Verify v2 Release/26.8.1

.cspell.json

@@ -6,6 +6,7 @@
     "**/*.{java,md,xml,yml,yaml,json,txt,properties}"
   ],
   "words": [
+    "japicmp",
     "Skyflow",
     "skyflow",
     "skyflowapi",
@@ -96,9 +97,18 @@
     "nocreds",
     "nodir",
     "detok",
-    "qhdmceurtnlz",
     "ngrok",
-    "obac"
+    "obac",
+    "siom",
+    "vaultid",
+    "recordss",
+    "synthesise",
+    "synthesised",
+    "deserialise",
+    "deserialised",
+    "unmodelled",
+    "recordss",
+    "rarr"
   ],
   "languageSettings": [
     {
@@ -118,7 +128,8 @@
     "**/target/**",
     "*.lock",
     "Rule/**",
-    "src/main/java/com/skyflow/generated/**",
+    "**/src/main/java/com/skyflow/generated/**",
+    "**/generated/**",
     "**/*.ts",
     "**/processed-*",
     "samples/src/main/java/com/example/credentials.json",

.github/workflows/beta-release.yml

@@ -15,6 +15,8 @@ jobs:
       server-password: ${{ secrets.CENTRAL_PUBLISHER_PORTAL_PASSWORD }}
       gpg-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
       gpg-passphrase: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
-      skyflow-credentials: ${{ secrets.SKYFLOW_CREDENTIALS }} >> .env
-      test-expired-token: ${{ secrets.TEST_EXPIRED_TOKEN }} >> .env
-      test-reusable-token: ${{ secrets.TEST_REUSABLE_TOKEN }} >> .env
+      skyflow-credentials: ${{ secrets.SKYFLOW_CREDENTIALS }}
+      test-expired-token: ${{ secrets.TEST_EXPIRED_TOKEN }}
+      test-reusable-token: ${{ secrets.TEST_REUSABLE_TOKEN }}
+      PAT_ACTIONS: ${{ secrets.PAT_ACTIONS }}
+      test-credentials-file-string: ${{ secrets.TEST_CREDENTIALS_FILE_STRING }}

.github/workflows/contract-tests.yml

@@ -0,0 +1,118 @@
+name: Contract Tests
+
+on:
+  pull_request:
+    branches:
+      - main
+      - release/*
+
+jobs:
+  contract-tests:
+    name: Contract Tests
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: 'maven'
+
+      - name: Verify API surface snapshot
+        run: mvn -B install -pl common,skyvault -am -DskipTests -Dmaven.javadoc.skip=true -Dgpg.skip=true
+
+      - name: Show API surface diff
+        if: failure()
+        run: |
+          echo "### API surface changes detected ###"
+          echo "See skyvault/target/japicmp/default-cli.diff for the full comparison against skyvault/api-report/skyflow-java.baseline.jar."
+          echo "If this change is intentional, run scripts/contract-snapshot-update.sh and commit the updated baseline jar."
+          echo ""
+          cat skyvault/target/japicmp/default-cli.diff || true
+
+      - name: Upload API surface diff on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: api-surface-diff
+          path: skyvault/target/japicmp/**
+          retention-days: 7
+
+      # The step above only shows a diff when the CURRENT build differs from the
+      # committed baseline - once someone runs contract-snapshot-update.sh and
+      # commits the refreshed baseline jar, that check goes green and shows nothing.
+      # A reviewer looking at a green PR that touches api-report/skyflow-java.baseline.jar
+      # (a binary file) would otherwise have no way to see WHAT was just approved as
+      # the new contract. These steps explicitly diff the OLD committed baseline
+      # (from the PR's base branch) against the NEW committed baseline (from this PR)
+      # and post it as a PR comment, regardless of whether the check above passed.
+      - name: Check if contract baseline was updated in this PR
+        id: baseline-diff-check
+        if: always() && github.event.pull_request
+        run: |
+          git fetch origin "${{ github.event.pull_request.base.ref }}" --depth=1
+          if git diff --name-only "origin/${{ github.event.pull_request.base.ref }}" HEAD -- skyvault/api-report/skyflow-java.baseline.jar | grep -q .; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Diff old vs new contract baseline
+        if: always() && steps.baseline-diff-check.outputs.changed == 'true'
+        run: |
+          curl -sL -o /tmp/japicmp-cli.jar "https://repo.maven.apache.org/maven2/com/github/siom79/japicmp/japicmp/0.26.0/japicmp-0.26.0-jar-with-dependencies.jar"
+          mvn -q -B dependency:build-classpath -pl skyvault -Dmdep.outputFile=/tmp/skyvault-classpath.txt -Dmaven.javadoc.skip=true -Dgpg.skip=true
+          git show "origin/${{ github.event.pull_request.base.ref }}:skyvault/api-report/skyflow-java.baseline.jar" > /tmp/old-baseline.jar
+
+          java -jar /tmp/japicmp-cli.jar \
+            -o /tmp/old-baseline.jar \
+            -n skyvault/api-report/skyflow-java.baseline.jar \
+            -a protected \
+            -e "com.skyflow.generated.*;com.skyflow.utils.*" \
+            --old-classpath "$(cat /tmp/skyvault-classpath.txt)" \
+            --new-classpath "$(cat /tmp/skyvault-classpath.txt)" \
+            -m \
+            --markdown > /tmp/contract-baseline-diff.md || true
+
+          cat /tmp/contract-baseline-diff.md
+
+      - name: Comment contract baseline change on PR
+        if: always() && steps.baseline-diff-check.outputs.changed == 'true'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const summary = fs.readFileSync('/tmp/contract-baseline-diff.md', 'utf8');
+            const marker = '<!-- contract-baseline-diff -->';
+            const body = `${marker}\n## Contract baseline change detected\n\nThis PR updates \`skyvault/api-report/skyflow-java.baseline.jar\` (the approved public API contract). Here is exactly what it changes, comparing the baseline on \`${{ github.event.pull_request.base.ref }}\` against the baseline committed in this PR:\n\n${summary}`;
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+            const existing = comments.find(c => c.body && c.body.includes(marker));
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body,
+              });
+            }

.github/workflows/endorlabsScan.yml

@@ -36,6 +36,15 @@ jobs:
           name: "credentials.json"
           json: ${{ secrets.TEST_CREDENTIALS_FILE_STRING }}
 
+      - name: Distribute test fixtures to modules
+        run: |
+          # Surefire runs each module's tests with the module directory as the working
+          # directory, so dotenv and ./credentials.json lookups miss the repo-root copies.
+          for module in common skyvault flowvault; do
+            cp .env "$module/.env"
+            cp credentials.json "$module/credentials.json"
+          done
+
       - name: Compile Package
         run: mvn -B package -f pom.xml -Dmaven.javadoc.skip=true
 

.github/workflows/internal-release.yml

@@ -1,4 +1,4 @@
-name: Publish package to the JFROG Artifactory
+name: Publish module to the JFROG Artifactory
 on:
   push:
     tags-ignore:
@@ -7,20 +7,39 @@ on:
       - "*.md"
     branches:
       - release/*
+      - flowvault-release/*
 
 jobs:
+  resolve-module:
+    runs-on: ubuntu-latest
+    outputs:
+      module: ${{ steps.set-module.outputs.module }}
+    steps:
+      - name: Resolve module from branch name
+        id: set-module
+        run: |
+          if [[ "${{ github.ref_name }}" == flowvault-release/* ]]; then
+            echo "module=flowvault" >> "$GITHUB_OUTPUT"
+          else
+            echo "module=skyvault" >> "$GITHUB_OUTPUT"
+          fi
+
   build-and-deploy:
+    needs: resolve-module
     uses: ./.github/workflows/shared-build-and-deploy.yml
     with:
       ref: ${{ github.ref_name }}
       server-id: central
       profile: jfrog
       tag: 'internal'
+      module: ${{ needs.resolve-module.outputs.module }}
     secrets:
       server-username: ${{ secrets.ARTIFACTORY_USERNAME }}
       server-password: ${{ secrets.ARTIFACTORY_PASSWORD }}
       gpg-key: ${{ secrets.JFROG_GPG_KEY }}
       gpg-passphrase: ${{ secrets.JFROG_GPG_PASSPHRASE }}
-      skyflow-credentials: ${{ secrets.SKYFLOW_CREDENTIALS }} >> .env
-      test-expired-token: ${{ secrets.TEST_EXPIRED_TOKEN }} >> .env
-      test-reusable-token: ${{ secrets.TEST_REUSABLE_TOKEN }} >> .env
+      skyflow-credentials: ${{ secrets.SKYFLOW_CREDENTIALS }}
+      test-expired-token: ${{ secrets.TEST_EXPIRED_TOKEN }}
+      test-reusable-token: ${{ secrets.TEST_REUSABLE_TOKEN }}
+      PAT_ACTIONS: ${{ secrets.PAT_ACTIONS }}
+      test-credentials-file-string: ${{ secrets.TEST_CREDENTIALS_FILE_STRING }}

.github/workflows/main.yml

@@ -30,13 +30,65 @@ jobs:
           echo TEST_EXPIRED_TOKEN=${{ secrets.TEST_EXPIRED_TOKEN }} >> .env
           echo TEST_REUSABLE_TOKEN=${{ secrets.TEST_REUSABLE_TOKEN }} >> .env
 
+      - name: Distribute test fixtures to modules
+        run: |
+          # Surefire runs each module's tests with the module directory as the working
+          # directory, so dotenv and ./credentials.json lookups miss the repo-root copies.
+          for module in common skyvault flowvault; do
+            cp .env "$module/.env"
+            cp credentials.json "$module/credentials.json"
+          done
+
       - name: Build & Run tests with Maven
         run: mvn -B package -f pom.xml -Dmaven.javadoc.skip=true
 
-      - name: Codecov
-        uses: codecov/codecov-action@v2.1.0
+      # JaCoCo records packages as "com/skyflow/..." with no module prefix, and all three
+      # modules share the com.skyflow package (deliberate split-package convention). So
+      # "com/skyflow/config/VaultConfig.java" matches BOTH skyvault and flowvault, Codecov
+      # resolves it to one of them, and the other module's file silently reports no data.
+      # Prefixing each report with its own source root makes every path unique and match the
+      # repo exactly, so all three modules' files are attributed correctly.
+      - name: Qualify JaCoCo report paths with their module
+        run: |
+          for module in common skyvault flowvault; do
+            report="$module/target/site/jacoco/jacoco.xml"
+            if [ ! -f "$report" ]; then
+              echo "Error: expected $report to exist after the build."
+              exit 1
+            fi
+            tmp="$(mktemp)"
+            sed "s|<package name=\"|<package name=\"$module/src/main/java/|g" "$report" > "$tmp"
+            mv "$tmp" "$report"
+          done
+
+      # One upload per module, each with its own flag, so Codecov reports per-module
+      # coverage instead of merging three same-named package trees into one number.
+      - name: Codecov (common)
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_REPO_UPLOAD_TOKEN }}
+          files: common/target/site/jacoco/jacoco.xml
+          flags: common
+          name: codecov-common
+          verbose: true
+          fail_ci_if_error: true
+
+      - name: Codecov (skyvault)
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_REPO_UPLOAD_TOKEN }}
+          files: skyvault/target/site/jacoco/jacoco.xml
+          flags: skyvault
+          name: codecov-skyvault
+          verbose: true
+          fail_ci_if_error: true
+
+      - name: Codecov (flowvault)
+        uses: codecov/codecov-action@v5
         with:
           token: ${{ secrets.CODECOV_REPO_UPLOAD_TOKEN }}
-          files: target/site/jacoco/jacoco.xml
-          name: codecov-skyflow-java
+          files: flowvault/target/site/jacoco/jacoco.xml
+          flags: flowvault
+          name: codecov-flowvault
           verbose: true
+          fail_ci_if_error: true

.github/workflows/pr.yml

@@ -39,16 +39,68 @@ jobs:
           echo TEST_EXPIRED_TOKEN=${{ secrets.TEST_EXPIRED_TOKEN }} >> .env
           echo TEST_REUSABLE_TOKEN=${{ secrets.TEST_REUSABLE_TOKEN }} >> .env
 
+      - name: Distribute test fixtures to modules
+        run: |
+          # Surefire runs each module's tests with the module directory as the working
+          # directory, so dotenv and ./credentials.json lookups miss the repo-root copies.
+          for module in common skyvault flowvault; do
+            cp .env "$module/.env"
+            cp credentials.json "$module/credentials.json"
+          done
+
       - name: Build & Run tests with Maven
         run: mvn -B package -f pom.xml -Dmaven.javadoc.skip=true
 
-      - name: Codecov
-        uses: codecov/codecov-action@v2.1.0
+      # JaCoCo records packages as "com/skyflow/..." with no module prefix, and all three
+      # modules share the com.skyflow package (deliberate split-package convention). So
+      # "com/skyflow/config/VaultConfig.java" matches BOTH skyvault and flowvault, Codecov
+      # resolves it to one of them, and the other module's file silently reports no data.
+      # Prefixing each report with its own source root makes every path unique and match the
+      # repo exactly, so all three modules' files are attributed correctly.
+      - name: Qualify JaCoCo report paths with their module
+        run: |
+          for module in common skyvault flowvault; do
+            report="$module/target/site/jacoco/jacoco.xml"
+            if [ ! -f "$report" ]; then
+              echo "Error: expected $report to exist after the build."
+              exit 1
+            fi
+            tmp="$(mktemp)"
+            sed "s|<package name=\"|<package name=\"$module/src/main/java/|g" "$report" > "$tmp"
+            mv "$tmp" "$report"
+          done
+
+      # One upload per module, each with its own flag, so Codecov reports per-module
+      # coverage instead of merging three same-named package trees into one number.
+      - name: Codecov (common)
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_REPO_UPLOAD_TOKEN }}
+          files: common/target/site/jacoco/jacoco.xml
+          flags: common
+          name: codecov-common
+          verbose: true
+          fail_ci_if_error: true
+
+      - name: Codecov (skyvault)
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_REPO_UPLOAD_TOKEN }}
+          files: skyvault/target/site/jacoco/jacoco.xml
+          flags: skyvault
+          name: codecov-skyvault
+          verbose: true
+          fail_ci_if_error: true
+
+      - name: Codecov (flowvault)
+        uses: codecov/codecov-action@v5
         with:
           token: ${{ secrets.CODECOV_REPO_UPLOAD_TOKEN }}
-          files: target/site/jacoco/jacoco.xml
-          name: codecov-skyflow-java
+          files: flowvault/target/site/jacoco/jacoco.xml
+          flags: flowvault
+          name: codecov-flowvault
           verbose: true
+          fail_ci_if_error: true
 
   spellcheck:
     name: Run spellcheck

.github/workflows/release.yml

@@ -15,6 +15,8 @@ jobs:
       server-password: ${{ secrets.CENTRAL_PUBLISHER_PORTAL_PASSWORD }}
       gpg-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
       gpg-passphrase: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
-      skyflow-credentials: ${{ secrets.SKYFLOW_CREDENTIALS }} >> .env
-      test-expired-token: ${{ secrets.TEST_EXPIRED_TOKEN }} >> .env
-      test-reusable-token: ${{ secrets.TEST_REUSABLE_TOKEN }} >> .env
+      skyflow-credentials: ${{ secrets.SKYFLOW_CREDENTIALS }}
+      test-expired-token: ${{ secrets.TEST_EXPIRED_TOKEN }}
+      test-reusable-token: ${{ secrets.TEST_REUSABLE_TOKEN }}
+      PAT_ACTIONS: ${{ secrets.PAT_ACTIONS }}
+      test-credentials-file-string: ${{ secrets.TEST_CREDENTIALS_FILE_STRING }}