@@ -11,40 +11,6 @@ permissions:
   contents: read
 
 jobs:
-  backend-test:
-    name: Backend Tests
-    runs-on: truenas-website
-    timeout-minutes: 30
-
-    steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
-        with:
-          java-version: '21'
-          distribution: temurin
-          cache: maven
-
-      - name: Set up Node.js 24
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
-        with:
-          node-version: '24'
-          cache: npm
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Run Backend Tests
-        run: ./mvnw --batch-mode test
-
-      - name: Upload Test Results
-        if: always()
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-        with:
-          name: backend-test-results
-          path: target/surefire-reports/
-          if-no-files-found: ignore
-          retention-days: 7
-
   frontend-build:
     name: Frontend Build
     runs-on: truenas-website
@@ -53,17 +19,21 @@ jobs:
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
-      - name: Set up Node.js 24
+      - name: Set up Node.js 26.10.0
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
-          node-version: '24'
+          node-version: '26.10.0'
           cache: npm
           cache-dependency-path: frontend/package-lock.json
 
       - name: Install Dependencies
         working-directory: ./frontend
         run: npm ci
 
+      - name: Audit Frontend Dependencies
+        working-directory: ./frontend
+        run: npm audit --audit-level=low
+
       - name: Build Frontend
         working-directory: ./frontend
         run: npm run build
@@ -77,9 +47,9 @@ jobs:
           retention-days: 7
 
   docker-build:
-    name: Docker Build
+    name: Backend Tests, Runtime Smoke and Vulnerability Scan
     runs-on: truenas-website
-    needs: [backend-test, frontend-build]
+    needs: [frontend-build]
     timeout-minutes: 40
 
     steps:
@@ -95,14 +65,14 @@ jobs:
             cert=/run/buildkit/tls/client.pem
             key=/run/buildkit/tls/client.key
 
-      - name: Build and Smoke Test Runtime Image
+      - name: Test Backend, Verify Linked Runtime and Scan Vulnerabilities
         uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           file: ./Dockerfile
-          target: smoke-test
+          target: security-scan
           platforms: linux/amd64
           push: false
           cache-from: type=gha,version=2,scope=truenas-15ed4a3293d99fba
           cache-to: type=gha,version=2,mode=max,scope=truenas-15ed4a3293d99fba
-          no-cache-filters: smoke-test
+          no-cache-filters: smoke-test,security-scan
@@ -79,6 +79,7 @@ jobs:
           context: .
           file: ./Dockerfile
           target: runtime
+          no-cache-filters: smoke-test,security-scan
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 
@@ -1 +1 @@
-24
+26.10.0
@@ -1,89 +1,92 @@
-# Maven's resource lifecycle builds the Vite assets, so provide both toolchains
-# to the builder while keeping the runtime image limited to the JRE.
-FROM node:24-alpine AS node-toolchain
-
-FROM maven:3.9.16-eclipse-temurin-21-alpine AS backend-build
+# syntax=docker/dockerfile:1
+# Java and Node are build tools only; the published image contains a jlink runtime.
+FROM node:26.10.0-alpine@sha256:0b36e8c136b94cd4fcf02188228e76c31ad5872eef3fec8cbd2eee500cfd9e80 AS node-toolchain
 
+FROM eclipse-temurin:25.0.4.1_1-jdk-alpine-3.24@sha256:3fd2d245c4e0eba615fe366a71b8bd25f5db7104f53e4026b24bf508b880bd2a AS backend-build
 RUN apk add --no-cache libstdc++
 COPY --from=node-toolchain /usr/local/ /usr/local/
-
 WORKDIR /app
-
-COPY pom.xml ./
-COPY mvnw ./
+COPY pom.xml mvnw ./
 COPY .mvn ./.mvn
 COPY frontend ./frontend
 COPY src ./src
 
-# The Maven lifecycle runs npm ci and the frontend build before packaging.
-RUN ./mvnw --batch-mode clean package -DskipTests
-
-# Stage 3: Runtime
-FROM eclipse-temurin:21-jre-alpine AS runtime-base
-
-WORKDIR /app
-
-# Create non-root user
-RUN addgroup -g 1001 -S spring && \
+# Run the same backend tests and frontend checks used for local verification.
+RUN ./mvnw --batch-mode --no-transfer-progress clean verify
+
+FROM backend-build AS java-runtime
+# jdeps finds static JDK dependencies. Reflection, charset and service-provider
+# use in Spring/Hibernate/Netty/PDFBox needs the additional modules below.
+RUN mkdir /app/unpacked && cd /app/unpacked && \
+    jar -xf /app/target/website-0.0.1-SNAPSHOT.jar && \
+    modules="$(jdeps --ignore-missing-deps --multi-release 25 --recursive \
+      --print-module-deps --class-path 'BOOT-INF/lib/*' BOOT-INF/classes)" && \
+    jlink --add-modules "$modules,java.desktop,java.instrument,java.management,java.naming,java.sql,jdk.charsets,jdk.crypto.ec,jdk.localedata,jdk.unsupported,jdk.zipfs" \
+      --strip-debug --no-header-files --no-man-pages --compress=zip-6 \
+      --output /opt/java-runtime
+
+FROM alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS runtime-base
+RUN apk upgrade --no-cache && \
+    apk add --no-cache ca-certificates libstdc++ zlib fontconfig font-dejavu && \
+    addgroup -g 1001 -S spring && \
     adduser -u 1001 -S spring -G spring
-
-# Copy JAR from build stage
-COPY --from=backend-build /app/target/*.jar app.jar
-
-# Copy resources directory (for markdown files)
-COPY --from=backend-build /app/src/main/resources ./resources
-
-# Change ownership
-RUN chown -R spring:spring /app
-
-# Switch to non-root user
-USER spring:spring
-
-# Expose port
+ENV JAVA_HOME=/opt/java
+ENV PATH="$JAVA_HOME/bin:$PATH" \
+    JAVA_OPTS="-Xms256m -Xmx512m -XX:+UseG1GC -XX:MaxGCPauseMillis=200 -Djava.awt.headless=true"
+WORKDIR /app
+COPY --from=java-runtime /opt/java-runtime /opt/java
+COPY --from=backend-build --chmod=0444 /app/target/website-0.0.1-SNAPSHOT.jar /app/app.jar
+USER 1001:1001
 EXPOSE 8080
-
-# Actuator exposes the application's health status without relying on a
-# client-information API as a readiness signal.
 HEALTHCHECK --interval=30s --timeout=3s --start-period=40s --retries=3 \
-  CMD wget --no-verbose --tries=1 --spider http://localhost:8080/actuator/health || exit 1
-
-# Set JVM options
-ENV JAVA_OPTS="-Xms256m -Xmx512m -XX:+UseG1GC -XX:MaxGCPauseMillis=200"
+  CMD wget -q -T 2 -O /dev/null http://127.0.0.1:8080/actuator/health || exit 1
+ENTRYPOINT ["sh", "-c", "exec java $JAVA_OPTS -jar /app/app.jar"]
 
-# Run application
-ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -jar app.jar"]
-
-# BuildKit runs this stage as the same non-root runtime user. Starting the
-# packaged application here verifies the runtime filesystem without needing a
-# Docker daemon or exporting an image from the remote builder.
+# Run the packaged app as the production UID to verify the linked Java modules,
+# PDF extraction, content parsing, and the actual generated web assets.
 FROM runtime-base AS smoke-test
 RUN set -eu; \
-    java $JAVA_OPTS -jar app.jar > /tmp/website-smoke.log 2>&1 & \
+    test "$(id -u)" = 1001; \
+    test ! -e /opt/java/bin/javac; \
+    java -version; \
+    java $JAVA_OPTS -jar /app/app.jar > /tmp/website-smoke.log 2>&1 & \
     app_pid=$!; \
     cleanup() { kill "$app_pid" 2>/dev/null || true; wait "$app_pid" 2>/dev/null || true; }; \
     trap cleanup EXIT; \
     attempt=0; \
     while [ "$attempt" -lt 60 ]; do \
       if ! kill -0 "$app_pid" 2>/dev/null; then cat /tmp/website-smoke.log; exit 1; fi; \
-        if wget -T 5 -qO /tmp/website-health.json http://127.0.0.1:8080/actuator/health; then break; fi; \
+      if wget -T 5 -qO /tmp/website-health.json http://127.0.0.1:8080/actuator/health; then break; fi; \
       attempt=$((attempt + 1)); \
       sleep 2; \
     done; \
     if [ "$attempt" -ge 60 ]; then cat /tmp/website-smoke.log; exit 1; fi; \
-    if ! grep -Eq '"status"[[:space:]]*:[[:space:]]*"UP"' /tmp/website-health.json; then cat /tmp/website-health.json; exit 1; fi; \
-    if ! wget -T 5 -qO /tmp/website-client-info.json http://127.0.0.1:8080/api/client/info; then cat /tmp/website-smoke.log; exit 1; fi; \
-    grep -Eq '"hostname"[[:space:]]*:[[:space:]]*"javadevjt\.tech"' /tmp/website-client-info.json; \
+    grep -Eq '"status"[[:space:]]*:[[:space:]]*"UP"' /tmp/website-health.json; \
+    wget -T 5 -qO /tmp/website-client-info.json http://127.0.0.1:8080/api/client/info; \
+    grep -Eq '"hostname"[[:space:]]*:[[:space:]]*"javadevjt[.]tech"' /tmp/website-client-info.json; \
     grep -Eq '"username"[[:space:]]*:[[:space:]]*"visitor"' /tmp/website-client-info.json; \
-    if ! wget -T 5 -qO /tmp/website-portfolio.json http://127.0.0.1:8080/api/content/portfolio/list; then cat /tmp/website-smoke.log; exit 1; fi; \
-    if ! grep -Eq '"filename"|RouteListToTesla' /tmp/website-portfolio.json; then cat /tmp/website-portfolio.json; exit 1; fi; \
-    if ! wget -T 5 -qO /tmp/website-index.html http://127.0.0.1:8080/; then cat /tmp/website-smoke.log; exit 1; fi; \
-    js_asset="$(grep -oE 'src="/assets/[^"]+\.js"' /tmp/website-index.html | head -n 1 | cut -d '"' -f 2)"; \
-    css_asset="$(grep -oE 'href="/assets/[^"]+\.css"' /tmp/website-index.html | head -n 1 | cut -d '"' -f 2)"; \
+    wget -T 5 -qO /tmp/website-portfolio.json http://127.0.0.1:8080/api/content/portfolio/list; \
+    grep -q 'Discord Option Tailer' /tmp/website-portfolio.json; \
+    grep -q 'Embedify' /tmp/website-portfolio.json; \
+    wget -T 5 -qO /tmp/website-resume.json http://127.0.0.1:8080/api/content/resume; \
+    grep -q 'Senior Software Engineer' /tmp/website-resume.json; \
+    wget -T 5 -qO /tmp/website-index.html http://127.0.0.1:8080/; \
+    js_asset="$(grep -oE 'src="/assets/[^"]+[.]js"' /tmp/website-index.html | head -n 1 | cut -d '"' -f 2)"; \
+    css_asset="$(grep -oE 'href="/assets/[^"]+[.]css"' /tmp/website-index.html | head -n 1 | cut -d '"' -f 2)"; \
     test -n "$js_asset" && test -n "$css_asset"; \
     wget -T 5 -qO /tmp/website-app.js "http://127.0.0.1:8080$js_asset"; \
     wget -T 5 -qO /tmp/website-app.css "http://127.0.0.1:8080$css_asset"; \
     test -s /tmp/website-app.js && test -s /tmp/website-app.css
 
-# Keep normal image builds on the production runtime stage; CI explicitly
-# selects smoke-test to execute the verification above.
+# Scan the runtime filesystem, including OS packages and nested Java libraries.
+# CI always reruns this stage against fresh vulnerability data.
+FROM aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 AS security-scan
+COPY --from=smoke-test / /scan-root/
+RUN trivy rootfs --scanners vuln --exit-code 1 --timeout 10m /scan-root && touch /scan-passed
+
+# Default builds publish only the application and linked runtime.
 FROM runtime-base AS runtime
+# This read-only build mount forces publication to depend on a scan of this
+# exact runtime-base filesystem without shipping the scanner or scan files.
+RUN --mount=type=bind,from=security-scan,source=/scan-passed,target=/scan-passed \
+    test -f /scan-passed
@@ -6,8 +6,8 @@ The [maintenance audit](docs/maintenance-audit-2026-09-28.md) records the code r
 
 ## Requirements
 
-- Java 21, with `JAVA_HOME` pointing to that installation.
-- Node.js 24 LTS and npm; `.nvmrc` selects the supported Node major.
+- Java 25, with `JAVA_HOME` pointing to that installation.
+- Node.js 26.10.0 and npm; `.nvmrc` selects the supported version.
 - The checked-in Maven wrapper downloads the project's Maven distribution.
 
 ## Build and test
@@ -45,7 +45,9 @@ Vite serves the development UI on port 3000. `npm run build` runs TypeScript che
 
 [CI](.github/workflows/ci.yml) and [deployment configuration](.github/workflows/deploy.yml) contain the automated build and image-publication rules. See the [maintenance audit](docs/maintenance-audit-2026-09-28.md) for the private-runner contract, validation evidence, and activation boundaries.
 
-The [Dockerfile](Dockerfile) builds the frontend and Spring Boot application. Container and reverse-proxy settings live under [infrastructure](infrastructure/). Verify the locally installed Docker or Podman Compose provider before running its commands.
+The [Dockerfile](Dockerfile) tests and builds with Java 25 and Node 26, then uses `jdeps` and `jlink` to create the Java runtime. The final Alpine image contains the application and linked runtime, runs as UID/GID 1001, and excludes Maven, Node, Java compiler tools, and source resources outside the JAR. CI boots that image, exercises PDF/content/UI routes, and scans its filesystem with Trivy before image publication. Any reported OS or Java-library vulnerability fails the scan; the scan uses current advisory data rather than guaranteeing future vulnerability absence.
+
+Container and reverse-proxy settings live under [infrastructure](infrastructure/). Verify the locally installed Docker or Podman Compose provider before running its commands.
 
 ## Contributing
 
 
@@ -2,6 +2,12 @@
 
 This records the pre-release audit and local verification. The owner subsequently authorized adding Discord Option Tailer and Embedify, publishing the changes, and deploying the resulting image; release execution is tracked separately.
 
+## Release hardening follow-up
+
+After Adoptium's version-discovery API timed out during CI, Java compilation and tests were moved into the pinned Docker builder. The current source uses Java 25 LTS, Node 26.10.0, Spring Boot 4.1.1, Exec Maven Plugin 3.6.4, and React Router 8.4.0. Java 27 is outside stable Spring Boot's documented compatibility range; Java 25 is the maintained LTS choice within that range.
+
+The multi-stage image now derives its Java modules with `jdeps` and creates a reduced runtime with `jlink`. The final Alpine image runs as UID/GID 1001 and contains the linked runtime and application JAR, without the Node/Maven build tools. CI exercises the linked runtime, PDF text extraction, selected catalogue entries and generated assets, then scans runtime OS packages and Java libraries with Trivy. Frontend dependencies have a separate npm audit gate. These gates fail on known findings and do not claim to eliminate every possible vulnerability. The detailed baseline audit and its earlier local results follow.
+
 ## Scope and acceptance
 
 Review all maintained backend, frontend, content, build, and deployment sources; update dependencies using verified stable releases; make the existing GitHub Actions build compatible with the user's private runner; report projects missing from the catalogue without adding them; update current job-title references to Senior Software Engineer while retaining job function.