chore(ci): adopt gate-based push/PR dedup (cuioss-organization v0.6.7)

[cuioss-oliver]

Bumps cuioss-organization refs to v0.6.7 and adopts the gate-based Maven build caller structure: drop the fork-only if: guard and add pull-requests: read. Quality + Sonar run on every push, PR analysis when a PR exists, no push/PR duplicate. Supersedes the closed bot SHA-only PR.

Summary by CodeRabbit

• Chores
  • Updated GitHub Actions workflows to reference newer versions of reusable workflow dependencies for continuous integration, dependency review, release automation, and security analysis.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 02c3c314-77b9-42eb-9f04-b7a696930347

📥 Commits

Reviewing files that changed from the base of the PR and between e0be13c and 4b1afb5.

📒 Files selected for processing (5)

• .github/workflows/dependabot-auto-merge.yml
• .github/workflows/dependency-review.yml
• .github/workflows/maven.yml
• .github/workflows/release.yml
• .github/workflows/scorecards.yml

---

📝 Walkthrough

Walkthrough

Five GitHub Actions workflow files update their pinned reusable workflow references from v0.6.6 to v0.6.7. Additionally, maven.yml adds pull-requests: read to workflow-level permissions and removes the if: condition that previously gated the build job.

Changes

Reusable Workflow Version Bump to v0.6.7

Layer / File(s)	Summary
Version pin updates across four workflows .github/workflows/dependabot-auto-merge.yml, .github/workflows/dependency-review.yml, .github/workflows/release.yml, .github/workflows/scorecards.yml	Each file updates its single uses: reference from the v0.6.6 pinned commit hash to the v0.6.7 pinned commit hash with no other changes.
maven.yml: permission addition, condition removal, and version bump .github/workflows/maven.yml	Adds pull-requests: read to workflow-level permissions, bumps the build job's reusable workflow reference to v0.6.7, and removes the if: condition that previously restricted job execution based on push vs. same-repo PR context.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐇 Hop, hop, a version goes up,
From six-point-six to six-point-seven's cup,
Permissions read, conditions freed,
The workflows bloom like clover and weed,
A rabbit approves — small changes indeed! 🌿

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: adopting a gate-based push/PR deduplication structure by updating workflow references to v0.6.7.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/adopt-gate-ci-structure

---

_{Comment @coderabbitai help to get the list of available commands.}