ Poor tradeoff

Floating @v1 tag is a conscious tradeoff — consider org-wide SHA pinning policy.

Referencing UltiKits/ci-workflows/...@v1 means any retag or compromise of v1 upstream immediately affects this workflow's execution. The inline comment already acknowledges this tradeoff in favor of auto-receiving re-pins, which is reasonable for an internal, trusted org repo, but for stricter supply-chain hygiene consider pinning to a full commit SHA at least for release/protected branches.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/maven-ci.yml around lines 10 - 11, The reusable workflow
reference in the maven CI config is using a floating `@v1` tag, which should be
aligned with your supply-chain policy. Update the uses reference for
UltiKits/ci-workflows/.github/workflows/maven-ci.yml to a full commit SHA for
release/protected branches, or otherwise make the pinning strategy explicit and
consistent with the org-wide policy noted in the inline comment.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/maven-ci.yml:
- Around line 10-11: The reusable workflow reference in the maven CI config is
using a floating `@v1` tag, which should be aligned with your supply-chain policy.
Update the uses reference for
UltiKits/ci-workflows/.github/workflows/maven-ci.yml to a full commit SHA for
release/protected branches, or otherwise make the pinning strategy explicit and
consistent with the org-wide policy noted in the inline comment.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 0f2b14b9-d380-4f7b-a044-8e2d434cc71a

📥 Commits

Reviewing files that changed from the base of the PR and between 7ad05ce and 5562c57.

📒 Files selected for processing (1)

• .github/workflows/maven-ci.yml