Phase 1 foundation: kherud fork + repo scaffolding #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Java CI — inference-sdk Phase 1 | |
| # | |
| # Target wall time: under 5 minutes for default tiny models (spec §12). | |
| # Triggers on java/, scripts/, and root POM changes. | |
| name: java-ci | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "java/**" | |
| - "scripts/**" | |
| - "pom.xml" | |
| - "**/*.xml" | |
| - ".github/workflows/java-ci.yml" | |
| pull_request: | |
| paths: | |
| - "java/**" | |
| - "scripts/**" | |
| - "pom.xml" | |
| - "**/*.xml" | |
| - ".github/workflows/java-ci.yml" | |
| concurrency: | |
| group: java-ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| packages: read | |
| jobs: | |
| verify: | |
| name: verify (${{ matrix.runner }}) | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - runner: ubuntu-latest | |
| arch: amd64 | |
| - runner: ubuntu-22.04-arm | |
| arch: arm64 | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| with: | |
| lfs: true | |
| - name: Set up JDK 25 (Temurin) | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: temurin | |
| java-version: "25" | |
| cache: maven | |
| - name: Set up Python 3.11 | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.11" | |
| - name: Install Python script deps | |
| run: pip install -r scripts/requirements.txt | |
| - name: Verify model checksums | |
| run: python3 scripts/verify_models.py | |
| - name: Maven verify | |
| run: ./mvnw -B -ntp -e verify | |
| - name: OWASP dependency-check | |
| run: ./mvnw -B -ntp dependency-check:check | |
| continue-on-error: false | |
| - name: JaCoCo threshold check | |
| run: ./mvnw -B -ntp jacoco:check | |
| - name: Spotless check | |
| run: ./mvnw -B -ntp spotless:check | |
| - name: SpotBugs check | |
| run: ./mvnw -B -ntp spotbugs:check | |
| - name: Upload test reports | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: test-reports-${{ matrix.arch }} | |
| path: | | |
| **/target/surefire-reports/** | |
| **/target/failsafe-reports/** | |
| retention-days: 7 | |
| network-isolation: | |
| name: network-isolation (linux/amd64) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| needs: verify | |
| steps: | |
| - uses: actions/checkout@v5 | |
| with: | |
| lfs: true | |
| - uses: actions/setup-java@v5 | |
| with: | |
| distribution: temurin | |
| java-version: "25" | |
| cache: maven | |
| # Resolve all deps + LFS files BEFORE we cut egress so the offline run | |
| # has everything it needs locally. | |
| - name: Resolve Maven dependencies (online) | |
| run: ./mvnw -B -ntp dependency:go-offline | |
| - name: Block egress and run verify offline | |
| # Drop OUTPUT egress except loopback. Any runtime network call from the | |
| # JVM under test will fail, exercising spec §11.2 case 47. | |
| run: | | |
| set -euo pipefail | |
| sudo iptables -I OUTPUT -o lo -j ACCEPT | |
| sudo iptables -A OUTPUT -m owner --uid-owner $(id -u) -j REJECT | |
| ./mvnw -B -ntp -o verify -Pnetwork-isolation | |
| sudo iptables -D OUTPUT -m owner --uid-owner $(id -u) -j REJECT || true | |
| javadoc: | |
| name: javadoc (linux/amd64) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| needs: verify | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: actions/setup-java@v5 | |
| with: | |
| distribution: temurin | |
| java-version: "25" | |
| cache: maven | |
| - name: Aggregate JavaDoc | |
| run: ./mvnw -B -ntp javadoc:aggregate | |
| - name: Upload JavaDoc artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: javadoc | |
| path: target/site/apidocs/ | |
| retention-days: 14 |