Repository: pagopa/pagopa-cruscotto-backend
Pull request #4: chore: Update pipelines
Author: login: pasqualespica
Labels: name: size/large
name: ignore-for-release
Created: 2025-04-29T07:12:48Z | Merged: 2025-04-29T07:13:20Z

<!--- Please always add a PR description as if nobody knows anything about the context these changes come from. -->
<!--- Even if we are all from our internal team, we may not be on the same page. -->
<!--- Write this PR as you were contributing to a public OSS project, where nobody knows you and you have to earn their trust. -->
<!--- This will improve our projects in the long run! Thanks. -->

#### List of Changes

<!--- Describe your changes in detail -->

#### Motivation and Context

<!--- Why is this change required? What problem does it solve? -->

#### How Has This Been Tested?

<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, tests ran to see how -->
<!--- your change affects other areas of the code, etc. -->

#### Screenshots (if appropriate):

#### Types of changes

<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->

- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)

#### Checklist:

<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->

- [ ] My change requires a change to the documentation.
- [ ] I have updated the documentation accordingly.



Diff:
diff --git a/.devops/db-users-schema-pipelines.yml b/.devops/db-users-schema-pipelines.yml
new file mode 100644
index 00000000..9a8ddeb7
--- /dev/null
+++ b/.devops/db-users-schema-pipelines.yml
@@ -0,0 +1,87 @@
+pr: none
+trigger: none
+#trigger:
+#  - develop
+
+pool:
+  vmImage: 'ubuntu-latest'
+
+parameters:
+  - name: k8sEnv
+    displayName: K8s Environment
+    type: string
+    default: dev
+    values:
+      - dev
+      - it
+      - prf
+      - uat
+      - prd
+
+variables:
+  ${{ if eq(parameters.k8sEnv, 'dev') }}:
+    DB_HOST: pagopa-d-itn-crusc8-flexible-postgresql
+    AZURE_SERVICE_CONNECTION: '$(TF_AZURE_SERVICE_CONNECTION_PLAN_NAME_DEV)'
+    KEY_VAULT_NAME: 'pagopa-d-crusc8-kv'
+    DATABASE_NAME: crusc83
+    poolImage: 'pagopa-dev-linux-infra'
+  ${{ elseif eq(parameters.k8sEnv, 'uat') }}:
+    DB_HOST: pagopa-u-itn-crusc8-flexible-postgresql
+    AZURE_SERVICE_CONNECTION: '$(TF_AZURE_SERVICE_CONNECTION_PLAN_NAME_UAT)'
+    KEY_VAULT_NAME: 'pagopa-u-crusc8-kv'
+    DATABASE_NAME: crusc83
+    poolImage: 'pagopa-uat-linux-infra'
+  ${{ elseif eq(parameters.k8sEnv, 'prd') }}:
+    DB_HOST: pagopa-p-itn-crusc8-flexible-postgresql
+    AZURE_SERVICE_CONNECTION: '$(TF_AZURE_SERVICE_CONNECTION_PLAN_NAME_PROD)'
+    KEY_VAULT_NAME: 'pagopa-p-crusc8-kv'
+    DATABASE_NAME: crusc83
+    poolImage: 'pagopa-prod-linux-infra'
+  ADMIN_USERNAME: azureuser
+  crusc83_USERNAME: crusc83
+  crusc83_SCHEMA: crusc83
+
+stages:
+  - stage: initialization_jobs
+    displayName: "Init ${{ parameters.k8sEnv }}"
+    jobs:
+      - job: initialization
+        pool: $(poolImage)
+        displayName: "Schemas creation job"
+        steps:
+          - task: AzureKeyVault@2
+            displayName: "Get secrets"
+            inputs:
+              azureSubscription: $(AZURE_SERVICE_CONNECTION)
+              keyVaultName: $(KEY_VAULT_NAME)
+              secretsFilter: 'db-administrator-login-password,db-crusc83-password'
+          - task: AzureCLI@2
+            displayName: "create all schemas"
+            inputs:
+              azureSubscription: $(AZURE_SERVICE_CONNECTION)
+              scriptLocation: inlineScript
+              scriptType: bash
+              inlineScript: |
+                az config set extension.use_dynamic_install=yes_without_prompt
+                az postgres flexible-server execute --name $(DB_HOST) --admin-user $(ADMIN_USERNAME) \
+                --admin-password '$(db-administrator-login-password)' --database-name "$(DATABASE_NAME)" \
+                --querytext "
+                do \$\$
+                BEGIN
+                IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = '$crusc83_USERNAME') THEN
+                CREATE ROLE $crusc83_USERNAME LOGIN PASSWORD '$(db-crusc83-password)';
+                END IF;
+
+                GRANT ALL PRIVILEGES ON DATABASE $DATABASE_NAME TO $crusc83_USERNAME;
+
+                GRANT $crusc83_USERNAME to $ADMIN_USERNAME;
+                  
+                CREATE SCHEMA IF NOT EXISTS $crusc83_SCHEMA AUTHORIZATION $crusc83_USERNAME;
+
+                GRANT ALL ON SCHEMA $crusc83_SCHEMA TO $crusc83_USERNAME;
+                ALTER DEFAULT PRIVILEGES IN SCHEMA $crusc83_SCHEMA grant all on tables to $crusc83_USERNAME;
+                ALTER DEFAULT PRIVILEGES IN SCHEMA $crusc83_SCHEMA grant all on sequences to $crusc83_USERNAME;
+                ALTER DEFAULT PRIVILEGES IN SCHEMA $crusc83_SCHEMA grant all on functions to $crusc83_USERNAME;
+                END
+                \$\$;
+                "
diff --git a/.github/workflows/00_add_patch_label.yml b/.github/workflows/00_add_patch_label.yml
new file mode 100644
index 00000000..2d2bbf05
--- /dev/null
+++ b/.github/workflows/00_add_patch_label.yml
@@ -0,0 +1,60 @@
+name: Add PATCH default label
+
+# Controls when the workflow will run
+on:
+  # Triggers the workflow on push or pull request events but only for the main branch
+  pull_request_target:
+    branches:
+      - main
+    types: [ opened, reopened ]
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  add_patch_label:
+    runs-on: ubuntu-latest
+    name: Add default label
+    steps:
+      - name: Check user labels
+        id: check_user_labels
+        uses: actions/github-script@d556feaca394842dc55e4734bf3bb9f685482fa0 # v6.3.3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            var addPatch = "true";
+            // retrieve label list
+            let labels = await github.rest.issues.listLabelsOnIssue({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo
+            });
+            
+            // verify if user have already added IGNORE-FOR-RELEASE, then skip add PATCH
+            // note: GitHub labels are added in .identity/03_github_environment.tf as github_issue_label resource
+            if (labels.data.find(label => label.name === 'ignore-for-release')){
+              addPatch = "false";
+            }
+            return addPatch;
+          result-encoding: string
+
+      - name: Add PATCH label
+        if: ${{ steps.check_user_labels.outputs.result == 'true' }}
+        uses: pagopa/github-actions-template/default-label@main
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          label: 'patch'
+
+      - name: Add comment
+        if: ${{ steps.check_user_labels.outputs.result == 'true' }}
+        uses: actions/github-script@d556feaca394842dc55e4734bf3bb9f685482fa0 # v6.3.3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            github.rest.issues.createComment({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                body: 'The default action is to increase the `PATCH` number of `SEMVER`. Set `IGNORE-FOR-RELEASE` if you want to skip `SEMVER` bump. `BREAKING-CHANGE` and `NEW-RELEASE` must be run from GH Actions section manually.'
+              });
diff --git a/.github/workflows/anchore.yml b/.github/workflows/01_anchore.yml
similarity index 81%
rename from .github/workflows/anchore.yml
rename to .github/workflows/01_anchore.yml
index 5ce097d0..c9944f1b 100644
--- a/.github/workflows/anchore.yml
+++ b/.github/workflows/01_anchore.yml
@@ -24,7 +24,9 @@ permissions:
   contents: read
 
 env:
-  DOCKERFILE: Dockerfile
+  APP_NAME: pagopacruscottobackend
+  QUARKUS_PROFILE: prod
+  DOCKERFILE: src/main/docker/Dockerfile.multistage.jvm
 
 jobs:
   Anchore-Build-Scan:
@@ -38,17 +40,17 @@ jobs:
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
       - name: Build the Docker image
-        run: docker build . --file ${{ env.DOCKERFILE }} --tag localbuild/testimage:latest
+        run: docker build . --file ${{ env.DOCKERFILE }} --force-rm --tag localbuild/testimage:latest --build-arg APP_NAME=pagopacruscottobackend --build-arg QUARKUS_PROFILE=prod
 
       - name: Run the Anchore scan action itself with GitHub Advanced Security code scanning integration enabled
         uses: anchore/scan-action@3343887d815d7b07465f6fdcd395bd66508d486a # v3
         with:
           image: "localbuild/testimage:latest"
           acs-report-enable: true
-          fail-build: true
+          fail-build: false
           severity-cutoff: "high"
       - name: Upload Anchore Scan Report
-        uses: github/codeql-action/upload-sarif@277b89701e930e6af7a758f50afa5185bfc53c81 # v2
+        uses: github/codeql-action/upload-sarif@6a89f57882288b3d2f190cda65000eec9e9ebb7c # v2
         if: always()
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/01_assignee.yml b/.github/workflows/01_assignee.yml
new file mode 100644
index 00000000..cf22668f
--- /dev/null
+++ b/.github/workflows/01_assignee.yml
@@ -0,0 +1,26 @@
+name: Auto Assign
+
+# Controls when the workflow will run
+on:
+  # Triggers the workflow on push or pull request events but only for the main branch
+  pull_request_target:
+    branches:
+      - main
+    types: [ opened, reopened ]
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  build:
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      - name: Assign Me
+        # You may pin to the exact commit or the version.
+        uses: kentaro-m/auto-assign-action@746a3a558fdd0e061f612ec9f8ff1b8a19c1a115 # v1.2.1
+        with:
+          configuration-path: '.github/auto_assign.yml'
diff --git a/.github/workflows/02_check_pr.yml b/.github/workflows/02_check_pr.yml
new file mode 100644
index 00000000..97b46c33
--- /dev/null
+++ b/.github/workflows/02_check_pr.yml
@@ -0,0 +1,91 @@
+name: Check PR
+
+# Controls when the workflow will run
+on:
+  merge_group:
+  pull_request:
+    branches:
+      - main
+      - next
+    types: [ opened, synchronize, labeled, unlabeled, reopened, edited ]
+
+
+permissions:
+  contents: read
+  checks: write
+  issues: write
+  pull-requests: write
+
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  auto_assign:
+    name: Auto Assign
+    runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' }}
+    steps:
+      - name: Assign Me
+        # You may pin to the exact commit or the version.
+        uses: kentaro-m/auto-assign-action@746a3a558fdd0e061f612ec9f8ff1b8a19c1a115 # v1.2.1
+        with:
+          configuration-path: '.github/auto_assign.yml'
+
+  check_labels:
+    name: Check Required Labels
+    runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4 # required to make the script available for next step
+      - name: Verify PR Labels
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'major') && !contains(github.event.pull_request.labels.*.name, 'minor') && !contains(github.event.pull_request.labels.*.name, 'patch') && !contains(github.event.pull_request.labels.*.name, 'patch') && !contains(github.event.pull_request.labels.*.name, 'skip') }}
+        uses: actions/github-script@d556feaca394842dc55e4734bf3bb9f685482fa0 # v6.3.3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const script = require('./.github/workflows/github_scripts/check_required_labels.js')
+            script({github, context, core})
+
+
+  formatter:
+    name: Formatter
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
+      - uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+      - name: Find incorrectly formatted file
+        uses: axel-op/googlejavaformat-action@v3
+        with:
+          args: "--replace"
+          skip-commit: true
+      - name: Print diffs
+        run: git --no-pager diff
+      - name: suggester / google-java-format
+        uses: reviewdog/action-suggester@a3026c6020837c23b61a79d12db223a00df19e6a # v1
+        with:
+          tool_name: google-java-format
+          fail_on_error: true
+
+  check_size:
+    runs-on: ubuntu-latest
+    name: Check Size
+    if: ${{ github.event_name == 'pull_request' }}
+    steps:
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        with:
+          fetch-depth: 0
+      - name: Check Size
+        uses: actions/github-script@d556feaca394842dc55e4734bf3bb9f685482fa0 # v6.3.3
+        env:
+          IGNORED_FILES: openapi.json
+          BRANCH_NAME: ${{ github.head_ref}}
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const script = require('./.github/workflows/github_scripts/check_size.js')
+            await script({github, context, core})
+
diff --git a/.github/workflows/03_code_review.yml b/.github/workflows/03_code_review.yml
new file mode 100644
index 00000000..4a9634a5
--- /dev/null
+++ b/.github/workflows/03_code_review.yml
@@ -0,0 +1,47 @@
+name: Code Review
+
+# Controls when the workflow will run
+on:
+  pull_request:
+    branches:
+      - main
+    types:
+      - opened
+      - synchronize
+      - reopened
+  push:
+    branches:
+      - main
+
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+env:
+  PROJECT_KEY: pagopa_pagopa-cruscotto-backend
+
+
+permissions:
+  id-token: write
+  contents: read
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  code-review:
+    name: Code Review
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      - name: Code Review
+        uses: pagopa/github-actions-template/maven-code-review@b134fb7af9a4d8b9b933eafb5cf5e12d88ee8ff1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          sonar_token: ${{ secrets.SONAR_TOKEN }}
+          project_key: ${{env.PROJECT_KEY}}
+          coverage_exclusions: "**/config/*,**/*Mock*,**/models/**,**/model/**,**/entities/*,org/openapi/**,**/enums/**,**/constant/**,**/util/openapi/**,**/util/error/exception/persistence/**,**/**Enum.java,**/**Constants.java"
+          coverage_report_path: "target/jacoco-report/jacoco.xml"
+          cpd_exclusions: "**/model/**,**/models/**,**/entities/*"
+          java_distribution: "graalvm"
+          java_version: "17.0.7"
diff --git a/.github/workflows/release_deploy.yml b/.github/workflows/04_release_and_deploy.yml
similarity index 67%
rename from .github/workflows/release_deploy.yml
rename to .github/workflows/04_release_and_deploy.yml
index 171df911..5f1e6516 100644
--- a/.github/workflows/release_deploy.yml
+++ b/.github/workflows/04_release_and_deploy.yml
@@ -2,6 +2,8 @@ name: Release And Deploy
 
 # Controls when the workflow will run
 on:
+  merge_group:
+    branches: [ main ]
   pull_request:
     types: [ closed ]
 
@@ -16,18 +18,26 @@ on:
           - dev
           - uat
           - prod
-          - all
+      version:
+        required: false
+        type: choice
+        description: Select the version
+        options:
+          - patch
+          - skip_or_promote
+          - new_release
+          - breaking_change
       beta:
         required: false
         type: boolean
         description: deploy beta version on AKS
         default: false
-      skip_release:
-        required: false
-        type: boolean
-        description: skip the release. Only deploy
-        default: false
 
+  workflow_call:
+    inputs:
+      environment:
+        required: true
+        type: string
 
 permissions:
   packages: write
@@ -55,21 +65,30 @@ jobs:
       # Set Semvar
       - run: echo "SEMVER=patch" >> $GITHUB_ENV
 
-      - if: ${{ (github.event.pull_request.merged && contains(github.event.pull_request.labels.*.name, 'breaking-change')) }}
+      - if: ${{ (github.event.pull_request.merged && contains(github.event.pull_request.labels.*.name, 'skip')) }}
+        run: echo "SEMVER=skip" >> $GITHUB_ENV
+
+      - if: ${{ (github.event.pull_request.merged && contains(github.event.pull_request.labels.*.name, 'patch')) }}
+        run: echo "SEMVER=patch" >> $GITHUB_ENV
+
+      - if: ${{ (github.event.pull_request.merged && contains(github.event.pull_request.labels.*.name, 'minor')) }}
+        run: echo "SEMVER=minor" >> $GITHUB_ENV
+
+      - if: ${{ (github.event.pull_request.merged && contains(github.event.pull_request.labels.*.name, 'major')) }}
         run: echo "SEMVER=major" >> $GITHUB_ENV
 
-      - if: ${{ inputs.environment == 'uat' }}
+      # force semver if dev, !=main or skip release
+      - if: ${{ inputs.version == 'new_release' }}
         run: echo "SEMVER=minor" >> $GITHUB_ENV
 
-      - if: ${{ inputs.environment == 'prod' }}
-        run: echo "SEMVER=skip" >> $GITHUB_ENV
+      - if: ${{ inputs.version == 'breaking_change' }}
+        run: echo "SEMVER=major" >> $GITHUB_ENV
 
       - if: ${{ github.ref_name != 'main' }}
         run: echo "SEMVER=buildNumber" >> $GITHUB_ENV
 
-      - if: ${{ inputs.skip_release }}
+      - if: ${{ inputs.version == 'skip_or_promote' }}
         run: echo "SEMVER=skip" >> $GITHUB_ENV
-
       - id: get_semver
         name: Set Output
         run: echo "semver=${{env.SEMVER}}" >> $GITHUB_OUTPUT
@@ -84,48 +103,46 @@ jobs:
         name: Set Output
         run: echo "environment=${{env.ENVIRNOMENT}}" >> $GITHUB_OUTPUT
 
-
   release:
     name: Create a New Release
     runs-on: ubuntu-latest
-    needs: [setup]
+    needs: [ setup ]
+    if: ${{ needs.setup.outputs.semver != 'skip' }}
     outputs:
       version: ${{ steps.release.outputs.version }}
     steps:
       - name: Make Release
         id: release
-        uses: pagopa/github-actions-template/maven-release@d91a1fd0b913c9830589be5d86cdb71c90813fae # v1.5.4
+        uses: pagopa/github-actions-template/maven-release@4a4c25ce28feeec9e619b3132b5327f52023d441 # v1.14.2
         with:
           semver: ${{ needs.setup.outputs.semver }}
           github_token: ${{ secrets.BOT_TOKEN_GITHUB }}
           beta: ${{ inputs.beta }}
-          skip_ci: false
+          skip_ci: true
+          prerelease: ${{  github.ref_name != 'main' }}
+          only_tag: false
 
   image:
     needs: [ setup, release ]
     name: Build and Push Docker Image
     runs-on: ubuntu-latest
-    if: ${{ inputs.semver != 'skip' }}
+    if: ${{ needs.setup.outputs.semver != 'skip' }}
     steps:
       - name: Build and Push
         id: semver
         uses: pagopa/github-actions-template/ghcr-build-push@d91a1fd0b913c9830589be5d86cdb71c90813fae # v1.5.4
         with:
-          branch: ${{ github.ref_name}}
           github_token: ${{ secrets.GITHUB_TOKEN }}
           tag: ${{ needs.release.outputs.version }}
+          build_args: APP_NAME=pagopa-cruscotto-backend
 
   deploy_aks:
     name: Deploy on AKS
     needs: [ setup, release, image ]
     if: ${{ always() && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') }}
-    strategy:
-      matrix:
-        environment: [ dev, uat, prod ]
-    uses: ./.github/workflows/deploy_with_github_runner.yml
+    uses: ./.github/workflows/04h_deploy_with_github_runner.yml
     with:
-      environment: ${{ matrix.environment }}
-      target: ${{ needs.setup.outputs.environment }}
+      environment: ${{ needs.setup.outputs.environment }}
     secrets: inherit
 
   notify:
@@ -135,7 +152,7 @@ jobs:
     if: always()
     steps:
       - name: Report Status
-        if: ${{ needs.setup.outputs.environment == 'prod' || needs.setup.outputs.environment == 'all'  }}
+        if: ${{ needs.setup.outputs.environment == 'prod' }}
         uses: ravsamhq/notify-slack-action@be814b201e233b2dc673608aa46e5447c8ab13f2 # v2
         with:
           status: ${{ needs.deploy_aks.result }}
@@ -145,4 +162,4 @@ jobs:
           footer: 'Linked to <{workflow_url}| workflow file>'
           icon_success: ':white_check_mark:'
         env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL_DEPLOY }}
\ No newline at end of file
diff --git a/.github/workflows/04h_deploy_with_github_runner.yml b/.github/workflows/04h_deploy_with_github_runner.yml
new file mode 100644
index 00000000..62854581
--- /dev/null
+++ b/.github/workflows/04h_deploy_with_github_runner.yml
@@ -0,0 +1,82 @@
+name: Deploy on AKS
+
+on:
+  workflow_call:
+    inputs:
+      environment:
+        required: true
+        description: The name of the environment where to deploy
+        type: string
+      branch:
+        required: false
+        default: ${{ github.ref_name }}
+        type: string
+
+env:
+  APP_NAME: pagopacruscottobackend
+
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  deploy:
+    runs-on: [ self-hosted-job, "${{ inputs.environment }}" ]
+    name: Deploy on AKS
+    environment: ${{ inputs.environment }}
+    steps:
+      - name: Deploy
+        uses: pagopa/github-actions-template/aks-deploy@main
+        with:
+          branch: ${{ inputs.branch }}
+          client_id: ${{ secrets.CD_CLIENT_ID }}
+          subscription_id: ${{ secrets.SUBSCRIPTION_ID }}
+          tenant_id: ${{ secrets.TENANT_ID }}
+          env: ${{ inputs.environment }}
+          namespace: ${{ vars.NAMESPACE }}
+          cluster_name: ${{ vars.CLUSTER_NAME }}
+          resource_group: ${{ vars.CLUSTER_RESOURCE_GROUP }}
+          app_name: ${{ env.APP_NAME }}
+          helm_upgrade_options: '--debug --set microservice-chart.azure.workloadIdentityClientId=${{vars.WORKLOAD_IDENTITY_ID}} --set scheduler.azure.workloadIdentityClientId=${{vars.WORKLOAD_IDENTITY_ID}}'
+          timeout: '10m0s'
+
+  # update_openapi:
+  #   needs: [ deploy ]
+  #   runs-on: ubuntu-latest
+  #   name: Update OpenAPI
+  #   environment: ${{ inputs.environment }}
+  #   steps:
+  #     - name: Checkout
+  #       id: checkout
+  #       # from https://github.com/actions/checkout/commits/main
+  #       uses: actions/checkout@1f9a0c22da41e6ebfa534300ef656657ea2c6707
+  #       with:
+  #         persist-credentials: false
+
+  #     - name: Setup Terraform
+  #       # from https://github.com/hashicorp/setup-terraform/commits/main
+  #       uses: hashicorp/setup-terraform@8feba2b913ea459066180f9cb177f58a881cf146
+  #       with:
+  #         terraform_version: ${{ vars.TERRAFORM_VERSION }}
+
+  #     - name: Login
+  #       id: login
+  #       # from https://github.com/Azure/login/commits/master
+  #       uses: azure/login@92a5484dfaf04ca78a94597f4f19fea633851fa2
+  #       with:
+  #         client-id: ${{ secrets.CD_CLIENT_ID }}
+  #         tenant-id: ${{ secrets.TENANT_ID }}
+  #         subscription-id: ${{ secrets.SUBSCRIPTION_ID }}
+
+  #     - name: Terraform Apply
+  #       shell: bash
+  #       run: |
+  #         cd ./infra
+  #         export ARM_CLIENT_ID="${{ secrets.CD_CLIENT_ID }}"
+  #         export ARM_SUBSCRIPTION_ID=$(az account show --query id --output tsv)
+  #         export ARM_TENANT_ID=$(az account show --query tenantId --output tsv)
+  #         export ARM_USE_OIDC=true
+  #         export ARM_ACCESS_KEY=$(az storage account keys list --resource-group io-infra-rg --account-name pagopainfraterraform${{inputs.environment}} --query '[0].value' -o tsv)
+  #         bash ./terraform.sh init weu-${{ inputs.environment }}
+  #         bash ./terraform.sh apply weu-${{ inputs.environment }} -auto-approve
diff --git a/.github/workflows/update_code.yml b/.github/workflows/05_update_code.yml
similarity index 74%
rename from .github/workflows/update_code.yml
rename to .github/workflows/05_update_code.yml
index 31807647..e37be111 100644
--- a/.github/workflows/update_code.yml
+++ b/.github/workflows/05_update_code.yml
@@ -12,44 +12,29 @@ permissions:
 
 jobs:
   update:
-    name: Update Openapi and Formatting
-    runs-on: ubuntu-latest
+    name: Formatting code
+    runs-on: ubuntu-18.04
     if: ${{ contains(github.event.comment.body, 'update_code') }}
     steps:
       - name: Checkout
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
-          token: ${{ secrets.BOT_TOKEN_GITHUB }}
+          token: ${{ secrets.API_TOKEN_GITHUB }}
 
       - name: Checkout Pull Request
         run: hub pr checkout ${{ github.event.issue.number }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Set up JDK 17
+      - name: Set up JDK 11
         uses: actions/setup-java@b6e674f4b717d7b0ae3baee0fbe79f498905dfde # v1
         with:
-          java-version: 17
-
-      - name: Update OpenApi/Swagger file
-        run: |
-          cd ./openapi
-          chmod +x ./generate_openapi.sh
-          ./generate_openapi.sh
+          java-version: 11
 
       - name: Formatting
-        id: format
-        uses: findologic/intellij-format-action@main
+        uses: axel-op/googlejavaformat-action@v3
         with:
-          path: .
-          fail-on-changes: false
-
-      - name: Commit files
-        run: |
-          git config --local user.email "pagopa-github-bot@pagopa.it"
-          git config --local user.name "pagopa-github-bot"
-          git commit -a -m "Formatting"
-          git push
-
+          args: "--replace"
+          commit-message: "Google Java format [skip ci]"
 
   notify:
     needs: [ update ]
diff --git a/.github/workflows/06_integration_test.yml b/.github/workflows/06_integration_test.yml
new file mode 100644
index 00000000..d1c48723
--- /dev/null
+++ b/.github/workflows/06_integration_test.yml
@@ -0,0 +1,181 @@
+# name: Integration Tests
+
+# on:
+#   schedule:
+#     - cron: '00 08 * * *'
+
+#   workflow_dispatch:
+#     inputs:
+#       environment:
+#         required: true
+#         type: choice
+#         description: Select the Environment
+#         options:
+#           - dev
+#           - uat
+#       tags:
+#         description: 'run the tests tagged with'
+#         required: false
+#         type: string
+#         default: 'runnable'
+#       junit:
+#         description: 'enable junit'
+#         required: false
+#         type: choice
+#         options:
+#           - true
+#           - false
+#         default: false
+# #      canary:
+# #        description: 'run the tests on canary version'
+# #        required: false
+# #        type: boolean
+# #        default: false
+#       notify:
+#         required: false
+#         type: boolean
+#         description: 'send the slack notification'
+#         default: false
+
+
+# permissions:
+#   id-token: write
+#   contents: read
+#   deployments: write
+
+
+# jobs:
+#   integration_test:
+#     name: Test ${{(github.event.inputs == null && 'dev') || inputs.environment }}
+#     runs-on: ubuntu-latest
+#     environment: ${{(github.event.inputs == null && 'dev') || inputs.environment }}
+#     steps:
+#       - name: Checkout
+#         id: checkout
+#         uses: actions/checkout@1f9a0c22da41e6ebfa534300ef656657ea2c6707
+
+#       - name: Create reports folder
+#         shell: bash
+#         run: |
+#           mkdir -p ./integration-test/reports
+#           mkdir -p ./integration-test/junit
+
+#       - name: Login
+#         id: login
+#         # from https://github.com/Azure/login/commits/master
+#         uses: azure/login@92a5484dfaf04ca78a94597f4f19fea633851fa2
+#         with:
+#           client-id: ${{ secrets.CI_CLIENT_ID }}
+#           tenant-id: ${{ secrets.TENANT_ID }}
+#           subscription-id: ${{ secrets.SUBSCRIPTION_ID }}
+
+#       - name: Download old reports
+#         uses: azure/CLI@4db43908b9df2e7ac93c8275a8f9a448c59338dd # v1
+#         env:
+#           STORAGE_NAME: ${{ vars.INTEGRATION_TEST_STORAGE_ACCOUNT_NAME }}
+#           STORAGE_FOLDER: ${{ vars.INTEGRATION_TEST_REPORTS_FOLDER }}
+#         with:
+#           inlineScript: |
+#             az storage blob download-batch \
+#             --destination "./integration-test/reports" \
+#             --source "${{ env.STORAGE_FOLDER }}" \
+#             --account-name "${{ env.STORAGE_NAME }}" \
+#             --subscription "${{ secrets.SUBSCRIPTION_ID }}" \
+#             --pattern "reports/*" \
+#             --auth-mode login
+
+#       - name: Run Integration Tests
+#         shell: bash
+#         run: |
+#           cd ./integration-test
+#           docker build -t fdr3_test .
+#           docker run \
+#           -e PSP_SUBSCRIPTION_KEY="${{ secrets.PSP_SUBSCRIPTION_KEY }}" \
+#           -e ORG_SUBSCRIPTION_KEY="${{ secrets.ORG_SUBSCRIPTION_KEY }}" \
+#           -e TAGS="${{ inputs.tags }}" \
+#           -e ENV="${{( github.event.inputs == null && 'dev') || inputs.environment }}" \
+#           -v  ./reports:/app/reports fdr3_test
+
+#       - name: Upload reports
+#         uses: azure/CLI@4db43908b9df2e7ac93c8275a8f9a448c59338dd # v1
+#         env:
+#           STORAGE_NAME: ${{ vars.INTEGRATION_TEST_STORAGE_ACCOUNT_NAME }}
+#           STORAGE_FOLDER: ${{ vars.INTEGRATION_TEST_REPORTS_FOLDER }}
+#         with:
+#           inlineScript: |
+#             az storage blob upload-batch \
+#               --destination '${{ env.STORAGE_FOLDER }}/reports' \
+#               --source ./integration-test/reports \
+#               --account-name ${{ env.STORAGE_NAME }} \
+#               --subscription ${{ secrets.SUBSCRIPTION_ID }} \
+#               --overwrite true \
+#               --auth-mode login
+
+#       - name: Upload junit
+#         if: ${{ inputs.junit == true }}
+#         uses: azure/CLI@4db43908b9df2e7ac93c8275a8f9a448c59338dd # v1
+#         env:
+#           STORAGE_NAME: ${{ vars.INTEGRATION_TEST_STORAGE_ACCOUNT_NAME }}
+#           STORAGE_FOLDER: ${{ vars.INTEGRATION_TEST_REPORTS_FOLDER }}
+#         with:
+#           inlineScript: |
+#             az storage blob upload-batch \
+#               --destination '${{ env.STORAGE_FOLDER }}/junit' \
+#               --source ./integration-test/junit \
+#               --account-name ${{ env.STORAGE_NAME }} \
+#               --subscription ${{ secrets.SUBSCRIPTION_ID }} \
+#               --overwrite true \
+#               --auth-mode login                      
+
+#   notify:
+#     needs: [ integration_test ]
+#     runs-on: ubuntu-latest
+#     name: Notify
+#     if: ${{ always() && inputs.notify == 'true' }}
+#     steps:
+#       - name: Report Status
+#         if: ${{ inputs.notify }}
+#         uses: ravsamhq/notify-slack-action@be814b201e233b2dc673608aa46e5447c8ab13f2 # v2
+#         with:
+#           status: ${{ needs.integration_test.result }}
+#           token: ${{ secrets.GITHUB_TOKEN }}
+#           notify_when: 'failure,skipped'
+#           notification_title: '<{run_url}|Scheduled Integration Test> has {status_message}'
+#           message_format: '{emoji} <{run_url}|{workflow}> {status_message} in <{repo_url}|{repo}>'
+#           footer: 'Linked to <{workflow_url}| workflow file>'
+#         env:
+#           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL_INTEGRATION_TEST }}
+
+# #  delete_github_deployments:
+# #    runs-on: ubuntu-latest
+# #    needs: integration_test
+# #    if: ${{ always() }}
+# #    steps:
+# #      - name: Delete Previous deployments
+# #        uses: actions/github-script@v6
+# #        env:
+# #          SHA_HEAD: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.sha) || github.sha}}
+# #        with:
+# #          script: |
+# #            const { SHA_HEAD } = process.env
+# #
+# #            const deployments = await github.rest.repos.listDeployments({
+# #              owner: context.repo.owner,
+# #              repo: context.repo.repo,
+# #              sha: SHA_HEAD
+# #            });
+# #            await Promise.all(
+# #              deployments.data.map(async (deployment) => {
+# #                await github.rest.repos.createDeploymentStatus({
+# #                  owner: context.repo.owner,
+# #                  repo: context.repo.repo,
+# #                  deployment_id: deployment.id,
+# #                  state: 'inactive'
+# #                });
+# #                return github.rest.repos.deleteDeployment({
+# #                  owner: context.repo.owner,
+# #                  repo: context.repo.repo,
+# #                  deployment_id: deployment.id
+# #                });
+# #              })
+# #            );
diff --git a/.github/workflows/07_performance_test.yml b/.github/workflows/07_performance_test.yml
new file mode 100644
index 00000000..e6e48019
--- /dev/null
+++ b/.github/workflows/07_performance_test.yml
@@ -0,0 +1,67 @@
+# name: Performance Test
+
+# on:
+#   #  schedule:
+#   #    - cron: '35 16 * * *'
+
+#   workflow_dispatch:
+#     inputs:
+#       environment:
+#         required: true
+#         type: choice
+#         description: Select the Environment
+#         options:
+#           - dev
+#           - uat
+
+#       test-type:
+#         required: true
+#         type: choice
+#         description: Select the Test Type
+#         options:
+#           - constant
+#           - constant-discard-bodies
+#           - load
+#           - ramping
+#           - smoke
+#           - soak
+#           - spike
+#           - stress
+#       script-name:
+#         required: true
+#         type: choice
+#         description: Select the Script Name
+#         options:
+#           - create_flow_sequential
+#           - create_flow_parallel
+#           - get_flow
+#       flow-size:
+#         required: true
+#         type: number
+#         description: Select the number of payments sent in flow
+#         default: 100
+#       max-parallel-calls:
+#         required: false
+#         type: number
+#         description: Select the number of maximum API calls in parallel (for each VU)
+#         default: 5
+
+# permissions:
+#   id-token: write
+#   contents: read
+#   deployments: write
+
+# jobs:
+#   run_performance_test:
+#     name: Test ${{(github.event.inputs == null && 'dev') || inputs.environment }}
+#     runs-on: ubuntu-latest
+#     environment: ${{(github.event.inputs == null && 'dev') || inputs.environment }}
+
+#     steps:
+#       - name: Checkout repository
+#         uses: actions/checkout@1f9a0c22da41e6ebfa534300ef656657ea2c6707
+
+#       - name: Run k6 script
+#         run: |
+#           cd ./performance-test
+#           sub_key_psp="${{ secrets.PSP_SUBSCRIPTION_KEY }}" sub_key_org="${{ secrets.ORG_SUBSCRIPTION_KEY }}" payments_in_flow="${{ inputs.flow-size }}" max_parallel_calls="${{ inputs.max-parallel-calls }}" env="${{ inputs.environment }}" type="${{ inputs.test-type }}" script="${{ inputs.script-name }}" db_name=fdr3_k6 docker compose -f docker-compose.yaml up --exit-code-from k6
diff --git a/.github/workflows/08_create_dashboard.yml b/.github/workflows/08_create_dashboard.yml
new file mode 100644
index 00000000..efa98dc0
--- /dev/null
+++ b/.github/workflows/08_create_dashboard.yml
@@ -0,0 +1,100 @@
+# name: Create Dashboard
+
+# # Controls when the workflow will run
+# on:
+#   push:
+#     branches:
+#       - main
+#     paths:
+#       - 'openapi/**'
+#       - '.github/workflows/08_create_dashboard.yaml'
+#       - '.opex/**'
+
+#   workflow_dispatch:
+
+# permissions:
+#   id-token: write
+#   contents: read
+#   deployments: write
+
+# # A workflow run is made up of one or more jobs that can run sequentially or in parallel
+# jobs:
+#   dashboard:
+#     # The type of runner that the job will run on
+#     runs-on: ubuntu-22.04
+
+#     strategy:
+#       matrix:
+#         environment: [prod]
+#         product: [internal, organization, psp]
+#       max-parallel: 1
+#     environment:
+#       name: ${{ matrix.environment }}
+#     # Steps represent a sequence of tasks that will be executed as part of the job
+#     steps:
+#       - name: Checkout
+#         id: checkout
+#         # from https://github.com/actions/checkout/commits/main
+#         uses: actions/checkout@1f9a0c22da41e6ebfa534300ef656657ea2c6707
+#         with:
+#           persist-credentials: false
+
+#       - run: |
+#           python -m venv venv
+#           source venv/bin/activate
+#           git clone --branch PAGOPA-2986-fdr-3-check-correttezza-dashboard https://github.com/pagopa/opex-dashboard
+#           cd opex-dashboard
+#           pip install -e .
+#           cd ..
+#           source venv/bin/activate
+#           venv/bin/opex_dashboard generate \
+#             --template-name azure-dashboard \
+#             --package ./dashboard \
+#             --config-file .opex/${{ matrix.product }}/env/${{ matrix.environment }}/config.yaml
+
+#       # we need to set env variables in the folder /azure-dashboard
+#       - name: Copy Environments
+#         shell: bash
+#         run: |
+#           cp -R .opex/${{ matrix.product }}/env ./dashboard/azure-dashboard
+
+#       - name: Setup Terraform
+#         id: setup_terraform
+#         # from https://github.com/hashicorp/setup-terraform/commits/main
+#         uses: hashicorp/setup-terraform@8feba2b913ea459066180f9cb177f58a881cf146
+#         with:
+#           terraform_version: 1.3.6
+
+#       - name: Login
+#         id: login
+#         # from https://github.com/Azure/login/commits/master
+#         uses: azure/login@92a5484dfaf04ca78a94597f4f19fea633851fa2
+#         with:
+#           client-id: ${{ secrets.CD_CLIENT_ID }}
+#           tenant-id: ${{ secrets.TENANT_ID }}
+#           subscription-id: ${{ secrets.SUBSCRIPTION_ID }}
+
+#       # now is possible to launch the command: terraform apply
+#       - name: Terraform Apply
+#         shell: bash
+#         run: |
+#           cd ./dashboard/azure-dashboard
+      
+#           export ARM_CLIENT_ID="${{ secrets.CD_CLIENT_ID }}"
+#           export ARM_TENANT_ID="${{ secrets.TENANT_ID }}"
+#           export ARM_SUBSCRIPTION_ID="${{ secrets.SUBSCRIPTION_ID }}"
+#           export ARM_USE_OIDC=true
+
+#           bash ./terraform.sh apply ${{ matrix.environment }} -auto-approve
+
+# #      # from https://github.com/pagopa/opex-dashboard-azure-action/
+# #      - uses: pagopa/opex-dashboard-azure-action@v1.2.2
+# #        with:
+# #          environment: ${{ matrix.environment }}
+# #          api-name: ${{ matrix.product }}
+# #          config: .opex/${{ matrix.product }}/env/${{ matrix.environment }}/config.yaml
+# #          client-id: ${{ secrets.CD_CLIENT_ID }}
+# #          tenant-id: ${{ secrets.TENANT_ID }}
+# #          subscription-id: ${{ secrets.SUBSCRIPTION_ID }}
+# #          # from https://github.com/pagopa/opex-dashboard-azure-action/pkgs/container/opex-dashboard-azure-action
+# #          docker-version: sha256:b17f49fc762cc2049f887f0999642c95b5546d1eb44e5ae19bed080f9d1859d4
diff --git a/.github/workflows/09_db_migration_with_github_runner.yml b/.github/workflows/09_db_migration_with_github_runner.yml
new file mode 100644
index 00000000..1ecddead
--- /dev/null
+++ b/.github/workflows/09_db_migration_with_github_runner.yml
@@ -0,0 +1,115 @@
+
+name: DB migration
+
+on:
+  workflow_call:
+    inputs:
+      environment:
+        required: true
+        description: The name of the environment target of the DB migration
+        type: string
+  workflow_dispatch:
+    inputs:
+      environment:
+        required: true
+        type: choice
+        description: Select the Environment
+        options:
+          - dev
+          - uat
+          - prod
+      db_version:
+        required: true
+        description: Db version (👀 src/main/resources/db/migration/liquibase )
+        type: string
+        default: "1.0.0"
+        
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  create_runner:
+    name: Create Runner
+    runs-on: ubuntu-22.04
+    environment:
+      name: ${{ inputs.environment }}
+    outputs:
+      runner_name: ${{ steps.create_github_runner.outputs.runner_name }}
+    steps:
+      - name: Create GitHub Runner
+        id: create_github_runner
+        # from https://github.com/pagopa/eng-github-actions-iac-template/tree/main/azure/github-self-hosted-runner-azure-create-action
+        uses: pagopa/eng-github-actions-iac-template/azure/github-self-hosted-runner-azure-create-action@main
+        with:
+          client_id: ${{ secrets.CD_CLIENT_ID }}
+          tenant_id: ${{ secrets.TENANT_ID }}
+          subscription_id: ${{ secrets.SUBSCRIPTION_ID }}
+          container_app_environment_name: ${{ vars.CONTAINER_APP_ENVIRONMENT_NAME }}
+          resource_group_name: ${{ vars.CONTAINER_APP_ENVIRONMENT_RESOURCE_GROUP_NAME }} # RG of the runner
+          pat_token: ${{ secrets.BOT_TOKEN_GITHUB }}
+          self_hosted_runner_image_tag: "latest"
+
+  db_migration:
+    needs: [ create_runner ]
+    runs-on: [ self-hosted, "${{ needs.create_runner.outputs.runner_name }}" ]
+    name: DB migration
+    environment: ${{ inputs.environment }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+
+      - name: Install Liquibase
+        shell: bash
+        run: |
+          cd ./
+          mkdir liquibase-app
+          wget -c https://github.com/liquibase/liquibase/releases/download/v4.17.1/liquibase-4.17.1.tar.gz
+          tar -xzf liquibase-4.17.1.tar.gz -C liquibase-app
+          rm -rf liquibase-4.17.1.tar.gz
+          ls -la liquibase-app
+
+      - name: Run liquibase::migrate
+        shell: bash
+        run: |
+          export PATH="$PATH:./liquibase-app"
+
+          echo "
+          classpath: ./src/main/resources/db/migration/liquibase/changelog
+          liquibase.headless: true
+          url: jdbc:postgresql://${{ vars.POSTGRES_DB_HOST }}:${{ vars.POSTGRES_DB_PORT }}/${{ vars.POSTGRES_DB_NAME }}?prepareThreshold=0&currentSchema=${{ vars.POSTGRES_DB_SCHEMA }}
+          contexts: ${{ inputs.environment }}
+          username: ${{ vars.POSTGRES_DB_USERNAME }}
+          password: ${{ secrets.POSTGRES_DB_PASSWORD }}
+          defaultSchemaName: ${{ vars.POSTGRES_DB_SCHEMA }}
+          liquibaseSchemaName: ${{ vars.POSTGRES_DB_SCHEMA }}
+          liquibase.hub.mode: OFF
+          log-level: INFO
+          " > fdr.properties
+
+          #liquibase --defaultsFile=fdr.properties drop-all
+          #liquibase --defaultsFile=fdr.properties update --changelogFile="db.changelog-master-1.0.0.xml"
+          #liquibase --defaultsFile=fdr.properties clear-checksums #--changelogFile="db.changelog-master-1.0.0.xml"
+
+          liquibase --defaultsFile=fdr.properties update --changelogFile="db.changelog-master-${{ inputs.db_version }}.xml"
+
+          rm fdr.properties
+
+  cleanup_runner:
+    name: Cleanup Runner
+    needs: [ create_runner, db_migration ]
+    if: ${{ success() || failure() }}
+    runs-on: ubuntu-22.04
+    environment: ${{ inputs.environment }}
+    steps:
+      - name: Cleanup GitHub Runner
+        id: cleanup_github_runner
+        # from https://github.com/pagopa/eng-github-actions-iac-template/tree/main/azure/github-self-hosted-runner-azure-cleanup-action
+        uses: pagopa/eng-github-actions-iac-template/azure/github-self-hosted-runner-azure-cleanup-action@0ee2f58fd46d10ac7f00bce4304b98db3dbdbe9a
+        with:
+          client_id: ${{ secrets.CD_CLIENT_ID }}
+          tenant_id: ${{ secrets.TENANT_ID }}
+          subscription_id: ${{ secrets.SUBSCRIPTION_ID }}
+          resource_group_name: ${{ vars.CONTAINER_APP_ENVIRONMENT_RESOURCE_GROUP_NAME }}
+          runner_name: ${{ needs.create_runner.outputs.runner_name }}
+          pat_token: ${{ secrets.BOT_TOKEN_GITHUB }}
diff --git a/.github/workflows/check_pr.yml b/.github/workflows/check_pr.yml
deleted file mode 100644
index bb83a15a..00000000
--- a/.github/workflows/check_pr.yml
+++ /dev/null
@@ -1,183 +0,0 @@
-name: Check PR
-
-# Controls when the workflow will run
-on:
-  pull_request:
-    branches:
-      - main
-    types: [ opened, synchronize, labeled, unlabeled, reopened, edited ]
-
-
-permissions:
-  pull-requests: write
-
-
-# A workflow run is made up of one or more jobs that can run sequentially or in parallel
-jobs:
-  auto_assign:
-    name: Auto Assign
-
-    # The type of runner that the job will run on
-    runs-on: ubuntu-latest
-
-    # Steps represent a sequence of tasks that will be executed as part of the job
-    steps:
-      - name: Assign Me
-        # You may pin to the exact commit or the version.
-        uses: kentaro-m/auto-assign-action@746a3a558fdd0e061f612ec9f8ff1b8a19c1a115 # v1.2.1
-        with:
-          configuration-path: '.github/auto_assign.yml'
-
-  check_format:
-    name: Check Format
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
-
-      - name: Formatting
-        id: format
-        continue-on-error: true
-        uses: findologic/intellij-format-action@main
-        with:
-          path: .
-          fail-on-changes: false
-
-      - uses: actions/github-script@d556feaca394842dc55e4734bf3bb9f685482fa0 # v6.3.3
-        if: steps.format.outcome != 'success'
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            console.log(context);
-            var comments = await github.rest.issues.listComments({
-                issue_number: context.issue.number,
-                owner: context.repo.owner,
-                repo: context.repo.repo
-            });
-            for (const comment of comments.data) {
-              console.log(comment);
-              if (comment.body.includes('Comment this PR with')){
-                github.rest.issues.deleteComment({
-                  issue_number: context.issue.number,
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  comment_id: comment.id
-                })
-              }
-            }
-            github.rest.issues.createComment({
-                issue_number: context.issue.number,
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                body: 'Comment this PR with *update_code* to update `openapi.json` and format the code. Consider to use pre-commit to format the code.'
-            })
-            core.setFailed('Format your code.')
-
-  check_size:
-    runs-on: ubuntu-latest
-    name: Check Size
-    steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
-        with:
-          fetch-depth: 0
-
-      - name: Check Size
-        uses: actions/github-script@d556feaca394842dc55e4734bf3bb9f685482fa0 # v6.3.3
-        env:
-          IGNORED_FILES: openapi.json, openapi-node.json
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const additions = context.payload.pull_request.additions || 0
-            const deletions = context.payload.pull_request.deletions || 0
-            var changes = additions + deletions
-            console.log('additions: '+additions+' + deletions: '+deletions+ ' = total changes: ' + changes);
-
-            const { IGNORED_FILES } = process.env
-            const ignored_files = IGNORED_FILES.trim().split(',').filter(word => word.length > 0);
-            if (ignored_files.length > 0){
-              var ignored = 0
-              const execSync = require('child_process').execSync;
-              for (const file of IGNORED_FILES.trim().split(',')) {
-            
-                const ignored_additions_str = execSync('git --no-pager  diff --numstat origin/main..origin/${{ github.head_ref}} | grep ' + file + ' | cut -f 1', { encoding: 'utf-8' })
-                const ignored_deletions_str = execSync('git --no-pager  diff --numstat origin/main..origin/${{ github.head_ref}} | grep ' + file + ' | cut -f 2', { encoding: 'utf-8' })
-            
-                const ignored_additions = ignored_additions_str.split('\n').map(elem=> parseInt(elem || 0)).reduce(
-                (accumulator, currentValue) => accumulator + currentValue,
-                0);
-                const ignored_deletions = ignored_deletions_str.split('\n').map(elem=> parseInt(elem || 0)).reduce(
-                (accumulator, currentValue) => accumulator + currentValue,
-                0);
-            
-                ignored += ignored_additions + ignored_deletions;
-              }
-              changes -= ignored
-              console.log('ignored lines: ' + ignored + ' , consider changes: ' + changes);
-            }
-            
-            var labels = await github.rest.issues.listLabelsOnIssue({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo
-            });
-
-            if (labels.data.find(label => label.name == 'size/large')){
-              github.rest.issues.removeLabel({
-                  issue_number: context.issue.number,
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  name: 'size/large'
-              })
-            }
-            if (labels.data.find(label => label.name == 'size/small')){
-                github.rest.issues.removeLabel({
-                    issue_number: context.issue.number,
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    name: 'size/small'
-                })
-            }
-            
-            var comments = await github.rest.issues.listComments({
-                issue_number: context.issue.number,
-                owner: context.repo.owner,
-                repo: context.repo.repo
-            });
-            for (const comment of comments.data) {
-              if (comment.body.includes('This PR exceeds the recommended size')){
-                github.rest.issues.deleteComment({
-                  issue_number: context.issue.number,
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  comment_id: comment.id
-                })
-              }
-            }
-            
-            if (changes < 200){
-              github.rest.issues.addLabels({
-                issue_number: context.issue.number,
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                labels: ['size/small']
-              })
-            }
-
-            if (changes > 400){
-              github.rest.issues.addLabels({
-                issue_number: context.issue.number,
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                labels: ['size/large']
-              })
-            
-              github.rest.issues.createComment({
-                issue_number: context.issue.number,
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                body: 'This PR exceeds the recommended size of 400 lines. Please make sure you are NOT addressing multiple issues with one PR. _Note this PR might be rejected due to its size._'
-              })
-            
-            }
-
diff --git a/.github/workflows/code_review.yml b/.github/workflows/code_review.yml
deleted file mode 100644
index e27561bd..00000000
--- a/.github/workflows/code_review.yml
+++ /dev/null
@@ -1,118 +0,0 @@
-name: Code Review
-
-# Controls when the workflow will run
-on:
-  pull_request:
-    branches:
-      - main
-    types:
-      - opened
-      - synchronize
-      - reopened
-  push:
-    branches:
-      - main
-
-
-  # Allows you to run this workflow manually from the Actions tab
-  workflow_dispatch:
-
-env:
-  PROJECT_KEY: pagopa_pagopa-cruscotto-backend
-
-permissions:
-  id-token: write
-  contents: read
-  deployments: write
-
-# A workflow run is made up of one or more jobs that can run sequentially or in parallel
-jobs:
-  code-review:
-    name: Code Review
-    # The type of runner that the job will run on
-    runs-on: ubuntu-latest
-
-    # Steps represent a sequence of tasks that will be executed as part of the job
-    steps:
-      - name: Code Review
-        uses: pagopa/github-actions-template/maven-code-review@50aaf5cffa09d76b953e64a630bc9e0528a6d73b
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          sonar_token: ${{ secrets.SONAR_TOKEN }}
-          project_key: ${{env.PROJECT_KEY}}
-          coverage_exclusions: "**/config/*,**/*Mock*,**/model/**,**/entity/*"
-          cpd_exclusions: "**/model/**,**/entity/*"
-          java_version: "17"
-  smoke-test:
-    name: Smoke Test
-    runs-on: ubuntu-latest
-    environment:
-      name: dev
-    steps:
-      - name: Checkout
-        id: checkout
-        uses: actions/checkout@1f9a0c22da41e6ebfa534300ef656657ea2c6707
-
-      - name: Login
-        id: login
-        # from https://github.com/Azure/login/commits/master
-        uses: azure/login@92a5484dfaf04ca78a94597f4f19fea633851fa2
-        with:
-          client-id: ${{ secrets.CLIENT_ID }}
-          tenant-id: ${{ secrets.TENANT_ID }}
-          subscription-id: ${{ secrets.SUBSCRIPTION_ID }}
-
-      - name: Run Service on Docker
-        shell: bash
-        id: run_service_docker
-        run: |
-          cd ./docker
-          chmod +x ./run_docker.sh
-          ./run_docker.sh local
-
-      - name: Run Integration Tests
-        shell: bash
-        id: run_integration_test
-        run: |
-          export SUBKEY=${{ secrets.SUBKEY }}      
-          export CANARY=${{ inputs.canary }}      
-          export CUCUMBER_PUBLISH_TOKEN=${{ secrets.CUCUMBER_PUBLISH_TOKEN }}
-          
-          cd ./integration-test
-          chmod +x ./run_integration_test.sh
-          ./run_integration_test.sh local
-
-
-  delete_github_deployments:
-    runs-on: ubuntu-latest
-    needs: smoke-test
-    if: ${{ always() }}
-    steps:
-      - name: Delete Previous deployments
-        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
-        env:
-          SHA_HEAD: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.sha) || github.sha}}
-        with:
-          script: |
-            const { SHA_HEAD } = process.env
-
-            const deployments = await github.rest.repos.listDeployments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              sha: SHA_HEAD
-            });
-            await Promise.all(
-              deployments.data.map(async (deployment) => {
-                await github.rest.repos.createDeploymentStatus({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  deployment_id: deployment.id,
-                  state: 'inactive'
-                });
-                return github.rest.repos.deleteDeployment({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  deployment_id: deployment.id
-                });
-              })
-            );
diff --git a/.github/workflows/create_dashboard.yaml b/.github/workflows/create_dashboard.yaml
deleted file mode 100644
index 9e9b4c2e..00000000
--- a/.github/workflows/create_dashboard.yaml
+++ /dev/null
@@ -1,84 +0,0 @@
-name: Create Dashboard
-
-# Controls when the workflow will run
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'openapi/**'
-      - '.github/workflows/create_dashboard.yaml'
-      - '.opex/**'
-
-  workflow_dispatch:
-
-permissions:
-  id-token: write
-  contents: read
-  deployments: write
-
-# A workflow run is made up of one or more jobs that can run sequentially or in parallel
-jobs:
-  dashboard:
-    # The type of runner that the job will run on
-    runs-on: ubuntu-22.04
-
-    strategy:
-      matrix:
-        environment: [prod]
-    environment:
-      name: ${{ matrix.environment }}
-    # Steps represent a sequence of tasks that will be executed as part of the job
-    steps:
-      - name: Checkout
-        id: checkout
-        # from https://github.com/actions/checkout/commits/main
-        uses: actions/checkout@1f9a0c22da41e6ebfa534300ef656657ea2c6707
-        with:
-          persist-credentials: false
-
-      # from https://github.com/pagopa/opex-dashboard-azure-action/
-      - uses: pagopa/opex-dashboard-azure-action@ece3bc2b133be74cabb50aec14cdb9b8051b886f # v1.1.2
-        with:
-          environment: ${{ matrix.environment }}
-          api-name:
-          config: .opex/env/${{ matrix.environment }}/config.yaml
-          client-id: ${{ secrets.CLIENT_ID }}
-          tenant-id: ${{ secrets.TENANT_ID }}
-          subscription-id: ${{ secrets.SUBSCRIPTION_ID }}
-          # from https://github.com/pagopa/opex-dashboard-azure-action/pkgs/container/opex-dashboard-azure-action
-          docker-version: sha256:e4245954566cd3470e1b5527d33bb58ca132ce7493eac01be9e808fd25a11c8d
-
-  delete_github_deployments:
-    runs-on: ubuntu-latest
-    needs: dashboard
-    if: ${{ always() }}
-    steps:
-      - name: Delete Previous deployments
-        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
-        env:
-          SHA_HEAD: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.sha) || github.sha}}
-        with:
-          script: |
-            const { SHA_HEAD } = process.env
-
-            const deployments = await github.rest.repos.listDeployments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              sha: SHA_HEAD
-            });
-            await Promise.all(
-              deployments.data.map(async (deployment) => {
-                await github.rest.repos.createDeploymentStatus({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  deployment_id: deployment.id,
-                  state: 'inactive'
-                });
-                return github.rest.repos.deleteDeployment({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  deployment_id: deployment.id
-                });
-              })
-            );
diff --git a/.github/workflows/deploy_with_github_runner.yml b/.github/workflows/deploy_with_github_runner.yml
deleted file mode 100644
index 0ca5f264..00000000
--- a/.github/workflows/deploy_with_github_runner.yml
+++ /dev/null
@@ -1,43 +0,0 @@
-name: Deploy on AKS
-
-on:
-  workflow_call:
-    inputs:
-      environment:
-        required: true
-        description: The name of the environment where to deploy
-        type: string
-      target:
-        required: true
-        description: The environment target of the job
-        type: string
-
-env:
-  APP_NAME: pagopacruscottobackend
-
-
-permissions:
-  id-token: write
-  contents: read
-
-jobs:
-  deploy:
-    runs-on: [self-hosted-job,"${{ inputs.environment }}"]
-    if: ${{ inputs.target == inputs.environment || inputs.target == 'all' }}
-    name: Deploy on AKS
-    environment: ${{ inputs.environment }}
-    steps:
-      - name: Deploy
-        uses: pagopa/github-actions-template/aks-deploy@main
-        with:
-          branch: ${{ github.ref_name }}
-          client_id: ${{ secrets.CLIENT_ID }}
-          subscription_id: ${{ secrets.SUBSCRIPTION_ID }}
-          tenant_id: ${{ secrets.TENANT_ID }}
-          env: ${{ inputs.environment }}
-          namespace: ${{ vars.NAMESPACE }}
-          cluster_name: ${{ vars.CLUSTER_NAME }}
-          resource_group: ${{ vars.CLUSTER_RESOURCE_GROUP }}
-          app_name: ${{ env.APP_NAME }}
-          helm_upgrade_options: "--debug --set microservice-chart.azure.workloadIdentityClientId=${{vars.WORKLOAD_IDENTITY_ID}}"
-
diff --git a/.github/workflows/github_scripts/check_required_labels.js b/.github/workflows/github_scripts/check_required_labels.js
new file mode 100644
index 00000000..a7393413
--- /dev/null
+++ b/.github/workflows/github_scripts/check_required_labels.js
@@ -0,0 +1,24 @@
+module.exports = async ({github, context, core}) => {
+    const comments = await github.rest.issues.listComments({
+        issue_number: context.issue.number,
+        owner: context.repo.owner,
+        repo: context.repo.repo
+    });
+    for (const comment of comments.data) {
+        if (comment.body.includes('This pull request does not contain a valid label')) {
+            github.rest.issues.deleteComment({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: comment.id
+            })
+        }
+    }
+    github.rest.issues.createComment({
+        issue_number: context.issue.number,
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        body: 'This pull request does not contain a valid label. Please add one of the following labels: `[major, minor, patch, patch, skip]`'
+    })
+    core.setFailed('Missing required labels')
+}
diff --git a/.github/workflows/github_scripts/check_size.js b/.github/workflows/github_scripts/check_size.js
new file mode 100644
index 00000000..e8132d0a
--- /dev/null
+++ b/.github/workflows/github_scripts/check_size.js
@@ -0,0 +1,99 @@
+module.exports = async ({github, context, core}) => {
+    const additions = context.payload.pull_request.additions || 0
+    const deletions = context.payload.pull_request.deletions || 0
+    let changes = additions + deletions;
+    console.log('additions: ' + additions + ' + deletions: ' + deletions + ' = total changes: ' + changes);
+
+    const {IGNORED_FILES, BRANCH_NAME} = process.env
+    const ignored_files = IGNORED_FILES.trim().split(',').filter(word => word.length > 0);
+    if (ignored_files.length > 0) {
+        var ignored = 0
+        const execSync = require('child_process').execSync;
+        for (const file of IGNORED_FILES.trim().split(',')) {
+
+            const ignored_additions_str = execSync('git --no-pager  diff --numstat origin/main..origin/' + BRANCH_NAME + ' | grep ' + file + ' | cut -f 1', {encoding: 'utf-8'})
+            const ignored_deletions_str = execSync('git --no-pager  diff --numstat origin/main..origin/' + BRANCH_NAME + ' | grep ' + file + ' | cut -f 2', {encoding: 'utf-8'})
+
+            const ignored_additions = ignored_additions_str.split('\n').map(elem => parseInt(elem || 0)).reduce(
+                (accumulator, currentValue) => accumulator + currentValue,
+                0);
+            const ignored_deletions = ignored_deletions_str.split('\n').map(elem => parseInt(elem || 0)).reduce(
+                (accumulator, currentValue) => accumulator + currentValue,
+                0);
+
+            ignored += ignored_additions + ignored_deletions;
+        }
+        changes -= ignored
+        console.log('ignored lines: ' + ignored + ' , consider changes: ' + changes);
+    }
+
+    var labels = await github.rest.issues.listLabelsOnIssue({
+        issue_number: context.issue.number,
+        owner: context.repo.owner,
+        repo: context.repo.repo
+    });
+
+    if (changes <= 400) {
+        if (labels.data.find(label => label.name === 'size/large')) {
+            github.rest.issues.removeLabel({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                name: 'size/large'
+            })
+        }
+    }
+
+    if (changes >= 200) {
+        if (labels.data.find(label => label.name === 'size/small')) {
+            github.rest.issues.removeLabel({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                name: 'size/small'
+            })
+        }
+    }
+
+    var comments = await github.rest.issues.listComments({
+        issue_number: context.issue.number,
+        owner: context.repo.owner,
+        repo: context.repo.repo
+    });
+    for (const comment of comments.data) {
+        if (comment.body.includes('This PR exceeds the recommended size')) {
+            github.rest.issues.deleteComment({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: comment.id
+            })
+        }
+    }
+
+    if (changes < 200) {
+        github.rest.issues.addLabels({
+            issue_number: context.issue.number,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            labels: ['size/small']
+        })
+    }
+
+    if (changes > 400) {
+        github.rest.issues.addLabels({
+            issue_number: context.issue.number,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            labels: ['size/large']
+        })
+
+        github.rest.issues.createComment({
+            issue_number: context.issue.number,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            body: 'This PR exceeds the recommended size of 400 lines. Please make sure you are NOT addressing multiple issues with one PR. _Note this PR might be rejected due to its size._'
+        })
+
+    }
+}
diff --git a/.github/workflows/integration_test.yml b/.github/workflows/integration_test.yml
deleted file mode 100644
index 002e641d..00000000
--- a/.github/workflows/integration_test.yml
+++ /dev/null
@@ -1,116 +0,0 @@
-name: Integration Tests
-
-on:
-  schedule:
-    - cron: '00 08 * * *'
-
-  workflow_dispatch:
-    inputs:
-      environment:
-        required: true
-        type: choice
-        description: Select the Environment
-        options:
-          - dev
-          - uat
-          - prod
-      canary:
-        description: 'run the tests on canary version'
-        required: false
-        type: boolean
-        default: false
-      notify:
-        required: false
-        type: boolean
-        description: 'send the slack notification'
-        default: true
-
-
-permissions:
-  id-token: write
-  contents: read
-  deployments: write
-
-
-jobs:
-  integration_test:
-    name: Test ${{(github.event.inputs == null && 'dev') || inputs.environment }}
-    runs-on: ubuntu-latest
-    environment: ${{(github.event.inputs == null && 'dev') || inputs.environment }}
-    steps:
-      - name: Checkout
-        id: checkout
-        uses: actions/checkout@1f9a0c22da41e6ebfa534300ef656657ea2c6707
-
-      - name: Login
-        id: login
-        # from https://github.com/Azure/login/commits/master
-        uses: azure/login@92a5484dfaf04ca78a94597f4f19fea633851fa2
-        with:
-          client-id: ${{ secrets.CLIENT_ID }}
-          tenant-id: ${{ secrets.TENANT_ID }}
-          subscription-id: ${{ secrets.SUBSCRIPTION_ID }}
-
-      - name: Run Integration Tests
-        shell: bash
-        run: |
-          export SUBKEY=${{ secrets.SUBKEY }}
-          export CANARY=${{ inputs.canary }}
-          export CUCUMBER_PUBLISH_TOKEN=${{ secrets.CUCUMBER_PUBLISH_TOKEN }}
-
-          cd ./integration-test
-          chmod +x ./run_integration_test.sh
-          ./run_integration_test.sh ${{( github.event.inputs == null && 'dev') || inputs.environment }}
-
-  notify:
-    needs: [ integration_test ]
-    runs-on: ubuntu-latest
-    name: Notify
-    if: ${{ always() && inputs.notify == 'true' }}
-    steps:
-      - name: Report Status
-        if: ${{ inputs.notify }}
-        uses: ravsamhq/notify-slack-action@be814b201e233b2dc673608aa46e5447c8ab13f2 # v2
-        with:
-          status: ${{ needs.integration_test.result }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          notify_when: 'failure,skipped'
-          notification_title: '<{run_url}|Scheduled Integration Test> has {status_message}'
-          message_format: '{emoji} <{run_url}|{workflow}> {status_message} in <{repo_url}|{repo}>'
-          footer: 'Linked to <{workflow_url}| workflow file>'
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-
-  delete_github_deployments:
-    runs-on: ubuntu-latest
-    needs: integration_test
-    if: ${{ always() }}
-    steps:
-      - name: Delete Previous deployments
-        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
-        env:
-          SHA_HEAD: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.sha) || github.sha}}
-        with:
-          script: |
-            const { SHA_HEAD } = process.env
-
-            const deployments = await github.rest.repos.listDeployments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              sha: SHA_HEAD
-            });
-            await Promise.all(
-              deployments.data.map(async (deployment) => {
-                await github.rest.repos.createDeploymentStatus({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  deployment_id: deployment.id,
-                  state: 'inactive'
-                });
-                return github.rest.repos.deleteDeployment({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  deployment_id: deployment.id
-                });
-              })
-            );
diff --git a/.gitignore b/.gitignore
index 9ac15e88..2fe03044 100644
--- a/.gitignore
+++ b/.gitignore
@@ -161,3 +161,4 @@ coverage/
 ######################
 hs_err_pid*
 replay_pid*
+__TEMP/*
\ No newline at end of file


Reviews:
user: login: github-advanced-security[bot]
state: COMMENTED
author_association: NONE
submitted_at: 2025-04-29T07:13:56Z

Review comments:
diff_hunk: @@ -0,0 +1,60 @@
+name: Add PATCH default label
+
+# Controls when the workflow will run
+on:
+  # Triggers the workflow on push or pull request events but only for the main branch
+  pull_request_target:
+    branches:
+      - main
+    types: [ opened, reopened ]
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  add_patch_label:
+    runs-on: ubuntu-latest
+    name: Add default label
+    steps:
+      - name: Check user labels
+        id: check_user_labels
+        uses: actions/github-script@d556feaca394842dc55e4734bf3bb9f685482fa0 # v6.3.3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            var addPatch = "true";
+            // retrieve label list
+            let labels = await github.rest.issues.listLabelsOnIssue({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo
+            });
+            
+            // verify if user have already added IGNORE-FOR-RELEASE, then skip add PATCH
+            // note: GitHub labels are added in .identity/03_github_environment.tf as github_issue_label resource
+            if (labels.data.find(label => label.name === 'ignore-for-release')){
+              addPatch = "false";
+            }
+            return addPatch;
+          result-encoding: string
+
+      - name: Add PATCH label
+        if: ${{ steps.check_user_labels.outputs.result == 'true' }}
+        uses: pagopa/github-actions-template/default-label@main
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          label: 'patch'
+
+      - name: Add comment
+        if: ${{ steps.check_user_labels.outputs.result == 'true' }}
+        uses: actions/github-script@d556feaca394842dc55e4734bf3bb9f685482fa0 # v6.3.3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            github.rest.issues.createComment({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                body: 'The default action is to increase the `PATCH` number of `SEMVER`. Set `IGNORE-FOR-RELEASE` if you want to skip `SEMVER` bump. `BREAKING-CHANGE` and `NEW-RELEASE` must be run from GH Actions section manually.'
+              });
path: .github/workflows/00_add_patch_label.yml
user: login: github-advanced-security[bot]
body: ## Workflow does not contain permissions

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{}}

[Show more details](https://github.com/pagopa/pagopa-cruscotto-backend/security/code-scanning/325)
created_at: 2025-04-29T07:13:56Z
author_association: NONE
diff_hunk: @@ -0,0 +1,60 @@
+name: Add PATCH default label
+
+# Controls when the workflow will run
+on:
+  # Triggers the workflow on push or pull request events but only for the main branch
+  pull_request_target:
+    branches:
+      - main
+    types: [ opened, reopened ]
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  add_patch_label:
+    runs-on: ubuntu-latest
+    name: Add default label
+    steps:
+      - name: Check user labels
+        id: check_user_labels
+        uses: actions/github-script@d556feaca394842dc55e4734bf3bb9f685482fa0 # v6.3.3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            var addPatch = "true";
+            // retrieve label list
+            let labels = await github.rest.issues.listLabelsOnIssue({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo
+            });
+            
+            // verify if user have already added IGNORE-FOR-RELEASE, then skip add PATCH
+            // note: GitHub labels are added in .identity/03_github_environment.tf as github_issue_label resource
+            if (labels.data.find(label => label.name === 'ignore-for-release')){
+              addPatch = "false";
+            }
+            return addPatch;
+          result-encoding: string
+
+      - name: Add PATCH label
+        if: ${{ steps.check_user_labels.outputs.result == 'true' }}
+        uses: pagopa/github-actions-template/default-label@main
path: .github/workflows/00_add_patch_label.yml
user: login: github-advanced-security[bot]
body: ## Unpinned tag for a non-immutable Action in workflow

Unpinned 3rd party Action 'Add PATCH default label' step [Uses Step](1) uses 'pagopa/github-actions-template/default-label' with ref 'main', not a pinned commit hash

[Show more details](https://github.com/pagopa/pagopa-cruscotto-backend/security/code-scanning/326)
created_at: 2025-04-29T07:13:56Z
author_association: NONE
diff_hunk: @@ -0,0 +1,26 @@
+name: Auto Assign
+
+# Controls when the workflow will run
+on:
+  # Triggers the workflow on push or pull request events but only for the main branch
+  pull_request_target:
+    branches:
+      - main
+    types: [ opened, reopened ]
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  build:
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      - name: Assign Me
+        # You may pin to the exact commit or the version.
+        uses: kentaro-m/auto-assign-action@746a3a558fdd0e061f612ec9f8ff1b8a19c1a115 # v1.2.1
+        with:
+          configuration-path: '.github/auto_assign.yml'
path: .github/workflows/01_assignee.yml
user: login: github-advanced-security[bot]
body: ## Workflow does not contain permissions

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{}}

[Show more details](https://github.com/pagopa/pagopa-cruscotto-backend/security/code-scanning/324)
created_at: 2025-04-29T07:13:56Z
author_association: NONE
diff_hunk: @@ -0,0 +1,91 @@
+name: Check PR
+
+# Controls when the workflow will run
+on:
+  merge_group:
+  pull_request:
+    branches:
+      - main
+      - next
+    types: [ opened, synchronize, labeled, unlabeled, reopened, edited ]
+
+
+permissions:
+  contents: read
+  checks: write
+  issues: write
+  pull-requests: write
+
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  auto_assign:
+    name: Auto Assign
+    runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' }}
+    steps:
+      - name: Assign Me
+        # You may pin to the exact commit or the version.
+        uses: kentaro-m/auto-assign-action@746a3a558fdd0e061f612ec9f8ff1b8a19c1a115 # v1.2.1
+        with:
+          configuration-path: '.github/auto_assign.yml'
+
+  check_labels:
+    name: Check Required Labels
+    runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'pull_request' }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4 # required to make the script available for next step
+      - name: Verify PR Labels
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'major') && !contains(github.event.pull_request.labels.*.name, 'minor') && !contains(github.event.pull_request.labels.*.name, 'patch') && !contains(github.event.pull_request.labels.*.name, 'patch') && !contains(github.event.pull_request.labels.*.name, 'skip') }}
+        uses: actions/github-script@d556feaca394842dc55e4734bf3bb9f685482fa0 # v6.3.3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const script = require('./.github/workflows/github_scripts/check_required_labels.js')
+            script({github, context, core})
+
+
+  formatter:
+    name: Formatter
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
+      - uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+      - name: Find incorrectly formatted file
+        uses: axel-op/googlejavaformat-action@v3
path: .github/workflows/02_check_pr.yml
user: login: github-advanced-security[bot]
body: ## Unpinned tag for a non-immutable Action in workflow

Unpinned 3rd party Action 'Check PR' step [Uses Step](1) uses 'axel-op/googlejavaformat-action' with ref 'v3', not a pinned commit hash

[Show more details](https://github.com/pagopa/pagopa-cruscotto-backend/security/code-scanning/327)
created_at: 2025-04-29T07:13:56Z
author_association: NONE
diff_hunk: @@ -0,0 +1,82 @@
+name: Deploy on AKS
+
+on:
+  workflow_call:
+    inputs:
+      environment:
+        required: true
+        description: The name of the environment where to deploy
+        type: string
+      branch:
+        required: false
+        default: ${{ github.ref_name }}
+        type: string
+
+env:
+  APP_NAME: pagopacruscottobackend
+
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  deploy:
+    runs-on: [ self-hosted-job, "${{ inputs.environment }}" ]
+    name: Deploy on AKS
+    environment: ${{ inputs.environment }}
+    steps:
+      - name: Deploy
+        uses: pagopa/github-actions-template/aks-deploy@main
path: .github/workflows/04h_deploy_with_github_runner.yml
user: login: github-advanced-security[bot]
body: ## Unpinned tag for a non-immutable Action in workflow

Unpinned 3rd party Action 'Deploy on AKS' step [Uses Step](1) uses 'pagopa/github-actions-template/aks-deploy' with ref 'main', not a pinned commit hash

[Show more details](https://github.com/pagopa/pagopa-cruscotto-backend/security/code-scanning/329)
created_at: 2025-04-29T07:13:56Z
author_association: NONE
diff_hunk: @@ -12,44 +12,29 @@
 
 jobs:
   update:
-    name: Update Openapi and Formatting
-    runs-on: ubuntu-latest
+    name: Formatting code
+    runs-on: ubuntu-18.04
     if: ${{ contains(github.event.comment.body, 'update_code') }}
     steps:
       - name: Checkout
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
-          token: ${{ secrets.BOT_TOKEN_GITHUB }}
+          token: ${{ secrets.API_TOKEN_GITHUB }}
 
       - name: Checkout Pull Request
         run: hub pr checkout ${{ github.event.issue.number }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Set up JDK 17
+      - name: Set up JDK 11
         uses: actions/setup-java@b6e674f4b717d7b0ae3baee0fbe79f498905dfde # v1
         with:
-          java-version: 17
-
-      - name: Update OpenApi/Swagger file
-        run: |
-          cd ./openapi
-          chmod +x ./generate_openapi.sh
-          ./generate_openapi.sh
+          java-version: 11
 
       - name: Formatting
-        id: format
-        uses: findologic/intellij-format-action@main
+        uses: axel-op/googlejavaformat-action@v3
path: .github/workflows/05_update_code.yml
user: login: github-advanced-security[bot]
body: ## Unpinned tag for a non-immutable Action in workflow

Unpinned 3rd party Action 'Update Code' step [Uses Step](1) uses 'axel-op/googlejavaformat-action' with ref 'v3', not a pinned commit hash

[Show more details](https://github.com/pagopa/pagopa-cruscotto-backend/security/code-scanning/328)
created_at: 2025-04-29T07:13:56Z
author_association: NONE
diff_hunk: @@ -0,0 +1,115 @@
+
+name: DB migration
+
+on:
+  workflow_call:
+    inputs:
+      environment:
+        required: true
+        description: The name of the environment target of the DB migration
+        type: string
+  workflow_dispatch:
+    inputs:
+      environment:
+        required: true
+        type: choice
+        description: Select the Environment
+        options:
+          - dev
+          - uat
+          - prod
+      db_version:
+        required: true
+        description: Db version (👀 src/main/resources/db/migration/liquibase )
+        type: string
+        default: "1.0.0"
+        
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  create_runner:
+    name: Create Runner
+    runs-on: ubuntu-22.04
+    environment:
+      name: ${{ inputs.environment }}
+    outputs:
+      runner_name: ${{ steps.create_github_runner.outputs.runner_name }}
+    steps:
+      - name: Create GitHub Runner
+        id: create_github_runner
+        # from https://github.com/pagopa/eng-github-actions-iac-template/tree/main/azure/github-self-hosted-runner-azure-create-action
+        uses: pagopa/eng-github-actions-iac-template/azure/github-self-hosted-runner-azure-create-action@main
path: .github/workflows/09_db_migration_with_github_runner.yml
user: login: github-advanced-security[bot]
body: ## Unpinned tag for a non-immutable Action in workflow

Unpinned 3rd party Action 'DB migration' step [Uses Step: create_github_runner](1) uses 'pagopa/eng-github-actions-iac-template/azure/github-self-hosted-runner-azure-create-action' with ref 'main', not a pinned commit hash

[Show more details](https://github.com/pagopa/pagopa-cruscotto-backend/security/code-scanning/330)
created_at: 2025-04-29T07:13:56Z
author_association: NONE

PR comments:
user: login: github-actions[bot]
created_at: 2025-04-29T07:13:23Z
body: This pull request does not contain a valid label. Please add one of the following labels: `[major, minor, patch, patch, skip]`
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-29T07:13:23Z
body: This pull request does not contain a valid label. Please add one of the following labels: `[major, minor, patch, patch, skip]`
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-04-29T07:13:25Z
body: This PR exceeds the recommended size of 400 lines. Please make sure you are NOT addressing multiple issues with one PR. _Note this PR might be rejected due to its size._
author_association: NONE