ci: enforce backend tests and update action runtimes

Author: javaDevJT

.dockerignore

@@ -39,11 +39,6 @@ logs
 !README.md
 !src/main/resources/**/*.md
 
-# Test files
-**/*.test.*
-**/__tests__
-**/test
-
 # CI/CD
 .github
 .gitlab-ci.yml

.github/workflows/ci.yml

@@ -17,10 +17,10 @@ jobs:
     timeout-minutes: 40
 
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Set up authenticated remote BuildKit
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
         with:
           driver: remote
           endpoint: tcp://buildkit:1234
@@ -30,7 +30,7 @@ jobs:
             key=/run/buildkit/tls/client.key
 
       - name: Test Backend, Verify Linked Runtime and Scan Vulnerabilities
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: ./Dockerfile

.github/workflows/deploy.yml

@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: Checkout tested main commit
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: ${{ github.event.workflow_run.head_sha }}
           fetch-depth: 1
@@ -47,7 +47,7 @@ jobs:
           test "$(git rev-parse refs/remotes/origin/main)" = "$TESTED_SHA"
 
       - name: Set up authenticated remote BuildKit
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
         with:
           driver: remote
           endpoint: tcp://buildkit:1234
@@ -57,15 +57,15 @@ jobs:
             key=/run/buildkit/tls/client.key
 
       - name: Log in to Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GHCR_PAT }}
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           context: git
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
@@ -74,7 +74,7 @@ jobs:
             type=sha,prefix=main-
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: ./Dockerfile

Dockerfile

@@ -12,7 +12,7 @@ COPY frontend ./frontend
 COPY src ./src
 
 # Run the same backend tests and frontend checks used for local verification.
-RUN ./mvnw --batch-mode --no-transfer-progress clean verify && \
+RUN ./mvnw --batch-mode --no-transfer-progress -DfailIfNoTests=true clean verify && \
     cd frontend && npm audit --audit-level=low
 
 FROM backend-build AS java-runtime

docs/maintenance-audit-2026-09-28.md

@@ -111,7 +111,7 @@ Playwright verified the desktop title and terminal styling, `gm`/`cat about.txt`
 
 The owner-reviewed inventory initially contained 24 repositories: six represented projects, four missing public candidates, eight missing private candidates, five forks, and one profile repository. The seven-entry audit baseline included one planned concept without a matching owned repository. The detailed inventory is retained locally because it names unselected private projects. After this audit, the owner selected Discord Option Tailer and Embedify for the release; their catalogue entries are the only approved additions.
 
-### Final integration record
+### Initial local validation record
 
 The final local build, dependency checks, workflow review, and executable-JAR/browser smoke checks are complete.
 
@@ -124,3 +124,15 @@ The final local build, dependency checks, workflow review, and executable-JAR/br
 - Workflow evidence: YAML parsing, inline shell syntax, Docker smoke shell syntax, and action pin checks passed. No local container daemon was available; private-runner/remote-BuildKit execution remains unverified.
 - Cleanup: the task-owned Java runtime on port 18080 and isolated `website-audit` browser were stopped after verification. No test server is being handed off.
 - Both staged and unstaged whitespace checks passed. The index contains only the deliberate dependency/generated-asset removals; source changes remain uncommitted. No push, workflow dispatch, image publication, production deployment, or catalogue addition occurred.
+
+## Subsequent release hardening
+
+After the initial audit, Joshua approved adding Discord Option Tailer and Embedify, committing/pushing the changes, publishing a container through CI, and deploying it to TrueNAS. The catalogue now contains nine entries. Embedify's repository visibility remains unchanged.
+
+- Updated the build to Spring Boot 4.1.1, Java 25 LTS, Node 26.10.0, React 19.3.0, React Router 8.4.0, Vite 8.3.1, TypeScript 7.0.2, and Maven 3.9.16. Java 25 is the maintained LTS choice within Spring Boot 4.1.1's supported Java range; Java 27 is outside that range.
+- The container now has separate build and runtime stages. `jdeps` and `jlink` produce the runtime; the published image runs as UID/GID 1001 and contains no Java compiler or Node toolchain.
+- CI runs the complete build inside pinned containers on the private TrueNAS runner, avoiding the Adoptium setup API timeout and missing host Node library. Docker action pins use current stable releases.
+- Removed Docker build-context test exclusions and enabled Maven `-DfailIfNoTests=true`; a successful container build must execute the backend tests. The seven tests also pass locally on Java 25.
+- The final image depends on a fresh non-root runtime smoke test and Trivy scan of its shared runtime filesystem. All detected vulnerability severities fail the build. The preceding Linux scan reported zero Alpine and application-JAR findings, and npm reported zero known vulnerabilities.
+
+Publication and production verification are recorded separately in the local release ledger; the earlier artifact hash and runtime checks above describe the initial audit build.