Implement workflow orchestration

[nscuro]

Description

Adds a new workflow-engine module that facilitates orchestration of workflows.

This implements ADR-002: Workflow Orchestration with the ultimate goal to implement ADR-001: Drop Kafka Dependency.

This PR does not include actual workflow implementations. Those will be added separately. For the time being, refer to some draft implementations in the older workflow-v2 branch: https://github.com/DependencyTrack/hyades-apiserver/tree/workflow-v2/src/main/java/org/dependencytrack/workflow

Addressed Issue

TODO

Additional Details

TODO

Checklist

• I have read and understand the contributing guidelines
• This PR fixes a defect, and I have provided tests to verify that the fix is effective
• This PR implements an enhancement, and I have provided tests to verify that it works as intended
• This PR introduces changes to the database model, and I have updated the migration changelog accordingly
• This PR introduces new or alters existing behavior, and I have updated the documentation accordingly

[codacy-production]

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation	Diff coverage
❌ -1.05% (target: -1.00%)	✅ 70.89% (target: 70.00%)

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (fd90635)	27304	22049	80.75%
Head commit (42519d7)	30489 (+3185)	24300 (+2251)	79.70% (-1.05%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#1138)	3185	2258	70.89%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings    Change summary preferences

[Copilot]

Pull Request Overview

This PR implements a new workflow orchestration module by introducing a workflow engine along with related components for executing and monitoring activities.

• Introduces core components like ActivityTaskManager, ActivityTask, ActivityGroup, and ActivityContext.
• Adds client APIs and REST resources for workflow runs along with serializers and test cases.

Reviewed Changes

Copilot reviewed 117 out of 121 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
workflow-engine/src/main/java/org/dependencytrack/workflow/engine/ActivityTaskManager.java	Implements task polling, processing, and abandonment logic for workflow activities.
workflow-engine/src/main/java/org/dependencytrack/workflow/engine/ActivityTask.java	Defines the record for individual activity tasks.
workflow-engine/src/main/java/org/dependencytrack/workflow/engine/ActivityGroup.java	Groups activity names and manages concurrency for a set of activities.
workflow-engine/src/main/java/org/dependencytrack/workflow/engine/ActivityExecutor.java	Declares the interface for activity executors.
workflow-engine/src/main/java/org/dependencytrack/workflow/engine/ActivityContext.java	Provides context for executing activities including heartbeat logic.
workflow-engine/src/main/java/org/dependencytrack/workflow/engine/ActivityClient.java	Creates a client wrapper for invoking activity calls.
workflow-engine/src/main/java/org/dependencytrack/workflow/engine/ActivityCallOptions.java	Specifies options for activity invocation including retry policy.
apiserver/...	Contains REST resources, response models, and serializers for workflow runs.
apiserver/src/main/java/org/dependencytrack/context/...	Provides DI support and factory/binder for WorkflowEngine integration.

Files not reviewed (4)

• apiserver/pom.xml: Language not supported
• coverage-report/pom.xml: Language not supported
• pom.xml: Language not supported
• workflow-engine/pom.xml: Language not supported

Comments suppressed due to low confidence (1)

workflow-engine/src/main/java/org/dependencytrack/workflow/engine/ActivityTaskManager.java:124

• [nitpick] The timeout scenario for task completion is not covered by tests; consider adding tests to validate behavior when a TimeoutException is thrown during task completion.

engine.completeActivityTask(task, result).join();