From 9dbd491ece790b5dafd3210cc94bd9694b77eafc Mon Sep 17 00:00:00 2001
From: Angel Eduardo Hincho Jove <82984150+ahincho@users.noreply.github.com>
Date: Sun, 12 Jul 2026 13:09:53 -0500
Subject: [PATCH 1/7] ci: bootstrap CI + activate build matrix, OWASP and SBOM
 workflows (NOVA-SEMVER-19/20/21)

This repo had no CI workflow at all. Adds ci.yml invoking:
- reusable-build-maven.yml
- reusable-build-matrix.yml (Java 21+25)
- reusable-owasp-check.yml (continue-on-error until NVD_API_KEY is
  configured)
- reusable-sbom.yml

Also fixes the distributionManagement URL: it still had the literal
'OWNER' placeholder instead of 'ahincho' (NOVA-SEMVER-00c fixed this
for the 10 Gradle repos with maven-publish, but missed this Maven repo's
distributionManagement block).
---
 .github/workflows/ci.yml | 41 ++++++++++++++++++++++++++++++++++++++++
 pom.xml                  |  2 +-
 2 files changed, 42 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..c0f6b24
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,41 @@
+name: CI/CD Pipeline
+
+on:
+  pull_request:
+    branches:
+      - main
+    types:
+      - opened
+      - synchronize
+      - reopened
+  push:
+    branches:
+      - main
+
+jobs:
+  build:
+    if: github.event_name == 'pull_request'
+    uses: ahincho/nova-devops/.github/workflows/reusable-build-maven.yml@main
+    secrets: inherit
+
+  matrix:
+    if: github.event_name == 'pull_request'
+    uses: ahincho/nova-devops/.github/workflows/reusable-build-matrix.yml@main
+    with:
+      build-tool: maven
+    secrets: inherit
+
+  owasp:
+    if: github.event_name == 'pull_request'
+    uses: ahincho/nova-devops/.github/workflows/reusable-owasp-check.yml@main
+    continue-on-error: true # TODO: remove once NVD_API_KEY org secret is configured (NOVA-SEMVER-20)
+    with:
+      build-tool: maven
+    secrets: inherit
+
+  sbom:
+    if: github.event_name == 'pull_request'
+    uses: ahincho/nova-devops/.github/workflows/reusable-sbom.yml@main
+    with:
+      build-tool: maven
+    secrets: inherit
diff --git a/pom.xml b/pom.xml
index 53bb8e6..7e40e8e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -93,7 +93,7 @@
     <distributionManagement>
         <repository>
             <id>github</id>
-            <url>https://maven.pkg.github.com/OWNER/nova-spring-boot-parent</url>
+            <url>https://maven.pkg.github.com/ahincho/nova-java-spring-boot-parent</url>
         </repository>
     </distributionManagement>
 

From 032e8c76e6b09e16e21a793d20543153adb542a7 Mon Sep 17 00:00:00 2001
From: Angel Eduardo Hincho Jove <82984150+ahincho@users.noreply.github.com>
Date: Sun, 12 Jul 2026 13:17:48 -0500
Subject: [PATCH 2/7] fix(ci): remove invalid continue-on-error from reusable
 workflow job

'continue-on-error' is not a supported keyword for a job that calls a
reusable workflow via 'uses:' - it broke workflow file parsing entirely.
Moved the actual fix to nova-devops (step-level, in the reusable
workflow itself).
---
 .github/workflows/ci.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c0f6b24..a0b611e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,7 +28,6 @@ jobs:
   owasp:
     if: github.event_name == 'pull_request'
     uses: ahincho/nova-devops/.github/workflows/reusable-owasp-check.yml@main
-    continue-on-error: true # TODO: remove once NVD_API_KEY org secret is configured (NOVA-SEMVER-20)
     with:
       build-tool: maven
     secrets: inherit

From 7239dbf58d9b9db4aab193c2cfc4244979d3af15 Mon Sep 17 00:00:00 2001
From: Angel Eduardo Hincho Jove <82984150+ahincho@users.noreply.github.com>
Date: Sun, 12 Jul 2026 17:07:22 -0500
Subject: [PATCH 3/7] fix: bump nova-bom/nova-starter version refs from
 0.1.0-SNAPSHOT to 1.0.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both pe.edu.nova.java:nova-spring-boot-bom and
pe.edu.nova.java.starters:nova-spring-boot-starter are published at
1.0.0 in GitHub Packages (never at 0.1.0-SNAPSHOT). The stale
SNAPSHOT reference made the parent POM unresolvable, failing the
build/matrix/sbom CI jobs with 'Non-resolvable import POM'.

Documented as bug C in
docs/java/06-semantic-versioning-en-java.md §11.9.30.
---
 pom.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pom.xml b/pom.xml
index 7e40e8e..27b4046 100644
--- a/pom.xml
+++ b/pom.xml
@@ -19,8 +19,8 @@
         <maven.compiler.target>${java.version}</maven.compiler.target>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <!-- Nova Platform -->
-        <nova-bom.version>0.1.0-SNAPSHOT</nova-bom.version>
-        <nova-starter.version>0.1.0-SNAPSHOT</nova-starter.version>
+        <nova-bom.version>1.0.0</nova-bom.version>
+        <nova-starter.version>1.0.0</nova-starter.version>
         <!-- Plugins -->
         <maven-compiler-plugin.version>3.14.0</maven-compiler-plugin.version>
         <maven-surefire-plugin.version>3.5.3</maven-surefire-plugin.version>

From 28aa45b56ec52b33ae0e87696e6cc3464c57c098 Mon Sep 17 00:00:00 2001
From: Angel Eduardo Hincho Jove <82984150+ahincho@users.noreply.github.com>
Date: Sun, 12 Jul 2026 17:20:20 -0500
Subject: [PATCH 4/7] fix: add <repositories> for cross-repo GitHub Packages
 reads

nova-spring-boot-bom (imported via dependencyManagement) is published
from the separate nova-bom repo, and nova-spring-boot-starter (a plain
dependency) from nova-java-spring-boot-starter. GitHub Packages requires
auth even for public reads, and each repo's Maven registry is scoped to
that repo's own URL - Maven has no way to find either artifact without
an explicit <repositories> entry pointing at the right repo.

Both entries share the 'nova-packages-read' id since they use the same
credentials (see nova-devops' nova-setup-java composite action, which
writes the matching <server> entry in settings.xml from the new
NOVA_PACKAGES_READ_TOKEN secret).

This repo's own dependencyManagement/dependencies declarations are
inherited by every child project via this parent POM, so this also
fixes cross-repo resolution for any project generated from
nova-java-spring-boot-archetype.
---
 pom.xml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/pom.xml b/pom.xml
index 27b4046..8d09ec6 100644
--- a/pom.xml
+++ b/pom.xml
@@ -27,6 +27,23 @@
         <spring-boot-maven-plugin.version>4.0.5</spring-boot-maven-plugin.version>
     </properties>
 
+    <!-- Repositorios de lectura — GitHub Packages de otros repos Nova.
+         Requiere credenciales (GitHub Packages exige auth incluso en repos
+         publicos); ver settings.xml generado por nova-setup-java (server id
+         "nova-packages-read", token NOVA_PACKAGES_READ_TOKEN). Se reutiliza
+         el mismo id en ambas entradas porque comparten las mismas credenciales.
+         Heredado por todos los proyectos hijos que usen este parent. -->
+    <repositories>
+        <repository>
+            <id>nova-packages-read</id>
+            <url>https://maven.pkg.github.com/ahincho/nova-bom</url>
+        </repository>
+        <repository>
+            <id>nova-packages-read</id>
+            <url>https://maven.pkg.github.com/ahincho/nova-java-spring-boot-starter</url>
+        </repository>
+    </repositories>
+
     <!-- Gestión de dependencias — importa el BOM -->
     <dependencyManagement>
         <dependencies>

From aa91c6c1fb2a948dabd419bba096d3c65b5e2e85 Mon Sep 17 00:00:00 2001
From: Angel Eduardo Hincho Jove <82984150+ahincho@users.noreply.github.com>
Date: Sun, 12 Jul 2026 17:23:47 -0500
Subject: [PATCH 5/7] fix: use 2 distinct repository ids matching
 nova-setup-java servers

---
 pom.xml | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pom.xml b/pom.xml
index 8d09ec6..025c33c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -29,17 +29,18 @@
 
     <!-- Repositorios de lectura — GitHub Packages de otros repos Nova.
          Requiere credenciales (GitHub Packages exige auth incluso en repos
-         publicos); ver settings.xml generado por nova-setup-java (server id
-         "nova-packages-read", token NOVA_PACKAGES_READ_TOKEN). Se reutiliza
-         el mismo id en ambas entradas porque comparten las mismas credenciales.
+         publicos); ver settings.xml generado por nova-setup-java (server ids
+         "nova-packages-read-bom" / "nova-packages-read-starter", token
+         NOVA_PACKAGES_READ_TOKEN). Maven exige id unico por repository, por
+         eso son 2 ids distintos aunque compartan las mismas credenciales.
          Heredado por todos los proyectos hijos que usen este parent. -->
     <repositories>
         <repository>
-            <id>nova-packages-read</id>
+            <id>nova-packages-read-bom</id>
             <url>https://maven.pkg.github.com/ahincho/nova-bom</url>
         </repository>
         <repository>
-            <id>nova-packages-read</id>
+            <id>nova-packages-read-starter</id>
             <url>https://maven.pkg.github.com/ahincho/nova-java-spring-boot-starter</url>
         </repository>
     </repositories>

From 697264511d16f86882266f5f12ffefcf330b2f39 Mon Sep 17 00:00:00 2001
From: Angel Eduardo Hincho Jove <82984150+ahincho@users.noreply.github.com>
Date: Sun, 12 Jul 2026 18:22:24 -0500
Subject: [PATCH 6/7] fix(deps): bump nova-spring-boot-starter to 1.0.1
 (republish fixes bug D)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previously published 1.0.0 POM carries a phantom
nova-spring-boot-bom:1.0.1 dependency baked in during the brief window
when the BOM was temporarily at 1.0.1 (see nova-docs §11.9.25) and was
never republished after the revert. The starter has now been republished
as 1.0.1 with a clean POM regenerated from the current build.gradle.kts
(which pins nova-spring-boot-bom:1.0.0 directly).
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 025c33c..6279a57 100644
--- a/pom.xml
+++ b/pom.xml
@@ -20,7 +20,7 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <!-- Nova Platform -->
         <nova-bom.version>1.0.0</nova-bom.version>
-        <nova-starter.version>1.0.0</nova-starter.version>
+        <nova-starter.version>1.0.1</nova-starter.version>
         <!-- Plugins -->
         <maven-compiler-plugin.version>3.14.0</maven-compiler-plugin.version>
         <maven-surefire-plugin.version>3.5.3</maven-surefire-plugin.version>

From ff2c22474d60ea7b024470aae8c0257e44020589 Mon Sep 17 00:00:00 2001
From: Angel Eduardo Hincho Jove <82984150+ahincho@users.noreply.github.com>
Date: Mon, 20 Jul 2026 20:50:47 -0500
Subject: [PATCH 7/7] chore(release): bump nova-spring-boot-parent to 1.0.0 +
 add manual publish workflow

- pom.xml: 0.1.0-SNAPSHOT -> 1.0.0 to align with nova-bom:1.0.0 API baseline
- publish.yml: manual trigger via workflow_dispatch; reuses
  ahincho/nova-devops/.github/workflows/reusable-publish-maven.yml@main
  (same pattern as nova-bom). Needed to unlock instances/ms-course and
  instances/ms-forum migration (see docs/java/11 plan #1).
---
 .github/workflows/publish.yml | 23 +++++++++++++++++++++++
 pom.xml                       |  2 +-
 2 files changed, 24 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/publish.yml

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..ec01c9e
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,23 @@
+name: Publish Parent POM
+
+# Manually triggered publish for nova-spring-boot-parent. The release-please
+# pipeline has not been wired to this repo yet (it relies on tag-driven
+# publish-on-tag flow used by other repos; tracked separately). This workflow
+# supports manual 1.0.x bumps in the meantime so Gradle/Maven consumers
+# (e.g. instances/ms-course, instances/ms-forum) can resolve the parent.
+on:
+  workflow_dispatch:
+    inputs:
+      dry-run:
+        description: 'Dry-run: deploy to local file:// repo for verification'
+        required: false
+        type: string
+        default: 'false'
+
+jobs:
+  publish:
+    uses: ahincho/nova-devops/.github/workflows/reusable-publish-maven.yml@main
+    with:
+      dry-run: ${{ inputs.dry-run || 'false' }}
+    secrets:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/pom.xml b/pom.xml
index 6279a57..9c4a433 100644
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@
 
     <groupId>pe.edu.nova.java</groupId>
     <artifactId>nova-spring-boot-parent</artifactId>
-    <version>0.1.0-SNAPSHOT</version>
+    <version>1.0.0</version>
     <packaging>pom</packaging>
 
     <name>Nova Platform Spring Boot Parent</name>