Phase 1 foundation: kherud fork + repo scaffolding #9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Java CI — inference-sdk Phase 1 | |
| # | |
| # Target wall time: under 5 minutes for default tiny models (spec §12). | |
| # Triggers on java/, scripts/, and root POM changes. | |
| name: java-ci | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "java/**" | |
| - "scripts/**" | |
| - "pom.xml" | |
| - "**/*.xml" | |
| - ".github/workflows/java-ci.yml" | |
| pull_request: | |
| paths: | |
| - "java/**" | |
| - "scripts/**" | |
| - "pom.xml" | |
| - "**/*.xml" | |
| - ".github/workflows/java-ci.yml" | |
| concurrency: | |
| group: java-ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| packages: read | |
| jobs: | |
| verify: | |
| name: verify (${{ matrix.runner }}) | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - runner: ubuntu-latest | |
| arch: amd64 | |
| - runner: ubuntu-22.04-arm | |
| arch: arm64 | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| - name: Set up JDK 25 (Temurin) | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: temurin | |
| java-version: "25" | |
| cache: maven | |
| - name: Set up Python 3.11 | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.11" | |
| - name: Install Python script deps | |
| run: pip install -r scripts/requirements.txt | |
| # Hybrid model-distribution: weights are fetched at build time by | |
| # scripts/fetch_models.py (bound to generate-resources in the | |
| # model JAR POMs) and embedded into the published Maven JAR. | |
| # Cache keyed on the pinned hashes + the fetch script itself so | |
| # the cache stays valid until we bump either. | |
| - name: Cache HF + staged model artifacts | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cache/huggingface | |
| java/inference-sdk-embed-bge-small/src/main/resources/models | |
| java/inference-sdk-generate-qwen-0_5b/src/main/resources/models | |
| build/llama.cpp | |
| key: hf-models-${{ runner.os }}-${{ matrix.arch }}-${{ hashFiles('scripts/checksums/models.sha256', 'scripts/fetch_models.py') }} | |
| restore-keys: | | |
| hf-models-${{ runner.os }}-${{ matrix.arch }}- | |
| hf-models-${{ runner.os }}- | |
| - name: Verify model checksums (pre-build, best-effort) | |
| # Non-fatal pre-check: if the cache hit produced staged files, | |
| # confirm they match the pin. The authoritative verification | |
| # runs inside `mvnw verify` via the model JAR POMs. | |
| run: python3 scripts/verify_models.py || true | |
| # `verify` runs the bound executions for surefire, jacoco-prepare-agent, | |
| # jacoco-report, and jacoco-check across every reactor module. Standalone | |
| # spotless/spotbugs invocations below run on parent-aware modules only — | |
| # the aggregator POM does not extend the parent so it lacks plugin config | |
| # and is excluded via `-pl !inference-sdk-aggregator` (Maven 4 syntax) / | |
| # by listing reactor modules explicitly. | |
| - name: Maven verify | |
| run: ./mvnw -f java/pom.xml -B -ntp -e verify | |
| - name: OWASP dependency-check | |
| run: >- | |
| ./mvnw -f java/pom.xml -B -ntp | |
| -pl inference-sdk-parent,inference-sdk-core,inference-sdk-embed | |
| org.owasp:dependency-check-maven:12.2.2:check | |
| continue-on-error: false | |
| - name: Spotless check | |
| run: >- | |
| ./mvnw -f java/pom.xml -B -ntp | |
| -pl inference-sdk-parent,inference-sdk-core,inference-sdk-embed | |
| com.diffplug.spotless:spotless-maven-plugin:3.4.0:check | |
| - name: SpotBugs check | |
| run: >- | |
| ./mvnw -f java/pom.xml -B -ntp | |
| -pl inference-sdk-parent,inference-sdk-core,inference-sdk-embed | |
| com.github.spotbugs:spotbugs-maven-plugin:4.9.8.3:check | |
| - name: Upload test reports | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: test-reports-${{ matrix.arch }} | |
| path: | | |
| **/target/surefire-reports/** | |
| **/target/failsafe-reports/** | |
| retention-days: 7 | |
| network-isolation: | |
| name: network-isolation (linux/amd64) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| needs: verify | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: actions/setup-java@v5 | |
| with: | |
| distribution: temurin | |
| java-version: "25" | |
| cache: maven | |
| # Resolve all deps BEFORE we cut egress so the offline run has | |
| # everything it needs locally. Models are fetched at build time | |
| # in the verify job and the staged files are restored from the | |
| # cache here via the model-jar POMs (or pre-fetched online if the | |
| # cache missed). | |
| - name: Resolve Maven dependencies (online) | |
| run: ./mvnw -f java/pom.xml -B -ntp dependency:go-offline | |
| - name: Block egress and run verify offline | |
| # Drop OUTPUT egress except loopback. Any runtime network call from the | |
| # JVM under test will fail, exercising spec §11.2 case 47. | |
| run: | | |
| set -euo pipefail | |
| sudo iptables -I OUTPUT -o lo -j ACCEPT | |
| sudo iptables -A OUTPUT -m owner --uid-owner $(id -u) -j REJECT | |
| ./mvnw -f java/pom.xml -B -ntp -o verify -Pnetwork-isolation | |
| sudo iptables -D OUTPUT -m owner --uid-owner $(id -u) -j REJECT || true | |
| javadoc: | |
| name: javadoc (linux/amd64) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| needs: verify | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: actions/setup-java@v5 | |
| with: | |
| distribution: temurin | |
| java-version: "25" | |
| cache: maven | |
| - name: Aggregate JavaDoc | |
| run: ./mvnw -f java/pom.xml -B -ntp javadoc:aggregate | |
| - name: Upload JavaDoc artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: javadoc | |
| path: java/target/site/apidocs/ | |
| retention-days: 14 |