[Alexanderamiri]

Part 3 of 6. For review; the platform team will not merge it. Merging this is the first platform deploy.

Why

This replaces "run cdk deploy by hand" with the shared platform pipeline. It builds, tests, plans with a review and deploys on every merge to master, with no AWS secrets in the repo.

What

• .github/workflows/deploy.yml calls javaBin/platform/.github/workflows/javabin.yml@main with java_version: 21 and test_postgres_image: postgres:17, db moresleepunit, user and password localdevuser. That is the setup docker/postgres creates and BaseTestClass expects.
• New Dockerfile (platform image):
  • Maven build stage, then eclipse-temurin:21-jre-jammy running java -jar app.jar as uid 1000.
  • No SOPS, no AWS CLI, no .enc.env. ECS injects the configuration as env vars.
  • -XX:MaxRAMPercentage=75 keeps the heap inside the 512 MB task.
  • The image keeps the code defaults (port 8082, Flyway on), so it is also a working local dev image, like the old :edge image that submittheforce's compose file uses. Production values (SERVER_PORT=5000, DO_FLYWAY_MIGRATION=false, ...) come from app.yaml.
• The old SOPS image moves to Dockerfile.cdk. cdk/lib/moresleep-stack.ts and run-local.sh point at it, so the old stack can still be redeployed (cdk-deploy.yml) until the cutover is safely done.

How the platform piece works

Job	PR	merge to master
build-jvm	mvn verify with a postgres:17 service container on localhost:5432	same
expand	regenerates terraform/ from app.yaml; commits to the PR branch if it changed	same
tf-plan	terraform plan with the team's role, then an AI risk review; both are posted as a PR comment	same; the plan is saved
tf-apply	—	applies the saved, reviewed plan. A HIGH risk rating stops here until a platform owner overrides
docker-build	—	builds Dockerfile, pushes sha-<commit> and latest to ECR moresleep-moresleep
ecs-deploy	—	rolls the service and waits until it is stable

• Credentials: GitHub's OIDC token proves "this job runs a javaBin/platform workflow for javaBin/moresleep". A broker Lambda checks that the repo belongs to the moresleep GitHub team and hands out short-lived credentials for javabin-ci-team-moresleep. That role can only touch resources tagged team=moresleep, or untagged ones like dbmoresleep before the import.
• Default branch: the platform deploys from the repo's default branch (feat(ci): deploy from the default branch and offer Postgres to JVM tests platform#154 added support for master).

What the first merge does: creates the ECR repo, target group, listener rule 120, moresleep.javazone.no, five SSM secrets (all PLACEHOLDER), log group, IAM role, alarms, and the ECS service with 0 tasks. It imports dbmoresleep, adds team=moresleep and the other tags, and turns on deletion protection. Production (sleepingpill.javazone.no on the old stack) is untouched.

How verified

• Tests: 16/16 pass on GitHub against Postgres with JDK 21 (this repo's Build workflow on chore: make master match the deployed awsdocker line #4, the same database and user as the test_postgres_* inputs). The Build workflow also builds this Dockerfile on this PR.
• deploy.yml lints clean (actionlint) against feat(ci): deploy from the default branch and offer Postgres to JVM tests platform#154's javabin.yml. Against current platform main it fails with input "test_postgres_image" is not defined, which is why the Deploy check shows a startup failure until #154 merges.
• The platform image (built by CI from this Dockerfile's runtime stage) runs under the platform's constraints: --read-only --tmpfs /tmp --user 1000 --memory 512m, configured only through env vars, against postgres:17.
  • Jetty starts on port 5000 in about 0.4 s and Flyway applies V1–V7.
  • GET / returns 200 and /public/allSessions returns 200.
  • An unauthenticated POST /data/conference returns 401; with the ALLACCESS user it returns 200.
• Expected red checks until the prerequisites merge: expand fails on adopt until feat(app-yaml): adopt an existing RDS instance and Route53 record platform#155 is merged, and tf-plan fails until the moresleep team exists (javaBin/registry#40) and the repo is in that GitHub team.

Merge when

All of these are done:

• feat(ci): deploy from the default branch and offer Postgres to JVM tests platform#154 and #155 are merged.
• javaBin/registry#40 is merged.
• The repo is added to the team: gh api -X PUT orgs/javaBin/teams/moresleep/repos/javaBin/moresleep -f permission=push.
• A manual snapshot of dbmoresleep exists and is available (aws rds describe-db-snapshots --db-snapshot-identifier dbmoresleep-pre-platform-migration-<date>). The first apply imports the production instance and changes its tags and deletion protection; without this snapshot the only backups are the 7-day automated ones. A platform admin takes it; it has not been taken yet.
• Deploy is re-run on this PR after the above, and its plan comment shows 1 to import, only tags, deletion_protection and final-snapshot settings changing on module.rds_main.aws_db_instance.this, and 0 to destroy. Every Deploy run on this stack fails until #154, #155 and registry#40 are merged (startup_failure, then expand, then tf-plan), so that re-run is the first end-to-end proof.

🤖 Generated with Claude Code