Phase 1 foundation: kherud fork + repo scaffolding #8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Java CI — inference-sdk Phase 1 | |
| # | |
| # Target wall time: under 5 minutes for default tiny models (spec §12). | |
| # Triggers on java/, scripts/, and root POM changes. | |
| name: java-ci | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "java/**" | |
| - "scripts/**" | |
| - "pom.xml" | |
| - "**/*.xml" | |
| - ".github/workflows/java-ci.yml" | |
| pull_request: | |
| paths: | |
| - "java/**" | |
| - "scripts/**" | |
| - "pom.xml" | |
| - "**/*.xml" | |
| - ".github/workflows/java-ci.yml" | |
| concurrency: | |
| group: java-ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| packages: read | |
| jobs: | |
| verify: | |
| name: verify (${{ matrix.runner }}) | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - runner: ubuntu-latest | |
| arch: amd64 | |
| - runner: ubuntu-22.04-arm | |
| arch: arm64 | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| with: | |
| lfs: true | |
| - name: Set up JDK 25 (Temurin) | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: temurin | |
| java-version: "25" | |
| cache: maven | |
| - name: Set up Python 3.11 | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.11" | |
| - name: Install Python script deps | |
| run: pip install -r scripts/requirements.txt | |
| - name: Verify model checksums | |
| run: python3 scripts/verify_models.py | |
| # `verify` runs the bound executions for surefire, jacoco-prepare-agent, | |
| # jacoco-report, and jacoco-check across every reactor module. Standalone | |
| # spotless/spotbugs invocations below run on parent-aware modules only — | |
| # the aggregator POM does not extend the parent so it lacks plugin config | |
| # and is excluded via `-pl !inference-sdk-aggregator` (Maven 4 syntax) / | |
| # by listing reactor modules explicitly. | |
| - name: Maven verify | |
| run: ./mvnw -f java/pom.xml -B -ntp -e verify | |
| - name: OWASP dependency-check | |
| run: >- | |
| ./mvnw -f java/pom.xml -B -ntp | |
| -pl inference-sdk-parent,inference-sdk-core,inference-sdk-embed | |
| org.owasp:dependency-check-maven:12.2.2:check | |
| continue-on-error: false | |
| - name: Spotless check | |
| run: >- | |
| ./mvnw -f java/pom.xml -B -ntp | |
| -pl inference-sdk-parent,inference-sdk-core,inference-sdk-embed | |
| com.diffplug.spotless:spotless-maven-plugin:3.4.0:check | |
| - name: SpotBugs check | |
| run: >- | |
| ./mvnw -f java/pom.xml -B -ntp | |
| -pl inference-sdk-parent,inference-sdk-core,inference-sdk-embed | |
| com.github.spotbugs:spotbugs-maven-plugin:4.9.8.3:check | |
| - name: Upload test reports | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: test-reports-${{ matrix.arch }} | |
| path: | | |
| **/target/surefire-reports/** | |
| **/target/failsafe-reports/** | |
| retention-days: 7 | |
| network-isolation: | |
| name: network-isolation (linux/amd64) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| needs: verify | |
| steps: | |
| - uses: actions/checkout@v5 | |
| with: | |
| lfs: true | |
| - uses: actions/setup-java@v5 | |
| with: | |
| distribution: temurin | |
| java-version: "25" | |
| cache: maven | |
| # Resolve all deps + LFS files BEFORE we cut egress so the offline run | |
| # has everything it needs locally. | |
| - name: Resolve Maven dependencies (online) | |
| run: ./mvnw -f java/pom.xml -B -ntp dependency:go-offline | |
| - name: Block egress and run verify offline | |
| # Drop OUTPUT egress except loopback. Any runtime network call from the | |
| # JVM under test will fail, exercising spec §11.2 case 47. | |
| run: | | |
| set -euo pipefail | |
| sudo iptables -I OUTPUT -o lo -j ACCEPT | |
| sudo iptables -A OUTPUT -m owner --uid-owner $(id -u) -j REJECT | |
| ./mvnw -f java/pom.xml -B -ntp -o verify -Pnetwork-isolation | |
| sudo iptables -D OUTPUT -m owner --uid-owner $(id -u) -j REJECT || true | |
| javadoc: | |
| name: javadoc (linux/amd64) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| needs: verify | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: actions/setup-java@v5 | |
| with: | |
| distribution: temurin | |
| java-version: "25" | |
| cache: maven | |
| - name: Aggregate JavaDoc | |
| run: ./mvnw -f java/pom.xml -B -ntp javadoc:aggregate | |
| - name: Upload JavaDoc artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: javadoc | |
| path: java/target/site/apidocs/ | |
| retention-days: 14 |