ci: inline pipeline workflow (ADR 004) (#117)

Inline pipeline orchestration per ADR 004 while keeping shared job-*
workflow references.

- Replace delegating pipe job with inlined job orchestration
- Add quality-gate aggregator job
- Split auto-labeler into separate workflow


On-behalf-of: @SAP <bastian.echterhoelter@sap.com>

Signed-off-by: Bastian Echterhölter <bastian.echterhoelter@sap.com>

Author: nexus49

.github/workflows/auto-labeler.yml

@@ -0,0 +1,17 @@
+name: auto-labeler
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
+jobs:
+  auto-labeler:
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    uses: platform-mesh/.github/.github/workflows/job-auto-labeler.yml@main

.github/workflows/pipeline.yml

@@ -1,4 +1,5 @@
 name: ci
+
 on:
   push:
     branches:
@@ -10,19 +11,97 @@ on:
 
 permissions:
   contents: write
+  id-token: write
+  issues: write
   packages: write
   pull-requests: write
 
+concurrency:
+  group: ${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  pipe:
-    concurrency:
-      group: ${{ github.ref }}
-      cancel-in-progress: true
-    uses: platform-mesh/.github/.github/workflows/pipeline-golang-app.yml@main
+  lint:
+    uses: platform-mesh/.github/.github/workflows/job-golang-lint.yml@main
+    with:
+      useMake: true
+
+  test:
+    uses: platform-mesh/.github/.github/workflows/job-golang-test-source.yml@main
     secrets: inherit
     with:
-      imageTagName: ghcr.io/platform-mesh/example-httpbin-operator
-      repoVersionUpdate: platform-mesh/helm-charts
       useMake: true
       useLocalCoverageConfig: true
 
+  docker-build:
+    if: github.event_name == 'pull_request'
+    uses: platform-mesh/.github/.github/workflows/job-docker-build-push.yml@main
+    with:
+      imageTagName: ghcr.io/platform-mesh/example-httpbin-operator
+    secrets: inherit
+
+  quality-gate:
+    if: always()
+    permissions: {}
+    needs: [lint, test, docker-build]
+    runs-on: ubuntu-latest
+    timeout-minutes: 1
+    steps:
+      - name: Check results
+        run: |
+          if [[ "${{ needs.lint.result }}" != "success" ]]; then
+            echo "lint failed"
+            exit 1
+          fi
+          if [[ "${{ needs.test.result }}" != "success" ]]; then
+            echo "test failed"
+            exit 1
+          fi
+          # docker-build is skipped on main pushes — allow skipped
+          if [[ "${{ needs.docker-build.result }}" != "success" && "${{ needs.docker-build.result }}" != "skipped" ]]; then
+            echo "docker-build failed"
+            exit 1
+          fi
+
+  create-version:
+    if: github.ref == 'refs/heads/main'
+    uses: platform-mesh/.github/.github/workflows/job-create-version.yml@main
+    secrets: inherit
+
+  docker-build-push:
+    if: github.ref == 'refs/heads/main'
+    needs: [create-version, lint, test]
+    uses: platform-mesh/.github/.github/workflows/job-docker-build-push.yml@main
+    with:
+      imageTagName: ghcr.io/platform-mesh/example-httpbin-operator
+      version: ${{ needs.create-version.outputs.version }}
+      multiarch: true
+    secrets: inherit
+
+  update-version:
+    if: github.ref == 'refs/heads/main'
+    needs: [create-version, docker-build-push]
+    uses: platform-mesh/.github/.github/workflows/job-chart-version-update.yml@main
+    secrets: inherit
+    with:
+      appVersion: ${{ needs.create-version.outputs.version }}
+      chart: example-httpbin-operator
+      targetRepository: platform-mesh/helm-charts
+
+  sbom:
+    if: github.ref == 'refs/heads/main'
+    needs: [create-version, docker-build-push]
+    uses: platform-mesh/.github/.github/workflows/job-sbom.yml@main
+    with:
+      imageReference: ghcr.io/platform-mesh/example-httpbin-operator:${{ needs.create-version.outputs.version }}
+
+  image-ocm:
+    if: github.ref == 'refs/heads/main'
+    needs: [create-version, docker-build-push, sbom]
+    uses: platform-mesh/.github/.github/workflows/job-image-ocm.yml@main
+    secrets: inherit
+    with:
+      imageReference: ghcr.io/platform-mesh/example-httpbin-operator:${{ needs.create-version.outputs.version }}
+      appVersion: ${{ needs.create-version.outputs.version }}
+      repoName: example-httpbin-operator
+      commit: ${{ github.sha }}