Pin reusable ci-java workflow to a SHA/tag instead of @main

[amavashev]

Issue

The org-wide reusable CI workflow at runcycles/.github/.github/workflows/ci-java.yml is referenced from every Cycles Java repo using @main:

```yaml
uses: runcycles/.github/.github/workflows/ci-java.yml@main
```

This is mutable — a malicious or accidental push to `runcycles/.github@main` propagates to every consuming repo's CI on the next run, which undercuts the otherwise-pinned-action supply-chain posture in those repos (Scorecard PRs A/B have pinned all third-party actions to SHAs everywhere except this org-internal reference).

Affected repos (sample)

• cycles-spring-boot-starter
• cycles-spring-ai-starter
• cycles-client-python (Python equivalent if it uses a reusable workflow)
• cycles-client-typescript (TS equivalent)
• cycles-mcp-server

Proposed fix

Either:

1. Tag the reusable workflow (`v1`, `v2`, ...) and have consumers reference `@v1`. Tags can be moved within a major version line if needed, while minor/patch bumps move the tag. This is the GitHub Actions ecosystem convention.
2. Pin to SHAs in each consuming repo's CI workflow, same as third-party actions. More tedious but fully reproducible.

Recommendation: option 1 — release `v1` from current main, update all consumers via Dependabot (GitHub Actions ecosystem already covers reusable-workflow refs).

Surface

Original review finding from PR #1 on cycles-spring-ai-starter (2026-05-12). Tracking org-wide rather than per-repo because the fix is a single change in this repo plus downstream consumer bumps.

[amavashev]

Status (2026-05-12)

Source-side: done. v1 tag cut from `main` HEAD at commit `020b98f` and pushed. Consumers can now reference `runcycles/.github/.github/workflows/ci-.yml@v1` (Java / Python / Rust / TypeScript reusables are all covered).

Within the v1 line the tag moves for backward-compatible changes; breaking changes will bump to v2 with a matching Dependabot bump on consumers.

Consumer bumps remaining (per-repo PRs):

• `cycles-client-python` — PR #61
• `cycles-spring-boot-starter`
• `cycles-spring-ai-starter`
• `cycles-server`
• `cycles-server-admin`
• `cycles-client-typescript`
• `cycles-client-rust`
• `cycles-mcp-server`
• `cycles-openai-agents`
• `cycles-openclaw-budget-guard`
• `cycles-protocol`
• `langchain-runcycles`

Each bump is a one-line change: `ci-.yml@main` → `ci-.yml@v1`. Dependabot's `github-actions` ecosystem will track future v2 bumps once any of these consumers picks up the v1 ref.

Leaving open until the remaining consumers bump.