chore: build java release CLIs against Maven Central by dmihalcik-virtru · Pull Request #652 · opentdf/tests

dmihalcik-virtru · 2026-10-15T17:18:01Z

Summary

java-sdk releases don't attach cmdline.jar to their GitHub Releases, and cmdline isn't published to Maven Central. So every Java release that xtest uses has been built from source with a full mvn clean install. That build's sdk module runs buf generate against buf.build. With a dozen xtest jobs doing this at the same moment, BSR returns resource_exhausted: too many requests and fails the run (e.g. 38632037584 on #571). This is DSPX-5177.

Everything cmdline depends on (sdk-pom, sdk, sdk-pqc-bc, sdk-fips-bc) is on Maven Central. This PR builds just the CLI against those published jars.

Changes (`otdf-sdk-mgr`)

install_java_release: when the GitHub Release has no cmdline.jar, the installer checks Maven Central for io.opentdf.platform:sdk:<version>. If it's there, it shallow-clones the tag into a temp dir and runs mvn -pl .,cmdline package, so sdk* resolves from Central and no codegen or BSR calls happen.
- The temp dir is outside src/ so the java Makefile doesn't rebuild it.
- The build uses its own local repo, ~/.m2/otdf-sdk-mgr-releases. java-sdk main carries the last release's version (currently 0.19.1), so an sdk that a head build mvn installed into ~/.m2/repository would otherwise shadow the release. I hit this locally: the v0.19.1 cmdline failed to compile against main's sdk.
- Any failure (not on Central, clone or build error) still raises InstallError, so setup-cli-tool falls back to today's full source build.
versions resolve java latest: no longer returns head: true when no release has a cmdline.jar asset. It's now an ordinary release row and takes the path above.
- Behaviour change: in platform-head cells, latest is no longer rebuilt against the platform under test via PLATFORM_BRANCH. It's tested as published.
install stable java: drops the has_cli filter, which had made it skip Java entirely.

No workflow changes: JDK and Maven are already set up before setup-cli-tool in every job that installs Java.

Expected effect

In a run like 38632037584, each job's v0.19.1 build no longer calls BSR. Combined with opentdf/java-sdk#419 (which stops attach-sources from running codegen a second time), BSR traffic per run drops from about 96 to about 24 buf generate passes. Only real heads still build from source. Building each head once per run is a separate follow-up.

Testing

Maven Central has sdk for every release since 0.7.2 except 0.8.0 and 0.17.0. Those fall back to a source build.
mvn -pl .,cmdline package checked against an empty local repo:
- v0.19.1 (latest): builds, zero buf calls.
- v0.9.0 (LTS): builds, zero buf calls, with Maven 3.9.11 as on the runners. Maven 3.10 rejects that tag's sdk/pom.xml for a duplicate plugin declaration in the fuzz profile.
End to end: otdf-sdk-mgr install artifact --sdk java --version v0.19.1 --dist-name v0.19.1 takes the new path, and cmdline.jar --version reports {"version":"0.19.1","tdfSpecVersion":"4.3.0"}, which cli.sh supports gates on.
Added tests/test_installers.py and updated test_resolve.py. ruff check, ruff format, pyright and pytest (144 passed) are all clean.

Summary by CodeRabbit

New Features
- Java installations now use the published command-line package when available. If it isn’t available, installation can build the CLI using the published SDK release.
- Selecting the latest Java version now resolves to the newest stable release, whether or not it includes a prebuilt CLI package.
Bug Fixes
- Installation reports an error when neither the published package nor the fallback build is available. CI can then fall back to a full source build.

coderabbitai · 2026-10-15T17:18:18Z

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 48 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 3e650f67-ae46-4be2-a615-85a616fed4e0

📥 Commits

Reviewing files that changed from the base of the PR and between 7639a94 and e7dcb36.

📒 Files selected for processing: 7

.github/workflows/xtest.yml
otdf-sdk-mgr/README.md
otdf-sdk-mgr/src/otdf_sdk_mgr/installers.py
otdf-sdk-mgr/src/otdf_sdk_mgr/resolve.py
otdf-sdk-mgr/tests/test_installers.py
otdf-sdk-mgr/tests/test_resolve.py
xtest/setup-cli-tool/action.yaml

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 73543a76-c01c-497b-850c-0234518c8e5d

📥 Commits

Reviewing files that changed from the base of the PR and between b9f9652 and 7639a94.

📒 Files selected for processing: 5

otdf-sdk-mgr/README.md
otdf-sdk-mgr/src/otdf_sdk_mgr/installers.py
otdf-sdk-mgr/src/otdf_sdk_mgr/resolve.py
otdf-sdk-mgr/tests/test_installers.py
otdf-sdk-mgr/tests/test_resolve.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Java release resolution now selects the newest stable tag. Installation tries the GitHub CLI asset first, then builds the CLI from the tagged source against the published SDK artifact if needed.

Changes: Java release installation

Layer / File(s)	Summary
Select the stable Java release `otdf-sdk-mgr/src/otdf_sdk_mgr/resolve.py`, `otdf-sdk-mgr/src/otdf_sdk_mgr/installers.py`, `otdf-sdk-mgr/tests/test_resolve.py`	Java `latest` resolution and stable-version selection use the newest stable tag without requiring a GitHub CLI asset. The test expects the newest stable tag as a release, without a `head` marker.
Install the CLI from a release or Maven Central `otdf-sdk-mgr/src/otdf_sdk_mgr/installers.py`, `otdf-sdk-mgr/tests/test_installers.py`, `otdf-sdk-mgr/README.md`	Installation tries the GitHub CLI asset first. If it is unavailable, the installer checks for the tagged SDK POM on Maven Central, clones the tag, and builds the CLI with a dedicated Maven repository. Tests cover asset download, Maven lookup, build failures, and cleanup. The README describes the fallback and the CI full-source-build fallback.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant Installer
  participant GitHub_Releases
  participant Maven_Central
  participant Git
  participant Maven
  Installer->>GitHub_Releases: Check and download CLI asset
  GitHub_Releases-->>Installer: Asset available or installation error
  Installer->>Maven_Central: Check for tagged SDK POM
  Maven_Central-->>Installer: POM availability
  Installer->>Git: Clone Java SDK tag
  Git-->>Installer: Tagged source
  Installer->>Maven: Build parent and cmdline projects
  Maven-->>Installer: CLI wrapper and JAR

Suggested reviewers: abarabash-virtru

Merge Risk: ⚪ Minimal · up to 7639a

No actionable merge-blocking issue remains; the documented source-build fallback remains available if release installation fails.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 38.89% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 18 functions across 4 files. (1 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: building Java release CLIs against Maven Central when needed.

Full details: Docstring Coverage

Explanation

Docstring coverage is 38.89% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 18 functions across 4 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches: 💡 2

📝 Generate docstrings: 💡

Commit to this branch
Create a new PR

🛠️ Fix failing CI checks: 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit checked the tag at dawn
Then fetched the CLI, neat and drawn
When GitHub’s jar was out of sight
Maven built the tool just right
The bunny hopped away with cheer}

_{Comment @coderabbitai help to get the list of available commands.}

java-sdk releases don't attach cmdline.jar to their GitHub Releases, so every java release xtest used fell back to a full source build, whose sdk module runs `buf generate` against buf.build. With a dozen xtest jobs doing that at once, BSR rate limits fail the run. When a release has no cmdline.jar asset, install_java_release now checks Maven Central for io.opentdf.platform:sdk at that version and, if present, builds only the parent pom and the cmdline module of the tag (mvn -pl .,cmdline), resolving sdk* from Central. No codegen, no BSR calls. It uses its own local Maven repo so a same-versioned head installed into ~/.m2 can't shadow the release. Any failure still raises InstallError, so setup-cli-tool falls back to the full source build. java `latest` no longer resolves to head:true when no release has a cmdline.jar asset; it is a normal release row, so it takes the path above and is tested as published rather than rebuilt against the platform under test. setup-cli-tool gains a needs-build output (any head, or any release whose artifact install failed), and the java make steps gate on it instead of on heads. Previously a run whose only java versions were releases checked out the fallback source but never built it. DSPX-5177 Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>

sonarqubecloud · 2026-10-15T17:29:57Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions · 2026-10-15T17:30:23Z

X-Test Failure Report

github-actions · 2026-10-15T17:52:41Z

X-Test Results

✅ java@v0.19.1-main
✅ java@main-v0.29.0
✅ java@v0.19.1-v0.29.0
✅ java@main-main
✅ go@main-v0.29.0
✅ js@v0.4.0-v0.29.0
✅ go@v0.38.1-v0.29.0
✅ js@v0.4.0-main
✅ go@v0.38.1-main
✅ js@main-v0.29.0
✅ js@main-main
✅ go@main-main

dmihalcik-virtru requested review from a team as code owners October 15, 2026 17:18

dmihalcik-virtru changed the title ~~fix(otdf-sdk-mgr): build java release CLIs against Maven Central~~ chore: build java release CLIs against Maven Central Oct 15, 2026

dmihalcik-virtru force-pushed the DSPX-5177-locobuf branch from 7639a94 to e7dcb36 Compare October 15, 2026 17:29

pflynn-virtru approved these changes Oct 15, 2026

View reviewed changes

dmihalcik-virtru merged commit e17816b into main Oct 15, 2026
31 checks passed

dmihalcik-virtru deleted the DSPX-5177-locobuf branch October 15, 2026 18:42

Navigation Menu

Repository navigation

chore: build java release CLIs against Maven Central - #652

chore: build java release CLIs against Maven Central#652
dmihalcik-virtru merged 1 commit into
mainfrom
DSPX-5177-locobuf

dmihalcik-virtru commented Oct 15, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 15, 2026 •

edited

Loading

Review limit reached

Sequence Diagram(s)

Uh oh!

sonarqubecloud Bot commented Oct 15, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026

Uh oh!

github-actions Bot commented Oct 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dmihalcik-virtru commented Oct 15, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes (otdf-sdk-mgr)

Expected effect

Testing

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Sequence Diagram(s)

Uh oh!

sonarqubecloud Bot commented Oct 15, 2026

Quality Gate passed

Uh oh!

github-actions Bot commented Oct 15, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Oct 15, 2026

X-Test Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dmihalcik-virtru commented Oct 15, 2026 •

edited by coderabbitai Bot

Loading

Changes (`otdf-sdk-mgr`)

coderabbitai Bot commented Oct 15, 2026 •

edited

Loading