chore(ci): adopt gate-based push/PR dedup (cuioss-organization v0.6.7)

[cuioss-oliver]

Bumps cuioss-organization refs to v0.6.7 and adopts the gate-based Maven build caller structure: drop the fork-only if: guard and add pull-requests: read. Quality + Sonar run on every push, PR analysis when a PR exists, no push/PR duplicate. Supersedes the closed bot SHA-only PR.

Summary by CodeRabbit

• Chores
  • Updated GitHub Actions workflow references to latest versions across multiple workflows for improved compatibility and maintenance.
  • Enhanced workflow permissions to support continued CI/CD execution and security processes.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ba9603b9-1c88-4106-9685-d990f99d3772

📥 Commits

Reviewing files that changed from the base of the PR and between c01638b and 19d267a.

📒 Files selected for processing (5)

• .github/workflows/dependabot-auto-merge.yml
• .github/workflows/dependency-review.yml
• .github/workflows/maven.yml
• .github/workflows/release.yml
• .github/workflows/scorecards.yml

---

📝 Walkthrough

Walkthrough

Five GitHub Actions workflow files update their pinned reusable workflow uses: references from v0.6.6 to v0.6.7. Additionally, maven.yml adds pull-requests: read to its top-level permissions block.

Changes

CI Workflow Version Bump

Layer / File(s)	Summary
Bump all reusable workflow refs to v0.6.7 .github/workflows/maven.yml, .github/workflows/dependabot-auto-merge.yml, .github/workflows/dependency-review.yml, .github/workflows/release.yml, .github/workflows/scorecards.yml	All five workflow files replace the pinned commit SHA (and version comment) from v0.6.6 to v0.6.7. maven.yml also adds pull-requests: read to the top-level permissions block.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐇 Hop, hop, a version bump in the air,
From six-point-six to six-point-seven with care,
The workflows spin their reusable wheel,
Pull-requests: read — a new permission deal!
A tiny leap, but the CI runs fair. 🌿

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main changes: upgrading cuioss-organization dependencies to v0.6.7 and adopting a gate-based push/PR deduplication mechanism.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/adopt-gate-ci-structure

---

_{Comment @coderabbitai help to get the list of available commands.}