chore(ci): adopt shared workflows and central Renovate preset

[TheMeinerLP]

What

Brings this repository onto the OneLiteFeather standard CI, release and dependency setup.

CI, security and dependencies

• renovate.json -> central preset (maintainers-launchpad)
• security.yml (Trivy + CycloneDX SBOM)
• close_invalid_prs.yml

Release automation and PR hygiene

• pr-lint.yml
• commitlint.config.mjs
• SBOM job appended to release-please.yml

Version anchoring and Renovate presets

• bootstrap-sha set from tip of main (no version tag yet)

Why

One shared setup per concern instead of a hand-maintained copy per repository:

• Reusable workflows (OneLiteFeatherNET/workflows) are pinned to a full SemVer tag, so a fix
  in the shared catalogue reaches this repository through a Renovate PR.
• Central Renovate preset brings the shared schedule, automerge and labelling rules and assigns
  the maintainer team as reviewer, instead of a per-repository config that drifts.
• Security gate: Trivy scans for vulnerabilities and secrets and reports into GitHub code
  scanning, plus a CycloneDX SBOM on every run. Report-only, so adopting it does not turn CI red on
  day one.
• Release Please in simple mode turns Conventional Commits into a release PR; merging it tags
  the version and cuts the release. Simple mode deliberately does not rewrite language version
  files, which keeps this change limited to release plumbing.
• A CycloneDX SBOM is attached to every GitHub release, so each shipped version carries its own
  dependency inventory.
• The Renovate platform preset (:minestom / :paper) is what teaches Renovate the
  date-based Minestom scheme and Paper's X.Y.Z-<mc-version> scheme; without it those two get
  parsed as plain SemVer and updated wrongly.
• The version lives in build.gradle.kts behind // x-release-please-version, so a release
  changes exactly one line in one file instead of a properties file the build has to parse.
• PR linting enforces Conventional Commits on the PR title and on every commit - without it
  release-please silently fails to bump the version or drops the commit from the changelog.

Everything a release needs is chained into the release-please workflow run on purpose: release-please
tags with GITHUB_TOKEN, and a tag pushed that way does not start a separate
on: push: tags workflow.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	launchpad	420e107	Commit Preview URL Branch Preview URL	Sep 06 2026, 11:32 AM