test(gateway): bind bootstrap API and public documentation

[seonghobae]

Purpose

Advance #223 with a path-disjoint gateway quality slice from exact protected develop@622e5e6c3d534f230c390f10e3832efadfc01825. Protected ZuulGatewayApplication had the required Spring Boot/discovery bootstrap annotations and public entry point but no beginner-readable Javadoc and no focused bootstrap contract.

This Draft deliberately does not overlap active gateway security PR #142: it changes only ZuulGatewayApplication and a focused bootstrap test. It does not change JWT/resource-server behavior, routing, application.yml, pom.xml, discovery destinations, identity configuration, or claim repository-wide coverage (#205).

Exact current identity

• protected/live base: develop@622e5e6c3d534f230c390f10e3832efadfc01825;
• branch: quality/gateway-bootstrap-docs-tests-622e5e6;
• fail-first source head: f37206616f009e856274f13e9f63f72270da1a63;
• exact current GREEN source head: 75a540deb09a39c25d64168c5384639e938fb6b0;
• current synthetic merge preview: 3bba9f8fc0c850461c54cba35c5a1edb4ae4ca7f;
• GitHub mergeability: true;
• Draft: true;
• formal reviews: none;
• unresolved review threads: zero.

Every check/review from another source head/base is historical and does not transfer.

RED → GREEN

ZuulGatewayApplicationContractTest was added before production changed. It preserves @SpringBootApplication, @EnableDiscoveryClient, and the public-static main(String[]) entry point and requires beginner-readable class/method Javadoc.

Hosted CI on fail-first head f37206616f009e856274f13e9f63f72270da1a63 reached the real gateway module after successful preceding production/test compilation. The structural annotation/main assertions passed and exactly publicBootstrapApiHasBeginnerReadableJavadoc failed because protected ZuulGatewayApplication.java lacked the required public documentation. That is valid RED at the intended production/documentation boundary rather than setup/import/dependency failure.

Exact current source head 75a540deb09a39c25d64168c5384639e938fb6b0 applies the smallest correction proven by RED: Javadoc only. It explains that the class starts the standalone mightyETL gateway with service discovery during bootstrap and documents main(String[]) plus its Spring Boot argument contract. Annotations and SpringApplication.run(...) behavior are unchanged.

Current hosted evidence

All exposed workflow aggregates for the exact current source head are terminal-success:

• CI 31371785995: success on Ubuntu, macOS and Windows;
• Dependency Review 31371785779: success;
• CycloneDX SBOM 31371785729: success;
• SAST Semgrep 31371785715: success;
• Security Scan 31371786135: aggregate success.

CI macOS job 93402154438 checked out GitHub synthetic merge 3bba9f8fc0c850461c54cba35c5a1edb4ae4ca7f, not literal source head. On that integration tree the full reactor completed BUILD SUCCESS; ZuulGatewayApplicationContractTest passed 3/3 and the gateway module passed 6/6. This is merged-tree structural/documentation evidence, not literal-source acceptance.

Security Scan Trivy job 93402154770 likewise checked out synthetic merge 3bba9f8.... It printed Dependency version cannot be determined. Child dependencies will not be found. before reporting zero CRITICAL/HIGH/MEDIUM findings, so #196 remains the scanner-completeness authority and the aggregate green is not accepted as complete same-revision Maven vulnerability evidence. The scan also still observes the tracked 82 MB zipkin.jar, owned by #168/#169.

The same current CI log reproduces the inherited JaCoCo false-green: Analyzed bundle 'etl-service' with 0 classes followed by coverage success. #162/#164 own selected ETL non-vacuity and #205 owns repository-wide owned-production coverage scope.

Scope / merge boundary

Keep Draft. This branch fixes one real public bootstrap documentation/test gap but does not close #142 gateway authentication, #196 scanner completeness, #162/#164 non-vacuous selected coverage, #205 repository-wide coverage, #121/exact-source control dependencies, or independent protected review/merge governance. Merge only after the unchanged exact source head satisfies every live applicable gate; no predecessor-head, other-PR, incomplete-scanner, status-only, skipped-required or synthetic-only evidence transfers.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b8292258-1ab6-4878-add6-979434055206

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}