release: spring-jdbc-tutorial complete API

.dockerignore

@@ -0,0 +1,8 @@
+# Keep the build context small and free of local files (keys, env files, git data)
+*
+!pom.xml
+!core/
+!ws/
+!mvnw
+!.mvn/
+**/target/

.env.example

@@ -0,0 +1,5 @@
+# Copy to .env (ignored by git) and adjust. Read by docker-compose.yml only.
+DB_NAME=spring_jdbc_tutorial
+DB_USER=spring
+DB_PASSWORD=change-me
+APP_PORT=8080

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,32 @@
+## Branch
+
+<!-- e.g. feature/core-architecture -->
+
+## Task checklist
+
+<!-- Copy the relevant section's checklist from README.md and check off each item. -->
+
+- [ ]
+
+## Commit summary
+
+<!-- One line per group of commits, summarizing what changed and why. -->
+
+## Test plan
+
+- [ ] Tests exist at every layer the branch's checklist calls for (DAO, RowMapper, EntityMapper, service, controller)
+- [ ] Each DAO test class loads its own dedicated SQL fixture file
+- [ ] `./mvnw clean verify` is green on the whole reactor
+
+## Code review checklist
+
+- [ ] No business logic in controllers; controllers only see services and `payload/` types
+- [ ] DAOs only use `entity/` types, services only `dto/` types at their boundary
+- [ ] Every response, success or error, is an `ApiResponse<T>` (errors through `GlobalExceptionHandler`, 401/403 through the security handlers)
+- [ ] Permission checks are declarative (`@PreAuthorize("hasPermission(...)")`), no manual permission `if`
+- [ ] No `@Repository`, `@Service` or `@Component` on a DAO or service; every bean is an explicit `@Bean` in `DaoConfig`/`ServiceConfig`
+- [ ] No Lombok, no `record`, no ORM (`JdbcTemplate` only)
+- [ ] Every RBAC mutation calls `AuditLogger`
+- [ ] The database schema only changes through a Flyway migration
+- [ ] Test methods are named `_NN_Should<Outcome>_When<Condition>`
+- [ ] Commits are atomic, follow Conventional Commits with a scope, no em dash, no tool attribution

.github/workflows/ci.yml

@@ -0,0 +1,28 @@
+name: CI
+
+on:
+  push:
+    branches: [master, develop]
+  pull_request:
+    branches: [master, develop]
+
+jobs:
+  build-and-test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Java 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "17"
+          cache: maven
+
+      # No "services: postgres" block on purpose. The DAO tests start their own PostgreSQL
+      # container through Testcontainers and the Docker daemon already available on
+      # ubuntu-latest, exactly as they do locally, so nothing is provisioned by the workflow.
+      - name: Build and test the whole reactor
+        run: ./mvnw -B verify

.github/workflows/pr-checks.yml

@@ -0,0 +1,43 @@
+name: PR checks
+
+on:
+  pull_request:
+    branches: [master, develop]
+
+jobs:
+  commit-lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Validate commit messages (Conventional Commits)
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+
+          pattern='^(feat|fix|refactor|test|docs|chore|build|ci|style|perf)\([a-z0-9.,/_-]+\): .{1,100}$'
+          failed=0
+
+          while IFS= read -r subject; do
+            [ -z "$subject" ] && continue
+            if [[ "$subject" =~ $pattern ]]; then
+              echo "OK: $subject"
+            else
+              echo "INVALID: $subject"
+              failed=1
+            fi
+          done < <(git log "$BASE_SHA..$HEAD_SHA" --no-merges --pretty=format:'%s')
+
+          if [ "$failed" -ne 0 ]; then
+            echo ""
+            echo "One or more commit messages do not follow Conventional Commits."
+            echo "Expected format: <type>(<scope>): <short summary>"
+            echo "Allowed types: feat, fix, refactor, test, docs, chore, build, ci, style, perf"
+            exit 1
+          fi

Dockerfile

@@ -0,0 +1,35 @@
+# Multi-stage image for the packaged WAR.
+# Stage 1 compiles and packages with Maven, stage 2 is a Tomcat 10.1 runtime holding only the WAR.
+
+FROM maven:3.9-eclipse-temurin-17 AS build
+WORKDIR /build
+
+# Copy the poms first so Docker caches the dependency download until a pom changes.
+COPY pom.xml ./
+COPY core/pom.xml core/pom.xml
+COPY core/common/pom.xml core/common/pom.xml
+COPY core/auth/pom.xml core/auth/pom.xml
+COPY core/catalog/pom.xml core/catalog/pom.xml
+COPY core/customer/pom.xml core/customer/pom.xml
+COPY core/order/pom.xml core/order/pom.xml
+COPY ws/pom.xml ws/pom.xml
+RUN mvn -B -q dependency:go-offline -DskipTests || true
+
+COPY core ./core
+COPY ws ./ws
+# Tests are skipped here: the DAO tests need Testcontainers, i.e. a Docker daemon that a build
+# stage does not have. They run in CI with mvn verify instead.
+RUN mvn -B -q package -DskipTests
+
+FROM tomcat:10.1-jre17-temurin
+# The README documents the API under /spring-jdbc-tutorial/api/v1: the WAR name is the context path.
+RUN rm -rf /usr/local/tomcat/webapps/*
+COPY --from=build /build/ws/target/ws.war /usr/local/tomcat/webapps/spring-jdbc-tutorial.war
+
+# Run as a non-root user so a compromised process has no rights on the container.
+RUN useradd --system --no-create-home spring \
+    && chown -R spring /usr/local/tomcat/webapps /usr/local/tomcat/logs /usr/local/tomcat/temp /usr/local/tomcat/work /usr/local/tomcat/conf
+USER spring
+
+EXPOSE 8080
+CMD ["catalina.sh", "run"]