Merge pull request 'ci: verify on the shared ci-workflows Maven workflow' (#8) from ci/ci-workflows into main

1.20.1 cannot talk to the CI runners' current Docker Engine (it pins an
API version the daemon no longer accepts), so the migration ITs failed
with "Could not find a valid Docker environment". 1.21.4 negotiates a
supported API version.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,6 @@
+.git
+**/target
+**/node_modules
+**/.next
+**/playwright-report
+**/test-results

.gitea/workflows/build.yaml

@@ -0,0 +1,10 @@
+name: build
+on:
+  push:
+jobs:
+  maven:
+    uses: self:KofTwentyTwo/ci-workflows/.gitea/workflows/maven.yaml@v1
+    secrets: inherit
+    with:
+      # Application: verify every push (unit, db migration and Testcontainers tests); no artifact publish.
+      publish: false

.github/workflows/db-migrations.yml

@@ -1,15 +0,0 @@
-name: Database migrations
-'on':
-  pull_request: {}
-  push:
-    branches:
-    - main
-permissions:
-  contents: read
-jobs:
-  validate:
-    uses: QRun-IO/qqq-orb/.github/workflows/business-db.yml@5bcec90e330b1b4d7ec416d64b065e0aed74a6ff
-concurrency:
-  group: business-db-${{ github.workflow }}-${{ github.event.pull_request.number ||
-    github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

.github/workflows/e2e.yml

@@ -1,19 +0,0 @@
-name: Required E2E validation
-'on':
-  pull_request: null
-  push:
-    branches:
-    - main
-  schedule:
-  - cron: 17 6 * * *
-  workflow_dispatch: null
-permissions:
-  contents: read
-concurrency:
-  group: e2e-${{ github.ref }}
-  cancel-in-progress: true
-jobs:
-  validate:
-    uses: QRun-IO/qqq-orb/.github/workflows/business-e2e.yml@0965a4565369a74650c8f96683b2296435a35382
-    secrets:
-      E2E_ALERT_WEBHOOK_URL: ${{ secrets.E2E_ALERT_WEBHOOK_URL }}

db/pom.xml

@@ -12,7 +12,7 @@
   <name>Platform Database Migrations</name>
 
   <properties>
-    <testcontainers.version>1.20.1</testcontainers.version>
+    <testcontainers.version>1.21.4</testcontainers.version>
   </properties>
 
   <dependencies>

deploy/compose/docker-compose.yml

@@ -87,7 +87,7 @@ services:
   # ========== Object Storage ==========
   
   minio:
-    image: minio/minio:latest
+    image: cgr.dev/chainguard/minio:latest-dev@sha256:25c69c296421a54961076193a136b1b34d81e2c5c66c6fd596e16ec2d2f668be
     container_name: qqq-platform-minio
     environment:
       MINIO_ROOT_USER: minio_admin
@@ -100,7 +100,7 @@ services:
       - "19000:9000"  # API
       - "19001:9001"  # Console
     healthcheck:
-      test: ["CMD-SHELL", "curl -f http://localhost:9000/minio/health/live || exit 1"]
+      test: ["CMD-SHELL", "wget -q -O /dev/null http://localhost:9000/minio/health/live || exit 1"]
       interval: 10s
       timeout: 5s
       retries: 5
@@ -110,7 +110,7 @@ services:
 
   # Initialize MinIO buckets
   minio-setup:
-    image: minio/mc:latest
+    image: cgr.dev/chainguard/minio-client:latest-dev@sha256:d0bce838369160ea7db20589040bee94bdb3e76dbf7fd10aa3eb755ae17a506b
     container_name: qqq-platform-minio-setup
     depends_on:
       minio:
@@ -121,7 +121,7 @@ services:
         mc alias set minio http://minio:9000 minio_admin minio_admin_password &&
         mc mb minio/platform-assets --ignore-existing &&
         mc mb minio/platform-uploads --ignore-existing &&
-        mc policy set public minio/platform-assets &&
+        mc anonymous set download minio/platform-assets &&
         echo 'MinIO setup completed!'
       "
     networks:
@@ -275,4 +275,4 @@ volumes:
 networks:
   platform-network:
     driver: bridge
-    name: qqq-platform
+    name: qqq-platform

platform-app/src/main/resources/application-compose.yml

@@ -2,9 +2,9 @@
 
 spring:
   datasource:
-    url: jdbc:postgresql://postgres:5432/qqq_platform
-    username: platform_app
-    password: qqq_platform
+    url: ${DB_URL:jdbc:postgresql://postgres:5432/qqq_platform}
+    username: ${DB_USERNAME:platform_app}
+    password: ${DB_PASSWORD:platform_app_password}
     driver-class-name: org.postgresql.Driver
     
   # Email configuration for newsletter QBit
@@ -24,8 +24,8 @@ spring:
     oauth2:
       resourceserver:
         jwt:
-          issuer-uri: http://keycloak:8081/realms/qqq-platform
-          jwk-set-uri: http://keycloak:8081/realms/qqq-platform/protocol/openid-connect/certs
+          issuer-uri: ${KEYCLOAK_ISSUER_URI:http://keycloak:8081/realms/qqq-platform}
+          jwk-set-uri: ${KEYCLOAK_JWK_SET_URI:http://keycloak:8081/realms/qqq-platform/protocol/openid-connect/certs}
 
 # Newsletter configuration
 newsletter:

web/README.md

@@ -27,7 +27,7 @@ Requires Keycloak on `localhost:18081` and the platform API on `localhost:18080`
 - `npm run test:e2e` runs Playwright against the real API and Keycloak services; it never mocks them. Playwright starts the frontend on port 3004 when needed.
 - `npm run build` automatically runs type checks, unit tests, and the complete E2E suite first. A failed or unavailable live service blocks the build.
 - `npm install`/`npm ci` enables the repository pre-commit hook. Commits touching platform code, infrastructure, tests, or workflows run the E2E suite and are rejected on failure.
-- `.github/workflows/e2e.yml` starts the actual Compose services on every pull request, main push, nightly schedule, and manual dispatch. Its `Deployment gate / E2E passed` status cannot succeed when E2E fails.
+- CI is `.gitea/workflows/build.yaml` (shared `KofTwentyTwo/ci-workflows` Maven workflow): `mvn verify` on every push, including the empty-database migration tests. The live-service Compose E2E job ran through the retired GitHub qqq-orb workflow and is not ported to Gitea yet; run `npm run test:e2e` against the live stack locally (the pre-commit hook enforces it).
 - HTML, JUnit, traces, screenshots, and videos are retained as workflow artifacts. Failures appear in the Actions summary and can be sent to a JSON incoming webhook (including Slack-compatible receivers) by defining the `E2E_ALERT_WEBHOOK_URL` Actions secret.
 
 Repository administrators should make **Required E2E validation / E2E / live services** and **Deployment gate / E2E passed** required branch-protection checks. Deployment workflows must depend on the deployment-gate job (or this workflow's successful conclusion); do not permit manual success overrides.

web/app/api/newsletter/subscribe/route.ts

@@ -13,7 +13,7 @@ export async function POST(request: NextRequest) {
     }
 
     // Call backend API from server-side (no CORS issues)
-    const backendUrl = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:18082'
+    const backendUrl = process.env.API_BASE_URL_INTERNAL || process.env.NEXT_PUBLIC_API_URL || 'http://localhost:18080'
     const response = await fetch(`${backendUrl}/api/public/v1/newsletter/subscribe`, {
       method: 'POST',
       headers: {