fix: restore CI with SHA-pinned actions and README badges

.github/workflows/ci.yml

@@ -2,106 +2,146 @@ name: CI/CD Pipeline
 
 on:
   push:
-    branches: [ main, develop ]
+    branches: [main, develop]
   pull_request:
-    branches: [ main, develop ]
+    branches: [main, develop]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+env:
+  MAVEN_OPTS: "-Dhttps.protocols=TLSv1.2"
+
 jobs:
   build-and-test:
     name: Build & Test
     runs-on: ubuntu-latest
-    
+
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
-          java-version: '21'
-          distribution: 'temurin'
-          cache: 'maven'
+          java-version: "21"
+          distribution: "temurin"
 
-      - name: Build with Maven
-        run: mvn clean compile -B
+      - name: Restore Maven cache
+        id: maven-cache
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        with:
+          path: ~/.m2/repository
+          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            ${{ runner.os }}-m2-
 
-      - name: Run tests
-        run: mvn test -B
+      - name: Build and test
+        run: mvn -B -ntp test
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: test-results
           path: target/surefire-reports/
 
+      - name: Save Maven cache
+        if: always() && steps.maven-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        with:
+          path: ~/.m2/repository
+          key: ${{ steps.maven-cache.outputs.cache-primary-key }}
+
   code-quality:
     name: Code Quality Checks
     runs-on: ubuntu-latest
     needs: build-and-test
-    
+
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - name: Restore Maven cache
+        id: maven-cache
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
-          java-version: '21'
-          distribution: 'temurin'
-          cache: 'maven'
+          path: ~/.m2/repository
+          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            ${{ runner.os }}-m2-
 
       - name: Check code formatting (Spotless)
-        run: mvn spotless:check -B
+        run: mvn -B -ntp spotless:check
 
       - name: Run Checkstyle
-        run: mvn checkstyle:check -B
+        run: mvn -B -ntp checkstyle:check
         continue-on-error: true
 
       - name: Run SpotBugs
-        run: mvn compile spotbugs:check -B
-        continue-on-error: true
+        run: mvn -B -ntp compile spotbugs:check
 
       - name: Upload SpotBugs results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: spotbugs-results
           path: target/spotbugsXml.xml
 
       - name: Upload Checkstyle results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: checkstyle-results
           path: target/checkstyle-result.xml
 
+      - name: Save Maven cache
+        if: always() && steps.maven-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        with:
+          path: ~/.m2/repository
+          key: ${{ steps.maven-cache.outputs.cache-primary-key }}
+
   code-coverage:
     name: Code Coverage
     runs-on: ubuntu-latest
     needs: build-and-test
-    
+
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - name: Restore Maven cache
+        id: maven-cache
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
-          java-version: '21'
-          distribution: 'temurin'
-          cache: 'maven'
+          path: ~/.m2/repository
+          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            ${{ runner.os }}-m2-
 
       - name: Generate coverage report
-        run: mvn clean test jacoco:report -B
+        run: mvn -B -ntp clean test jacoco:report
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
         with:
           files: ./target/site/jacoco/jacoco.xml
           flags: unittests
@@ -110,35 +150,49 @@ jobs:
           verbose: true
 
       - name: Upload JaCoCo coverage report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: jacoco-report
           path: target/site/jacoco/
 
       - name: Check coverage thresholds
-        run: mvn jacoco:check -B
-        continue-on-error: true
+        run: mvn -B -ntp jacoco:check
+
+      - name: Save Maven cache
+        if: always() && steps.maven-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        with:
+          path: ~/.m2/repository
+          key: ${{ steps.maven-cache.outputs.cache-primary-key }}
 
   sonarcloud:
     name: SonarCloud Analysis
     runs-on: ubuntu-latest
     needs: build-and-test
-    
+
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        with:
+          java-version: "21"
+          distribution: "temurin"
+
+      - name: Restore Maven cache
+        id: maven-cache
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
-          java-version: '21'
-          distribution: 'temurin'
-          cache: 'maven'
+          path: ~/.m2/repository
+          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            ${{ runner.os }}-m2-
 
       - name: Cache SonarCloud packages
-        uses: actions/cache@v4
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: ~/.sonar/cache
           key: ${{ runner.os }}-sonar
@@ -149,9 +203,15 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
         run: |
-          mvn clean verify sonar:sonar \
-            -Dsonar.projectKey=my-java-genie \
-            -Dsonar.organization=${{ github.repository_owner }} \
+          mvn -B -ntp clean verify sonar:sonar \
+            -Dsonar.projectKey=devops-thiago_my-java-genie \
+            -Dsonar.organization=devops-thiago \
             -Dsonar.host.url=https://sonarcloud.io \
-            -Dsonar.coverage.jacoco.xmlReportPaths=target/site/jacoco/jacoco.xml \
-            -B
+            -Dsonar.coverage.jacoco.xmlReportPaths=target/site/jacoco/jacoco.xml
+
+      - name: Save Maven cache
+        if: always() && steps.maven-cache.outputs.cache-hit != 'true'
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        with:
+          path: ~/.m2/repository
+          key: ${{ steps.maven-cache.outputs.cache-primary-key }}

Dockerfile

@@ -13,7 +13,7 @@ COPY chat-ui/. .
 RUN npm run build
 
 # Stage 2: Build Java Application
-FROM maven:3.9-eclipse-temurin-17 AS build
+FROM maven:3.9-eclipse-temurin-21 AS build
 WORKDIR /app
 
 # Copy pom.xml and download dependencies (cached layer)
@@ -28,7 +28,7 @@ COPY src ./src
 RUN mvn clean package -DskipTests -B
 
 # Stage 2: Runtime
-FROM eclipse-temurin:17-jre-jammy
+FROM eclipse-temurin:21-jre-jammy
 WORKDIR /app
 
 # Install curl for healthchecks

README.md

@@ -10,10 +10,10 @@
 
 ## 🏆 CI/CD & Code Quality
 
-![Build Status](https://github.com/thiagotigaz/my-java-genie/workflows/CI%2FCD%20Pipeline/badge.svg)
-[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=my-java-genie&metric=alert_status)](https://sonarcloud.io/dashboard?id=my-java-genie)
-[![codecov](https://codecov.io/gh/thiagotigaz/my-java-genie/branch/main/graph/badge.svg)](https://codecov.io/gh/thiagotigaz/my-java-genie)
-[![Code Quality](https://img.shields.io/badge/code%20quality-automated-brightgreen)](https://github.com/thiagotigaz/my-java-genie/actions)
+[![Build Status](https://github.com/devops-thiago/my-java-genie/actions/workflows/ci.yml/badge.svg)](https://github.com/devops-thiago/my-java-genie/actions/workflows/ci.yml)
+[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=devops-thiago_my-java-genie&metric=alert_status)](https://sonarcloud.io/dashboard?id=devops-thiago_my-java-genie)
+[![codecov](https://codecov.io/gh/devops-thiago/my-java-genie/branch/main/graph/badge.svg)](https://codecov.io/gh/devops-thiago/my-java-genie)
+[![Code Quality](https://img.shields.io/badge/code%20quality-automated-brightgreen)](https://github.com/devops-thiago/my-java-genie/actions)
 
 ## ✨ Features
 

docker-compose.yml

@@ -4,15 +4,13 @@
 services:
   # ChromaDB Vector Database
   chromadb:
-    image: chromadb/chroma:0.4.24
+    image: chromadb/chroma:1.5.9
     container_name: java-rag-chromadb
     ports:
       - "8000:8000"
     volumes:
-      - chroma-data:/chroma/chroma
-    environment:
-      - IS_PERSISTENT=TRUE
-      - ANONYMIZED_TELEMETRY=FALSE
+      # Chroma 1.x persists to /data (configured in the image's /config.yaml).
+      - chroma-data:/data
     networks:
       - rag-network
     healthcheck:
@@ -61,6 +59,11 @@ services:
       - MODEL_BASE_URL=http://ollama:11434
       - MODEL_NAME=llama3.2:1b
       - OTEL_EXPORTER_OTLP_ENDPOINT=http://alloy:4317
+      - OPENTELEMETRY_ENABLED=true
+      # The custom OpenTelemetry SDK exports to these per-signal endpoints (Alloy).
+      - OPENTELEMETRY_TRACES_ENDPOINT=http://alloy:4317
+      - OPENTELEMETRY_METRICS_ENDPOINT=http://alloy:4317
+      - OPENTELEMETRY_LOGS_ENDPOINT=http://alloy:4317
       - ENVIRONMENT=docker
     volumes:
       - ./docs:/app/docs:ro
@@ -106,7 +109,7 @@ services:
 
   # Grafana Tempo for Distributed Tracing
   tempo:
-    image: grafana/tempo:latest
+    image: grafana/tempo:2.6.1
     container_name: java-rag-tempo
     command: ["-config.file=/etc/tempo.yaml"]
     volumes: