ci: wire up GitHub Actions build + JFrog publish via shared reusable workflow

Adds .github/workflows/build-publish.yml (~30 lines) that calls
NrgXnat/xnat-ci-workflows/.github/workflows/gradle-build-publish.yml@v1
for the build → JFrog publish path. No Docker image yet (plugin
distribution image flow is deferred per project plan).

Trigger branches: main, develop, releases/*, github-build
  (github-build is the temporary validation branch, to be removed
   once the pipeline is verified on this repo)

workflow_dispatch with one boolean input (publish_jfrog) lets manual
runs cherry-pick whether to actually publish.

build.gradle change: add `credentials { ... }` to the XNAT_Artifactory
maven repository so CI's ORG_GRADLE_PROJECT_artifactoryUser/Token env
vars (sourced from org-level GitHub Secrets XNAT_ARTIFACTORY_USER/TOKEN)
authenticate the gradle publish. Local devs can put artifactoryUser/Token
in ~/.gradle/gradle.properties for manual publishes the same way.

Java version is pinned to 8 here because this branch line (XNAT 1.9.2)
still compiles with sourceCompatibility = VERSION_1_8. The
java-upgrade / *java21-rc branches will need their own caller with
java-version: '21' when those lines get wired up.

Verified the reusable workflow's version-detection step picks up
`version "0.9.0-SNAPSHOT"` from build.gradle (no gradle.properties
needed) — see NrgXnat/xnat-ci-workflows commit 40cc407.

Author: bin-xnatworks

.github/workflows/build-publish.yml

@@ -0,0 +1,41 @@
+name: Build and Publish
+
+# Thin caller around the shared reusable workflow in
+# NrgXnat/xnat-ci-workflows. All build/publish orchestration lives there;
+# this file only defines our triggers and the project-specific inputs
+# (java version, jar layout — plugin doesn't ship a Docker image yet).
+
+on:
+  push:
+    branches:
+      - main
+      - develop
+      - 'releases/*'
+      - github-build   # for pipeline testing; remove once verified
+  workflow_dispatch:
+    inputs:
+      publish_jfrog:
+        description: 'Publish jar to JFrog Artifactory (nrgxnat)'
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  build-publish:
+    uses: NrgXnat/xnat-ci-workflows/.github/workflows/gradle-build-publish.yml@v1
+    with:
+      # build.gradle still pins sourceCompatibility = VERSION_1_8 on the
+      # develop / main branches (XNAT 1.9.2 line). The java-upgrade /
+      # *java21-rc branches will need their own caller with
+      # java-version: '21'.
+      java-version: '8'
+      artifact-glob: 'build/libs/*.jar'
+      # No Docker image for plugins yet (per project plan).
+      publish-jfrog: ${{ github.event_name == 'push' || inputs.publish_jfrog }}
+      publish-ghcr:  false
+
+    # secrets: inherit passes XNAT_ARTIFACTORY_USER/TOKEN (org-level)
+    # through to the reusable workflow.
+    secrets: inherit

build.gradle

@@ -191,6 +191,12 @@ publishing {
             } else {
                 url "https://nrgxnat.jfrog.io/nrgxnat/libs-release-local"
             }
+            // CI injects ORG_GRADLE_PROJECT_artifactoryUser/Token env vars.
+            // Local devs can set artifactoryUser/Token in ~/.gradle/gradle.properties.
+            credentials {
+                username = (project.findProperty('artifactoryUser')  ?: System.getenv('ARTIFACTORY_USER'))  ?: ''
+                password = (project.findProperty('artifactoryToken') ?: System.getenv('ARTIFACTORY_TOKEN')) ?: ''
+            }
         }
     }
 }