bcgov · SScholefield · Jul 21, 2026 · Jul 16, 2026 · Jul 17, 2026 · Jul 17, 2026
@@ -0,0 +1,13 @@
+SPRING_PROFILES_ACTIVE=local
+SERVER_PORT=8080
+LOG_LEVEL=INFO
+ILCR_SECURITY_ENABLED=false
+
+# Local Oracle dev DB. Keep real local credentials in ignored .env only.
+# Leave ILCR_DATASOURCE_ENABLED=false for the in-memory scaffold.
+# In Docker Compose, set ILCR_DATASOURCE_ENABLED=true to enable Oracle connectivity.
+# For direct Maven runs, the oracle profile also enables the datasource.
+ILCR_DATASOURCE_ENABLED=false
+SPRING_DATASOURCE_URL=jdbc:oracle:thin:@//<host>:1521/<service-name>
+SPRING_DATASOURCE_USERNAME=<username>
+SPRING_DATASOURCE_PASSWORD=<password>
@@ -6,7 +6,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        **Please provide details about the bug to help us resolve it efficiently.**  
+        **Please provide details about the bug to help us resolve it efficiently.**
         Fill out all required fields to ensure we have the necessary context.
 
   - type: input
@@ -71,9 +71,9 @@ body:
       label: Desktop Information
       description: Provide details about the desktop environment where the bug was encountered.
       placeholder: |
-        OS: [e.g., iOS, Windows]  
-        Browser: [e.g., Chrome, Safari]  
-        Version: [e.g., 22]  
+        OS: [e.g., iOS, Windows]
+        Browser: [e.g., Chrome, Safari]
+        Version: [e.g., 22]
 
   - type: textarea
     id: additional_context

@@ -6,7 +6,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        **Document a key decision.**  
+        **Document a key decision.**
         This template helps clarify changes in project direction or priorities.
 
   - type: input

@@ -6,7 +6,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        **Please provide the following details for your Epic.**  
+        **Please provide the following details for your Epic.**
         If you're new to writing acceptance criteria, learn more about [Gherkin syntax](https://cucumber.io/docs/gherkin/).
 
   - type: input
@@ -21,9 +21,9 @@ body:
     attributes:
       label: Epic Goal or User Story
       description: |
-        Use the format below:  
-        **As a** _(User Type/Persona)_  
-        **I want** _(High-level objective or goal)_  
+        Use the format below:
+        **As a** _(User Type/Persona)_
+        **I want** _(High-level objective or goal)_
         **So That** _(Value or purpose of this epic)_
       placeholder: As a [User Type], I want [Objective], so that [Purpose].
 
@@ -44,10 +44,10 @@ body:
     attributes:
       label: Acceptance Criteria
       description: |
-        Define the high-level conditions of success using Gherkin syntax. Example:  
-        - [ ] **Given** [Context], **When** [Action], **Then** [Outcome]  
+        Define the high-level conditions of success using Gherkin syntax. Example:
+        - [ ] **Given** [Context], **When** [Action], **Then** [Outcome]
       placeholder: |
-        - [ ] Given [Context], When [Action carried out], Then [Expected outcome]  
+        - [ ] Given [Context], When [Action carried out], Then [Expected outcome]
         - [ ] Given [Context], When [Action carried out], Then [Expected outcome]
       render: shell
 

@@ -6,17 +6,17 @@ body:
   - type: markdown
     attributes:
       value: |
-        **Please provide the following details for your feature request or user story.**  
+        **Please provide the following details for your feature request or user story.**
         If you're new to writing acceptance criteria, learn more about [Gherkin syntax](https://cucumber.io/docs/gherkin/).
 
   - type: input
     id: user_story
     attributes:
       label: User Story
       description: |
-        Use the format below:  
-        **As a** _(User Type/Persona)_  
-        **I want** _(Feature/Enhancement)_  
+        Use the format below:
+        **As a** _(User Type/Persona)_
+        **I want** _(Feature/Enhancement)_
         **So That** _(Value or purpose of this request)_
       placeholder: As a [User Type], I want [Feature], so that [Purpose].
 
@@ -37,10 +37,10 @@ body:
     attributes:
       label: Acceptance Criteria
       description: |
-        Define the conditions of success using Gherkin syntax. Example:  
-        - [ ] **Given** [Context], **When** [Action], **Then** [Outcome]  
+        Define the conditions of success using Gherkin syntax. Example:
+        - [ ] **Given** [Context], **When** [Action], **Then** [Outcome]
       placeholder: |
-        - [ ] Given [Context], When [Action carried out], Then [Expected outcome]  
+        - [ ] Given [Context], When [Action carried out], Then [Expected outcome]
         - [ ] Given [Context], When [Action carried out], Then [Expected outcome]
       render: shell
 

@@ -6,7 +6,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        **Need help or clarification?**  
+        **Need help or clarification?**
         Use this template to ask technical, general, or project-related questions.
 
   - type: input

@@ -6,7 +6,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        **⚠️ Responsible Disclosure Notice**  
+        **⚠️ Responsible Disclosure Notice**
         Please do **not** include exploit code, proof-of-concept payloads, or
         personally identifiable information (PII) in this issue. This template
         creates a **public** issue. For sensitive vulnerabilities that must not

@@ -6,7 +6,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        **Please provide the necessary details for the UX design task.**  
+        **Please provide the necessary details for the UX design task.**
         Ensure all required fields are filled out to avoid delays.
 
   - type: input

@@ -18,30 +18,82 @@ permissions: {}
 jobs:
   backend-tests:
     name: Backend Tests
-    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
+    if: (! github.event.pull_request.draft)
     permissions:
+      contents: read
       pull-requests: write
-    secrets: inherit
-    uses: ./.github/workflows/reusable-tests-be.yml
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: bcgov/action-test-and-analyse-java@7c7309721cae054b3e837c723afa4efb4b1a256d # v1.1.0
+        name: Backend Coverage
+        with:
+          commands: |
+            mvn -B -ntp -Dcheckstyle.skip=false verify checkstyle:checkstyle
+          dir: backend
+          java-cache: maven
+          java-distribution: temurin
+          java-version: "21"
+          sonar_args: >
+            -Dsonar.organization=bcgov-sonarcloud
+            -Dsonar.projectKey=bcgov-sonarcloud_nr-ilcr_backend
+            -Dsonar.host.url=https://sonarcloud.io
+          sonar_token: ${{ secrets.sonar_token_backend }}
+          triggers: ('backend/')
 
-  tests-frontend:
-    name: Frontend Unit Tests
-    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
-    secrets: inherit
+  frontend-tests:
+    name: Frontend Tests
+    if: (! github.event.pull_request.draft)
     permissions:
-      contents: write
+      contents: read
       checks: write
-    uses: ./.github/workflows/reusable-tests-fe.yml
+      security-events: write
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: bcgov/action-test-and-analyse@8f699e3fd3fadd9a6adf6f4b1f2638ef7ecfefb9 # v2.0.0
+        env:
+          sonar_token: ${{ secrets.sonar_token_frontend }}
+        with:
+          commands: |
+            npm ci
+            npm run lint
+            npm run format:check
+            npm run test:cov
+          dir: frontend
+          node_version: "24"
+          sonar_args: >
+            -Dsonar.exclusions=**/coverage/**,**/node_modules/**,**/*spec.ts,**/*test.tsx,**/routeTree.gen.ts
+            -Dsonar.organization=bcgov-sonarcloud
+            -Dsonar.projectKey=bcgov-sonarcloud_nr-ilcr_frontend
+            -Dsonar.sources=src
+            -Dsonar.test.inclusions=**/*spec.ts,**/*test.tsx
+            -Dsonar.javascript.lcov.reportPaths=./coverage/lcov.info
+          sonar_token: ${{ env.sonar_token }}
+          dep_scan: warn
+          supply_scan: true
+          triggers: ('frontend/')
 
+  # https://github.com/marketplace/actions/aqua-security-trivy
   trivy:
-    name: Repository Report
-    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
+    name: Trivy Security Scan
+    if: (! github.event.pull_request.draft)
     permissions:
       contents: read
       security-events: write
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-slim
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v7
+
+      - name: Cache Trivy DB
+        uses: actions/cache@v6
+        with:
+          path: .trivycache
+          key: ${{ runner.os }}-trivy-v0.36.0-cache-v1
+          restore-keys: |
+            ${{ runner.os }}-trivy-
+
       - name: Run Trivy vulnerability scanner in repo mode
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
@@ -51,55 +103,26 @@ jobs:
           scan-type: "fs"
           scanners: "vuln,secret,misconfig"
           severity: "CRITICAL,HIGH"
+          trivyignores: ".github/.trivyignore"
+          cache-dir: .trivycache
+          skip-dirs: "**/node_modules,**/coverage,**/dist,**/target,.git"
 
       - name: Upload Trivy scan results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v4
         with:
+          category: "trivy"
           sarif_file: "trivy-results.sarif"
 
-  cve-lite:
-    name: CVE Lite Scan (${{ matrix.folder }})
-    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
-    permissions:
-      contents: read
-      security-events: write
-    runs-on: ubuntu-24.04
-    strategy:
-      matrix:
-        folder: [cypress, frontend]
-    steps:
-      - uses: actions/checkout@v7
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: "24"
-      - name: Run cve-lite-cli SARIF scan (${{ matrix.folder }})
-        run: npx --yes cve-lite-cli@1.25.0 "${{ matrix.folder }}" --sarif --check-overrides
-      - name: Locate SARIF file
-        id: locate
-        run: |
-          sarif_file=$(ls ${{ github.workspace }}/cve-lite-scan-*.sarif 2>/dev/null | head -1)
-          if [ -z "$sarif_file" ]; then
-            echo "::error::No SARIF file found in ${{ github.workspace }}"
-            exit 1
-          fi
-          echo "path=$sarif_file" >> $GITHUB_OUTPUT
-      - name: Upload SARIF to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v4
-        with:
-          sarif_file: ${{ steps.locate.outputs.path }}
-          category: "cve-lite-${{ matrix.folder }}"
-
   # ==========================================================================
   # WARNING: This job acts as the required merge gate for this workflow.
   # If you add a new job to this workflow, you MUST add its ID to the 'needs'
   # array below, otherwise its failure or cancellation will not block the PR!
   # ==========================================================================
   results:
     name: Analysis Results
-    needs: [backend-tests, tests-frontend, trivy, cve-lite]
+    needs: [backend-tests, frontend-tests, trivy]
     if: always()
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-slim
     timeout-minutes: 1
     steps:
       - name: Log Job Results Context

@@ -34,7 +34,6 @@ jobs:
     needs: [init]
     uses: ./.github/workflows/reusable-deploy.yml
     secrets:
-      db_password: ${{ secrets.db_password }}
       oc_namespace: ${{ secrets.oc_namespace }}
       oc_token: ${{ secrets.oc_token }}
     with:
@@ -44,6 +43,7 @@ jobs:
 
   tests:
     name: Tests
+    if: needs.deploy-test.result == 'success'
     needs: [deploy-test]
     uses: ./.github/workflows/reusable-tests.yml
     with:
@@ -54,7 +54,6 @@ jobs:
     needs: [tests, init]
     uses: ./.github/workflows/reusable-deploy.yml
     secrets:
-      db_password: ${{ secrets.db_password }}
       oc_namespace: ${{ secrets.oc_namespace }}
       oc_token: ${{ secrets.oc_token }}
     with:
@@ -90,7 +89,7 @@ jobs:
       packages: write
     strategy:
       matrix:
-        package: [migrations, backend, frontend]
+        package: [backend, frontend]
     timeout-minutes: 1
     steps:
       - uses: shrink/actions-docker-registry-tag@e6aaef25c595b6e0edd18bf4c7dbfea3abd43299 # v5
@@ -99,3 +98,24 @@ jobs:
           repository: ${{ github.repository }}/${{ matrix.package }}
           target: ${{ needs.init.outputs.pr }}
           tags: prod
+
+  results:
+    name: Merge Results
+    needs: [init, deploy-test, tests, deploy-prod, promote]
+    if: always()
+    runs-on: ubuntu-slim
+    timeout-minutes: 1
+    steps:
+      - name: Log Job Results Context
+        run: |
+          echo "=== Upstream Job Statuses ==="
+          echo '${{ toJson(needs) }}'
+
+      - name: Evaluate Overall Status
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: |
+          echo "❌ Merge pipeline failure: at least one required job failed or was cancelled."
+          exit 1
+
+      - name: Success Message
+        run: echo "✅ All merge pipeline jobs passed or were intentionally skipped!"
@@ -12,8 +12,22 @@ concurrency:
 permissions: {}
 
 jobs:
+  # ZONE for OpenShift objects is the PR number mapped into 1-50 (see
+  # pr-open.yml), so cleanup must target that zone, not the raw PR number.
+  init:
+    name: Initialize
+    if: ${{ vars.ENABLE_OPENSHIFT_DEPLOY == 'true' }}
+    runs-on: ubuntu-slim
+    timeout-minutes: 1
+    outputs:
+      zone: ${{ steps.zone.outputs.zone }}
+    steps:
+      - id: zone
+        run: echo "zone=$(( (${{ github.event.number }} - 1) % 50 + 1 ))" >> $GITHUB_OUTPUT
+
   cleanup:
     name: Cleanup and Image Promotion
+    needs: [init]
     uses: bcgov/quickstart-openshift-helpers/.github/workflows/.pr-close.yml@a11ad3d1b9288fb40757c4314a62eb86ff227931 # v1.2.1
     permissions:
       packages: write
@@ -22,4 +36,11 @@ jobs:
       oc_token: ${{ secrets.oc_token }}
     with:
       cleanup: label
-      packages: backend frontend migrations
+      # Resources are labeled with three app values: ${NAME}-${ZONE} (init),
+      # ${NAME}-backend-${ZONE} and ${NAME}-frontend-${ZONE} (deploys).
+      # The default cleanup only deletes app=<repo>-<PR#>, so list all three.
+      cleanup_name: >-
+        ${{ github.event.repository.name }}-${{ needs.init.outputs.zone }}
+        ${{ github.event.repository.name }}-backend-${{ needs.init.outputs.zone }}
+        ${{ github.event.repository.name }}-frontend-${{ needs.init.outputs.zone }}
+      packages: backend frontend