SK-3002 Flowvault release/26.8.1

.cspell.json

@@ -6,6 +6,7 @@
     "**/*.{java,md,xml,yml,yaml,json,txt,properties}"
   ],
   "words": [
+    "japicmp",
     "Skyflow",
     "skyflow",
     "skyflowapi",
@@ -98,7 +99,9 @@
     "detok",
     "qhdmceurtnlz",
     "ngrok",
-    "obac"
+    "obac",
+    "siom",
+    "recordss"
   ],
   "languageSettings": [
     {
@@ -118,7 +121,7 @@
     "**/target/**",
     "*.lock",
     "Rule/**",
-    "src/main/java/com/skyflow/generated/**",
+    "**/generated/**",
     "**/*.ts",
     "**/processed-*",
     "samples/src/main/java/com/example/credentials.json",

.github/workflows/contract-tests.yml

@@ -0,0 +1,118 @@
+name: Contract Tests
+
+on:
+  pull_request:
+    branches:
+      - main
+      - release/*
+
+jobs:
+  contract-tests:
+    name: Contract Tests
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: 'maven'
+
+      - name: Verify API surface snapshot
+        run: mvn -B install -pl common,v2 -am -DskipTests -Dmaven.javadoc.skip=true -Dgpg.skip=true
+
+      - name: Show API surface diff
+        if: failure()
+        run: |
+          echo "### API surface changes detected ###"
+          echo "See v2/target/japicmp/default-cli.diff for the full comparison against v2/api-report/skyflow-java.baseline.jar."
+          echo "If this change is intentional, run scripts/contract-snapshot-update.sh and commit the updated baseline jar."
+          echo ""
+          cat v2/target/japicmp/default-cli.diff || true
+
+      - name: Upload API surface diff on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: api-surface-diff
+          path: v2/target/japicmp/**
+          retention-days: 7
+
+      # The step above only shows a diff when the CURRENT build differs from the
+      # committed baseline - once someone runs contract-snapshot-update.sh and
+      # commits the refreshed baseline jar, that check goes green and shows nothing.
+      # A reviewer looking at a green PR that touches api-report/skyflow-java.baseline.jar
+      # (a binary file) would otherwise have no way to see WHAT was just approved as
+      # the new contract. These steps explicitly diff the OLD committed baseline
+      # (from the PR's base branch) against the NEW committed baseline (from this PR)
+      # and post it as a PR comment, regardless of whether the check above passed.
+      - name: Check if contract baseline was updated in this PR
+        id: baseline-diff-check
+        if: always() && github.event.pull_request
+        run: |
+          git fetch origin "${{ github.event.pull_request.base.ref }}" --depth=1
+          if git diff --name-only "origin/${{ github.event.pull_request.base.ref }}" HEAD -- v2/api-report/skyflow-java.baseline.jar | grep -q .; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Diff old vs new contract baseline
+        if: always() && steps.baseline-diff-check.outputs.changed == 'true'
+        run: |
+          curl -sL -o /tmp/japicmp-cli.jar "https://repo.maven.apache.org/maven2/com/github/siom79/japicmp/japicmp/0.26.0/japicmp-0.26.0-jar-with-dependencies.jar"
+          mvn -q -B dependency:build-classpath -pl v2 -Dmdep.outputFile=/tmp/v2-classpath.txt -Dmaven.javadoc.skip=true -Dgpg.skip=true
+          git show "origin/${{ github.event.pull_request.base.ref }}:v2/api-report/skyflow-java.baseline.jar" > /tmp/old-baseline.jar
+
+          java -jar /tmp/japicmp-cli.jar \
+            -o /tmp/old-baseline.jar \
+            -n v2/api-report/skyflow-java.baseline.jar \
+            -a protected \
+            -e "com.skyflow.generated.*;com.skyflow.utils.*" \
+            --old-classpath "$(cat /tmp/v2-classpath.txt)" \
+            --new-classpath "$(cat /tmp/v2-classpath.txt)" \
+            -m \
+            --markdown > /tmp/contract-baseline-diff.md || true
+
+          cat /tmp/contract-baseline-diff.md
+
+      - name: Comment contract baseline change on PR
+        if: always() && steps.baseline-diff-check.outputs.changed == 'true'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const summary = fs.readFileSync('/tmp/contract-baseline-diff.md', 'utf8');
+            const marker = '<!-- contract-baseline-diff -->';
+            const body = `${marker}\n## Contract baseline change detected\n\nThis PR updates \`v2/api-report/skyflow-java.baseline.jar\` (the approved public API contract). Here is exactly what it changes, comparing the baseline on \`${{ github.event.pull_request.base.ref }}\` against the baseline committed in this PR:\n\n${summary}`;
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+            const existing = comments.find(c => c.body && c.body.includes(marker));
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body,
+              });
+            }

.github/workflows/endorlabsScan.yml

@@ -36,6 +36,15 @@ jobs:
           name: "credentials.json"
           json: ${{ secrets.TEST_CREDENTIALS_FILE_STRING }}
 
+      - name: Distribute test fixtures to modules
+        run: |
+          # Surefire runs each module's tests with the module directory as the working
+          # directory, so dotenv and ./credentials.json lookups miss the repo-root copies.
+          for module in common v2 flowvault; do
+            cp .env "$module/.env"
+            cp credentials.json "$module/credentials.json"
+          done
+
       - name: Compile Package
         run: mvn -B package -f pom.xml -Dmaven.javadoc.skip=true
 

.github/workflows/internal-release.yml

@@ -1,4 +1,4 @@
-name: Publish package to the JFROG Artifactory
+name: Publish module to the JFROG Artifactory
 on:
   push:
     tags-ignore:
@@ -7,20 +7,37 @@ on:
       - "*.md"
     branches:
       - release/*
+      - flowvault-release/*
 
 jobs:
+  resolve-module:
+    runs-on: ubuntu-latest
+    outputs:
+      module: ${{ steps.set-module.outputs.module }}
+    steps:
+      - name: Resolve module from branch name
+        id: set-module
+        run: |
+          if [[ "${{ github.ref_name }}" == flowvault-release/* ]]; then
+            echo "module=flowvault" >> "$GITHUB_OUTPUT"
+          else
+            echo "module=v2" >> "$GITHUB_OUTPUT"
+          fi
+
   build-and-deploy:
+    needs: resolve-module
     uses: ./.github/workflows/shared-build-and-deploy.yml
     with:
       ref: ${{ github.ref_name }}
       server-id: central
       profile: jfrog
       tag: 'internal'
+      module: ${{ needs.resolve-module.outputs.module }}
     secrets:
       server-username: ${{ secrets.ARTIFACTORY_USERNAME }}
       server-password: ${{ secrets.ARTIFACTORY_PASSWORD }}
       gpg-key: ${{ secrets.JFROG_GPG_KEY }}
       gpg-passphrase: ${{ secrets.JFROG_GPG_PASSPHRASE }}
-      skyflow-credentials: ${{ secrets.SKYFLOW_CREDENTIALS }} >> .env
-      test-expired-token: ${{ secrets.TEST_EXPIRED_TOKEN }} >> .env
-      test-reusable-token: ${{ secrets.TEST_REUSABLE_TOKEN }} >> .env
+      skyflow-credentials: ${{ secrets.SKYFLOW_CREDENTIALS }}
+      test-expired-token: ${{ secrets.TEST_EXPIRED_TOKEN }}
+      test-reusable-token: ${{ secrets.TEST_REUSABLE_TOKEN }}

.github/workflows/main.yml

@@ -30,6 +30,15 @@ jobs:
           echo TEST_EXPIRED_TOKEN=${{ secrets.TEST_EXPIRED_TOKEN }} >> .env
           echo TEST_REUSABLE_TOKEN=${{ secrets.TEST_REUSABLE_TOKEN }} >> .env
 
+      - name: Distribute test fixtures to modules
+        run: |
+          # Surefire runs each module's tests with the module directory as the working
+          # directory, so dotenv and ./credentials.json lookups miss the repo-root copies.
+          for module in common v2 flowvault; do
+            cp .env "$module/.env"
+            cp credentials.json "$module/credentials.json"
+          done
+
       - name: Build & Run tests with Maven
         run: mvn -B package -f pom.xml -Dmaven.javadoc.skip=true
 

.github/workflows/pr.yml

@@ -39,14 +39,27 @@ jobs:
           echo TEST_EXPIRED_TOKEN=${{ secrets.TEST_EXPIRED_TOKEN }} >> .env
           echo TEST_REUSABLE_TOKEN=${{ secrets.TEST_REUSABLE_TOKEN }} >> .env
 
+      - name: Distribute test fixtures to modules
+        run: |
+          # Surefire runs each module's tests with the module directory as the working
+          # directory, so dotenv and ./credentials.json lookups miss the repo-root copies.
+          for module in common v2 flowvault; do
+            cp .env "$module/.env"
+            cp credentials.json "$module/credentials.json"
+          done
+
       - name: Build & Run tests with Maven
         run: mvn -B package -f pom.xml -Dmaven.javadoc.skip=true
 
+      # JaCoCo writes one report per module. The root pom is <packaging>pom</packaging>
+      # with no sources, so target/site/jacoco/jacoco.xml - correct when this was a
+      # single-module build - is never generated post common/v2/flowvault split, and
+      # codecov was silently uploading nothing.
       - name: Codecov
         uses: codecov/codecov-action@v2.1.0
         with:
           token: ${{ secrets.CODECOV_REPO_UPLOAD_TOKEN }}
-          files: target/site/jacoco/jacoco.xml
+          files: common/target/site/jacoco/jacoco.xml,v2/target/site/jacoco/jacoco.xml,flowvault/target/site/jacoco/jacoco.xml
           name: codecov-skyflow-java
           verbose: true
 

.github/workflows/shared-build-and-deploy.yml

@@ -21,6 +21,13 @@ on:
         description: 'Release Tag'
         required: true
         type: string
+
+      module:
+        description: 'Module to build and publish'
+        required: false
+        type: string
+        default: ''
+
     secrets:
       server-username:
         required: true
@@ -61,10 +68,10 @@ jobs:
           server-password: SERVER_PASSWORD
           gpg-private-key: ${{ secrets.gpg-key }} # Value of the GPG private key to import
           gpg-passphrase: GPG_PASSPHRASE # env variable for GPG private key passphrase
-      
+
       - name: Resolve Branch for the Tagged Commit
         id: resolve-branch
-        if: ${{ inputs.tag == 'beta' || inputs.tag == 'public' }} 
+        if: ${{ inputs.tag == 'beta' || inputs.tag == 'public' }}
         run: |
           TAG_COMMIT=$(git rev-list -n 1 ${{ github.ref_name }})
           BRANCH_NAME=$(git for-each-ref --points-at="$TAG_COMMIT" --format='%(refname:short)' refs/remotes/origin | grep -v '/HEAD$' | sed 's#^origin/##' | head -n 1)
@@ -85,9 +92,9 @@ jobs:
         run: |
           chmod +x ./scripts/bump_version.sh
           if ${{ inputs.tag == 'internal' }}; then
-            ./scripts/bump_version.sh "${{ steps.previoustag.outputs.tag }}" "$(git rev-parse --short "$GITHUB_SHA")"
+            ./scripts/bump_version.sh "${{ steps.previoustag.outputs.tag }}" "$(git rev-parse --short "$GITHUB_SHA")" "${{ inputs.module }}"
           else
-            ./scripts/bump_version.sh "${{ steps.previoustag.outputs.tag }}"
+            ./scripts/bump_version.sh "${{ steps.previoustag.outputs.tag }}" "" "${{ inputs.module }}"
           fi
 
       - name: Commit changes
@@ -99,7 +106,7 @@ jobs:
             git checkout ${{ env.branch_name }}
           fi
 
-          git add pom.xml
+          git add ${{ inputs.module }}/pom.xml
           if [[ "${{ inputs.tag }}" == "internal" ]]; then
             git commit -m "[AUTOMATED] Private Release ${{ steps.previoustag.outputs.tag }}-dev-$(git rev-parse --short $GITHUB_SHA)"
             git push origin ${{ github.ref_name }} -f
@@ -124,10 +131,28 @@ jobs:
           name: "credentials.json"
           json: ${{ secrets.TEST_CREDENTIALS_FILE_STRING }}
 
+      - name: Distribute test fixtures to modules
+        run: |
+          # Surefire runs each module's tests with the module directory as the working
+          # directory, so dotenv and ./credentials.json lookups miss the repo-root copies.
+          for module in common v2 flowvault; do
+            cp .env "$module/.env"
+            cp credentials.json "$module/credentials.json"
+          done
+
       - name: Publish package
-        run: mvn --batch-mode deploy -P ${{ inputs.profile }}
+        run: |
+          if [[ "${{ inputs.tag }}" == "internal" ]]; then
+            # Javadoc is skipped for internal (JFrog) builds only: these are dev snapshots that
+            # nobody browses docs for, and strict doclint on the pinned JDK 11 fails the release
+            # on HTML nits in comments. Beta/public below must keep it — Sonatype requires the
+            # -javadoc.jar, so any doclint error there is a real break to fix at the source.
+            mvn --batch-mode -pl ${{ inputs.module }} -am deploy -P jfrog -DskipTests -Dmaven.javadoc.skip=true
+          elif [[ "${{ inputs.tag }}" == "beta" || "${{ inputs.tag }}" == "public" ]]; then
+            mvn --batch-mode -pl ${{ inputs.module }} -am deploy -P ${{ inputs.profile }} -Dmaven.javadoc.skip=true
+          fi
 
         env:
           SERVER_USERNAME: ${{ secrets.server-username }}
           SERVER_PASSWORD: ${{ secrets.server-password  }}
-          GPG_PASSPHRASE: ${{ secrets.gpg-passphrase }}
+          GPG_PASSPHRASE: ${{ secrets.gpg-passphrase }}