PayGuard version 1.0.0

.dockerignore

@@ -10,16 +10,27 @@
 **/target
 **/__pycache__
 
+**/.gradle
+**/build
+
 # Only the four packaged service JARs enter application build contexts.
-!payguard-identity/target/
-payguard-identity/target/*
-!payguard-identity/target/payguard-identity-1.0.0-SNAPSHOT.jar
-!payguard-wallet/target/
-payguard-wallet/target/*
-!payguard-wallet/target/payguard-wallet-1.0.0-SNAPSHOT.jar
-!payguard-loan/target/
-payguard-loan/target/*
-!payguard-loan/target/payguard-loan-1.0.0-SNAPSHOT.jar
-!payguard-collateral/target/
-payguard-collateral/target/*
-!payguard-collateral/target/payguard-collateral-1.0.0-SNAPSHOT.jar
+!payguard-identity/build/
+payguard-identity/build/*
+!payguard-identity/build/libs/
+payguard-identity/build/libs/*
+!payguard-identity/build/libs/payguard-identity-1.0.0-SNAPSHOT.jar
+!payguard-wallet/build/
+payguard-wallet/build/*
+!payguard-wallet/build/libs/
+payguard-wallet/build/libs/*
+!payguard-wallet/build/libs/payguard-wallet-1.0.0-SNAPSHOT.jar
+!payguard-loan/build/
+payguard-loan/build/*
+!payguard-loan/build/libs/
+payguard-loan/build/libs/*
+!payguard-loan/build/libs/payguard-loan-1.0.0-SNAPSHOT.jar
+!payguard-collateral/build/
+payguard-collateral/build/*
+!payguard-collateral/build/libs/
+payguard-collateral/build/libs/*
+!payguard-collateral/build/libs/payguard-collateral-1.0.0-SNAPSHOT.jar

.github/workflows/_database-security.yml

@@ -14,6 +14,7 @@ jobs:
       PAYGUARD_POSTGRES_WALLET_VOLUME: payguard-it-ci_wallet
       PAYGUARD_POSTGRES_LOAN_VOLUME: payguard-it-ci_loan
       PAYGUARD_POSTGRES_COLLATERAL_VOLUME: payguard-it-ci_collateral
+      PAYGUARD_POSTGRES_EVIDENCE_VOLUME: payguard-it-ci_evidence
       PAYGUARD_VAULT_DATA_VOLUME: payguard-it-ci_vault
       PAYGUARD_VAULT_AUDIT_VOLUME: payguard-it-ci_audit
       PAYGUARD_KAFKA_DATA_VOLUME: payguard-it-ci_kafka
@@ -23,7 +24,7 @@ jobs:
         with:
           distribution: temurin
           java-version: '25'
-          cache: maven
+          cache: gradle
       - name: Install native Ansible dependencies and offline test dependencies
         run: |
           python3 -m venv /tmp/payguard-ansible
@@ -38,23 +39,23 @@ jobs:
       - name: Verify source contracts and build applications
         run: |
           python3 -m unittest discover -s infrastructure/tests -v
-          ./mvnw -B -ntp -pl payguard-identity,payguard-wallet,payguard-loan,payguard-collateral -am test package
+          bash ./gradlew --no-daemon --build-cache :payguard-identity:test :payguard-wallet:test :payguard-loan:test :payguard-collateral:test :payguard-identity:bootJar :payguard-wallet:bootJar :payguard-loan:bootJar :payguard-collateral:bootJar
       - name: Prepare isolated fixture and allocate only new explicit volumes
         run: |
           ansible-playbook -i localhost, -c local infrastructure/operations/prepare.yml -e fresh_target=true
           ansible-playbook -i localhost, -c local infrastructure/operations/allocate.yml -e fresh_target=true
           docker compose -f docker-compose.yaml -f infrastructure/compose.operations.yaml --profile operations build operations
-          docker compose up -d --wait postgres-identity postgres-wallet postgres-loan postgres-collateral
+          docker compose up -d --wait postgres-identity postgres-wallet postgres-loan postgres-collateral postgres-evidence
           docker compose up -d vault
       - name: Initialize and provision the new fixture through Ansible
         run: |
           docker compose -f docker-compose.yaml -f infrastructure/compose.operations.yaml run --rm --no-deps operations infrastructure/operations/vault-lifecycle.yml -e operation=initialize -e fresh_target=true -e local_rehearsal=true
           docker compose -f docker-compose.yaml -f infrastructure/compose.operations.yaml run --rm --no-deps operations infrastructure/operations/site.yml -e fresh_target=true
           docker compose -f docker-compose.yaml -f infrastructure/compose.operations.yaml up -d agent-operator
-      - name: Run all four CLI migrations twice
+      - name: Run all five CLI migrations twice
         run: |
           for pass in 1 2; do
-            for service in identity wallet loan collateral; do
+            for service in identity wallet loan collateral evidence; do
               docker compose -f docker-compose.yaml -f infrastructure/compose.operations.yaml run --rm --no-deps operations infrastructure/operations/migrate.yml -e service="$service"
             done
           done
@@ -73,7 +74,7 @@ jobs:
         uses: actions/upload-artifact@v7
         with:
           name: native-infrastructure-java-reports
-          path: '**/target/surefire-reports/TEST-*.xml'
+          path: '**/build/test-results/test/TEST-*.xml'
           if-no-files-found: warn
       - name: Stop only this isolated fixture
         if: always()

.github/workflows/_publish.yml

@@ -12,27 +12,6 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@v7
 
-      - name: Set up JDK 25
-        uses: actions/setup-java@v6
-        with:
-          java-version: '25'
-          distribution: 'temurin'
-          cache: 'maven'
-
-      - name: Compile and Package (Skip Tests)
-        # Tests are skipped because they already passed in the _quality workflow
-        run: ./mvnw clean package -DskipTests
-
-      - name: Install Maven Modules for Image Builds
-        # Image builds run as separate Maven invocations and need reactor artifacts in the local repository.
-        run: ./mvnw -DskipTests -Dpmd.skip=true -Dspotbugs.skip=true install
-
-      - name: Verify Spring Boot plugin resolution
-        run: |
-          ./mvnw -version
-          ./mvnw help:effective-pom -pl payguard-wallet \
-            | grep -A8 -B2 spring-boot-maven-plugin
-
       - name: Build Wallet Service Image
         run: docker build -f payguard-wallet/Dockerfile -t payguard/wallet-service:${{ github.sha }} .
 

.github/workflows/_quality.yml

@@ -20,28 +20,10 @@ jobs:
         with:
           java-version: '25'
           distribution: 'temurin'
-          cache: 'maven'
+          cache: 'gradle'
 
-      # 1. Spotless: Verifies code formatting without mutating the checkout
-      - name: Run Spotless
-        run: ./mvnw spotless:check
+      - name: Verify pre-push hook
+        run: python3 -m unittest discover -s git-hook -p 'test_*.py' -v
 
-      # 2. CheckStyle: Enforces coding standards
-      - name: Run CheckStyle
-        run: ./mvnw checkstyle:check
-
-      # Install reactor modules so independent analysis invocations can resolve local artifacts.
-      - name: Install Maven Modules
-        run: ./mvnw -DskipTests -Dpmd.skip=true -Dspotbugs.skip=true install
-
-      # 3. PMD: Scans for programming flaws
-      - name: Run PMD
-        run: ./mvnw pmd:check
-
-      # 4. SpotBugs: Looks for bugs in Java bytecode
-      - name: Run SpotBugs
-        run: ./mvnw spotbugs:check
-
-      # 5. Unit Tests: Ensures the core domain logic is intact
-      - name: Run Unit Tests
-        run: ./mvnw clean verify
+      - name: Run formatting, static analysis, and tests
+        run: bash ./gradlew --no-daemon --build-cache check

.github/workflows/codeql.yml

@@ -29,9 +29,9 @@ jobs:
         uses: github/codeql-action/init@v4
         with:
           languages: java-kotlin
-          build-mode: autobuild
+          build-mode: automobiled
 
-      - name: Autobuild
+      - name: Auto build
         if: ${{ env.ACT != 'true' }}
         uses: github/codeql-action/autobuild@v4
 

.gitignore

@@ -5,6 +5,8 @@
 
 # Generated build output
 target/
+build/
+.gradle/
 
 # Local workflow guidance
 GIT_WORKFLOW_CONVENTION.md
@@ -18,4 +20,4 @@ CLAUDE.md
 payguard-identity/NEW IDEAS.MD
 payguard-identity/ARCHITECTURE.md
 payguard-identity/IDENTITY_CHECKLIST.MD
-NO_LLM_FOR_CODING.MD
+NO_LLM_FOR_CODING.MD

README.md

@@ -27,7 +27,7 @@ First clone the repository and build it:
 ```bash
 git clone https://github.com/<your-org>/payguard.git
 cd payguard
-./mvnw -B -ntp clean verify
+bash ./gradlew --build-cache build
 ```
 
 Then start the infrastructure (PostgreSQL and Vault) and the applications:
@@ -209,15 +209,23 @@ Each service is an independently deployable module.
 
 ## Requirements
 
-PayGuard runs on the JVM. Use JDK **25**, Docker and Compose, Ansible and OpenSSL. The Maven wrapper is included.
+PayGuard runs on the JVM. Use JDK **25**, Docker and Compose, Ansible and OpenSSL. The Gradle wrapper is included.
 Database integration tests start real PostgreSQL containers.
 
 ## Build and local rehearsal
 
 ```bash
-./mvnw -B -ntp clean verify
+bash ./gradlew --build-cache build
 ```
 
+Install the repository's pre-push hook once:
+
+```bash
+bash git-hook/install.sh
+```
+
+The hook validates committed changes. Commit build and workflow changes before pushing.
+
 For the Compose, Vault Agent, Ansible and Flyway CLI deployment,
 follow [the infrastructure runbook](docs/infrastructure.md).
 It gives the exact preparation, initialization, migration and test commands.