From 9130a72651a49a97f55cc87d607c158583c56601 Mon Sep 17 00:00:00 2001 From: saileshwar-skyflow Date: Mon, 3 Aug 2026 21:35:08 +0530 Subject: [PATCH] SK-3037 stop publishing the contract-testing comparison jar The comparison jar the contract gate builds was being published. shadedArtifactAttached makes it a real project artifact, and Maven installs and deploys attached artifacts, so a deploy to a throwaway repo showed exactly what would reach jfrog and Maven Central: skyflow-flowvault-java-.jar skyflow-flowvault-java-.pom skyflow-flowvault-java--sources.jar skyflow-flowvault-java--tests.jar skyflow-flowvault-java--with-common.jar <- should never have shipped Same for skyvault. It is a build input for japicmp, not something a consumer should be able to resolve - and it duplicates the whole SDK plus common under a classifier, so anyone who found it would get a second, silently divergent copy of the library. Switched to shade's outputFile, which writes the jar to disk and attaches nothing, and moved it out of the modules entirely: it now lands in the repo-root api-report/build/, gitignored. Nothing under a module directory can package or publish what it cannot see. The committed baselines move the same way, from /api-report/ to the repo-root api-report/. They were never packaged - api-report/ is not a resource directory, and they appear zero times inside every built jar - but keeping the contract fixtures out of the source trees makes that structural rather than something to re-verify each time. Also set createDependencyReducedPom=false on this execution: it is a second shade run whose only job is to produce a comparison file, and it has no business rewriting the pom the module publishes. Verified: a real deploy now publishes exactly the four expected artifacts per module and no with-common; both contract gates pass reading the new paths; the snapshot script regenerates from api-report/build/; common 158, flowvault 674 tests pass; YAML parses; cspell clean. skyvault's 3 ConnectionClientTests failures are pre-existing and need the real SKYFLOW_CREDENTIALS secret, which CI supplies. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/contract-tests.yml | 10 +++--- .gitignore | 3 ++ .../skyflow-flowvault-java.baseline.jar | Bin .../skyflow-java.baseline.jar | Bin flowvault/pom.xml | 24 +++++++------ scripts/contract-snapshot-update.sh | 15 ++++---- skyvault/pom.xml | 34 ++++++++++-------- 7 files changed, 49 insertions(+), 37 deletions(-) rename {flowvault/api-report => api-report}/skyflow-flowvault-java.baseline.jar (100%) rename {skyvault/api-report => api-report}/skyflow-java.baseline.jar (100%) diff --git a/.github/workflows/contract-tests.yml b/.github/workflows/contract-tests.yml index 9a3c26f7..ddabc6a7 100644 --- a/.github/workflows/contract-tests.yml +++ b/.github/workflows/contract-tests.yml @@ -47,7 +47,7 @@ jobs: if: failure() run: | echo "### API surface changes detected in ${{ matrix.module }} ###" - echo "Compared against ${{ matrix.module }}/api-report/${{ matrix.artifact }}.baseline.jar." + echo "Compared against api-report/${{ matrix.artifact }}.baseline.jar." echo "If this change is intentional, run:" echo " scripts/contract-snapshot-update.sh ${{ matrix.module }}" echo "and commit the updated baseline jar." @@ -75,7 +75,7 @@ jobs: if: always() && github.event.pull_request run: | git fetch origin "${{ github.event.pull_request.base.ref }}" --depth=1 - BASELINE="${{ matrix.module }}/api-report/${{ matrix.artifact }}.baseline.jar" + BASELINE="api-report/${{ matrix.artifact }}.baseline.jar" if ! git diff --name-only "origin/${{ github.event.pull_request.base.ref }}" HEAD -- "$BASELINE" | grep -q .; then echo "changed=false" >> "$GITHUB_OUTPUT" elif git cat-file -e "origin/${{ github.event.pull_request.base.ref }}:$BASELINE" 2>/dev/null; then @@ -91,7 +91,7 @@ jobs: - name: Diff old vs new contract baseline if: always() && (steps.baseline-diff-check.outputs.changed == 'true' || steps.baseline-diff-check.outputs.changed == 'new') run: | - BASELINE="${{ matrix.module }}/api-report/${{ matrix.artifact }}.baseline.jar" + BASELINE="api-report/${{ matrix.artifact }}.baseline.jar" if [ "${{ steps.baseline-diff-check.outputs.changed }}" = "new" ]; then { @@ -140,8 +140,8 @@ jobs: ? `## Contract baseline added (\`${module}\`)` : `## Contract baseline change detected (\`${module}\`)`; const preamble = isNew - ? `This PR adds \`${module}/api-report/${artifact}.baseline.jar\`, the approved public API contract for this module.` - : `This PR updates \`${module}/api-report/${artifact}.baseline.jar\` (the approved public API contract). Here is exactly what it changes, comparing the baseline on \`${{ github.event.pull_request.base.ref }}\` against the baseline committed in this PR:`; + ? `This PR adds \`api-report/${artifact}.baseline.jar\`, the approved public API contract for this module.` + : `This PR updates \`api-report/${artifact}.baseline.jar\` (the approved public API contract). Here is exactly what it changes, comparing the baseline on \`${{ github.event.pull_request.base.ref }}\` against the baseline committed in this PR:`; const body = `${marker}\n${heading}\n\n${preamble}\n\n${summary}`; const { data: comments } = await github.rest.issues.listComments({ owner: context.repo.owner, diff --git a/.gitignore b/.gitignore index 4f10424a..751e8d7c 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,6 @@ docs/superpowers/ # local sample configuration - may hold credentials .env + +# comparison jars built for the contract gate (japicmp reads them off disk; never artifacts) +api-report/build/ diff --git a/flowvault/api-report/skyflow-flowvault-java.baseline.jar b/api-report/skyflow-flowvault-java.baseline.jar similarity index 100% rename from flowvault/api-report/skyflow-flowvault-java.baseline.jar rename to api-report/skyflow-flowvault-java.baseline.jar diff --git a/skyvault/api-report/skyflow-java.baseline.jar b/api-report/skyflow-java.baseline.jar similarity index 100% rename from skyvault/api-report/skyflow-java.baseline.jar rename to api-report/skyflow-java.baseline.jar diff --git a/flowvault/pom.xml b/flowvault/pom.xml index 5a8f014f..8d6d63cc 100644 --- a/flowvault/pom.xml +++ b/flowvault/pom.xml @@ -78,12 +78,11 @@ - + org.apache.maven.plugins maven-shade-plugin 3.6.0 @@ -95,8 +94,13 @@ shade - true - with-common + + ${project.basedir}/../api-report/build/${project.build.finalName}-with-common.jar + false com.skyflow:common @@ -117,12 +121,12 @@ after an intentional public API change, then commit the updated jar. --> - ${project.basedir}/api-report/skyflow-flowvault-java.baseline.jar + ${project.basedir}/../api-report/skyflow-flowvault-java.baseline.jar - ${project.build.directory}/${project.build.finalName}-with-common.jar + ${project.basedir}/../api-report/build/${project.build.finalName}-with-common.jar diff --git a/scripts/contract-snapshot-update.sh b/scripts/contract-snapshot-update.sh index 9c4c5314..34948fb3 100755 --- a/scripts/contract-snapshot-update.sh +++ b/scripts/contract-snapshot-update.sh @@ -1,5 +1,5 @@ #!/usr/bin/env bash -# Regenerates a module's contract-testing baseline (/api-report/*.baseline.jar) +# Regenerates a module's contract-testing baseline (repo-root api-report/*.baseline.jar) # from the CURRENT working tree and overwrites the committed snapshot. # # Run this after an intentional public API change, review the resulting git diff on @@ -40,16 +40,17 @@ for MODULE in "${MODULES[@]}"; do echo "=== $MODULE ===" mvn -B package -pl "common,$MODULE" -am -DskipTests -Dmaven.javadoc.skip=true -Dgpg.skip=true - # the comparison-only jar, which merges com.skyflow:common into the module - SHADED_JAR=$(ls "$MODULE"/target/"$ARTIFACT"-*-with-common.jar 2>/dev/null | head -n1) + # The comparison-only jar merging com.skyflow:common. It is written to api-report/build/ + # rather than the module's target/ so that nothing inside a published module can pick it + # up; it is deliberately not a Maven artifact, so it is never installed or deployed. + SHADED_JAR=$(ls api-report/build/"$ARTIFACT"-*-with-common.jar 2>/dev/null | head -n1) if [ -z "$SHADED_JAR" ]; then - echo "Error: could not find $MODULE/target/$ARTIFACT-*-with-common.jar. Did the build succeed?" + echo "Error: could not find api-report/build/$ARTIFACT-*-with-common.jar. Did the build succeed?" exit 1 fi - mkdir -p "$MODULE/api-report" - cp "$SHADED_JAR" "$MODULE/api-report/$ARTIFACT.baseline.jar" - echo "Updated $MODULE/api-report/$ARTIFACT.baseline.jar from $SHADED_JAR" + cp "$SHADED_JAR" "api-report/$ARTIFACT.baseline.jar" + echo "Updated api-report/$ARTIFACT.baseline.jar from $SHADED_JAR" done echo "--------------------------" diff --git a/skyvault/pom.xml b/skyvault/pom.xml index 618c7e9d..6a8e8814 100644 --- a/skyvault/pom.xml +++ b/skyvault/pom.xml @@ -60,16 +60,14 @@ - + org.apache.maven.plugins maven-shade-plugin 3.6.0 @@ -81,8 +79,14 @@ shade - true - with-common + + ${project.basedir}/../api-report/build/${project.build.finalName}-with-common.jar + false com.skyflow:common @@ -98,19 +102,19 @@ 0.26.0 - ${project.basedir}/api-report/skyflow-java.baseline.jar + ${project.basedir}/../api-report/skyflow-java.baseline.jar - ${project.build.directory}/${project.build.finalName}-with-common.jar + ${project.basedir}/../api-report/build/${project.build.finalName}-with-common.jar