Add and update various workflow templates for .NET, Java, Node.js, and security audits

[SondreFjaertoft]

Prøvde på at alle valg som en utvikler kan ha i reusables. Her kan de slette ting sjøl, men tenkte at det va greit at dei fikk med alt som va mulig.

[Copilot]

Pull request overview

This PR expands and refreshes the repository’s GitHub Actions caller workflow templates so consuming repos can more easily adopt the existing reusable workflows for build/deploy and security/audit tasks.

Changes:

• Added new caller templates for OpenAPI spec publishing, Dependency-Track license checks, standalone Helm deploy, and Java library builds (internal + Maven Central).
• Updated existing caller templates (Node.js, Java service, .NET library, Zizmor) to expose more workflow_dispatch inputs and simplify configuration.
• Replaced the old Java library template with a deprecated placeholder.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
.github/caller-templates/zizmor-audit.yml	Adds workflow_dispatch input for output format and forwards it to reusable audit workflow.
.github/caller-templates/open-api-specs.yml	New template to call the OpenAPI spec publishing reusable workflow with configurable folders/ignore list.
.github/caller-templates/nodejs-service-build.yml	Adds many workflow inputs and forwards them to the Node.js service build reusable workflow.
.github/caller-templates/license-check.yml	New template for Dependency-Track license scanning.
.github/caller-templates/java-service-build.yml	Expands inputs and forwards them to the Java service build reusable workflow.
.github/caller-templates/java-library-maven-central-build.yml	New template for Maven Central publishing flow.
.github/caller-templates/java-library-internal-build.yml	New template for internal Artifactory publishing flow.
.github/caller-templates/java-library-build.yml	Replaced prior workflow with a deprecated placeholder.
.github/caller-templates/dotnet-library-build.yml	Adds many workflow inputs and forwards them to the .NET library build reusable workflow.
.github/caller-templates/deploy.yml	New standalone deploy-by-version caller template.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[shogemo]

Ser fint ut, eg føretrekkjer òg at alle alternativa ligg der frå før.
Éin ting eg kom på er at environment kan (bør?) vera ein choice-variabel, det gjeld då java-service-build og nodejs-service-build. Så du får ein input variabel av sorten

environment:
  description: 'The environment to deploy to'
  required: false
  type: choice
  options:
    - dev
    - test
    - prod
  default: 'dev'

kvar ein kan endra/fjerna miljø om det skulle behøvast.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.

Suppressed comments (6)

.github/caller-templates/java-service-build.yml:53

• inputs.* context is only defined for workflow_dispatch. Since this workflow also runs on push/pull_request, referencing inputs.semver_increment / inputs.version will fail at runtime on those events. Use github.event.inputs (and guard on workflow_dispatch) so non-dispatch runs get safe defaults.

      semver_increment: ${{ inputs.semver_increment || '' }}
      is_release: ${{ github.event_name == 'workflow_dispatch' && inputs.is_release || false }}
      version: ${{ inputs.version || '' }}

.github/caller-templates/java-library-maven-central-build.yml:48

• This workflow runs on push/pull_request as well as workflow_dispatch, but inputs.* only exists for workflow_dispatch. The unguarded inputs.version / inputs.semver_increment / inputs.reviewer expressions will break non-dispatch runs.

      is_release: ${{ github.event_name == 'workflow_dispatch' && inputs.is_release || false }}
      version: ${{ inputs.version || '' }}
      semver_increment: ${{ inputs.semver_increment || '' }}
      reviewer: ${{ inputs.reviewer || '' }}

.github/caller-templates/java-library-internal-build.yml:47

• This workflow triggers on push/pull_request, but uses inputs.* in the with: block. inputs is only defined for workflow_dispatch, so these expressions will fail on non-dispatch runs unless guarded.

      is_release: ${{ github.event_name == 'workflow_dispatch' && inputs.is_release || false }}
      version: ${{ inputs.version || '' }}
      semver_increment: ${{ inputs.semver_increment || '' }}
      reviewer: ${{ inputs.reviewer || '' }}

.github/caller-templates/dotnet-library-build.yml:47

• Like the other templates, this workflow runs on push/pull_request too. Using the inputs.* context can fail on non-workflow_dispatch events; prefer github.event.inputs (guarded) so normal CI runs keep working.

      is-release: ${{ github.event_name == 'workflow_dispatch' && inputs.isRelease || false }}
      push-to-nuget-org: ${{ github.event_name == 'workflow_dispatch' && inputs.pushToNugetOrg || false }}
      specified-version: ${{ github.event_name == 'workflow_dispatch' && inputs.specifiedVersion || '' }}
      release-notes: ${{ github.event_name == 'workflow_dispatch' && inputs.releaseNotes || 'No changes specified' }}
      reviewer: ${{ inputs.reviewer || 'No review required' }}

.github/caller-templates/license-check.yml:16

• license-check.yml reusable workflow expects a secret named dependency_track_api_key (lowercase) and passes it to dt-license-check, where it is a required input. With secrets: inherit, repositories that already have the conventional DEPENDENCY_TRACK_API_KEY secret won't provide the expected name, so the scan will run without credentials.

    uses: ks-no/github-actions-public/.github/workflows/license-check.yml@main
    secrets: inherit

.github/caller-templates/zizmor-audit.yml:10

• The reusable zizmor-audit.yml supports inputs.output_format (including sarif). This template removed both the commented with: output_format example and the security-events: write permission needed for SARIF uploads, making it hard/impossible to enable GitHub Security tab reporting from the starter workflow.

permissions:
  contents: read