chore: Upgrade bff from spring to quarkus by giampiero-ferrara · Pull Request #220 · pagopa/selfcare

giampiero-ferrara · 2026-04-10T12:40:48Z

List of Changes

Migrated and consolidated onboarding-bff on Quarkus, aligned with the
structure used by other microservices.
Refactored onboarding integration by removing the BFF client pattern in
favor of a proper service layer (OnboardingService /
OnboardingServiceImpl) outside the api package.
Aligned REST client configuration and application properties (cleanup,
grouped sections with comments, renamed ms_core -> institution).
Aligned token/JWT handling with other microservices (iam, product,
auth) and removed remaining unnecessary Spring remnants.
Moved Jackson/date codec configuration under config (same approach used in
iam/product) and fixed BFF date deserialization issues.
Hardened logging to resolve GitHub Advanced Security findings (CodeQL Log Injection) through centralized sanitization (OWASP Encode.forJava).
Updated tests and technical documentation for the module.
Updated CI workflows:
- split Cucumber integration tests into a dedicated workflow
  integration_tests_onboarding_bff.yml;
- aligned integration test suite naming to CucumberSuiteTest (same
  convention as other microservices);
- excluded Cucumber suite from standard test lifecycle (maven-surefire- plugin exclude), so clean install does not run it automatically;
- fixed workflow permissions by removing pull-requests: write where not
  allowed in the reusable workflow chain.

Motivation and Context

This PR originates from the need to experimentally use an AI tool to perform a
migration of onboarding-bff from Spring to Quarkus, while keeping functional
parity and repository standards.

During this migration experiment, a number of issues emerged and were
addressed in this work:

401 errors on downstream REST calls;
token/client configuration misalignment;
date deserialization failures;
security findings from GitHub Advanced Security scans.

The PR also improves CI reliability by:

running Cucumber integration tests only when explicitly requested;
removing PR workflow failures caused by reusable-workflow permission
mismatch.

Overall goal: validate an AI-assisted migration path from Spring to Quarkus,
with human supervision and targeted corrections, aligned with the technical
and operational standards already adopted across the repository.

How Has This Been Tested?

Compiled the BFF module after refactoring.
Performed static/config-level validation of updated GitHub workflows.
Verified runtime wiring (REST clients/config/token flow) during local
troubleshooting.
Re-tested real scenarios that previously reproduced:
- 401 errors on downstream client calls;
- OffsetDateTime deserialization failures when timezone offset is missing.
Re-checked impacted GHAS/CodeQL findings on updated logging points.

Screenshots (if appropriate):

N/A

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality
to not work as expected)

Checklist:

My change requires a change to the documentation.
I have updated the documentation accordingly.

AI-assisted development disclosure

This PR was implemented with AI model assistance and supervised by me end-to-
end.
I reviewed all proposed changes and applied targeted manual adjustments where
needed (application logic, security, configuration, and CI workflows) before
finalizing.

sonarqubecloud · 2026-04-14T12:58:02Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

+                                                         @Valid
+                                                         VerificationMatchRequest verificationMatchRequest) {
+        log.trace("matchInstitutionAndUser start");
+        log.debug(LogUtils.CONFIDENTIAL_MARKER, "matchInstitutionAndUser userDto = {}", verificationMatchRequest);


sonarqubecloud · 2026-04-20T12:51:14Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarqubecloud · 2026-04-23T07:59:37Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarqubecloud · 2026-04-28T15:14:23Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

sonarqubecloud · 2026-07-16T12:26:44Z

Quality Gate failed

Failed conditions
0.0% Coverage on New Code (required ≥ 80%)
4.5% Duplication on New Code (required ≤ 3%)
D Security Rating on New Code (required ≥ A)
C Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

💡 Need a hand with PR review? Try Gitar by Sonar!

+        log.info("Checking IAM permission: onboardingId={}, userId={}, permission={}, productId={}",
+                onboardingId, userId, permission, productId);


+    @Override
+    public OnboardingData getOnboardingWithUserInfo(String onboardingId) {
+        log.trace("getOnboardingWithUserInfo start");
+        log.debug("getOnboardingWithUserInfo id = {}", onboardingId);


giampiero-ferrara requested review from a team and giulia-tremolada as code owners April 10, 2026 12:40

github-actions Bot added docs onboarding-bff labels Apr 10, 2026

github-advanced-security Bot found potential problems Apr 13, 2026

View reviewed changes

github-actions Bot added the ops label Apr 13, 2026

github-advanced-security Bot found potential problems Apr 13, 2026

View reviewed changes

github-advanced-security Bot found potential problems Apr 14, 2026

View reviewed changes

Comment thread ...onboarding-bff/src/main/java/it/pagopa/selfcare/onboarding/controller/ProductController.java Fixed

giampiero-ferrara had a problem deploying to dev-cd April 15, 2026 07:39 — with GitHub Actions Failure

giampiero-ferrara temporarily deployed to dev-ci April 15, 2026 07:39 — with GitHub Actions Inactive

giampiero-ferrara temporarily deployed to dev-ci April 15, 2026 07:46 — with GitHub Actions Inactive

giampiero-ferrara had a problem deploying to dev-cd April 15, 2026 07:46 — with GitHub Actions Failure

giampiero-ferrara temporarily deployed to dev-cd April 15, 2026 08:00 — with GitHub Actions Inactive

giampiero-ferrara temporarily deployed to dev-ci April 15, 2026 08:00 — with GitHub Actions Inactive

giampiero-ferrara temporarily deployed to dev-ci April 15, 2026 08:08 — with GitHub Actions Inactive

giampiero-ferrara temporarily deployed to dev-cd April 15, 2026 08:08 — with GitHub Actions Inactive

giampiero-ferrara temporarily deployed to dev-cd April 15, 2026 08:15 — with GitHub Actions Inactive

giampiero-ferrara temporarily deployed to dev-cd April 15, 2026 08:16 — with GitHub Actions Inactive

giampiero-ferrara had a problem deploying to dev-cd April 15, 2026 10:08 — with GitHub Actions Failure

giampiero-ferrara temporarily deployed to dev-ci April 15, 2026 10:08 — with GitHub Actions Inactive

giampiero-ferrara had a problem deploying to dev-cd April 15, 2026 10:29 — with GitHub Actions Failure

giampiero-ferrara temporarily deployed to dev-ci April 15, 2026 10:29 — with GitHub Actions Inactive

giampiero-ferrara temporarily deployed to dev-ci April 15, 2026 10:31 — with GitHub Actions Inactive

giampiero-ferrara temporarily deployed to dev-cd April 15, 2026 10:31 — with GitHub Actions Inactive

github-advanced-security Bot found potential problems Apr 15, 2026

View reviewed changes

giampiero-ferrara temporarily deployed to dev-cd April 15, 2026 10:36 — with GitHub Actions Inactive

github-actions Bot added the onboarding-functions label Apr 16, 2026

giampiero-ferrara temporarily deployed to dev-cd April 16, 2026 16:00 — with GitHub Actions Inactive

giampiero-ferrara temporarily deployed to dev-cd April 17, 2026 06:41 — with GitHub Actions Inactive

giampiero-ferrara temporarily deployed to dev-cd April 17, 2026 07:23 — with GitHub Actions Inactive

giampiero-ferrara temporarily deployed to dev-cd April 17, 2026 07:36 — with GitHub Actions Inactive

giampiero-ferrara temporarily deployed to dev-cd April 17, 2026 08:00 — with GitHub Actions Inactive

giampiero-ferrara temporarily deployed to dev-cd April 17, 2026 11:19 — with GitHub Actions Inactive

giampiero-ferrara temporarily deployed to dev-cd April 17, 2026 12:02 — with GitHub Actions Inactive

giampiero-ferrara temporarily deployed to dev-cd April 17, 2026 12:21 — with GitHub Actions Inactive

giampiero-ferrara temporarily deployed to dev-cd April 17, 2026 13:37 — with GitHub Actions Inactive

giampiero-ferrara temporarily deployed to dev-cd April 17, 2026 14:20 — with GitHub Actions Inactive

giampiero-ferrara temporarily deployed to dev-cd April 17, 2026 15:21 — with GitHub Actions Inactive

giampiero-ferrara requested a review from fabiosalamonenttdata as a code owner April 20, 2026 06:46

giampiero-ferrara had a problem deploying to dev-cd April 20, 2026 07:20 — with GitHub Actions Error

giampiero-ferrara temporarily deployed to dev-ci April 20, 2026 07:22 — with GitHub Actions Inactive

github-advanced-security Bot found potential problems Apr 20, 2026

View reviewed changes

Comment thread .github/workflows/call_release_functions.yml Fixed

Comment thread .github/workflows/call_release_functions.yml Fixed

Comment thread .github/workflows/call_release_functions.yml Fixed

giampiero-ferrara had a problem deploying to dev-cd April 20, 2026 07:23 — with GitHub Actions Error

giampiero-ferrara temporarily deployed to dev-ci April 20, 2026 07:30 — with GitHub Actions Inactive

giampiero-ferrara had a problem deploying to dev-cd April 20, 2026 07:32 — with GitHub Actions Error

giampiero-ferrara temporarily deployed to dev-ci April 20, 2026 12:35 — with GitHub Actions Inactive

giampiero-ferrara temporarily deployed to dev-cd April 20, 2026 12:37 — with GitHub Actions Inactive

giampiero-ferrara and others added 3 commits July 16, 2026 09:39

chore: migrate onboarding-bff to quarkus (transfer from v2 branch)

3fe9969

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Deleted old infra

bf49eaa

Fixed post upgrade

b326617

github-advanced-security Bot found potential problems Jul 16, 2026

View reviewed changes

Fixed post upgrade

99607d0

		log.info("Checking IAM permission: onboardingId={}, userId={}, permission={}, productId={}",
		onboardingId, userId, permission, productId);

Uh oh!

Conversation

giampiero-ferrara commented Apr 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

List of Changes

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate):

Types of changes

Checklist:

AI-assisted development disclosure

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud Bot commented Apr 14, 2026

Quality Gate passed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud Bot commented Apr 20, 2026

Quality Gate passed

Uh oh!

sonarqubecloud Bot commented Apr 23, 2026

Quality Gate passed

Uh oh!

sonarqubecloud Bot commented Apr 28, 2026

Quality Gate passed

Uh oh!

sonarqubecloud Bot commented Jul 16, 2026

Quality Gate failed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

giampiero-ferrara commented Apr 10, 2026 •

edited

Loading