[Alexanderamiri]

Why

Onboarding javaBin/moresleep (sleepingpill) without architectural changes hits two pipeline gaps:

1. Deploy jobs in javabin.yml were gated on github.ref == 'refs/heads/main'. moresleep's default branch is master, so it would build and plan but never apply or deploy.
2. build-jvm runs mvn verify with no database. moresleep's test suite needs a real PostgreSQL on localhost:5432, which is common for JVM apps.

What

• javabin.yml: the docker-build, tf-apply, ecs-deploy and eb-deploy gates are now github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch). The full ref is compared (review fix), so a tag named like the default branch (refs/tags/master) never deploys; the broker/apply-gate doesn't check the app ref, so this gate is the only branch control. Repos on main behave exactly as before.
• tf-plan.yml: the HIGH-risk Slack NOTIFY flag uses the same default-branch test.
• build-jvm.yml: an optional services.postgres container. Its image comes from the new test_postgres_image input; GitHub skips a service whose image is an empty string (actions/runner#822), so nothing changes for existing callers. Its health check is pg_isready -h 127.0.0.1, with no input interpolated into the docker options string (review fix; 127.0.0.1 also skips the socket-only server the image runs while initialising). The export step fails early unless test_postgres_db / test_postgres_user are plain identifiers and the password has no newline, because the values are written to $GITHUB_ENV. The build step gets PGHOST/PGPORT/PGDATABASE/PGUSER/PGPASSWORD.
• javabin.yml passes new inputs through: test_postgres_image, test_postgres_db, test_postgres_user, test_postgres_password (each defaults to test), and the existing maven_args / gradle_args that build-jvm already accepted but the orchestrator never passed on.
• Docs: docs/reusable-workflows.md (inputs, default-branch rule, a Postgres example) and one line in docs/app-yaml-reference.md.

Not changed: OIDC trust and the broker/apply-gate still pin the platform workflow refs to javaBin/platform@refs/heads/main. They already accept any app repo branch (sub = repo:javaBin/*:*), so nothing in IAM depends on the app's branch name.

How verified

• actionlint on javabin.yml, build-jvm.yml and tf-plan.yml: clean.
• github.event.repository.default_branch is in the payload for push and workflow_dispatch, which are the only events that can reach the deploy jobs (pull requests are excluded explicitly).
• End-to-end proof comes with the moresleep stack PR that calls javabin.yml@main with test_postgres_image: postgres:17.

Follow-ups

• Companion PR: feat(app-yaml): adopt an existing RDS instance and Route53 record (independent; no shared files).
• moresleep migration plan: inventory, cutover and rollback (kept outside the repo).

🤖 Generated with Claude Code

[github-actions]

Terraform Plan

✅ No changes — infrastructure is up to date.

Plan output

Acquiring state lock. This may take a few moments...
aws_ssm_parameter.atlassian_org_id: Refreshing state... [id=/javabin/platform/atlassian-org-id]
aws_ssm_parameter.atlassian_api_key: Refreshing state... [id=/javabin/platform/atlassian-api-key]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

[github-actions]

Terraform Plan

✅ No changes — infrastructure is up to date.

Plan output

Acquiring state lock. This may take a few moments...
aws_ssm_parameter.atlassian_org_id: Refreshing state... [id=/javabin/platform/atlassian-org-id]
aws_ssm_parameter.atlassian_api_key: Refreshing state... [id=/javabin/platform/atlassian-api-key]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.