Bilko CI — integration-test job (Testcontainers) MC #102843 — 2026-06-03

Summary 
 MC #102843 adds an integration-test job to Bilko's .github/workflows/ci.yml . Previously the backend-test job ran only ./gradlew test , and tasks.test does excludeTags("integration") (apps/api/build.gradle.kts:159) — so the integrationTest task (Testcontainers/Postgres, includeTags("integration") ) never ran in CI . PRs that broke integration tests passed green (surfaced manually by Proveo during MC #102798). 
 Change (PR #245, base main, not merged) 
 
 New integration-test job: ubuntu-latest, Java 21, ./gradlew integrationTest --no-daemon in apps/api . Testcontainers spins its own Postgres (no services: block needed). 
 Non-blocking for now ( continue-on-error: true , NOT in build needs: ). 
 
 Why non-blocking (important) 
 Running the suite revealed it is currently broken on main: ~78/1147 integration tests fail (FlywayMigrateException in SettingsServiceRlsTest, ExposedSQLException in VatReportStatutoryGroupingTest, and others). These had never run in CI. Making the job a required gate immediately would red-lock every PR. So the job is visible on every PR (failures now surface) but does not block merges yet. 
 Path to required gate 
 Tracked in MC #102874 (H): fix the 78 failing integration suites. Once green, promotion is a one-line CI change — remove continue-on-error: true and add integration-test to build needs: [lint, unit, backend-test, integration-test] . 
 Verification 
 
 CI run 26900887524 : integration-test job executed; log shows Task :integrationTest , 1147 tests / 78 failed, Testcontainers Postgres started. 
 yaml-lint PASS, actionlint PASS, gitleaks 0, diff = ci.yml only. 
 Independent pre-verifier (Company Mesh / Proveo): PASS — mesh-thr-8f34975b-a1ef-4d99-8bd8-cd9f894a022a . 
 til-done: DONE — /tmp/til-done/102843-20260603T172857Z.json . 
 
 Incident (logged, low severity) 
 During implementation a build branch was accidentally pushed to origin/main (commit ecf5a97 ) and immediately reverted ( 036e2c6 ). It triggered bilko-stage-auto-deploy twice; both SUCCESS, change was ci.yml -only (no app artifact change), stage is non-customer-facing. origin/main verified clean afterwards. Lesson recorded: build agents must git push -u origin HEAD:<branch> and verify upstream ≠ origin/main (push to Bilko main auto-deploys stage).