Add documentation, config template and ownership files

.github/workflows/cleanup-old-runs.yaml

@@ -0,0 +1,20 @@
+name: Cleanup old workflow runs
+
+on:
+  schedule:
+    - cron: '0 0 * * 0'  # Run weekly on Sunday at midnight UTC
+  workflow_dispatch:      # Allow manual triggering
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+    steps:
+      - name: Delete old workflow runs
+        uses: Mattraks/delete-workflow-runs@v2
+        with:
+          token: ${{ github.token }}
+          repository: ${{ github.repository }}
+          retain_days: 30
+          keep_minimum_runs: 6

.gitignore

@@ -1,3 +1,6 @@
+# Office temporary lock files (e.g. ~$server.xml created by Word/Excel)
+~$*
+
 # Maven
 target/
 pom.xml.tag

CODEOWNERS

@@ -0,0 +1,6 @@
+# CODEOWNERS - Defines maintainers for this CICS sample
+# Docs: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+# Last reviewed: 2026-08
+
+# For members of the team that maintains Java samples, see https://github.com/orgs/cicsdev/teams/cics-java-maintainers
+* @cicsdev/cics-java-maintainers

etc/config/liberty/server.xml

@@ -0,0 +1,95 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<server description="CICS Liberty sample configuration">
+
+    <featureManager>
+        <!-- Jakarta EE 10 servlet container — required for Spring Boot 3.x -->
+        <feature>servlet-6.0</feature>
+        <!-- JDBC support for Db2 type 2 and type 4 connectivity -->
+        <feature>jdbc-4.3</feature>
+        <!-- TLS transport security -->
+        <feature>transportSecurity-1.0</feature>
+    </featureManager>
+
+    <!-- JDBC type 2 connectivity via CICS DB2CONN resource.
+         type="javax.sql.DataSource" is required — Liberty defaults to XADataSource
+         which Db2 T2 does not support (DSRA7015E). -->
+    <dataSource id="t2_multi" jndiName="jdbc/t2DataSource" transactional="false" type="javax.sql.DataSource">
+        <jdbcDriver>
+            <library name="DB2LIB">
+                <fileset dir="/usr/lpp/db2v13/jdbc/classes" includes="db2jcc4.jar db2jcc_license_cisuz.jar"/>
+                <fileset dir="/usr/lpp/db2v13/jdbc/lib" includes="libdb2jcct2zos4_64.so"/>
+            </library>
+        </jdbcDriver>
+        <properties.db2.jcc currentSchema="YOUR_SCHEMA" driverType="2"/>
+        <connectionManager agedTimeout="0"/>
+    </dataSource>
+
+    <!-- JDBC type 4 connectivity via TCP/IP — substitute your Db2 connection details -->
+    <dataSource id="t4_multi" jndiName="jdbc/t4DataSource" type="javax.sql.XADataSource">
+        <jdbcDriver>
+            <library name="DB2LIB">
+                <fileset dir="/usr/lpp/db2v13/jdbc/classes" includes="db2jcc4.jar db2jcc_license_cisuz.jar"/>
+                <fileset dir="/usr/lpp/db2v13/jdbc/lib" includes="libdb2jcct2zos4_64.so"/>
+            </library>
+        </jdbcDriver>
+        <properties.db2.jcc
+            driverType="4"
+            serverName="YOUR.SERVER.CORPORATION.COM"
+            portNumber="YOUR_PORT_NUMBER"
+            currentSchema="YOUR_SCHEMA"
+            databaseName="YOUR_DATABASE"
+            user="YOUR_USER"
+            password="YOUR_PASSWORD"/>
+    </dataSource>
+
+    <!-- Default HTTP End Point -->
+    <httpEndpoint host="*" httpPort="10201" httpsPort="10202" id="defaultHttpEndpoint">
+        <!-- Increase server security with the OWASP recommended HTTP headers.
+             These should be configured further to meet the security needs of
+             your web applications, especially the Content-Security-Policy
+             (CSP) header. -->
+        <headers>
+            <setIfMissing>Content-Security-Policy</setIfMissing>
+            <setIfMissing>Referrer-Policy: strict-origin-when-cross-origin</setIfMissing>
+            <setIfMissing>X-Content-Type-Options: nosniff</setIfMissing>
+            <setIfMissing>X-Frame-Options: DENY</setIfMissing>
+        </headers>
+    </httpEndpoint>
+
+    <!-- Provide more secure cookie defaults -->
+    <httpSession cookieHttpOnly="true" cookieSecure="true"/>
+
+    <!-- Provide more secure application defaults -->
+    <webAppSecurity httpOnlyCookies="true" ssoRequiresSSL="true"/>
+
+    <!-- Caution: Add Strict Transport Security (HSTS)
+         HSTS prevents protocol downgrade and SSL stripping attacks. If used,
+         it should be applied consistently across your entire domain. -->
+    <webContainer addStrictTransportSecurityHeader="max-age=31536000"/>
+
+    <!-- Add a more balanced security session timeout (default is 120 mins).
+         From Liberty 25.0.0.12 an LTPA password is required. -->
+    <ltpa expiration="60m" keysPassword="xRrwus9V77Q$dgnvd^MD7LSKpaB9p@jf"/>
+
+    <!-- Session inactivity timeout - per user (default is 30 mins) -->
+    <httpSession invalidationTimeout="15m"/>
+
+    <!-- Controls how often server.xml is scanned for updates.
+         Use "polled" when deploying via CICS Bundles (WAR bundlepart). -->
+    <config monitorInterval="5s" updateTrigger="polled"/>
+
+    <!-- Maximum time the server waits for applications to start -->
+    <applicationManager startTimeout="60s"/>
+
+    <!-- Disable dropins — use CICS Bundles for application deployment -->
+    <applicationMonitor dropins="dropins" dropinsEnabled="false" pollingRate="5s" updateTrigger="disabled"/>
+
+    <!-- Disable implicit CDI bean archive scanning to reduce startup time -->
+    <cdi enableImplicitBeanArchives="false"/>
+
+    <safRegistry enableFailover="false" id="saf"/>
+    <keyStore id="defaultKeyStore" password="defaultPassword"/>
+    <ssl clientAuthenticationSupported="true" id="defaultSSLConfig" keyStoreRef="defaultKeyStore" sslProtocol="TLSv1.3,TLSv1.2"/>
+    <executor coreThreads="8" id="allowCICSconfigure" maxThreads="15"/>
+
+</server>

gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,5 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
 distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.4-bin.zip
-networkTimeout=10000
-validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists