Re: Centralized CodeQL and Scorecards workflows

Hi Gary,

On 17.04.2026 16:06, Gary Gregory wrote:
> If this is going in the direction of Log4j, then it's going to be a real
> problem in the long term: that integration with GitHub actions is so deep
> and complicated, I've given up trying to understand it.

The problem with `logging-parent` is that, until last week, the
workflows were *part* of the release, which added useless delays
whenever a change was needed. The situation was pretty much like
`commons-parent`, which needs to be released dozens of times a year.

This is not my plan here: the reusable workflows will be used directly
from *master* and changes will propagate immediately. IIRC you just need
to re-run the workflow in the downstream project to see the effects of
an upstream change.

Piotr