Rewrite Gamma services in Kotlin

.devcontainer/devcontainer-lock.json

@@ -0,0 +1,19 @@
+{
+  "features": {
+    "ghcr.io/devcontainers/features/docker-in-docker:4": {
+      "version": "4.1.0",
+      "resolved": "ghcr.io/devcontainers/features/docker-in-docker@sha256:7d979c4a36d595eb4ab79909caa3f396daf3b6152dcf38e8328ea4eff42206c7",
+      "integrity": "sha256:7d979c4a36d595eb4ab79909caa3f396daf3b6152dcf38e8328ea4eff42206c7"
+    },
+    "ghcr.io/devcontainers/features/java:1": {
+      "version": "1.8.2",
+      "resolved": "ghcr.io/devcontainers/features/java@sha256:7d2fc86e0dad756209cd68da6b2b43e6149a5e07232a9f20663c42a8ca1563ad",
+      "integrity": "sha256:7d2fc86e0dad756209cd68da6b2b43e6149a5e07232a9f20663c42a8ca1563ad"
+    },
+    "ghcr.io/devcontainers/features/node:2": {
+      "version": "2.1.0",
+      "resolved": "ghcr.io/devcontainers/features/node@sha256:586c9a6f7dd40bd3ba2cd41e7f2f88dcc31fbe5d1442afcbf07ffbc66b686857",
+      "integrity": "sha256:586c9a6f7dd40bd3ba2cd41e7f2f88dcc31fbe5d1442afcbf07ffbc66b686857"
+    }
+  }
+}

.devcontainer/devcontainer.json

@@ -1,25 +1,39 @@
 {
-	"name": "Gamma Devcontainer",
-    "image": "mcr.microsoft.com/devcontainers/base:ubuntu-24.04",
+	"name": "Gamma Kotlin",
+	"image": "mcr.microsoft.com/devcontainers/base:ubuntu-24.04",
 	"workspaceFolder": "/workspaces/${localWorkspaceFolderBasename}",
 	"remoteUser": "root",
+	"containerEnv": {
+		"GRADLE_OPTS": "-Dorg.gradle.jvmargs=-Xmx1g -XX:MaxMetaspaceSize=768m"
+	},
 
 	"features": {
 		"ghcr.io/devcontainers/features/java:1": {
-			"version": "25",
-			"jdkDistro": "open"
+			"version": "21",
+			"additionalVersions": "25",
+			"jdkDistro": "tem"
+		},
+		"ghcr.io/devcontainers/features/node:2": {
+			"version": "24",
+			"pnpmVersion": "10.18.3"
 		},
-        "ghcr.io/devcontainers/features/node:1": {
-            "version": "20"
-        },
-        "ghcr.io/devcontainers/features/docker-in-docker:2": {}
+		"ghcr.io/devcontainers/features/docker-in-docker:4": {}
 	},
+	"mounts": [
+		"source=gamma-e2e-node-modules,target=/workspaces/${localWorkspaceFolderBasename}/e2e/node_modules,type=volume"
+	],
+	"postCreateCommand": ["pnpm", "--dir", "e2e", "install", "--frozen-lockfile"],
 
 	"forwardPorts": [8081],
+	"portsAttributes": {
+		"8081": {
+			"label": "Gamma"
+		}
+	},
 
-	"customizations" : {
-    	"jetbrains" : {
-      		"backend" : "IntelliJ"
-    	}
-  }
+	"customizations": {
+		"jetbrains": {
+			"backend": "IntelliJ"
+		}
+	}
 }

.editorconfig

@@ -0,0 +1,18 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.{kt,kts}]
+indent_style = space
+indent_size = 4
+continuation_indent_size = 4
+max_line_length = 120
+ktlint_code_style = ktlint_official
+ktlint_standard = enabled
+ij_kotlin_allow_trailing_comma = true
+ij_kotlin_allow_trailing_comma_on_call_site = true
+ij_kotlin_imports_layout = *,java.**,javax.**,kotlin.**,^alias.**

.github/workflows/dependency-submission.yml

@@ -11,13 +11,15 @@ jobs:
   dependency-submission:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 25
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961
         with:
           java-version: "25"
           distribution: "temurin"
 
       - name: Generate and submit dependency graph
-        uses: gradle/actions/dependency-submission@v5
+        uses: gradle/actions/dependency-submission@0723195856401067f7a2779048b490ace7a47d7c

.github/workflows/workflow.yml

@@ -9,35 +9,72 @@ on:
     branches: [main]
 
 jobs:
-  build-and-publish:
+  verify:
     runs-on: ubuntu-24.04
     permissions:
-      packages: write
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         timeout-minutes: 20
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 25
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961
         timeout-minutes: 20
         with:
           java-version: "25"
           distribution: "temurin"
 
       - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@v4
+        uses: gradle/actions/wrapper-validation@ed408507eac070d1f99cc633dbcf757c94c7933a
         timeout-minutes: 20
 
+      - name: Review dependency changes
+        if: github.event_name == 'pull_request'
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294
+        timeout-minutes: 20
+        with:
+          fail-on-severity: high
+
       - name: Check
-        run: ./gradlew check
+        run: ./gradlew check -x detektCheck -x detekt
+        timeout-minutes: 20
+
+      - name: Detekt
+        run: ./gradlew detektCheck
+        timeout-minutes: 20
+        # Detekt 2.x is still alpha. Keep failures visible on Renovate PRs without blocking dependency updates.
+        continue-on-error: ${{ github.event_name == 'pull_request' && github.actor == 'renovate[bot]' }}
+
+  build-and-publish:
+    if: github.event_name == 'push'
+    needs: verify
+    runs-on: ubuntu-24.04
+    permissions:
+      attestations: write
+      contents: read
+      id-token: write
+      packages: write
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         timeout-minutes: 20
+        with:
+          persist-credentials: false
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961
+        timeout-minutes: 20
+        with:
+          java-version: "25"
+          distribution: "temurin"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
         timeout-minutes: 20
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
         timeout-minutes: 20
         with:
           registry: ghcr.io
@@ -46,7 +83,7 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051
         timeout-minutes: 20
         with:
           images: ghcr.io/${{ github.repository_owner }}/gamma
@@ -62,35 +99,86 @@ jobs:
         run: ./gradlew bootBuildImage
         timeout-minutes: 20
 
+      - name: Generate image SBOM
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610
+        timeout-minutes: 20
+        with:
+          image: app:latest
+          format: spdx-json
+          output-file: sbom.spdx.json
+          artifact-name: gamma-image-sbom
+
+      - name: Scan image
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
+        timeout-minutes: 20
+        with:
+          image-ref: app:latest
+          format: table
+          exit-code: "1"
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+
       - name: Push docker image
+        id: push
         timeout-minutes: 20
         run: |
           for tag in $(jq -r '.tags | join(" ")' <<< $DOCKER_METADATA_OUTPUT_JSON ); do
             docker image tag app:latest $tag
           done
           docker image push --all-tags ghcr.io/${{ github.repository_owner }}/gamma
+          IMAGE_DIGEST=$(docker inspect --format '{{index .RepoDigests 0}}' app:latest | cut -d@ -f2)
+          test -n "$IMAGE_DIGEST"
+          echo "digest=$IMAGE_DIGEST" >> "$GITHUB_OUTPUT"
+
+      - name: Attest published image
+        uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f
+        timeout-minutes: 20
+        with:
+          subject-name: ghcr.io/${{ github.repository_owner }}/gamma
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true
 
   e2e-tests:
-    needs: build-and-publish
+    if: >-
+      always() &&
+      needs.verify.result == 'success' &&
+      (needs.build-and-publish.result == 'success' || needs.build-and-publish.result == 'skipped')
+    needs: [verify, build-and-publish]
     timeout-minutes: 60
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         timeout-minutes: 20
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-node@v4
+      - name: Set up JDK 25
+        if: github.event_name == 'pull_request'
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961
+        timeout-minutes: 20
+        with:
+          java-version: "25"
+          distribution: "temurin"
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         timeout-minutes: 20
         with:
           node-version: lts/*
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
         timeout-minutes: 20
         with:
           version: 10.18.3
 
       - name: Install dependencies
-        run: cd e2e && pnpm install
+        run: cd e2e && pnpm install --frozen-lockfile
+        timeout-minutes: 20
+
+      - name: Audit E2E dependencies
+        run: cd e2e && pnpm audit --audit-level high
         timeout-minutes: 20
 
       - name: Check code formatting
@@ -109,18 +197,23 @@ jobs:
         run: cd e2e && pnpm exec playwright install --with-deps chromium
         timeout-minutes: 20
 
-      - name: Determine Gamma version
-        id: gamma-version
+      - name: Build untrusted PR image locally
+        if: github.event_name == 'pull_request'
+        run: make build-image
         timeout-minutes: 20
+
+      - name: Pull trusted published image
+        if: github.event_name == 'push'
         run: |
           SHA="${{ github.sha }}"
-          echo "version=sha-${SHA:0:7}" >> $GITHUB_OUTPUT
+          docker pull "ghcr.io/${{ github.repository_owner }}/gamma:sha-${SHA:0:7}"
+          docker image tag "ghcr.io/${{ github.repository_owner }}/gamma:sha-${SHA:0:7}" gamma-app:test
 
       - name: Run E2E tests
-        run: make test-e2e GAMMA_VERSION=${{ steps.gamma-version.outputs.version }}
-        timeout-minutes: 20
+        run: cd e2e && pnpm test
+        timeout-minutes: 40
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         timeout-minutes: 20
         if: ${{ !cancelled() }}
         with:

.gitignore

@@ -1,9 +1,14 @@
 .gradle/
+.kotlin/
 
 .idea/*
 .DS_Store
 uploads/
 .run
 build
 
-.pnpm-store
+.pnpm-store
+
+# Repo-local agent skills (personal tooling)
+/.agents/skills/
+/.codex/skills/