Sync fork with parent Main branch

.github/workflows/angular_build.yml

@@ -20,10 +20,10 @@ jobs:
         working-directory: ./matchbox-frontend
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           # https://github.com/actions/setup-node
           node-version: 20
@@ -39,7 +39,7 @@ jobs:
 
       - name: Commit
         if: success()
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@v6.0.1
         with:
           commit_message: "server: rebuild the Angular GUI resources"
           file_pattern: "matchbox-server/src/main/resources/static"

.github/workflows/angular_test.yml

@@ -13,13 +13,13 @@ jobs:
         working-directory: ./matchbox-frontend
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           # https://github.com/actions/setup-node
-          node-version: 20
+          node-version: 24
           cache: npm
           cache-dependency-path: matchbox-frontend/package-lock.json
 

.github/workflows/central_repository.yml

@@ -13,17 +13,17 @@ jobs:
 
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Java 21
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with: # running setup-java again overwrites the settings.xml
           java-version: "21"
           distribution: "adopt"
           cache: maven
-          server-id: ossrh
-          server-username: OSSRH_USERNAME
-          server-password: OSSRH_PASSWORD
+          server-id: central
+          server-username: MAVEN_USERNAME
+          server-password: MAVEN_CENTRAL_TOKEN
           gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
 
@@ -33,8 +33,8 @@ jobs:
       - name: Publish to Apache Maven Central
         run: mvn deploy -P release --file pom.xml --projects :matchbox,:matchbox-engine -DskipTests
         env:
-          OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
-          OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+          MAVEN_USERNAME: ${{ secrets.NEXUS_USERNAME }}
+          MAVEN_CENTRAL_TOKEN: ${{ secrets.NEXUS_PASSWORD }}
           MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
 # The requirements are described in https://central.sonatype.org/publish/requirements/
 # The secrets are managed in https://github.com/ahdis/matchbox/settings/secrets/actions

.github/workflows/documentation.yml

@@ -11,10 +11,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout master
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Python 3
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.x'
           cache: 'pip'
@@ -28,7 +28,7 @@ jobs:
         # https://www.mkdocs.org/user-guide/deploying-your-docs/#github-pages
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         # https://github.com/actions/setup-java#usage
         with:
           java-version: 21
@@ -42,6 +42,6 @@ jobs:
         uses: JamesIves/github-pages-deploy-action@v4
         # https://github.com/JamesIves/github-pages-deploy-action#configuration-
         with:
-          branch: gh-pages            # The destination branch.
-          folder: target/site/apidocs # The source folder.
-          target-folder: apidocs      # The destination folder.
+          branch: gh-pages                # The destination branch.
+          folder: target/reports/apidocs  # The source folder.
+          target-folder: apidocs          # The destination folder.

.github/workflows/googleregistry.yml

@@ -25,10 +25,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Build Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           java-version: 21
           distribution: adopt
@@ -37,15 +37,20 @@ jobs:
       - run: mvn --batch-mode --update-snapshots package -DskipTests -P release
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@master
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: arm64
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@master
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: latest
+          platforms: linux/amd64,linux/arm64
 
       # Configure Workload Identity Federation and generate an access token.
       - id: "auth"
         name: "Authenticate to Google Cloud"
-        uses: google-github-actions/auth@v2
+        uses: google-github-actions/auth@v3
         with:
           token_format: "access_token"
           workload_identity_provider: "projects/1022310475153/locations/global/workloadIdentityPools/github-wif-pool/providers/oidc-github-provider"
@@ -67,22 +72,6 @@ jobs:
             --platform=linux/arm64,linux/amd64 \
             -f matchbox-server/Dockerfile \
             matchbox-server
-
-      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@master
-        with:
-          image-ref: '${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.REPOSITORY }}/${{ env.IMAGE }}:${{ github.ref_name }}'
-          format: 'sarif'
-          ignore-unfixed: true
-          vuln-type: 'os,library'
-          severity: 'CRITICAL,HIGH'
-          output: 'trivy-results.sarif'
-
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@main
-        if: always()
-        with:
-          sarif_file: 'trivy-results.sarif'
 
       - name: Send a stream message to Zulip
         uses: zulip/github-actions-zulip/send-message@v1

.github/workflows/integration_tests.yml

@@ -13,18 +13,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout matchbox
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           path: matchbox
 
       - name: Checkout integration tests
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           path: matchbox-int-tests
           repository: ahdis/matchbox-int-tests
 
       - name: Setup Java 21
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         # https://github.com/actions/setup-java#usage
         with:
           java-version: 21
@@ -47,7 +47,7 @@ jobs:
       - name: Run the tests
         timeout-minutes: 90 # We need a long timeout here
         env:
-          MAVEN_OPTS: -Xmx12g
+          MAVEN_OPTS: -Xmx12g -Xms4g -XX:MaxMetaspaceSize=1g
         run: mvn --batch-mode --no-transfer-progress --update-snapshots -Dmatchbox.version="${{ env.MATCHBOX_VERSION }}" verify site
         working-directory: matchbox-int-tests
 

.github/workflows/java-sonar-build.yml

@@ -4,6 +4,8 @@ on:
   push:
     branches:
       - main
+  pull_request:
+    types: [ opened, synchronize ]
   schedule:
     - cron: '0 0 * * 2'  # Runs every Monday at 00:00 UTC
 
@@ -42,7 +44,7 @@ jobs:
       # Log is too large and so we are creating a log file and uploading it.
       # this is why we need continue on error on the step above.
       - name: Upload build log
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: build-log
           path: build.log          

.github/workflows/javadoc_test.yml

@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the project
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         # https://github.com/actions/setup-java#usage
         with:
           java-version: 21

.github/workflows/maven.yml

@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the project
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         # https://github.com/actions/setup-java#usage
         with:
           java-version: 21

.github/workflows/security.yml

@@ -39,7 +39,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@main
+        uses: github/codeql-action/init@v3
         with:
           languages: 'java'
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -55,7 +55,7 @@ jobs:
         run: mvn compile
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@main
+        uses: github/codeql-action/analyze@v3
 
   test-trivy:
     name: Analyze the Java code with Trivy
@@ -67,10 +67,10 @@ jobs:
 
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@main
+        uses: actions/checkout@v5
 
       - name: Run Trivy vulnerability scanner in repo mode
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@0.33.1
         with:
           scan-type: 'fs'
           ignore-unfixed: true
@@ -84,7 +84,7 @@ jobs:
           ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@main
+        uses: github/codeql-action/upload-sarif@v3
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'

.gitignore

@@ -67,6 +67,7 @@ $RECYCLE.BIN/
 # Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
 
 # User-specific stuff
+.idea
 .idea/**/workspace.xml
 .idea/**/tasks.xml
 .idea/**/usage.statistics.xml
@@ -103,6 +104,7 @@ $RECYCLE.BIN/
 .idea/*.iml
 .idea/modules
 .idea/sonarlint
+.idea/copilot.data.*.xml
 *.iml
 *.ipr
 
@@ -235,4 +237,4 @@ matchbox-server/src/main/resources/static/prerendered-routes.json
 
 *.repomixignore
 repomix-output.xml
-repomix.config.json
+repomix.config.json

.vscode/launch.json

@@ -105,6 +105,15 @@
       "vmArgs": "-Dspring.config.additional-location=file:with-ch/application.yaml",
       "cwd": "${workspaceFolder}/matchbox-server"
     },
+    {
+      "type": "java",
+      "name": "Launch Matchbox-Server (gazelle)",
+      "request": "launch",
+      "mainClass": "ca.uhn.fhir.jpa.starter.Application",
+      "projectName": "matchbox-server",
+      "vmArgs": "-Dspring.config.additional-location=file:with-gazelle/application.yaml",
+      "cwd": "${workspaceFolder}/matchbox-server"
+    },
     {
       "type": "java",
       "name": "Launch Matchbox-Server (one engine (dev))",
@@ -141,6 +150,15 @@
       "vmArgs": "-Dspring.config.additional-location=file:../../matchbox-int-tests/src/test/resources/application-validate-r4-ch-elm.yaml",
       "cwd": "${workspaceFolder}/matchbox-server"
     },
+    {
+      "type": "java",
+      "name": "Launch Matchbox-Server (autoinstall)",
+      "request": "launch",
+      "mainClass": "ca.uhn.fhir.jpa.starter.Application",
+      "projectName": "matchbox-server",
+      "vmArgs": "-Dspring.config.additional-location=file:../../matchbox-int-tests/src/test/resources/application-validate-r4-auto-install.yaml",
+      "cwd": "${workspaceFolder}/matchbox-server"
+    },
     {
       "type": "java",
       "name": "Launch Matchbox-Server (int-tests ch)",

.vscode/settings.json

@@ -2,5 +2,5 @@
   "java.compile.nullAnalysis.mode": "automatic",
   "java.configuration.updateBuildConfiguration": "disabled",
   "maven.view": "flat",
-  "java.jdt.ls.vmargs": "-XX:+UseParallelGC -XX:GCTimeRatio=4 -XX:AdaptiveSizePolicyWeight=90 -Dsun.zip.disableMemoryMapping=true -Xmx2G -Xms100m -Xlog:disable"
+  "java.jdt.ls.vmargs": "-XX:+UseParallelGC -XX:GCTimeRatio=4 -XX:AdaptiveSizePolicyWeight=90 -Dsun.zip.disableMemoryMapping=true -Xmx4G -Xms100m -Xlog:disable"
 }

README.md

@@ -71,8 +71,8 @@ or
 ### Configurable base image:
 
 ```bash
-cd matchbox-server
 mvn package -DskipTests
+cd matchbox-server
 docker build -t matchbox .
 docker run -d --name matchbox -p 8080:8080 -v /Users/oegger/Documents/github/matchbox/matchbox-server/with-settings:/config matchbox
 ```
@@ -120,9 +120,9 @@ docker-compose exec -T matchbox-test-db pg_restore -c -U matchbox -d matchbox <
 ### making container available
 
 ```
-docker tag matchbox eu.gcr.io/fhir-ch/matchbox:v313
+docker tag matchbox eu.gcr.io/fhir-ch/matchbox:4.0.12
 
-docker push eu.gcr.io/fhir-ch/matchbox:v313
+docker push eu.gcr.io/fhir-ch/matchbox:v4.0.12
 ```
 
 ### publish docs