Several fixes and improvements for CI

[orionpapadakis]

This PR:

• Merges integration-quarkus-langchain4j into build-and-run — single workflow with four sequential jobs (build → standalone-inference / quarkus-integration → perf-history), eliminating duplicate TornadoVM builds from two concurrent workflows racing on the same runner
• Fix TornadoVM rebuilding on every run — move TORNADO_ROOT to runner.tool_cache (outside workspace) so actions/checkout's git clean no longer wipes it; SHA-based sentinel skips rebuilds when upstream HEAD is unchanged
• max-parallel: 1 on build matrix — opencl and ptx variants run sequentially, no workspace conflicts
• Extract setup-java composite action — SDKMAN-based JDK setup deduplicated across all workflows (build-and-run, deploy-maven-central, prepare-release)
• Extract setup-tornadovm composite action — TornadoVM clone/build/sentinel logic extracted and reused; find dist deduplication via step output
• Extract run-inference composite action — inference invocation deduplicated across all model steps

[Copilot]

Pull request overview

This PR focuses on improving CI reliability and maintainability by centralizing repeated workflow logic into reusable composite actions and tightening access control for the workflow-rerun command flow.

Changes:

• Added permission-gating for /rerun PR comments to restrict who can trigger workflow reruns.
• Replaced inline TornadoVM setup logic in workflows with a cached composite action (setup-tornadovm).
• Replaced repeated inference + metrics/sidecar logic with a composite action (run-inference) and reduced clone depth for an external integration dependency.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
.github/workflows/rerun-workflow.yml	Adds commenter permission checks and gates rerun-related steps based on authorization.
.github/workflows/integration-quarkus-langchain4j.yml	Switches TornadoVM setup to the composite action; small CI improvements (shallow clone, persist APP_PID).
.github/workflows/build-and-run.yml	Refactors repeated inference steps to a composite action and TornadoVM setup to a shared cached action.
.github/actions/setup-tornadovm/action.yml	New composite action to clone/cache/build TornadoVM and export environment variables for subsequent steps.
.github/actions/run-inference/action.yml	New composite action to run inference and generate metrics + sidecar files consistently.

Comments suppressed due to low confidence (1)

.github/workflows/rerun-workflow.yml:96

• The workflow creates a reaction via reactions.createForIssueComment, but permissions: does not include reactions: write. Add that permission (or remove the reaction step) to avoid 403 failures at runtime.

      - name: Add reaction to comment
        if: steps.help.outputs.is_help != 'true' && steps.check_permission.outputs.authorized == 'true'
        uses: actions/github-script@v7
        with:
          script: |
            await github.rest.reactions.createForIssueComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              comment_id: context.payload.comment.id,

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[stratika]

Thanks @orionpapadakis. LGTM, there is a test run of the pipeline here.

One note (maybe for future addition) is to provide coverage for different quantization level (f16, q8, etc.). This would be useful, in my opinion.