PR15/15: build gates — enforcer convergence, Boot 3.5.16, wrapper, formatter 4.35, secrets CI, Dependabot

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: maven
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly

.github/release.yml

@@ -0,0 +1,20 @@
+changelog:
+  exclude:
+    labels:
+      - ignore-for-release
+  categories:
+    - title: Breaking Changes
+      labels:
+        - breaking-change
+    - title: Features
+      labels:
+        - feature 
+    - title: Enhancements 
+      labels:
+        - enhancement
+    - title: Bug Fixes
+      labels:
+        - bug
+    - title: Other Changes
+      labels:
+        - "*"

.github/workflows/github-actions-deploy-snapshots.yml

@@ -0,0 +1,23 @@
+name: Maven Deploy Snapshots
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'release'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 #v5.2.0
+        with:
+          java-version: '25'
+          distribution: 'temurin'
+      - name: Build with Maven
+        run: mvn --update-snapshots deploy
+        env:
+          GITHUB_TOKEN: ${{ github.token }}

.github/workflows/github-actions-test.yml

@@ -0,0 +1,20 @@
+name: Maven Run Tests
+
+on: [ push ]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 #v5.2.0
+        with:
+          java-version: '25'
+          distribution: 'temurin'
+          cache: maven
+      - name: Test with Maven
+        run: ./mvnw --update-snapshots test
+        env:
+          GITHUB_TOKEN: ${{ github.token }}

.github/workflows/label-checker.yml

@@ -0,0 +1,21 @@
+name: Label Checker
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
+      - unlabeled
+
+jobs:
+
+  check_labels:
+    name: Check labels
+    runs-on: ubuntu-latest
+    steps:
+      - uses: docker://agilepathway/pull-request-label-checker:latest
+        with:
+          one_of: breaking-change,enhancement,bug,documentation,ignore-for-release,dependencies
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+

.github/workflows/pic-sure-auth-microapp-test.yml

@@ -0,0 +1,22 @@
+name: pic-sure-auth-microapp tests
+on:
+  pull_request:
+    paths: ['services/pic-sure-auth-microapp/**']
+  push:
+    branches: [main]
+    paths: ['services/pic-sure-auth-microapp/**']
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 #v5.2.0
+        with:
+          java-version: '25'
+          distribution: 'temurin'
+          cache: maven
+      - name: Test with Maven
+        run: ./mvnw -B -pl services/pic-sure-auth-microapp/pic-sure-auth-services -am verify
+        env:
+          GITHUB_TOKEN: ${{ github.token }}

.github/workflows/pic-sure-hpds-test.yml

@@ -0,0 +1,22 @@
+name: pic-sure-hpds tests
+on:
+  pull_request:
+    paths: ['services/pic-sure-hpds/**']
+  push:
+    branches: [main]
+    paths: ['services/pic-sure-hpds/**']
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 #v5.2.0
+        with:
+          java-version: '25'
+          distribution: 'temurin'
+          cache: maven
+      - name: Test with Maven
+        run: ./mvnw -B -pl services/pic-sure-hpds/common,services/pic-sure-hpds/data,services/pic-sure-hpds/etl,services/pic-sure-hpds/processing,services/pic-sure-hpds/service,services/pic-sure-hpds/genomic-processor,services/pic-sure-hpds/war,services/pic-sure-hpds/docker -am verify
+        env:
+          GITHUB_TOKEN: ${{ github.token }}

.github/workflows/pic-sure-logging-test.yml

@@ -0,0 +1,22 @@
+name: pic-sure-logging tests
+on:
+  pull_request:
+    paths: ['services/pic-sure-logging/**']
+  push:
+    branches: [main]
+    paths: ['services/pic-sure-logging/**']
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 #v5.2.0
+        with:
+          java-version: '25'
+          distribution: 'temurin'
+          cache: maven
+      - name: Test with Maven
+        run: ./mvnw -B -pl services/pic-sure-logging -am verify
+        env:
+          GITHUB_TOKEN: ${{ github.token }}

.github/workflows/pic-sure-services-test.yml

@@ -0,0 +1,22 @@
+name: pic-sure-services tests
+on:
+  pull_request:
+    paths: ['services/pic-sure-services/**']
+  push:
+    branches: [main]
+    paths: ['services/pic-sure-services/**']
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 #v5.2.0
+        with:
+          java-version: '25'
+          distribution: 'temurin'
+          cache: maven
+      - name: Test with Maven
+        run: ./mvnw -B -pl services/pic-sure-services/info-service,services/pic-sure-services/uploader -am verify
+        env:
+          GITHUB_TOKEN: ${{ github.token }}

.github/workflows/picsure-dictionary-test.yml

@@ -0,0 +1,22 @@
+name: picsure-dictionary tests
+on:
+  pull_request:
+    paths: ['services/picsure-dictionary/**']
+  push:
+    branches: [main]
+    paths: ['services/picsure-dictionary/**']
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 #v5.2.0
+        with:
+          java-version: '25'
+          distribution: 'temurin'
+          cache: maven
+      - name: Test with Maven
+        run: ./mvnw -B -pl services/picsure-dictionary,services/picsure-dictionary/aggregate,services/picsure-dictionary/dictionaryweights -am verify
+        env:
+          GITHUB_TOKEN: ${{ github.token }}

.github/workflows/secrets-scan.yml

@@ -0,0 +1,19 @@
+name: secrets scan
+on:
+  pull_request:
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+        with:
+          fetch-depth: 0
+      - name: Install gitleaks 8.30.1 (checksum-verified)
+        run: |
+          curl -sSfL -o /tmp/gitleaks.tar.gz https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
+          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  /tmp/gitleaks.tar.gz" | sha256sum -c -
+          tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
+      - name: Scan PR commits
+        run: >
+          /tmp/gitleaks git --redact --no-banner
+          --log-opts="${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}" .

.github/workflows/visualization-service-test.yml

@@ -0,0 +1,22 @@
+name: visualization-service tests
+on:
+  pull_request:
+    paths: ['services/pic-sure-visualization-service/**']
+  push:
+    branches: [main]
+    paths: ['services/pic-sure-visualization-service/**']
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 #v5.2.0
+        with:
+          java-version: '25'
+          distribution: 'temurin'
+          cache: maven
+      - name: Test with Maven
+        run: ./mvnw -B -pl services/pic-sure-visualization-service -am verify
+        env:
+          GITHUB_TOKEN: ${{ github.token }}

.gitignore

@@ -0,0 +1,38 @@
+target/
+pom.xml.tag
+pom.xml.releaseBackup
+pom.xml.versionsBackup
+pom.xml.next
+release.properties
+dependency-reduced-pom.xml
+.flattened-pom.xml
+buildNumber.properties
+.mvn/timing.properties
+log/
+
+#Eclipse 
+.project
+.settings/
+.classpath
+
+#Intellij
+.idea/
+*.iml
+*.iws
+
+#Mac
+.DS_Store
+
+
+# Avoid ignoring Maven wrapper jar file (.jar files are usually ignored)
+!/.mvn/wrapper/maven-wrapper.jar
+
+# Claude Code: local-only files, never commit (plans, specs, reviews, tickets, settings)
+.claude/
+**/.claude/
+docs/superpowers/
+*.http
+
+# TODO: Remove once development is complete
+george_development_notes.md
+fable-master-handoff.md

.gitleaksignore

@@ -0,0 +1,4 @@
+# gitleaks false-positive fingerprints — one per line:
+#   <commit>:<file>:<rule-id>:<line>
+# Put a comment above each entry explaining why the finding is safe.
+# Honored by the pre-commit hook, the pre-push hook, and the secrets-scan workflow.

.mvn/wrapper/maven-wrapper.properties

@@ -0,0 +1,3 @@
+wrapperVersion=3.3.4
+distributionType=only-script
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.9/apache-maven-3.9.9-bin.zip

.sdkmanrc

@@ -0,0 +1 @@
+java=25.0.3-tem