github-actions-ci

Create a build.yml workflow triggered on push and pull_request that checks out the code, sets up Temurin Java 21 with Maven caching via actions/setup-java, and runs mvn verify. Add surefire report uploads and a JUnit test reporter for visibility into failures.

Pick one per repository, never both, since two pipelines producing two images create drift opportunities. GitHub Actions suits teams standardized on GitHub-hosted runners and standard actions; Jenkins fits organizations with existing controller infrastructure.

Build and push the image with docker/build-push-action, scan it with aquasecurity/trivy-action failing on HIGH and CRITICAL severities, sign it with cosign using OIDC, and attach an SBOM via anchore/sbom-action.

Pin actions to a commit SHA in production-critical workflows because tags can be silently re-pointed to different code. Tags are acceptable for lower-risk workflows, but SHA pinning prevents supply-chain surprises.

Integration tests requiring external infrastructure should not run on every PR. Gate them behind a label or a scheduled workflow to avoid flaky pipelines and wasted runner minutes.