chore: CI cleanup (#239)

## Summary

- Fix CodeQL `build-mode` warning — set to `manual` for `java-kotlin`,
`none` for `actions`
- Add `artifact-metadata: write` permission to docker build job so
attestation storage records are persisted
- Remove OWASP Dependency Check plugin from `build.gradle` and dead
`depcheck` job from `cve.yml` — fully redundant with the existing
`grype-gradle` SBOM scan

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: coopernetes

.github/workflows/codeql.yml

@@ -47,6 +47,7 @@ jobs:
         uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # ratchet:github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.language == 'java-kotlin' && 'manual' || 'none' }}
 
       - name: Build Java
         if: matrix.language == 'java-kotlin'

.github/workflows/cve.yml

@@ -101,42 +101,3 @@ jobs:
             grype-gradle-report.txt
             ${{ steps.scan.outputs.json }}
           retention-days: 30
-
-  depcheck:
-    name: Dependency Check (Gradle)
-    if: false # disabled — NVD API reliability issues; re-enable when stable
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
-
-      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # ratchet:actions/setup-java@v5
-        with:
-          distribution: temurin
-          java-version: 25
-          cache: gradle
-
-      - name: Cache NVD database
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # ratchet:actions/cache@v5
-        with:
-          path: ~/.gradle/dependency-check-data/
-          key: depcheck-db
-          save-always: true
-
-      - name: Run OWASP Dependency Check
-        timeout-minutes: 180
-        env:
-          NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
-          OSS_INDEX_USERNAME: ${{ secrets.OSS_INDEX_USERNAME }}
-          OSS_INDEX_TOKEN: ${{ secrets.OSS_INDEX_TOKEN }}
-        run: ./gradlew dependencyCheckAggregate --info
-
-      - name: Upload report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # ratchet:actions/upload-artifact@v7
-        with:
-          name: dependency-check-report
-          path: ${{ github.workspace }}/build/reports/dependency-check*
-          retention-days: 30

.github/workflows/docker-publish.yml

@@ -33,6 +33,7 @@ jobs:
       packages: write
       id-token: write
       attestations: write
+      artifact-metadata: write
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6

build.gradle

@@ -9,7 +9,6 @@ buildscript {
 
 plugins {
     id 'com.diffplug.spotless' version '8.4.0' apply false
-    id 'org.owasp.dependencycheck' version '12.2.2'
     id 'org.cyclonedx.bom' version '3.2.4'
     id 'com.github.node-gradle.node' version '7.1.0' apply false
 }
@@ -87,15 +86,6 @@ allprojects {
             url = 'https://repo.eclipse.org/content/groups/releases/'
         }
     }
-    dependencyCheck {
-        nvd.apiKey = System.getenv("NVD_API_KEY")
-        analyzers.ossIndex.username = System.getenv("OSS_INDEX_USERNAME")
-        analyzers.ossIndex.password = System.getenv("OSS_INDEX_TOKEN")
-        analyzers.ossIndex.url = 'https://api.guide.sonatype.com/'
-        failBuildOnCVSS = 5
-        suppressionFile = rootProject.file('gradle-suppressions.xml').toString()
-        failOnError = false
-    }
 }