test(eureka): bind bootstrap API and public documentation

[seonghobae]

Purpose

Close a path-disjoint quality/documentation gap on protected develop@622e5e6c3d534f230c390f10e3832efadfc01825: eureka-server historically had no tests in the hosted reactor and its public EurekaServerApplication bootstrap class/method had no beginner-readable Javadoc even though repository policy requires public production APIs to be documented.

This Draft is intentionally bounded to the Eureka bootstrap surface. It does not implement service-registry authentication (#185), change port/network exposure (#180/#195), alter Eureka client identity, change Maven dependencies, or claim repository-wide coverage (#205).

Exact current identity

• protected/live base: develop@622e5e6c3d534f230c390f10e3832efadfc01825;
• branch: quality/eureka-bootstrap-docs-tests-622e5e6;
• fail-first source head: b899c62712e6df9e81b4be80a2b1c619fba8c402;
• exact current GREEN candidate: f96369312ffcb6ec0581bdfe463e2a9fb43ab395;
• current synthetic merge preview: b70f6207b2921ae9f30f6ff504963ed32b17cfe5;
• Draft: true;
• GitHub mergeability: true;
• formal reviews: none at the latest refresh.

Every check/review from the RED head or another base is historical after the source movement.

RED — hosted production-boundary proof

Commit b899c62712e6df9e81b4be80a2b1c619fba8c402 added only EurekaServerApplicationContractTest. Two assertions preserve the real @SpringBootApplication / @EnableEurekaServer bootstrap and public-static main entry point; the third requires beginner-readable public Javadoc.

CI run 31351668125, macOS job 93343552628, checked out GitHub synthetic merge 3f416a15ba22915b40150abcdd0262373efdd500 (Merge b899c627... into 622e5e6...). The reactor compiled all preceding production/test modules successfully. eureka-server then compiled its new test and ran exactly 3 tests with exactly 1 failure and 0 errors/skips:

EurekaServerApplicationContractTest.publicBootstrapApiHasBeginnerReadableJavadoc — expected: <true> but was: <false>.

The annotation and entry-point assertions were green. This is valid RED at the intended Eureka public-documentation boundary rather than a setup/import/fixture/dependency failure. It is still synthetic-merge execution, not literal-source acceptance evidence.

GREEN candidate and hosted evidence

Exact current source head f96369312ffcb6ec0581bdfe463e2a9fb43ab395 applies the smallest correction proven by RED: it changes only EurekaServerApplication.java Javadoc while preserving annotations and SpringApplication.run(...) behavior.

The class now explains that it starts the standalone mightyETL Eureka service registry, distinguishes bootstrap ownership from the separate production authentication/service-identity decision in #185, and documents main(String[]) plus its Spring Boot argument contract. No security mechanism, credential, endpoint, dependency, port or lifecycle behavior is invented.

All exposed workflow aggregates for this exact source head are now terminal-success:

• CI 31351787414: success on macOS, Ubuntu and Windows;
• Dependency Review 31351787350: success;
• CycloneDX SBOM 31351787356: success;
• SAST Semgrep 31351787365: success;
• Security Scan 31351787334: success.

CI macOS job 93343884562 checked out synthetic merge b70f6207b2921ae9f30f6ff504963ed32b17cfe5, not literal source head. The full reactor completed BUILD SUCCESS; eureka-server ran the new 3 tests with 0 failures/errors/skips. This is strong merged-tree structural/documentation evidence, not literal-source proof.

Security Scan hard Trivy job 93343884375 likewise scanned synthetic merge b70f6207.... It printed Dependency version cannot be determined. Child dependencies will not be found. before reporting 0 CRITICAL/HIGH/MEDIUM findings. Therefore the aggregate green is not accepted as complete Maven dependency-vulnerability evidence; #196 owns that scanner-completeness root cause. The same scan also still sees the tracked 82 MB zipkin.jar, whose retirement is separately owned by #168/#169.

Current CI also reproduces the independent protected coverage defect: JaCoCo reports Analyzed bundle 'etl-service' with 0 classes before passing. #162/#164 owns non-vacuity for that selected ETL bundle, and #205 owns repository-wide coverage-scope completeness.

Shared acceptance boundaries

This branch fixes one concrete no-test/no-public-Javadoc gap but does not close:

• [Security/MSA] Define authenticated service-registry authority for Eureka #185 — authenticated service-registry authority;
• [Quality gate] Make JaCoCo fail closed when production class selection is empty #162/fix(coverage): make JaCoCo production gate non-vacuous #164 — selected ETL coverage non-vacuity;
• [Quality evidence] Extend non-vacuous 100% coverage to every owned production module #205 — repository-wide owned-production coverage scope;
• [Security evidence] Fail closed when Trivy cannot resolve Maven BOM-managed dependency versions #196 — Maven dependency-scanner completeness;
• ci: schedule NVIDIA OpenCode maintenance agent #121 — literal-source evidence controls;
• independent review / protected merge governance.

Keep Draft. A passing three-test Eureka bootstrap contract is structural/documentation evidence; it is not a claim that the Eureka module has complete behavioral/security coverage or that the registry is production-secure. Any head/base movement invalidates the current check/review facts.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 26e28fe5-ca2b-4345-b898-d81010fa1303

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}