ci: migrate from CircleCI to GitHub Actions with cached core-jar build

[velo]

Summary

Migrates CI from CircleCI to GitHub Actions, restructured around a single cached core-jar build that every downstream job restores instead of rebuilding.

Architecture

• build — runs once: validates formatting, clean install -Pno-databases (builds all jars + database-independent unit tests), then saves ~/.m2/repository/io/github/openfeign/querydsl as a per-commit cache (build-artifacts-<sha>). Maven dependencies are cached by pom.xml hash via the reusable .github/actions/setup-build composite action (which also installs JDK 17/21/25 and generates toolchains.xml).
• Test jobs restore that cache and run only the relevant modules with -pl (core resolved from cache, not rebuilt) — -Deasyjacoco.skip=true disables the coverage aggregator so module-scoped builds resolve cleanly.
• Split by database (as before): mysql, postgresql, oracle, cubrid, firebird, mongodb, db2 — each with a service container and tests run on the runner so the hard-coded localhost JDBC URLs keep working unchanged.
• embedded — runs all embedded databases: H2, HSQLDB, Derby, SQLite, Turso.
• examples, examples-quarkus, examples-ksp, windows — examples and Windows build, restoring the cache where applicable.
• ci — single aggregation gate that fails if any job failed or all were skipped (intended new required status check).
• deploy.yml — snapshot (push to master/querydsl-*) and release (tags) to Maven Central, using .github/settings.xml.

.circleci/ is removed.

Bug fixed along the way

The old CircleCI embedded job used -Dgroups=…EmbeddedDatabase, but the suites are tagged with their specific DB name and JUnit 5 does not inherit tags through the EmbeddedDatabase marker interface — so the H2/HSQLDB/Derby/SQLite suites never actually ran in CI. The new embedded job lists every embedded tag explicitly, so they run for real.

Action required from a maintainer

1. Branch protection: change the required status check from build (CircleCI) to ci (this workflow). Until then this PR's required check won't be satisfiable, since CircleCI no longer runs.
2. Deploy secrets (for deploy.yml, only needed for publishing): CENTRAL_TOKEN_USERNAME, CENTRAL_TOKEN_PASSWORD, GPG_PASSPHRASE, GPG_KEY (base64-encoded key), under a central environment.

Notes

• Per-database jobs run only their relevant modules (-pl), so they no longer rebuild the whole reactor — that's the point of caching the core jars.
• SQLServer has tagged tests but had no CircleCI job and still has none here (no service was ever configured); can be added later.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WPLya3e3DqdYmfdaoH3L6o