feat: add JPA production capability

.github/ci-gate-matrix.yml

@@ -101,6 +101,20 @@ gates:
     workflow: ci-quality-gates.yml
     job: gate-matrix-lint
     execution: job
+  - id: jpa-candidate-evidence
+    release_blocking: true
+    mechanism: workflow-job
+    ref: jpa-candidate-evidence
+    workflow: ci-quality-gates.yml
+    job: jpa-candidate-evidence
+    execution: job
+  - id: jpa-r2-evidence
+    release_blocking: conditional
+    mechanism: workflow-job
+    ref: jpa-r2-evidence
+    workflow: jpa-r2-evidence.yml
+    job: jpa-r2-evidence
+    execution: job
   - id: quality-release-gate
     release_blocking: true
     mechanism: workflow-job

.github/scripts/verify-gate-matrix.sh

@@ -5,7 +5,7 @@ readonly SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"
 readonly REPO_ROOT="$(git -C "${SCRIPT_DIR}" rev-parse --show-toplevel)"
 readonly EXPECTED_SCRIPT_DIR="$(cd -- "${REPO_ROOT}/.github/scripts" && pwd -P)"
 readonly MATRIX="${REPO_ROOT}/.github/ci-gate-matrix.yml"
-readonly EXPECTED_GATE_COUNT=19
+readonly EXPECTED_GATE_COUNT=21
 
 if [[ "${SCRIPT_DIR}" != "${EXPECTED_SCRIPT_DIR}" ]]; then
   printf '::error::gate-matrix-lint: script resolved outside the repository .github/scripts directory\n' >&2

.github/workflows/ci-quality-gates.yml

@@ -70,6 +70,35 @@ jobs:
       - name: Verify the gate matrix against the repository
         run: bash .github/scripts/verify-gate-matrix.sh
 
+  jpa-candidate-evidence:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
+        with:
+          distribution: temurin
+          java-version: "21.0.11+10"
+          cache: gradle
+          cache-dependency-path: |
+            src/**/*.gradle
+            src/**/gradle-wrapper.properties
+            src/**/gradle.lockfile
+      - name: Produce zero-skip JPA candidate manifests
+        working-directory: src
+        run: >-
+          ./gradlew
+          :adapter:outbound:persistence-jpa:verifyJpaCandidateEvidence
+          --no-daemon
+          --stacktrace
+      - name: Retain content-addressed JPA candidate manifests
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact@v7.0.1
+        with:
+          name: jpa-candidate-evidence-${{ github.sha }}
+          path: src/adapter/outbound/persistence-jpa/build/jpa-evidence/manifests
+          if-no-files-found: error
+          retention-days: 14
+
   # Advisory only. Quarantine expiry/drift remains blocking through verifyQuarantineSunset in check.
   quarantine:
     runs-on: ubuntu-latest
@@ -94,6 +123,7 @@ jobs:
       - quality-gates
       - sample-off
       - gate-matrix-lint
+      - jpa-candidate-evidence
     if: always()
     runs-on: ubuntu-latest
     steps:
@@ -102,9 +132,14 @@ jobs:
           QUALITY_RESULT: ${{ needs.quality-gates.result }}
           SAMPLE_OFF_RESULT: ${{ needs.sample-off.result }}
           MATRIX_RESULT: ${{ needs.gate-matrix-lint.result }}
+          JPA_CANDIDATE_RESULT: ${{ needs.jpa-candidate-evidence.result }}
         run: |
           set -euo pipefail
-          for result in "${QUALITY_RESULT}" "${SAMPLE_OFF_RESULT}" "${MATRIX_RESULT}"; do
+          for result in \
+            "${QUALITY_RESULT}" \
+            "${SAMPLE_OFF_RESULT}" \
+            "${MATRIX_RESULT}" \
+            "${JPA_CANDIDATE_RESULT}"; do
             if [[ "${result}" != "success" ]]; then
               echo "::error::release-gate: required job result was ${result}"
               exit 1

.github/workflows/jpa-r2-evidence.yml

@@ -0,0 +1,53 @@
+name: jpa-r2-evidence
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  TESTCONTAINERS_REUSE_ENABLE: "false"
+
+jobs:
+  jpa-r2-evidence:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      JPA_EVIDENCE_PROFILE: r2
+      JPA_EVIDENCE_CI_JOB: >-
+        actions:${{ github.workflow }}:${{ github.run_id }}:${{ github.job }}
+      JPA_EVIDENCE_ARTIFACT_LOCATION: >-
+        ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+      JPA_EVIDENCE_TOPOLOGY: postgresql-16-testcontainers-tls-and-fault-matrix
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
+        with:
+          distribution: temurin
+          java-version: "21.0.11+10"
+          cache: gradle
+          cache-dependency-path: |
+            src/**/*.gradle
+            src/**/gradle-wrapper.properties
+            src/**/gradle.lockfile
+      - name: Verify the production-profile JPA R2 manifest DAG
+        working-directory: src
+        run: >-
+          ./gradlew
+          :adapter:outbound:persistence-jpa:verifyJpaPrimaryFoundationEvidence
+          -PjpaEvidenceProfile=r2
+          --no-daemon
+          --stacktrace
+      - name: Retain JPA R2 attempt manifests
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact@v7.0.1
+        with:
+          name: jpa-r2-evidence-${{ github.sha }}-${{ github.run_id }}
+          path: src/adapter/outbound/persistence-jpa/build/jpa-evidence/manifests
+          if-no-files-found: error
+          retention-days: 30