Skip to content

1.4 CI Skeleton

Sprint: Sprint 01 - Foundation
Feature ID: 1.4
Subtasks: 1.4.1, 1.4.2

Objective

Deliver "CI Skeleton" within Sprint 01 - Foundation.

Dependencies

Aggregated from the subtasks below (prerequisite task IDs and enablers):

  • 1.2.3
  • 1.4.1

Subtasks

1.4.1 Build-and-test CI pipeline

  • ID: 1.4.1
  • Title: Create GitHub Actions build/test workflow
  • Description: Workflow on push/PR running mvn -q verify on JDK 21 with Maven caching and Testcontainers-compatible runner. Upload surefire/failsafe reports as artifacts (ADR-014).
  • Business Purpose: Every change is built, tested, and statically analyzed (NFR-17).
  • Inputs: ADR-014, 1.2.3.
  • Outputs: .github/workflows/build.yml.
  • Acceptance Criteria:
  • Workflow runs on PR and fails on a failing test or Checkstyle violation.
  • Dependencies: 1.2.3
  • Complexity: M

1.4.2 Dependency and security scanning

  • ID: 1.4.2
  • Title: Add dependency update and vulnerability scanning to CI
  • Description: Configure Dependabot for Maven and GitHub Actions, and an OWASP/Trivy dependency scan job that fails on high-severity findings.
  • Business Purpose: Keep the dependency matrix current and free of known vulnerabilities.
  • Inputs: ADR-014.
  • Outputs: .github/dependabot.yml, scan job in CI.
  • Acceptance Criteria:
  • Dependabot opens update PRs; the scan job runs and reports findings.
  • Dependencies: 1.4.1
  • Complexity: S

Acceptance Criteria

Each subtask above carries its own objective, testable acceptance criteria. This feature is complete when every subtask's acceptance criteria are met.

Deliverables

  • .github/workflows/build.yml.
  • .github/dependabot.yml, scan job in CI.

Definition of Done

  • All subtasks (1.4.1, 1.4.2) completed and their acceptance criteria verified.
  • All listed dependencies satisfied.
  • Build and tests green per the global conventions in ../README.md (Section 3).