From ed4895abfab83bab157410f3bc619eb9866edcca Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Tue, 26 Aug 2025 08:09:24 +0200
Subject: [PATCH 01/32] chore: update Java version in Dockerfile and sdkmanrc
 to liberica

---
 .circleci/config.yml                   | 93 --------------------------
 .github/workflows/gradle.yml           | 30 +++++++++
 .circleci/codecov.yaml => codecov.yaml |  0
 3 files changed, 30 insertions(+), 93 deletions(-)
 delete mode 100644 .circleci/config.yml
 create mode 100644 .github/workflows/gradle.yml
 rename .circleci/codecov.yaml => codecov.yaml (100%)

diff --git a/.circleci/config.yml b/.circleci/config.yml
deleted file mode 100644
index 747ce382..00000000
--- a/.circleci/config.yml
+++ /dev/null
@@ -1,93 +0,0 @@
-# $schema: https://www.schemastore.org/circleciconfig.json
-version: 2.1
-orbs:
-  codecov: codecov/codecov@5.4.3
-  gradle: circleci/gradle@3.0.0
-executors:
-  jdk:
-    docker:
-      - image: cimg/openjdk:21.0.8
-  jdk-machine:
-    machine:
-      image: ubuntu-2204:current
-      docker_layer_caching: true
-defaults:
-  gradle: &gradle
-    deps_checksum_file: build.gradle.kts
-    cache_key: v2
-    executor: jdk
-jobs:
-  gradle_docker:
-    parameters:
-      command:
-        type: string
-      after:
-        type: steps
-        default: []
-    executor: jdk
-    steps:
-      - checkout
-      - setup_remote_docker:
-          docker_layer_caching: true
-          version: default
-      - gradle/with_cache:
-          deps_checksum_file: build.gradle.kts
-          cache_key: v2
-          steps:
-            - run: ./gradlew << parameters.command >>
-      - steps: << parameters.after >>
-  gradle_integration:
-    executor: jdk-machine
-    steps:
-      - checkout
-      - run: docker compose --profile app up --wait --build
-      - gradle/with_cache:
-          deps_checksum_file: build.gradle.kts
-          cache_key: v2
-          steps:
-            - run: ./gradlew integrationTest --continue
-      - gradle/collect_test_results:
-          reports_path: integration/build/reports
-          test_results_path: integration/build/test-results
-      - run: docker compose down
-  github_release:
-    docker:
-      - image: cimg/base:stable
-    steps:
-      - checkout
-      - github-cli/install:
-          version: 2.76.0
-      - github-cli/setup:
-          version: 2.76.0
-      - run: gh release create << pipeline.git.tag >> -t << pipeline.git.tag >> --generate-notes
-workflows:
-  Build app:
-    jobs:
-      - gradle/run:
-          name: Lint
-          command: spotlessCheck
-          <<: *gradle
-      - gradle/run:
-          name: Build boot jar
-          command: bootJar
-          <<: *gradle
-      - gradle_integration:
-          name: Integration test
-      - gradle_docker:
-          name: Coverage verification
-          command: jacocoTestCoverageVerification
-          after:
-            - codecov/upload:
-                flags: unit
-      - gradle_docker:
-          name: Unit test
-          command: test --continue
-          after:
-            - run:
-                name: Save test results
-                command: |
-                  mkdir -p test-results/junit/
-                  find . -type f -regex ".*/build/test-results/.*xml" -exec cp {} test-results/junit/ \;
-            - gradle/collect_test_results:
-                reports_path: server/build/reports
-                test_results_path: test-results
diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
new file mode 100644
index 00000000..e69432e1
--- /dev/null
+++ b/.github/workflows/gradle.yml
@@ -0,0 +1,30 @@
+name: Gradle Build
+
+on:
+  pull_request:
+  workflow_dispatch:
+  merge_group:
+  schedule:
+    - cron: "0 0 * * *"
+  push:
+    branches: [ "main" ]
+
+jobs:
+  build:
+    runs-on: ubuntu-22.04-arm
+    name: "Build Gradle"
+    permissions:
+      id-token: write # for codecov
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          distribution: "liberica"
+          java-version: 21
+      - uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
+        with:
+          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+      - run: "./gradlew build --continue"
+      - uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0
+        with:
+          use_oidc: 'true'
\ No newline at end of file
diff --git a/.circleci/codecov.yaml b/codecov.yaml
similarity index 100%
rename from .circleci/codecov.yaml
rename to codecov.yaml

From e5883ee3cfb14d9f73bda13f4fbd423ec1a3d543 Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Tue, 26 Aug 2025 08:29:16 +0200
Subject: [PATCH 02/32] chore: update Java version in Dockerfile and sdkmanrc
 to liberica

---
 .github/workflows/gradle.yml | 35 ++++++++++++++++++++++++++++++++---
 1 file changed, 32 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
index e69432e1..bce954ae 100644
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -1,4 +1,4 @@
-name: Gradle Build
+name: Gradle
 
 on:
   pull_request:
@@ -9,10 +9,12 @@ on:
   push:
     branches: [ "main" ]
 
+permissions: read-all
+
 jobs:
   build:
     runs-on: ubuntu-22.04-arm
-    name: "Build Gradle"
+    name: "Build"
     permissions:
       id-token: write # for codecov
     steps:
@@ -27,4 +29,31 @@ jobs:
       - run: "./gradlew build --continue"
       - uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0
         with:
-          use_oidc: 'true'
\ No newline at end of file
+          use_oidc: 'true'
+      - uses: actions/upload-artifact@v3.1.2
+        with:
+          name: "gradle-build-artifacts"
+          path: |
+            **/build/**
+            !buildSrc/build/**
+
+  integration:
+    runs-on: ubuntu-22.04-arm
+    name: "Integration test"
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          distribution: "liberica"
+          java-version: 21
+      - uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
+        with:
+          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+      - run: docker compose -f docker-compose.yml --profile app up --wait --build
+      - run: "./gradlew build --continue"
+      - uses: actions/upload-artifact@v3.1.2
+        with:
+          name: "gradle-build-artifacts"
+          path: |
+            **/build/**
+            !buildSrc/build/**

From 420ee0196cf0a99eae14d4228982edb8c0a9086a Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Tue, 26 Aug 2025 08:30:41 +0200
Subject: [PATCH 03/32] chore: update upload-artifact action to v4.6.2 in
 gradle.yml

---
 .github/workflows/gradle.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
index bce954ae..c2d5b097 100644
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -51,7 +51,7 @@ jobs:
           cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
       - run: docker compose -f docker-compose.yml --profile app up --wait --build
       - run: "./gradlew build --continue"
-      - uses: actions/upload-artifact@v3.1.2
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: "gradle-build-artifacts"
           path: |

From 27e6762c41d3437c4dfb6cb96a238fc43edc5b71 Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Tue, 26 Aug 2025 08:31:47 +0200
Subject: [PATCH 04/32] chore: update upload-artifact action to v4.6.2 in
 gradle.yml

---
 .github/workflows/gradle.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
index c2d5b097..0bbcb9c0 100644
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -30,7 +30,7 @@ jobs:
       - uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0
         with:
           use_oidc: 'true'
-      - uses: actions/upload-artifact@v3.1.2
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: "gradle-build-artifacts"
           path: |

From 96dc8c546ebe6f5dc6d7652f9147285e037daa58 Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Tue, 26 Aug 2025 08:40:43 +0200
Subject: [PATCH 05/32] chore: update upload-artifact action to v4.6.2 in
 gradle.yml

---
 .dockerignore                | 1 +
 .github/workflows/gradle.yml | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.dockerignore b/.dockerignore
index c4cb1623..149bf854 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -117,3 +117,4 @@ renovate.json
 
 ### User template
 db/
+README.md
diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
index 0bbcb9c0..62fb82c4 100644
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -50,10 +50,10 @@ jobs:
         with:
           cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
       - run: docker compose -f docker-compose.yml --profile app up --wait --build
-      - run: "./gradlew build --continue"
+      - run: "./gradlew integrationTest --continue"
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: "gradle-build-artifacts"
+          name: "gradle-integration-artifacts"
           path: |
             **/build/**
             !buildSrc/build/**

From 35427083a00e99efb8915d562876877e5719f07a Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Fri, 29 Aug 2025 18:21:07 +0200
Subject: [PATCH 06/32] feat: add SonarQube plugin and configuration for code
 quality analysis

---
 .github/workflows/gradle.yml                  |  4 ++-
 build.gradle.kts                              |  4 +++
 buildSrc/build.gradle.kts                     |  5 ++++
 .../bsstudio/gradle/SonarConventionPlugin.kt  | 27 +++++++++++++++++++
 gradle/libs.versions.toml                     |  2 ++
 5 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 build.gradle.kts
 create mode 100644 buildSrc/src/main/kotlin/hu/bsstudio/gradle/SonarConventionPlugin.kt

diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
index 62fb82c4..fcf96e76 100644
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -26,7 +26,9 @@ jobs:
       - uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
         with:
           cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
-      - run: "./gradlew build --continue"
+      - run: "./gradlew build sonar --continue"
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
       - uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0
         with:
           use_oidc: 'true'
diff --git a/build.gradle.kts b/build.gradle.kts
new file mode 100644
index 00000000..2220199e
--- /dev/null
+++ b/build.gradle.kts
@@ -0,0 +1,4 @@
+plugins {
+    base
+    id("hu.bsstudio.gradle.sonar-convention")
+}
diff --git a/buildSrc/build.gradle.kts b/buildSrc/build.gradle.kts
index 81c525e1..a58cba73 100644
--- a/buildSrc/build.gradle.kts
+++ b/buildSrc/build.gradle.kts
@@ -10,6 +10,7 @@ repositories {
 dependencies {
     implementation(libs.plugin.springBoot)
     implementation(libs.plugin.spotless)
+    implementation(libs.plugin.sonar)
     implementation(kotlin("allopen", "2.2.10"))
     implementation(kotlin("gradle-plugin", "2.2.10"))
     // required for kotlin plugin jpa
@@ -43,6 +44,10 @@ gradlePlugin {
         id = "hu.bsstudio.gradle.kotlin-convention"
         implementationClass = "hu.bsstudio.gradle.KotlinConventionPlugin"
     }
+    plugins.create("sonar-convention") {
+        id = "hu.bsstudio.gradle.sonar-convention"
+        implementationClass = "hu.bsstudio.gradle.SonarConventionPlugin"
+    }
     plugins.create("spotless-convention") {
         id = "hu.bsstudio.gradle.spotless-convention"
         implementationClass = "hu.bsstudio.gradle.SpotlessConventionPlugin"
diff --git a/buildSrc/src/main/kotlin/hu/bsstudio/gradle/SonarConventionPlugin.kt b/buildSrc/src/main/kotlin/hu/bsstudio/gradle/SonarConventionPlugin.kt
new file mode 100644
index 00000000..3590e795
--- /dev/null
+++ b/buildSrc/src/main/kotlin/hu/bsstudio/gradle/SonarConventionPlugin.kt
@@ -0,0 +1,27 @@
+package hu.bsstudio.gradle
+
+import org.gradle.api.Plugin
+import org.gradle.api.Project
+import org.gradle.kotlin.dsl.apply
+import org.gradle.kotlin.dsl.configure
+import org.gradle.kotlin.dsl.named
+import org.sonarqube.gradle.SonarExtension
+import org.sonarqube.gradle.SonarQubePlugin
+import org.sonarqube.gradle.SonarTask
+
+class SonarConventionPlugin: Plugin<Project> {
+    override fun apply(project: Project) {
+        project.pluginManager.apply(SonarQubePlugin::class)
+        // project.apply(Sonar)
+        project.extensions.configure(SonarExtension::class) {
+            properties {
+                property("sonar.projectKey", "BSStudio_bss-web-admin-backend")
+                property("sonar.organization", "bsstudio")
+            }
+        }
+
+        project.tasks.named<SonarTask>("sonar") {
+            dependsOn(project.tasks.getByName("check"))
+        }
+    }
+}
\ No newline at end of file
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 2953b121..61aafa0a 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -3,6 +3,7 @@ springdoc = "2.8.11"
 springBoot = "3.5.5"
 kotest = "6.0.1"
 spotless = "7.2.1"
+sonar = "6.3.1.5724"
 
 [plugins]
 spotless = { id = "com.diffplug.spotless", version.ref = "spotless" }
@@ -13,3 +14,4 @@ kotestAssertionsJson = { module = "io.kotest:kotest-assertions-json", version.re
 
 plugin-springBoot = { module = "org.springframework.boot:spring-boot-gradle-plugin", version.ref = "springBoot" }
 plugin-spotless = { module = "com.diffplug.spotless:spotless-plugin-gradle", version.ref = "spotless" }
+plugin-sonar = { module = "org.sonarsource.scanner.gradle:sonarqube-gradle-plugin", version.ref = "sonar" }
\ No newline at end of file

From 7bf6e7edb83869dafbaa97ce8f101b1609e870be Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Fri, 29 Aug 2025 18:53:42 +0200
Subject: [PATCH 07/32] fix: update gradle.yml to set fetch-depth for Git blame
 information

---
 .github/workflows/gradle.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
index fcf96e76..b31c4189 100644
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -19,6 +19,8 @@ jobs:
       id-token: write # for codecov
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: '0' # to allow sonar to attach git blame information
       - uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
           distribution: "liberica"

From eca713dcb1c691b8f1e4248988897f1acd436bc2 Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Tue, 16 Sep 2025 21:27:52 +0200
Subject: [PATCH 08/32] Update gradle.yml

---
 .github/workflows/gradle.yml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
index b31c4189..47880b7d 100644
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -28,9 +28,7 @@ jobs:
       - uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
         with:
           cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
-      - run: "./gradlew build sonar --continue"
-        env:
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+      - run: "./gradlew build --continue"
       - uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0
         with:
           use_oidc: 'true'

From 790cdb35d28fc4b6dc64999b896898abbe236aa6 Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Tue, 16 Sep 2025 21:44:49 +0200
Subject: [PATCH 09/32] chore: update scorecard.yml for improved GitHub Actions
 integration

---
 .github/workflows/scorecard.yml | 53 ++++++++++-----------------------
 1 file changed, 15 insertions(+), 38 deletions(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 4f1e6f30..0be503cd 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -1,7 +1,3 @@
-# This workflow uses actions that are not certified by GitHub. They are provided
-# by a third-party and are governed by separate terms of service, privacy
-# policy, and support documentation.
-
 name: Scorecard supply-chain security
 on:
   # For Branch-Protection check. Only the default branch is supported. See
@@ -16,65 +12,46 @@ on:
   push:
     branches: [ "main" ]
 
-# Declare default permissions as read only.
 permissions: read-all
 
 jobs:
   analysis:
     name: Scorecard analysis
     runs-on: ubuntu-latest
-    # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
-    if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
     permissions:
-      # Needed to upload the results to code-scanning dashboard.
       security-events: write
-      # Needed to publish results and get a badge (see publish_results below).
       id-token: write
-      # Uncomment the permissions below if installing in a private repository.
-      # contents: read
-      # actions: read
 
     steps:
-      - name: "Checkout code"
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+        id: release-token
+        with:
+          app-id: ${{ vars.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+          permission-contents: write # to be able to publish a GitHub release
+          permission-issues: write # to be able to comment on released issues
+          permission-pull-requests: write # to be able to comment on released pull requests
+
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
 
-      - name: "Run analysis"
-        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
+      - uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
         with:
           results_file: results.sarif
           results_format: sarif
-          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
-          # - you want to enable the Branch-Protection check on a *public* repository, or
-          # - you are installing Scorecard on a *private* repository
-          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
-          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
-
-          # Public repositories:
-          #   - Publish results to OpenSSF REST API for easy access by consumers
-          #   - Allows the repository to include the Scorecard badge.
-          #   - See https://github.com/ossf/scorecard-action#publishing-results.
-          # For private repositories:
-          #   - `publish_results` will always be set to `false`, regardless
-          #     of the value entered here.
-          publish_results: true
+          repo_token: ${{ steps.release-token.outputs.token }}
+          publish_results: ${{ github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request' }}
 
           # (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore
           # file_mode: git
 
-      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
-      # format to the repository Actions tab.
-      - name: "Upload artifact"
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
-      # Upload the results to GitHub's code scanning dashboard (optional).
-      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
-      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
+      - uses: github/codeql-action/upload-sarif@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
         with:
           sarif_file: results.sarif

From c3aab6b3297d77b03dab3367b46e6f1ea21378df Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Fri, 19 Sep 2025 13:27:02 +0100
Subject: [PATCH 10/32] feat: add application configuration and initial test
 setup

---
 server/build.gradle.kts                             |  5 +++++
 .../hu/bsstudio/bssweb/BssWebApplicationTest.kt     | 13 +++++++++++++
 server/src/test/resources/application.yml           | 13 +++++++++++++
 3 files changed, 31 insertions(+)
 create mode 100644 server/src/test/kotlin/hu/bsstudio/bssweb/BssWebApplicationTest.kt
 create mode 100644 server/src/test/resources/application.yml

diff --git a/server/build.gradle.kts b/server/build.gradle.kts
index 00ca9d6b..09252804 100644
--- a/server/build.gradle.kts
+++ b/server/build.gradle.kts
@@ -4,6 +4,7 @@ plugins {
     id("hu.bsstudio.gradle.spotless-convention")
     id("hu.bsstudio.gradle.kotlin-convention")
     id("hu.bsstudio.gradle.spring-app-convention")
+    id("hu.bsstudio.gradle.test-convention")
     `jacoco-report-aggregation`
     `test-report-aggregation`
 }
@@ -14,6 +15,10 @@ dependencies {
     // todo these scopes were only supported by the spring gradle dependency management plugin
     // annotationProcessor("org.springframework.boot:spring-boot-configuration-processor")
     // developmentOnly("org.springframework.boot:spring-boot-devtools")
+    testImplementation("org.springframework.boot:spring-boot-testcontainers")
+    testImplementation("org.testcontainers:testcontainers")
+    testImplementation("org.testcontainers:postgresql")
+    testImplementation("org.testcontainers:junit-jupiter")
 }
 
 tasks.test {
diff --git a/server/src/test/kotlin/hu/bsstudio/bssweb/BssWebApplicationTest.kt b/server/src/test/kotlin/hu/bsstudio/bssweb/BssWebApplicationTest.kt
new file mode 100644
index 00000000..08ba2f84
--- /dev/null
+++ b/server/src/test/kotlin/hu/bsstudio/bssweb/BssWebApplicationTest.kt
@@ -0,0 +1,13 @@
+package hu.bsstudio.bssweb
+
+import org.junit.jupiter.api.Test
+import org.springframework.boot.test.context.SpringBootTest
+
+@SpringBootTest
+class BssWebApplicationTest {
+
+    @Test
+    fun contextLoads() {
+    }
+
+}
diff --git a/server/src/test/resources/application.yml b/server/src/test/resources/application.yml
new file mode 100644
index 00000000..64be21f5
--- /dev/null
+++ b/server/src/test/resources/application.yml
@@ -0,0 +1,13 @@
+bss:
+  file-api:
+    url: http://localhost:8888
+spring:
+  datasource:
+    url: jdbc:tc:postgresql:16.3-alpine3.18:///db?currentSchema=private
+  security:
+    oauth2:
+      resourceserver:
+        opaquetoken:
+          introspection-uri: http://localhost:8888
+          client-id: client-id
+          client-secret: client-secret

From 7a15f24fa0f1219b513599685697af853ea60ca9 Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Tue, 23 Sep 2025 09:27:50 +0100
Subject: [PATCH 11/32] feat: upgrade to Java 25 and update Gradle wrapper to
 9.1.0

---
 .sdkmanrc                                                     | 2 +-
 Dockerfile                                                    | 4 ++--
 .../main/kotlin/hu/bsstudio/gradle/JavaConventionPlugin.kt    | 2 +-
 .../kotlin/hu/bsstudio/gradle/JavaLibraryConventionPlugin.kt  | 2 +-
 .../main/kotlin/hu/bsstudio/gradle/KotlinConventionPlugin.kt  | 2 +-
 gradle/wrapper/gradle-wrapper.properties                      | 2 +-
 gradlew                                                       | 3 ---
 gradlew.bat                                                   | 3 +--
 8 files changed, 8 insertions(+), 12 deletions(-)

diff --git a/.sdkmanrc b/.sdkmanrc
index fea384dc..0f5a374b 100644
--- a/.sdkmanrc
+++ b/.sdkmanrc
@@ -1,3 +1,3 @@
 # Enable auto-env through the sdkman_auto_env config
 # Add key=value pairs of SDKs to use below
-java=21.0.8-librca
+java= 25-librca
diff --git a/Dockerfile b/Dockerfile
index 17c3ff12..6ccea33d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM bellsoft/liberica-runtime-container:jdk-21.0.8_13-crac-cds-musl@sha256:38fc3826ce2ef81058b4384d4d49a33ceba57607737a775af369db66daeb6009 AS build
+FROM bellsoft/liberica-runtime-container:jdk-25_37-crac-cds-musl AS build
 WORKDIR /usr/src/app
 # cache dependencies
 COPY ./gradlew                         ./
@@ -23,7 +23,7 @@ COPY ./server   ./server
 ARG BUILD_ARG="bootJar"
 RUN ./gradlew ${BUILD_ARG}
 
-FROM bellsoft/liberica-runtime-container:jre-21.0.8_12-cds-musl@sha256:8e63ca393ad6f5e39734c742cc5632bff702450e632684880232ce3057ed1831 AS app
+FROM bellsoft/liberica-runtime-container:jre-25_37-cds-musl@sha256:ce3b1ee12fc239c65ddfaa26182e326ecdfd059620d9a15ac00d5910cfca6f16 AS app
 # use non-root user
 RUN addgroup -S spring && adduser -S spring -G spring
 USER spring:spring
diff --git a/buildSrc/src/main/kotlin/hu/bsstudio/gradle/JavaConventionPlugin.kt b/buildSrc/src/main/kotlin/hu/bsstudio/gradle/JavaConventionPlugin.kt
index c4b051b7..906e0982 100644
--- a/buildSrc/src/main/kotlin/hu/bsstudio/gradle/JavaConventionPlugin.kt
+++ b/buildSrc/src/main/kotlin/hu/bsstudio/gradle/JavaConventionPlugin.kt
@@ -15,7 +15,7 @@ class JavaConventionPlugin : Plugin<Project> {
 
         project.extensions.configure(JavaPluginExtension::class) {
             toolchain {
-                languageVersion.set(JavaLanguageVersion.of(21))
+                languageVersion.set(JavaLanguageVersion.of(25))
             }
         }
 
diff --git a/buildSrc/src/main/kotlin/hu/bsstudio/gradle/JavaLibraryConventionPlugin.kt b/buildSrc/src/main/kotlin/hu/bsstudio/gradle/JavaLibraryConventionPlugin.kt
index ee3797d5..ff35e62f 100644
--- a/buildSrc/src/main/kotlin/hu/bsstudio/gradle/JavaLibraryConventionPlugin.kt
+++ b/buildSrc/src/main/kotlin/hu/bsstudio/gradle/JavaLibraryConventionPlugin.kt
@@ -15,7 +15,7 @@ class JavaLibraryConventionPlugin : Plugin<Project> {
 
         project.extensions.configure(JavaPluginExtension::class) {
             toolchain {
-                languageVersion.set(JavaLanguageVersion.of(21))
+                languageVersion.set(JavaLanguageVersion.of(25))
             }
         }
 
diff --git a/buildSrc/src/main/kotlin/hu/bsstudio/gradle/KotlinConventionPlugin.kt b/buildSrc/src/main/kotlin/hu/bsstudio/gradle/KotlinConventionPlugin.kt
index 32ffd2e4..364c9aba 100644
--- a/buildSrc/src/main/kotlin/hu/bsstudio/gradle/KotlinConventionPlugin.kt
+++ b/buildSrc/src/main/kotlin/hu/bsstudio/gradle/KotlinConventionPlugin.kt
@@ -16,7 +16,7 @@ class KotlinConventionPlugin : Plugin<Project> {
                 freeCompilerArgs = listOf("-Xjsr305=strict")
                 extraWarnings = true
                 allWarningsAsErrors = true
-                jvmTarget = org.jetbrains.kotlin.gradle.dsl.JvmTarget.JVM_21
+                jvmTarget = org.jetbrains.kotlin.gradle.dsl.JvmTarget.JVM_25
             }
         }
     }
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index 2a84e188..2e111328 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.0.0-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.1.0-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
diff --git a/gradlew b/gradlew
index ef07e016..adff685a 100755
--- a/gradlew
+++ b/gradlew
@@ -114,7 +114,6 @@ case "$( uname )" in                #(
   NONSTOP* )        nonstop=true ;;
 esac
 
-CLASSPATH="\\\"\\\""
 
 
 # Determine the Java command to use to start the JVM.
@@ -172,7 +171,6 @@ fi
 # For Cygwin or MSYS, switch paths to Windows format before running java
 if "$cygwin" || "$msys" ; then
     APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
-    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
 
     JAVACMD=$( cygpath --unix "$JAVACMD" )
 
@@ -212,7 +210,6 @@ DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
 
 set -- \
         "-Dorg.gradle.appname=$APP_BASE_NAME" \
-        -classpath "$CLASSPATH" \
         -jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
         "$@"
 
diff --git a/gradlew.bat b/gradlew.bat
index db3a6ac2..c4bdd3ab 100644
--- a/gradlew.bat
+++ b/gradlew.bat
@@ -70,11 +70,10 @@ goto fail
 :execute
 @rem Setup the command line
 
-set CLASSPATH=
 
 
 @rem Execute Gradle
-"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
 
 :end
 @rem End local scope for the variables with windows NT shell

From 98752144237b65b0e29b816cd8b6ed44131f36e2 Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Tue, 23 Sep 2025 09:28:16 +0100
Subject: [PATCH 12/32] feat: update Kotlin dependencies to version 2.3.0

---
 buildSrc/build.gradle.kts | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/buildSrc/build.gradle.kts b/buildSrc/build.gradle.kts
index b80116ab..48f2461a 100644
--- a/buildSrc/build.gradle.kts
+++ b/buildSrc/build.gradle.kts
@@ -11,12 +11,12 @@ dependencies {
     implementation(libs.plugin.springBoot)
     implementation(libs.plugin.spotless)
     implementation(libs.plugin.detekt)
-    implementation(kotlin("allopen", "2.2.20"))
-    implementation(kotlin("gradle-plugin", "2.2.20"))
+    implementation(kotlin("allopen", "2.3.0"))
+    implementation(kotlin("gradle-plugin", "2.3.0"))
     // required for kotlin plugin jpa
-    implementation(kotlin("reflect", "2.2.20"))
-    implementation(kotlin("stdlib-jdk8", "2.2.20"))
-    implementation(kotlin("noarg", "2.2.20"))
+    implementation(kotlin("reflect", "2.3.0"))
+    implementation(kotlin("stdlib-jdk8", "2.3.0"))
+    implementation(kotlin("noarg", "2.3.0"))
 }
 
 gradlePlugin {

From 4e60d29bc1f1c0c0c377c5a560958367a17f0d62 Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Mon, 29 Sep 2025 11:04:27 +0100
Subject: [PATCH 13/32] Update .sdkmanrc

---
 .sdkmanrc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.sdkmanrc b/.sdkmanrc
index 0f5a374b..2b4236b4 100644
--- a/.sdkmanrc
+++ b/.sdkmanrc
@@ -1,3 +1,3 @@
 # Enable auto-env through the sdkman_auto_env config
 # Add key=value pairs of SDKs to use below
-java= 25-librca
+java=25-librca

From 0bd6b28dd13266d4fc055178d4fc0bbe3b43298e Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Sat, 4 Oct 2025 09:43:31 +0100
Subject: [PATCH 14/32] feat: update Kotlin dependencies to 2.3.0-dev-9673 and
 add bootstrap repository

---
 buildSrc/build.gradle.kts                             | 11 ++++++-----
 .../hu/bsstudio/gradle/DependencyManagementPlugin.kt  |  3 +++
 settings.gradle.kts                                   |  1 +
 3 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/buildSrc/build.gradle.kts b/buildSrc/build.gradle.kts
index 48f2461a..33c4e2b5 100644
--- a/buildSrc/build.gradle.kts
+++ b/buildSrc/build.gradle.kts
@@ -5,18 +5,19 @@ plugins {
 
 repositories {
     gradlePluginPortal()
+    maven("https://redirector.kotlinlang.org/maven/bootstrap")
 }
 
 dependencies {
     implementation(libs.plugin.springBoot)
     implementation(libs.plugin.spotless)
     implementation(libs.plugin.detekt)
-    implementation(kotlin("allopen", "2.3.0"))
-    implementation(kotlin("gradle-plugin", "2.3.0"))
+    implementation(kotlin("allopen", "2.3.0-dev-9673"))
+    implementation(kotlin("gradle-plugin", "2.3.0-dev-9673"))
     // required for kotlin plugin jpa
-    implementation(kotlin("reflect", "2.3.0"))
-    implementation(kotlin("stdlib-jdk8", "2.3.0"))
-    implementation(kotlin("noarg", "2.3.0"))
+    implementation(kotlin("reflect", "2.3.0-dev-9673"))
+    implementation(kotlin("stdlib-jdk8", "2.3.0-dev-9673"))
+    implementation(kotlin("noarg", "2.3.0-dev-9673"))
 }
 
 gradlePlugin {
diff --git a/buildSrc/src/main/kotlin/hu/bsstudio/gradle/DependencyManagementPlugin.kt b/buildSrc/src/main/kotlin/hu/bsstudio/gradle/DependencyManagementPlugin.kt
index 41f30d5f..89046475 100644
--- a/buildSrc/src/main/kotlin/hu/bsstudio/gradle/DependencyManagementPlugin.kt
+++ b/buildSrc/src/main/kotlin/hu/bsstudio/gradle/DependencyManagementPlugin.kt
@@ -9,6 +9,9 @@ class DependencyManagementPlugin : Plugin<Project> {
     override fun apply(project: Project) {
         project.repositories {
             mavenCentral()
+            maven {
+                url = project.uri("https://redirector.kotlinlang.org/maven/bootstrap")
+            }
         }
 
         project.dependencies {
diff --git a/settings.gradle.kts b/settings.gradle.kts
index afff5329..bc78af72 100644
--- a/settings.gradle.kts
+++ b/settings.gradle.kts
@@ -1,4 +1,5 @@
 rootProject.name = "bss-web-admin-backend"
+
 include(
     "server",
     "server:web",

From 1d57787b3666d9fee66d8c68e85f22826807caf8 Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Sat, 4 Oct 2025 09:48:00 +0100
Subject: [PATCH 15/32] chore: update Dockerfile to use specific image digest
 for build

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 2aeeb244..ea946c84 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM bellsoft/liberica-runtime-container:jdk-25-cds-musl AS build
+FROM bellsoft/liberica-runtime-container:jdk-25-cds-musl@sha256:450594440bb32b72f281e50626b629f1cc60caeb7796638bc570b9fab03e55ee AS build
 WORKDIR /usr/src/app
 # cache dependencies
 COPY ./gradlew                         ./

From 697da06db6b09d30c0a0ff379931dc9a70365343 Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Sat, 4 Oct 2025 09:52:55 +0100
Subject: [PATCH 16/32] refactor: remove unnecessary whitespace in
 BssWebApplicationTest

---
 .../src/test/kotlin/hu/bsstudio/bssweb/BssWebApplicationTest.kt | 2 --
 1 file changed, 2 deletions(-)

diff --git a/server/src/test/kotlin/hu/bsstudio/bssweb/BssWebApplicationTest.kt b/server/src/test/kotlin/hu/bsstudio/bssweb/BssWebApplicationTest.kt
index 08ba2f84..c0260351 100644
--- a/server/src/test/kotlin/hu/bsstudio/bssweb/BssWebApplicationTest.kt
+++ b/server/src/test/kotlin/hu/bsstudio/bssweb/BssWebApplicationTest.kt
@@ -5,9 +5,7 @@ import org.springframework.boot.test.context.SpringBootTest
 
 @SpringBootTest
 class BssWebApplicationTest {
-
     @Test
     fun contextLoads() {
     }
-
 }

From c0558a54c08a9d4cf2bde64f27da097b5cc4eace Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Sat, 4 Oct 2025 21:19:46 +0100
Subject: [PATCH 17/32] chore: update OpenJDK image version to 25.0 in
 config.yml

---
 .circleci/config.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 747ce382..f7b61488 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -6,7 +6,7 @@ orbs:
 executors:
   jdk:
     docker:
-      - image: cimg/openjdk:21.0.8
+      - image: cimg/openjdk:25.0
   jdk-machine:
     machine:
       image: ubuntu-2204:current

From b61e4ad176e7be7c5aeeb3aa86e1b1180512c78b Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Sat, 4 Oct 2025 21:31:30 +0100
Subject: [PATCH 18/32] chore: update OpenJDK image version to 25.0 in
 config.yml

---
 .circleci/config.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index f7b61488..9db55a64 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -6,7 +6,7 @@ orbs:
 executors:
   jdk:
     docker:
-      - image: cimg/openjdk:25.0
+      - image: cimg/openjdk:25.0@sha256:68904aab56332053f83310682a30d455a6c785600d6d25b7fa9f91ccc66d8c72
   jdk-machine:
     machine:
       image: ubuntu-2204:current

From 05cb963d3517b401075f4045974746b520cd0008 Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Sat, 4 Oct 2025 22:05:35 +0100
Subject: [PATCH 19/32] chore: reorganize Dockerfile and settings.gradle.kts
 for improved build structure

---
 Dockerfile          | 31 ++++++++++++++++---------------
 settings.gradle.kts | 14 +++++++-------
 2 files changed, 23 insertions(+), 22 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 17c3ff12..0bbf67bd 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,22 +1,23 @@
 FROM bellsoft/liberica-runtime-container:jdk-21.0.8_13-crac-cds-musl@sha256:38fc3826ce2ef81058b4384d4d49a33ceba57607737a775af369db66daeb6009 AS build
 WORKDIR /usr/src/app
 # cache dependencies
-COPY ./gradlew                         ./
-COPY ./gradle.properties               ./
-COPY ./gradle/wrapper                  ./gradle/wrapper/
+COPY ./buildSrc/*.gradle.kts             ./buildSrc/
+COPY ./buildSrc/src                      ./buildSrc/src/
+COPY ./client/build.gradle.kts           ./client/
+COPY ./gradle                            ./gradle/
+COPY ./integration/build.gradle.kts      ./integration/
+COPY ./server/build.gradle.kts           ./server/
+COPY ./server/client/build.gradle.kts    ./server/client/
+COPY ./server/common/build.gradle.kts    ./server/common/
+COPY ./server/data/build.gradle.kts      ./server/data/
+COPY ./server/model/build.gradle.kts     ./server/model/
+COPY ./server/operation/build.gradle.kts ./server/operation/
+COPY ./server/service/build.gradle.kts   ./server/service/
+COPY ./server/web/build.gradle.kts       ./server/web/
+COPY ./gradlew                           ./
+COPY ./gradle.properties                 ./
+COPY ./settings.gradle.kts               ./
 RUN ./gradlew
-COPY ./settings.gradle.kts             ./
-COPY ./gradle                          ./gradle/
-COPY ./buildSrc/src                    ./buildSrc/src/
-COPY ./buildSrc/*.gradle.kts           ./buildSrc/
-COPY ./server/build.gradle.kts         ./server/
-COPY ./server/web/build.gradle.kts     ./server/web/
-COPY ./server/service/build.gradle.kts ./server/service/
-COPY ./server/data/build.gradle.kts    ./server/data/
-COPY ./server/model/build.gradle.kts   ./server/model/
-COPY ./server/common/build.gradle.kts  ./server/common/
-COPY ./integration/build.gradle.kts    ./integration/
-COPY ./client/build.gradle.kts         ./client/
 # build
 COPY ./buildSrc ./buildSrc
 COPY ./server   ./server
diff --git a/settings.gradle.kts b/settings.gradle.kts
index afff5329..ac0c1eaf 100644
--- a/settings.gradle.kts
+++ b/settings.gradle.kts
@@ -1,13 +1,13 @@
 rootProject.name = "bss-web-admin-backend"
 include(
+    "client",
+    "integration",
     "server",
-    "server:web",
+    "server:client",
+    "server:common",
+    "server:data",
+    "server:model",
     "server:operation",
     "server:service",
-    "server:model",
-    "server:data",
-    "server:common",
-    "server:client",
-    "client",
-    "integration"
+    "server:web",
 )

From 7b427509c18f173984b40c092646d6a9c004b26f Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Sat, 4 Oct 2025 22:30:55 +0100
Subject: [PATCH 20/32] chore: optimize Dockerfile with cache mounts for gradle
 builds

---
 Dockerfile | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index ea998a60..b1bfeef6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,12 +17,14 @@ COPY ./server/web/build.gradle.kts       ./server/web/
 COPY ./gradlew                           ./
 COPY ./gradle.properties                 ./
 COPY ./settings.gradle.kts               ./
-RUN ./gradlew
+RUN --mount=type=cache,target=/root/.gradle \
+    ./gradlew
 # build
 COPY ./buildSrc ./buildSrc
 COPY ./server   ./server
 ARG BUILD_ARG="bootJar"
-RUN ./gradlew ${BUILD_ARG}
+RUN --mount=type=cache,target=/root/.gradle \
+    ./gradlew ${BUILD_ARG}
 
 FROM bellsoft/liberica-runtime-container:jre-25-cds-musl@sha256:dfba02c9de055cd89f1c3e860425bef21cd88129a49a874e6024b953d9060d05 AS app
 # use non-root user

From 62bda84e5e9c924725b862fb72f6c988d970e5ff Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Sat, 4 Oct 2025 22:59:04 +0100
Subject: [PATCH 21/32] chore: update Java version to 25 in gradle.yml and
 modify docker.yml for conditional platform setting

---
 .github/workflows/docker.yml | 1 +
 .github/workflows/gradle.yml | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 8abd9be4..55bd5d55 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -67,6 +67,7 @@ jobs:
           sbom: true
           provenance: true
           set: |
+            ${{ github.event_name == 'pull_request' || '--set="*.platform=linux/arm64/v8"' }}
             *.cache-from=type=gha
             *.cache-to=type=gha,mode=max
 
diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
index 47880b7d..81a10ddb 100644
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -24,7 +24,7 @@ jobs:
       - uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
           distribution: "liberica"
-          java-version: 21
+          java-version: 25
       - uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
         with:
           cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}

From 13df06e32aed2f5be1d0a63558980785b00128cd Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Sat, 4 Oct 2025 23:07:41 +0100
Subject: [PATCH 22/32] chore: remove conditional platform setting from
 docker.yml

---
 .github/workflows/docker.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 55bd5d55..8abd9be4 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -67,7 +67,6 @@ jobs:
           sbom: true
           provenance: true
           set: |
-            ${{ github.event_name == 'pull_request' || '--set="*.platform=linux/arm64/v8"' }}
             *.cache-from=type=gha
             *.cache-to=type=gha,mode=max
 

From 3e6b0201f5e35a22a5db1bb4d7fb428e913e3855 Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Thu, 13 Nov 2025 10:09:11 +0000
Subject: [PATCH 23/32] Update build.gradle.kts

---
 buildSrc/build.gradle.kts | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/buildSrc/build.gradle.kts b/buildSrc/build.gradle.kts
index 5e0e3006..23ffb638 100644
--- a/buildSrc/build.gradle.kts
+++ b/buildSrc/build.gradle.kts
@@ -11,12 +11,12 @@ dependencies {
     implementation(libs.plugin.springBoot)
     implementation(libs.plugin.spotless)
     implementation(libs.plugin.detekt)
-    implementation(kotlin("allopen", "2.2.21"))
-    implementation(kotlin("gradle-plugin", "2.2.21"))
+    implementation(kotlin("allopen", "2.3.0-Beta2"))
+    implementation(kotlin("gradle-plugin", "2.3.0-Beta2"))
     // required for kotlin plugin jpa
-    implementation(kotlin("reflect", "2.2.21"))
-    implementation(kotlin("stdlib-jdk8", "2.2.21"))
-    implementation(kotlin("noarg", "2.2.21"))
+    implementation(kotlin("reflect", "2.3.0-Beta2"))
+    implementation(kotlin("stdlib-jdk8", "2.3.0-Beta2"))
+    implementation(kotlin("noarg", "2.3.0-Beta2"))
 }
 
 gradlePlugin {

From 073755cbb425f805584a1ce1fb5c429d59aff7b1 Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Thu, 13 Nov 2025 11:28:52 +0000
Subject: [PATCH 24/32] chore(deps): update Kotlin dependencies and Detekt
 version

---
 buildSrc/build.gradle.kts | 10 +++++-----
 gradle/libs.versions.toml |  8 +++++++-
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/buildSrc/build.gradle.kts b/buildSrc/build.gradle.kts
index 23ffb638..71ad4b9c 100644
--- a/buildSrc/build.gradle.kts
+++ b/buildSrc/build.gradle.kts
@@ -11,12 +11,12 @@ dependencies {
     implementation(libs.plugin.springBoot)
     implementation(libs.plugin.spotless)
     implementation(libs.plugin.detekt)
-    implementation(kotlin("allopen", "2.3.0-Beta2"))
-    implementation(kotlin("gradle-plugin", "2.3.0-Beta2"))
+    implementation(libs.kotlin.allopen)
+    implementation(libs.kotlin.gradle.plugin)
     // required for kotlin plugin jpa
-    implementation(kotlin("reflect", "2.3.0-Beta2"))
-    implementation(kotlin("stdlib-jdk8", "2.3.0-Beta2"))
-    implementation(kotlin("noarg", "2.3.0-Beta2"))
+    implementation(libs.kotlin.reflect)
+    implementation(libs.kotlin.stdlib.jdk8)
+    implementation(libs.kotlin.noarg)
 }
 
 gradlePlugin {
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index ecdcb841..b1c56120 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -3,7 +3,8 @@ springdoc = "2.8.14"
 springBoot = "3.5.7"
 kotest = "6.0.4"
 spotless = "8.0.0"
-detekt = "1.23.8"
+detekt = "2.0.0-alpha.1"
+kotlin = "2.3.0-Beta2"
 
 [plugins]
 spotless = { id = "com.diffplug.spotless", version.ref = "spotless" }
@@ -15,3 +16,8 @@ kotestAssertionsJson = { module = "io.kotest:kotest-assertions-json", version.re
 plugin-springBoot = { module = "org.springframework.boot:spring-boot-gradle-plugin", version.ref = "springBoot" }
 plugin-spotless = { module = "com.diffplug.spotless:spotless-plugin-gradle", version.ref = "spotless" }
 plugin-detekt = { module = "io.gitlab.arturbosch.detekt:detekt-gradle-plugin", version.ref = "detekt" }
+kotlin-allopen = { module = "org.jetbrains.kotlin:kotlin-allopen", version.ref = "kotlin" }
+kotlin-gradle-plugin = { module = "org.jetbrains.kotlin:kotlin-gradle-plugin", version.ref = "kotlin" }
+kotlin-reflect = { module = "org.jetbrains.kotlin:kotlin-reflect", version.ref = "kotlin" }
+kotlin-stdlib-jdk8 = { module = "org.jetbrains.kotlin:kotlin-stdlib-jdk8", version.ref = "kotlin" }
+kotlin-noarg = { module = "org.jetbrains.kotlin:kotlin-noarg", version.ref = "kotlin" }

From c7926956c17fd8e6daa3907cc3db138c89765adf Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Thu, 13 Nov 2025 11:50:35 +0000
Subject: [PATCH 25/32] chore(deps): update Kotlin dependencies and Detekt
 version

---
 buildSrc/build.gradle.kts | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/buildSrc/build.gradle.kts b/buildSrc/build.gradle.kts
index 71ad4b9c..17ad1f40 100644
--- a/buildSrc/build.gradle.kts
+++ b/buildSrc/build.gradle.kts
@@ -5,6 +5,14 @@ plugins {
 
 repositories {
     gradlePluginPortal()
+    // TODO: remove when detekt stable is in gradle plugin portal
+    maven {
+        // https://central.sonatype.org/publish/publish-portal-snapshots/#consuming-via-gradle
+        url = 'https://central.sonatype.com/repository/maven-snapshots/'
+        content {
+            includeModule("io.gitlab.arturbosch.detekt", "detekt-gradle-plugin")
+        }
+    }
 }
 
 dependencies {

From 01743b543e223e211953c486ac0b6ccc1dfaee3a Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Thu, 13 Nov 2025 11:51:54 +0000
Subject: [PATCH 26/32] chore(deps): update Kotlin dependencies and Detekt
 version

---
 buildSrc/build.gradle.kts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/buildSrc/build.gradle.kts b/buildSrc/build.gradle.kts
index 17ad1f40..61ce4a5e 100644
--- a/buildSrc/build.gradle.kts
+++ b/buildSrc/build.gradle.kts
@@ -8,7 +8,7 @@ repositories {
     // TODO: remove when detekt stable is in gradle plugin portal
     maven {
         // https://central.sonatype.org/publish/publish-portal-snapshots/#consuming-via-gradle
-        url = 'https://central.sonatype.com/repository/maven-snapshots/'
+        url = "https://central.sonatype.com/repository/maven-snapshots/"
         content {
             includeModule("io.gitlab.arturbosch.detekt", "detekt-gradle-plugin")
         }

From ebfea61c6e07901cfdc5e3bef4b8cf44baa846b2 Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Thu, 13 Nov 2025 11:52:10 +0000
Subject: [PATCH 27/32] chore(deps): update Kotlin dependencies and Detekt
 version

---
 buildSrc/build.gradle.kts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/buildSrc/build.gradle.kts b/buildSrc/build.gradle.kts
index 61ce4a5e..99ec209e 100644
--- a/buildSrc/build.gradle.kts
+++ b/buildSrc/build.gradle.kts
@@ -8,7 +8,7 @@ repositories {
     // TODO: remove when detekt stable is in gradle plugin portal
     maven {
         // https://central.sonatype.org/publish/publish-portal-snapshots/#consuming-via-gradle
-        url = "https://central.sonatype.com/repository/maven-snapshots/"
+        url = uri("https://central.sonatype.com/repository/maven-snapshots/")
         content {
             includeModule("io.gitlab.arturbosch.detekt", "detekt-gradle-plugin")
         }

From 7da06dddf554c81800e5c7d0f682ea06f8343ba9 Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Fri, 21 Nov 2025 07:18:34 +0000
Subject: [PATCH 28/32] Update libs.versions.toml

---
 gradle/libs.versions.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index b1c56120..54e998ca 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -15,7 +15,7 @@ kotestAssertionsJson = { module = "io.kotest:kotest-assertions-json", version.re
 
 plugin-springBoot = { module = "org.springframework.boot:spring-boot-gradle-plugin", version.ref = "springBoot" }
 plugin-spotless = { module = "com.diffplug.spotless:spotless-plugin-gradle", version.ref = "spotless" }
-plugin-detekt = { module = "io.gitlab.arturbosch.detekt:detekt-gradle-plugin", version.ref = "detekt" }
+plugin-detekt = { module = "dev.detekt:detekt-gradle-plugin", version.ref = "detekt" }
 kotlin-allopen = { module = "org.jetbrains.kotlin:kotlin-allopen", version.ref = "kotlin" }
 kotlin-gradle-plugin = { module = "org.jetbrains.kotlin:kotlin-gradle-plugin", version.ref = "kotlin" }
 kotlin-reflect = { module = "org.jetbrains.kotlin:kotlin-reflect", version.ref = "kotlin" }

From 49516b8cefd72bf23c570bfd38f571445c7d4d16 Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Fri, 21 Nov 2025 07:19:24 +0000
Subject: [PATCH 29/32] Update build.gradle.kts

---
 buildSrc/build.gradle.kts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/buildSrc/build.gradle.kts b/buildSrc/build.gradle.kts
index 99ec209e..99de14b5 100644
--- a/buildSrc/build.gradle.kts
+++ b/buildSrc/build.gradle.kts
@@ -10,7 +10,7 @@ repositories {
         // https://central.sonatype.org/publish/publish-portal-snapshots/#consuming-via-gradle
         url = uri("https://central.sonatype.com/repository/maven-snapshots/")
         content {
-            includeModule("io.gitlab.arturbosch.detekt", "detekt-gradle-plugin")
+            includeModule("dev.detekt", "detekt-gradle-plugin")
         }
     }
 }

From 412a015a908dad3d09c1d524947bd4aeca1783d8 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 21 Nov 2025 07:27:33 +0000
Subject: [PATCH 30/32] perf(deps): update bellsoft/liberica-runtime-container
 docker tag

---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 31fba86c..9fdeb7be 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM bellsoft/liberica-runtime-container:jdk-21.0.9_11-cds-musl@sha256:5496387564e4d750e81e9f0ecb01efa372a8e83caa39fbac793d29ecf9881e5d AS build
+FROM bellsoft/liberica-runtime-container:jdk-25.0.1_11-cds-musl@sha256:b0c86d868c5ef7a5828fbf8b511910f0019491f0b04b739cf25bb340a63a6601 AS build
 WORKDIR /usr/src/app
 # cache dependencies
 COPY ./buildSrc/*.gradle.kts             ./buildSrc/
@@ -26,7 +26,7 @@ ARG BUILD_ARG="bootJar"
 RUN --mount=type=cache,target=/root/.gradle \
     ./gradlew ${BUILD_ARG}
 
-FROM bellsoft/liberica-runtime-container:jre-25-cds-musl@sha256:67bd5da45bfceacc89d642ad38771fbfbe44c00ea73e90ec646e417df8d940e5 AS app
+FROM bellsoft/liberica-runtime-container:jre-25.0.1_11-cds-musl@sha256:67bd5da45bfceacc89d642ad38771fbfbe44c00ea73e90ec646e417df8d940e5 AS app
 # use non-root user
 RUN addgroup -S spring && adduser -S spring -G spring
 USER spring:spring

From 3244b4a5ffa913509260b49b66d1a9c648d4921e Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Fri, 21 Nov 2025 08:16:23 +0000
Subject: [PATCH 31/32] chore(deps): update Kotlin dependencies and Detekt
 version

---
 .../main/kotlin/hu/bsstudio/gradle/DetektConventionPlugin.kt | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/buildSrc/src/main/kotlin/hu/bsstudio/gradle/DetektConventionPlugin.kt b/buildSrc/src/main/kotlin/hu/bsstudio/gradle/DetektConventionPlugin.kt
index 0059e5e0..768814ba 100644
--- a/buildSrc/src/main/kotlin/hu/bsstudio/gradle/DetektConventionPlugin.kt
+++ b/buildSrc/src/main/kotlin/hu/bsstudio/gradle/DetektConventionPlugin.kt
@@ -1,7 +1,7 @@
 package hu.bsstudio.gradle
 
-import io.gitlab.arturbosch.detekt.DetektPlugin
-import io.gitlab.arturbosch.detekt.extensions.DetektExtension
+import dev.detekt.gradle.extensions.DetektExtension
+import dev.detekt.gradle.plugin.DetektPlugin
 import org.gradle.api.Plugin
 import org.gradle.api.Project
 import org.gradle.kotlin.dsl.apply
@@ -12,7 +12,6 @@ class DetektConventionPlugin : Plugin<Project> {
         project.pluginManager.apply(DetektPlugin::class)
 
         project.extensions.configure<DetektExtension> {
-            buildUponDefaultConfig = true
             config.setFrom(project.layout.settingsDirectory.file("detekt.yml"))
         }
     }

From 29d3a03516e8ee526092d85b9a98f7ed67f04384 Mon Sep 17 00:00:00 2001
From: Bence Csik <22349790+csikb@users.noreply.github.com>
Date: Fri, 21 Nov 2025 14:01:46 +0000
Subject: [PATCH 32/32] chore(build): remove deprecated Detekt snapshot
 repository

---
 buildSrc/build.gradle.kts | 63 ++++++++++-----------------------------
 1 file changed, 16 insertions(+), 47 deletions(-)

diff --git a/buildSrc/build.gradle.kts b/buildSrc/build.gradle.kts
index 99de14b5..5d7ef4e0 100644
--- a/buildSrc/build.gradle.kts
+++ b/buildSrc/build.gradle.kts
@@ -5,14 +5,6 @@ plugins {
 
 repositories {
     gradlePluginPortal()
-    // TODO: remove when detekt stable is in gradle plugin portal
-    maven {
-        // https://central.sonatype.org/publish/publish-portal-snapshots/#consuming-via-gradle
-        url = uri("https://central.sonatype.com/repository/maven-snapshots/")
-        content {
-            includeModule("dev.detekt", "detekt-gradle-plugin")
-        }
-    }
 }
 
 dependencies {
@@ -28,45 +20,22 @@ dependencies {
 }
 
 gradlePlugin {
-    plugins.create("dependency-management") {
-        id = "hu.bsstudio.gradle.dependency-management"
-        implementationClass = "hu.bsstudio.gradle.DependencyManagementPlugin"
-    }
-    plugins.create("detekt-convention") {
-        id = "hu.bsstudio.gradle.detekt-convention"
-        implementationClass = "hu.bsstudio.gradle.DetektConventionPlugin"
-    }
-    plugins.create("integration-test-convention") {
-        id = "hu.bsstudio.gradle.integration-test-convention"
-        implementationClass = "hu.bsstudio.gradle.IntegrationTestConventionPlugin"
-    }
-    plugins.create("jacoco-convention") {
-        id = "hu.bsstudio.gradle.jacoco-convention"
-        implementationClass = "hu.bsstudio.gradle.JacocoConventionPlugin"
-    }
-    plugins.create("java-convention") {
-        id = "hu.bsstudio.gradle.java-convention"
-        implementationClass = "hu.bsstudio.gradle.JavaConventionPlugin"
-    }
-    plugins.create("java-library-convention") {
-        id = "hu.bsstudio.gradle.java-library-convention"
-        implementationClass = "hu.bsstudio.gradle.JavaLibraryConventionPlugin"
-    }
-    plugins.create("kotlin-convention") {
-        id = "hu.bsstudio.gradle.kotlin-convention"
-        implementationClass = "hu.bsstudio.gradle.KotlinConventionPlugin"
-    }
-    plugins.create("spotless-convention") {
-        id = "hu.bsstudio.gradle.spotless-convention"
-        implementationClass = "hu.bsstudio.gradle.SpotlessConventionPlugin"
-    }
-    plugins.create("spring-app-convention") {
-        id = "hu.bsstudio.gradle.spring-app-convention"
-        implementationClass = "hu.bsstudio.gradle.SpringAppConventionPlugin"
-    }
-    plugins.create("testing-convention") {
-        id = "hu.bsstudio.gradle.test-convention"
-        implementationClass = "hu.bsstudio.gradle.TestConventionPlugin"
+    mapOf(
+        "dependency-management" to "hu.bsstudio.gradle.DependencyManagementPlugin",
+        "detekt-convention" to "hu.bsstudio.gradle.DetektConventionPlugin",
+        "integration-test-convention" to "hu.bsstudio.gradle.IntegrationTestConventionPlugin",
+        "jacoco-convention" to "hu.bsstudio.gradle.JacocoConventionPlugin",
+        "java-convention" to "hu.bsstudio.gradle.JavaConventionPlugin",
+        "java-library-convention" to "hu.bsstudio.gradle.JavaLibraryConventionPlugin",
+        "kotlin-convention" to "hu.bsstudio.gradle.KotlinConventionPlugin",
+        "spotless-convention" to "hu.bsstudio.gradle.SpotlessConventionPlugin",
+        "spring-app-convention" to "hu.bsstudio.gradle.SpringAppConventionPlugin",
+        "testing-convention" to "hu.bsstudio.gradle.TestConventionPlugin",
+    ).forEach { (id, implementationClass) ->
+        plugins.create(id) {
+            this.id = "hu.bsstudio.gradle.$id"
+            this.implementationClass = implementationClass
+        }
     }
 }