berezovskyi · Oct 5, 2026 · Oct 5, 2026 · Oct 5, 2026
diff --git a/.dockerignore b/.dockerignore
@@ -1,28 +1,14 @@
-# Git
 .git
 .gitignore
-
-# Docker
 Dockerfile
 docker-compose.yml
 .dockerignore
-
-# Documentation
 README.md
 *.md
-
-# IDE
 .vscode
 .idea
 *.iml
-
-# OS
 .DS_Store
 Thumbs.db
-
-# Target directories
-*/target/
-target/
-
-# Logs
-*.log
+**/target
+**/*.log
diff --git a/.editorconfig b/.editorconfig
@@ -0,0 +1,24 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 4
+
+[*.{yml,yaml,json}]
+indent_size = 2
+
+[promcode-lyo-server/src/test/java/**.java]
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{xml,aird}]
+trim_trailing_whitespace = false
+
+[promcode-lyo-server-model/**]
+indent_size = 2
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
@@ -2,7 +2,7 @@ name: "Docker Build and Push (PROMCODE Server)"
 
 on:
   push:
-    branches: [main, master]
+    branches: [main]
     paths:
       - 'promcode-lyo-server/**'
       - 'promcode-lyo-server-model/**'
@@ -20,41 +20,42 @@ env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
 
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   build-and-push:
+    name: Publish server image
+    if: github.repository == 'OSLC/promcode-lyo-server' && (github.ref == 'refs/heads/main' || github.event_name == 'release')
     runs-on: ubuntu-latest
+    timeout-minutes: 40
     permissions:
       contents: read
-      packages: write
+      packages: write # Push the built server image to GHCR.
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Check build trigger
-        run: |
-          if [ "${{ github.event_name }}" = "schedule" ]; then
-            echo "🔄 This is a scheduled weekly rebuild to update base images"
-          elif [ "${{ github.event_name }}" = "release" ]; then
-            echo "🚀 This is a release build"
-          else
-            echo "📦 This is a regular build triggered by push"
-          fi
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
 
       - name: Log in to Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
-            # For pushes to master/main branch or scheduled builds, tag as "latest"
+            # For pushes to main branch or scheduled builds, tag as "latest"
             type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || github.event_name == 'schedule' }}
             # For releases, create semantic version tags
             type=semver,pattern={{version}}
@@ -64,27 +65,39 @@ jobs:
             org.opencontainers.image.title=PROMCODE Server
             org.opencontainers.image.description=A demonstration server for OSLC toolchain management of PROject Management of COntracted DElivery
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        id: build
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           file: ./Dockerfile
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=promcode-server
+          cache-to: type=gha,mode=max,scope=promcode-server
           # For scheduled builds, don't use cache to ensure fresh base images
           no-cache: ${{ github.event_name == 'schedule' }}
           pull: true
 
       - name: Output image details
+        env:
+          IMAGE_TAGS: ${{ steps.meta.outputs.tags }}
+          IMAGE_DIGEST: ${{ steps.build.outputs.digest }}
         run: |
-          echo "Image has been pushed to:"
-          echo "${{ steps.meta.outputs.tags }}" | while read -r tag; do
-            echo "  - $tag"
-          done
+          printf 'Updated image tags:\n'
+          printf '### Updated image tags\n\n' >> "$GITHUB_STEP_SUMMARY"
+          while IFS= read -r tag; do
+            [ -n "$tag" ] || continue
+            printf '  - %s\n' "$tag"
+            printf -- '- `%s`\n' "$tag" >> "$GITHUB_STEP_SUMMARY"
+          done <<< "$IMAGE_TAGS"
+          printf 'Digest: %s\n' "$IMAGE_DIGEST"
+          printf '\nDigest: `%s`\n' "$IMAGE_DIGEST" >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/maven-acceptance-manual.yml b/.github/workflows/maven-acceptance-manual.yml
@@ -1,57 +1,44 @@
 name: Acceptance test (Lyo HEAD)
-run-name: "acceptance@${{ github.ref_name }} (Lyo@${{ github.event.inputs.lyoBranch }}; comment: ${{ inputs.comment }})"
-
-
+run-name: "acceptance@${{ github.ref_name }} (Lyo@${{ inputs.lyoBranch }}; ${{ inputs.link }})"
 on:
   workflow_dispatch:
     inputs:
       lyoBranch:
-        description: 'Lyo branch to test on'
+        description: Lyo branch to test on
         required: true
-        default: 'master'
+        default: main
       lyoRepo:
-        description: 'Lyo repository or fork'
+        description: Lyo repository or fork
         required: true
-        default: 'eclipse/lyo'
+        default: eclipse-lyo/lyo
       link:
-        description: 'PR/issue link (e.g., to Lyo)'
-
+        description: PR/issue link
+permissions:
+  contents: read
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event.inputs.lyoRepo }}-${{ github.event.inputs.lyoBranch }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/master' && github.ref != 'refs/heads/main' }}
-
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ inputs.lyoRepo }}-${{ inputs.lyoBranch }}
+  cancel-in-progress: true
 jobs:
-  build-jdk17:
+  build:
+    name: Lyo HEAD compatibility
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-#         java-version: [17]
-# #        distribution: ['temurin', 'zulu', 'oracle', 'corretto', 'microsoft', 'liberica']
-#         distribution: ['temurin']
-        include:
-          - java-version: '21'
-            distribution: 'temurin'
-          - java-version: '25'
-            distribution: 'liberica'
-          - java-version: '27'
-            distribution: 'liberica'
+    timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
-          repository: "${{ github.event.inputs.lyoRepo }}"
-          ref: "${{ github.event.inputs.lyoBranch }}"
+          repository: ${{ inputs.lyoRepo }}
+          ref: ${{ inputs.lyoBranch }}
           path: lyo-trunk
-      - uses: actions/checkout@v6
+          persist-credentials: false
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           path: main
-      - name: Set up JDK ${{ matrix.java-version }}
-        uses: actions/setup-java@v4
+          persist-credentials: false
+      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
-          distribution:  ${{ matrix.distribution }}
-          java-version: ${{ matrix.java-version }}
-      - name: 'Maven build (Lyo)'
-        run: mvn -B clean install --file lyo-trunk/pom.xml -DskipTests -Dmaven.javadoc.skip=true -P '!spotless' -P'!spotbugs'
-      - name: 'Maven build (project)'
-        run: |
-          mvn -B clean verify --file main/promcode-lyo-server/pom.xml
+          distribution: temurin
+          java-version: '25'
+      - name: Maven build (Lyo)
+        run: mvn -B --no-transfer-progress clean install --file lyo-trunk/pom.xml -DskipTests -Dmaven.javadoc.skip=true -P '!spotless,!spotbugs'
+      - name: Maven verify (project)
+        run: mvn -B --no-transfer-progress clean verify -Dselfie=readonly --file main/promcode-lyo-server/pom.xml
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
@@ -1,57 +1,31 @@
 name: CI
-
 on:
   merge_group:
+    types: [checks_requested]
   push:
-    branches: [main, master]
+    branches: [main]
   pull_request:
-    branches: [main, master]
+    branches: [main]
   schedule:
-    - cron: "19 4 * * 4" # catch SNAPSHOT breaking changes
+    - cron: "19 4 * * 4"
   workflow_dispatch:
-
+permissions:
+  contents: read
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/master' && github.ref != 'refs/heads/main' }}
-
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   build:
+    name: build
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        # jdk: ['17', '21']
-        # distribution: ['temurin']
-        # experimental: [false]
-        include:
-          - jdk: '21'
-            distribution: 'temurin'
-            experimental: false
-          - jdk: '25'
-            distribution: 'temurin'
-            experimental: false
-          - jdk: '27'
-            distribution: 'liberica'
-            experimental: false
-          # - jdk: '25-ea'
-          #   distribution: 'zulu'
-          #   experimental: true
-    continue-on-error: ${{ matrix.experimental }}
-
+    timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
-      - name: Set up JDK ${{ matrix.jdk }}
-        uses: actions/setup-java@v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
-          distribution: ${{ matrix.distribution }}
-          java-version: ${{ matrix.jdk }}
-      - uses: actions/cache@v4
+          persist-credentials: false
+      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
-          path: ~/.m2/repository
-          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
-          restore-keys: |
-            ${{ runner.os }}-maven-
-
-      - name: 'Maven build'
-        run: |
-          mvn -B clean verify --file ./promcode-lyo-server/pom.xml
+          distribution: temurin
+          java-version: '25'
+      - name: Maven verify
+        run: mvn -B --no-transfer-progress clean verify -Dselfie=readonly --file promcode-lyo-server/pom.xml
diff --git a/.gitignore b/.gitignore
@@ -22,3 +22,6 @@
 # virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
 hs_err_pid*
 replay_pid*
+
+# Maven build output
+**/target/
diff --git a/AGENTS.md b/AGENTS.md
@@ -1,8 +1,8 @@
 # AGENTS.md — OSLC PROMCODE Server
 
-Follow human-facing docs: `DEVELOPMENT.md` (build/run) and `CONTRIBUTING.md` (rules).
-
-Agent-specific notes:
-
-- `promcode-server` has **no automated tests**; `mvn test` is a compile check only.
+Follow [DEVELOPMENT.md](DEVELOPMENT.md) and [CONTRIBUTING.md](CONTRIBUTING.md).
 
+- Run `mvn test -Dselfie=readonly` in `promcode-lyo-server/` for the default check.
+- Preserve Lyo Designer user-code guards; do not rewrite generated Java outside them.
+- Prefer Java text blocks for multiline RDF payloads.
+- Run container smoke checks only when Docker or Podman is available.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -9,9 +9,12 @@ This server is generated from a Lyo Designer model (`promcode-lyo-server-model`)
 Prefer making model changes in Lyo Designer to preserve traceability between the
 model and the generated code.
 
+Edit generated Java only inside its user-code guards; change the model when
+changing generated resource types, services, or routing.
+
 ## Before you submit
 
-- `mvn test` should build the module (it has no automated tests yet).
+- `mvn clean verify -Dselfie=readonly` must pass in `promcode-lyo-server/`.
 - Keep `DEVELOPMENT.md` and `AGENTS.md` in sync when the build/test setup changes.
 - Keep CI configuration and `DEVELOPMENT.md` in sync for any significant changes.