| Tool | Required version | Notes | |------|-----------------|-------| | Java (JDK) | 21 (Temurin recommended) | CI uses temurin-21; newer JDKs (24+) work but require the Lombok pin in pom.xml | | Maven wrapper | bundled — ./mvnw in backend/ | Do not install Maven separately; always use ./mvnw | | Node.js | 22 LTS or later | Required by Angular 22; check with node -v | | npm | 11 (bundled with Node 22) | package.json pins packageManager: npm@11.17.0 |

Running the backend locally

No database is required for a basic local run. By default, application.yml excludes the DataSourceAutoConfiguration, DataSourceTransactionManagerAutoConfiguration, HibernateJpaAutoConfiguration, FlywayAutoConfiguration, and JpaRepositoriesAutoConfiguration Spring Boot auto-configuration classes via the SPRING_AUTOCONFIGURE_EXCLUDE environment variable. All analysis data is kept in-memory for the duration of the JVM session.

cd backend
./mvnw spring-boot:run

The server starts on port 8096 (registered in the workspace port registry). To override:

SERVER_PORT=9000 ./mvnw spring-boot:run

Health check: http://localhost:8096/actuator/health

Running with a local PostgreSQL database

Activate the local profile to enable the datasource, Flyway migrations, and JPA:

cd backend
SPRING_PROFILES_ACTIVE=local ./mvnw spring-boot:run

application-local.yml connects to postgresql://localhost:5432/athena with credentials athena / localpass123. Bring up Postgres before starting the application (e.g. docker compose up -d postgres).

Running the frontend locally

cd frontend/athena-web
npm install
npx ng serve --port 4200

The Angular dev server proxies API requests to the backend at port 8096 by default. Open http://localhost:4200 in a browser.

Running tests

Backend

cd backend
./mvnw test

Integration tests that require a real PostgreSQL instance use Testcontainers; Docker must be running for those tests to pass. Unit tests have no external dependencies.

To run the full Maven verify lifecycle (includes quality gates, skipping the OWASP scan):

cd backend
./mvnw verify -Ddependency-check.skip=true

Frontend

cd frontend/athena-web
npx ng test --watch=false

The frontend test suite uses Vitest under the Angular CLI test runner.

Staging and production deployment

Overview

| Environment | Namespace | Trigger | |-------------|-----------|---------| | Staging | athena-staging | Automatic — every push to develop that passes CI | | Acceptance | athena-acceptance | Manual — workflow_dispatch via CI Backend workflow | | Production | athena | Manual — workflow_dispatch via CD Backend / CD Frontend workflows, owner-gated |

All environments run on a Leaseweb Kubernetes cluster accessed via the LEASEWEB_KUBECONFIG secret. Helm chart: ops/helm/athena/.

Staging (automatic)

Every push to develop that passes the CI — Backend or CI — Frontend workflow triggers an automatic deploy-staging job:

Builds and pushes a Docker image tagged sha-<short-sha> and develop to ghcr.io/mahmoudholding/athena/{backend,frontend}.
Runs helm upgrade --install athena ops/helm/athena/ -f values-staging.yaml --namespace athena-staging.
Pins the new image tag in values-staging.yaml via an auto-bump PR against develop.
Smoke-tests https://athena.staging.glorylabs.nl/actuator/health.

Production (manual, owner-gated)

Production deploys use the separate CD — Backend (.github/workflows/deploy-backend.yml) and CD — Frontend (.github/workflows/deploy-frontend.yml) workflows. Both are workflow_dispatch-only and reference the production GitHub Environment. The workflow comments describe this environment as carrying a required reviewer, but as of this writing gh api repos/mahmoudholding/athena/environments shows protection_rules: [] for production — no required-reviewer rule is actually configured on GitHub's side (same known gap as interimplaza: the org's GitHub plan doesn't support required-reviewer rules). Anyone with workflow_dispatch access can trigger a production deploy without an approval step today. Safety is process discipline only — treat the "owner-gated" label as a convention, not an enforced gate, until this is fixed at the org/billing level.

Steps (per workflow):

Owner triggers the workflow with an explicit image_tag (e.g. sha-a1b2c3d).
helm upgrade --install athena ops/helm/athena/ -f values-production.yaml --namespace athena.
Auto-bumps the image pin in values-production.yaml via a PR against develop.
Smoke-tests https://app.athena.glorylabs.nl/actuator/health (backend) or the frontend URL.
On Helm failure: automatic helm rollback athena 0 before exiting non-zero.

Images are pulled from ghcr.io/mahmoudholding/athena/{backend,frontend} using the ghcr-pull-secret imagePullSecret, which must exist in the target namespace.

Reacties

Nog geen reacties

Athena — setup.md

Athena — Local Setup & Deployment Guide

Prerequisites