ci: add reproducible repository verification

[juherr]

Summary

• add a single ./scripts/verify.sh contributor command with failure-tail logging and JaCoCo summaries
• verify the consumer dependency graph from an empty temporary Maven repository
• pin actionlint and zizmor through mise and run them locally and in CI
• explicitly disable persisted checkout credentials in documentation workflows
• document the new verification path for contributors

Why

The 0.1.0 preparation exposed three avoidable sources of wasted time: stale locally installed POMs produced a misleading dependency tree, condensed Maven output hid the actual failing module, and workflow mistakes were only found during review. These checks make those failures reproducible and actionable without adding a custom prose-linting implementation.

Impact

Contributors get one release-readiness command and CI gains dedicated workflow linting plus an isolated consumer dependency check. The published library API and runtime behavior are unchanged.

Validation

• ./scripts/verify.sh
• full 31-module Maven reactor passed
• isolated Maven repository contains only datex4j-model-v3_7 for the consumer test
• XML line coverage: 85.4%
• validation line coverage: 90.5%
• actionlint 1.7.12
• zizmor 1.28.0 with no medium-or-higher findings
• ShellCheck and bash -n
• workflow YAML parsing
• git diff --check

Summary by CodeRabbit

• New Features

  • Added a single verification command covering workflow checks, security scanning, Maven builds, consumer dependency isolation, and coverage reporting.
  • Added consumer isolation verification to detect unexpected dependency variants.
  • Verification failures now provide actionable log output, with complete logs saved for review.

• Documentation

  • Updated contributor guidance and the changelog with the new verification workflow.
  • Documented required tool versions and setup steps.

• Security

  • Improved documentation workflow checkout security by disabling credential persistence.

[coderabbitai]

Warning

Review limit reached

@juherr, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 12 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0e30f3c8-e3b0-402e-967e-8276bf9f6b5c

📥 Commits

Reviewing files that changed from the base of the PR and between 98951c1 and a152160.

📒 Files selected for processing (1)

• scripts/verify.sh

📝 Walkthrough

Walkthrough

The pull request adds unified verification scripts for workflow linting, Maven validation, consumer dependency isolation, and coverage reporting. CI runs the new checks, documentation checkouts disable credential persistence, and contributor documentation records the updated verification command.

Changes

Verification and CI policy

Layer / File(s)	Summary
Verification scripts and contributor workflow mise.toml, scripts/verify*.sh, CONTRIBUTING.md, CHANGELOG.md	Adds logged verification, coverage reporting, isolated consumer dependency validation, pinned tooling, and documentation for the unified verification command.
CI verification and checkout policy .github/workflows/ci.yml, .github/workflows/docs.yml	Adds workflow-linting and consumer-isolation jobs, and disables credential persistence for documentation checkouts.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant verify.sh
  participant WorkflowLinters
  participant Maven
  participant ConsumerIsolation
  participant CoverageReports
  verify.sh->>WorkflowLinters: run actionlint and zizmor
  verify.sh->>Maven: run targeted and full verification
  verify.sh->>ConsumerIsolation: validate the consumer dependency tree
  verify.sh->>CoverageReports: calculate module line coverage

Loading

Possibly related PRs

• juherr/datex4j#41: Adds related consumer-classpath isolation checks and v3_7 dependency alignment.

Poem

I hop through checks both swift and bright,
Linting workflows day and night.
Maven paths stay neatly clear,
Consumer models persevere.
Logs and coverage bloom in view—
A verification trail for you!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding reproducible repository verification in CI and via a contributor script.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch juherr/recommandations-proposees

---

_{Comment @coderabbitai help to get the list of available commands.}

[juherr]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[juherr]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/verify.sh`:
- Around line 31-37: Update the awk summary in the verification script to handle
total equal to zero before calculating or printing the percentage. Emit a valid
zero-coverage result for header-only JaCoCo reports, while preserving the
existing covered/total percentage output when total is greater than zero.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: adce086a-3e71-4dc7-9b38-f32c052a1076

📥 Commits

Reviewing files that changed from the base of the PR and between 80e797c and 98951c1.

📒 Files selected for processing (7)

• .github/workflows/ci.yml
• .github/workflows/docs.yml
• CHANGELOG.md
• CONTRIBUTING.md
• mise.toml
• scripts/verify-consumer-isolation.sh
• scripts/verify.sh