Validate SPRING_DATASOURCE_URL and add Qodana

Add validation for SPRING_DATASOURCE_URL in CI and deploy script, and introduce a Qodana code-quality workflow.

- .github/workflows/cicd.yml: validate .env.espacogeek contains a non-empty SPRING_DATASOURCE_URL that starts with 'jdbc:'; print error, redact file and fail the job on invalid input.
- .github/workflows/qodana_code_quality.yml: add a new Qodana workflow to run scans on push (dev/master), pull requests and manual dispatch using JetBrains/qodana-action.
- docker/deploy.sh: validate SPRING_DATASOURCE_URL in the target env file before deploying; on the final health-check attempt accept a running container even if the health endpoint is unavailable (log a warning and treat as operational).

These changes aim to prevent deployments with malformed or missing DB URLs, add automated static analysis, and make container health checks more tolerant in edge cases.

Author: vitorhugo-java

.github/workflows/cicd.yml

@@ -386,6 +386,27 @@ jobs:
             FRONTEND_URL=${{ secrets.FRONTEND_URL }}
             ENVEOF
 
+            # Validate SPRING_DATASOURCE_URL before deployment
+            echo "Validating environment file..."
+            if ! grep -q "^SPRING_DATASOURCE_URL=" .env.espacogeek; then
+              echo "ERROR: SPRING_DATASOURCE_URL not found in .env.espacogeek"
+              cat .env.espacogeek
+              rm -f .env.espacogeek
+              exit 1
+            fi
+            DATASOURCE_URL=$(grep "^SPRING_DATASOURCE_URL=" .env.espacogeek | cut -d'=' -f2)
+            if [ -z "$DATASOURCE_URL" ]; then
+              echo "ERROR: SPRING_DATASOURCE_URL is empty"
+              rm -f .env.espacogeek
+              exit 1
+            fi
+            if [[ ! "$DATASOURCE_URL" =~ ^jdbc: ]]; then
+              echo "ERROR: SPRING_DATASOURCE_URL must start with 'jdbc:' but got: $DATASOURCE_URL"
+              rm -f .env.espacogeek
+              exit 1
+            fi
+            echo "✓ SPRING_DATASOURCE_URL is valid: $DATASOURCE_URL"
+
             # Login to GHCR
             echo "${{ secrets.GHCR_TOKEN }}" | docker login ghcr.io -u "${{ secrets.GHCR_USER }}" --password-stdin
 

.github/workflows/qodana_code_quality.yml

@@ -0,0 +1,40 @@
+#-------------------------------------------------------------------------------#
+#            Discover all capabilities of Qodana in our documentation           #
+#             https://www.jetbrains.com/help/qodana/about-qodana.html           #
+#-------------------------------------------------------------------------------#
+
+name: Qodana
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches:
+      - dev
+      - master
+
+jobs:
+  qodana:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      checks: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+      - name: 'Qodana Scan'
+        uses: JetBrains/qodana-action@v2025.3
+        env:
+          QODANA_TOKEN: ${{ secrets.QODANA_TOKEN }}
+        with:
+          # When pr-mode is set to true, Qodana analyzes only the files that have been changed
+          pr-mode: false
+          use-caches: true
+          post-pr-comment: true
+          use-annotations: true
+          # Upload Qodana results (SARIF, other artifacts, logs) as an artifact to the job
+          upload-result: false
+          # quick-fixes available in Ultimate and Ultimate Plus plans
+          push-fixes: 'none'

docker/deploy.sh

@@ -176,6 +176,11 @@ validate_container_health() {
                    docker exec "$CONTAINER_NAME" curl -s http://localhost:8080/actuator/health &>/dev/null; then
                     log_success "Container is healthy"
                     return 0
+                elif [ $attempt -eq $max_attempts ]; then
+                    # On last attempt, accept if container is just running
+                    log_warn "Health endpoint not available, but container is running"
+                    log_success "Container is operational"
+                    return 0
                 fi
             else
                 log_warn "Container status is: $status"
@@ -261,13 +266,29 @@ main() {
     log_info "Environment file: ${ENV_FILE}"
     log_info ""
 
-    # Step 1: Verify environment file exists
+    # Step 1: Verify environment file exists and validate SPRING_DATASOURCE_URL
     if [ ! -f "$ENV_FILE" ]; then
         log_error "Environment file not found: ${ENV_FILE}"
         exit 1
     fi
     log_success "Environment file found"
 
+    # Validate SPRING_DATASOURCE_URL exists and starts with 'jdbc:'
+    if ! grep -q "^SPRING_DATASOURCE_URL=" "$ENV_FILE"; then
+        log_error "SPRING_DATASOURCE_URL not found in environment file"
+        exit 1
+    fi
+    DATASOURCE_URL=$(grep "^SPRING_DATASOURCE_URL=" "$ENV_FILE" | cut -d'=' -f2)
+    if [ -z "$DATASOURCE_URL" ]; then
+        log_error "SPRING_DATASOURCE_URL is empty"
+        exit 1
+    fi
+    if [[ ! "$DATASOURCE_URL" =~ ^jdbc: ]]; then
+        log_error "SPRING_DATASOURCE_URL must start with 'jdbc:' but got: $DATASOURCE_URL"
+        exit 1
+    fi
+    log_success "SPRING_DATASOURCE_URL validated: $DATASOURCE_URL"
+
     # Step 2: Create backups
     backup_old_container || exit 1