From 364d5fd333a7a769e03da37cd2680be90b6aebba Mon Sep 17 00:00:00 2001
From: cuioss-release-bot <action@github.com>
Date: Wed, 26 Aug 2026 20:57:16 +0000
Subject: [PATCH 1/2] chore: update cuioss-organization workflows to v0.21.0

---
 .github/workflows/codeql.yml                | 2 +-
 .github/workflows/dependabot-auto-merge.yml | 2 +-
 .github/workflows/dependency-review.yml     | 2 +-
 .github/workflows/maven.yml                 | 2 +-
 .github/workflows/release.yml               | 2 +-
 .github/workflows/scorecards.yml            | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 3be7609..844cb2d 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -17,7 +17,7 @@ jobs:
     # The reusable workflow fixes the query suite to +security-and-quality org-wide;
     # build-mode: none analyses the sources directly (no Maven build needed for this
     # zero-dependency library).
-    uses: cuioss/cuioss-organization/.github/workflows/reusable-codeql.yml@5aed9a45d80dc68ae3f21f2fb24a81e5ecbdd865 # v0.20.0
+    uses: cuioss/cuioss-organization/.github/workflows/reusable-codeql.yml@4962f9875826f8f73cd04987278f30b6cd8365d7 # v0.21.0
     permissions:
       security-events: write
       contents: read
diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index 084516f..a6d0b87 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   auto-merge:
-    uses: cuioss/cuioss-organization/.github/workflows/reusable-dependabot-auto-merge.yml@5aed9a45d80dc68ae3f21f2fb24a81e5ecbdd865 # v0.20.0
+    uses: cuioss/cuioss-organization/.github/workflows/reusable-dependabot-auto-merge.yml@4962f9875826f8f73cd04987278f30b6cd8365d7 # v0.21.0
     permissions:
       contents: write
       pull-requests: write
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index d88a607..e430c9c 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -9,7 +9,7 @@ permissions:
 
 jobs:
   dependency-review:
-    uses: cuioss/cuioss-organization/.github/workflows/reusable-dependency-review.yml@5aed9a45d80dc68ae3f21f2fb24a81e5ecbdd865 # v0.20.0
+    uses: cuioss/cuioss-organization/.github/workflows/reusable-dependency-review.yml@4962f9875826f8f73cd04987278f30b6cd8365d7 # v0.21.0
     permissions:
       contents: read
       pull-requests: write
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 432707f..d8a84ba 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -17,7 +17,7 @@ permissions:
 
 jobs:
   build:
-    uses: cuioss/cuioss-organization/.github/workflows/reusable-maven-build.yml@5aed9a45d80dc68ae3f21f2fb24a81e5ecbdd865 # v0.20.0
+    uses: cuioss/cuioss-organization/.github/workflows/reusable-maven-build.yml@4962f9875826f8f73cd04987278f30b6cd8365d7 # v0.21.0
     secrets:
       SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
       OSS_SONATYPE_USERNAME: ${{ secrets.OSS_SONATYPE_USERNAME }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4a47bdb..35a9201 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ jobs:
     permissions:
       contents: write
     if: github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch'
-    uses: cuioss/cuioss-organization/.github/workflows/reusable-maven-release.yml@5aed9a45d80dc68ae3f21f2fb24a81e5ecbdd865 # v0.20.0
+    uses: cuioss/cuioss-organization/.github/workflows/reusable-maven-release.yml@4962f9875826f8f73cd04987278f30b6cd8365d7 # v0.21.0
     secrets:
       RELEASE_APP_ID: ${{ secrets.RELEASE_APP_ID }}
       RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index a17dff7..c6a1182 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   analysis:
-    uses: cuioss/cuioss-organization/.github/workflows/reusable-scorecards.yml@5aed9a45d80dc68ae3f21f2fb24a81e5ecbdd865 # v0.20.0
+    uses: cuioss/cuioss-organization/.github/workflows/reusable-scorecards.yml@4962f9875826f8f73cd04987278f30b6cd8365d7 # v0.21.0
     permissions:
       security-events: write
       id-token: write

From 5a4e06751857c1bdeb53dc93c483c20a7fbe33bb Mon Sep 17 00:00:00 2001
From: OliverWolffGIP <oliver.wolff@gipmbh.de>
Date: Wed, 26 Aug 2026 23:27:41 +0200
Subject: [PATCH 2/2] fix: grant actions: read for the v0.21.0 conclusion job

reusable-maven-build.yml's conclusion job requests actions: read.
A called workflow cannot escalate the caller's token, so without
this the whole run is rejected with a startup failure.
---
 .github/workflows/maven.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index d8a84ba..bbc2906 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -14,6 +14,7 @@ on:
 permissions:
   contents: read
   pull-requests: read
+  actions: read        # the conclusion job verifies a covering run exists
 
 jobs:
   build: