Phase 1 foundation: kherud fork + repo scaffolding #12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Java CI — inference-sdk Phase 1 | |
| # | |
| # Target wall time: under 5 minutes for default tiny models (spec §12). | |
| # Triggers on java/, scripts/, and root POM changes. | |
| name: java-ci | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "java/**" | |
| - "scripts/**" | |
| - "pom.xml" | |
| - "**/*.xml" | |
| - ".github/workflows/java-ci.yml" | |
| pull_request: | |
| paths: | |
| - "java/**" | |
| - "scripts/**" | |
| - "pom.xml" | |
| - "**/*.xml" | |
| - ".github/workflows/java-ci.yml" | |
| concurrency: | |
| group: java-ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| packages: read | |
| jobs: | |
| verify: | |
| name: verify (${{ matrix.runner }}) | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - runner: ubuntu-latest | |
| arch: amd64 | |
| - runner: ubuntu-22.04-arm | |
| arch: arm64 | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| - name: Set up JDK 25 (Temurin) | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: temurin | |
| java-version: "25" | |
| cache: maven | |
| # PR verify is FAST: skip the heavy fetch+convert+quantize pipeline | |
| # (Qwen GGUF conversion needs torch + numpy + sentencepiece + transformers, | |
| # llama.cpp clone + cmake + gcc — minutes-to-hours of work that does NOT | |
| # validate SDK code). The full build, including model fetch and the | |
| # @Tag("model") integration tests, runs in `package-artifacts.yml` | |
| # (manual + scheduled). PR verify exercises: | |
| # - all 165 unit tests + 29 non-model IT tests across the reactor | |
| # - spotless / spotbugs / OWASP / javadoc / network-isolation gates | |
| # - module wiring for the model-bundle JARs (POM-only, no weights) | |
| - name: Maven verify (skip model fetch) | |
| run: ./mvnw -f java/pom.xml -B -ntp -e -Dfetch.models.skip=true verify | |
| - name: OWASP dependency-check | |
| run: >- | |
| ./mvnw -f java/pom.xml -B -ntp | |
| -pl inference-sdk-parent,inference-sdk-core,inference-sdk-embed | |
| org.owasp:dependency-check-maven:12.2.2:check | |
| continue-on-error: false | |
| - name: Spotless check | |
| run: >- | |
| ./mvnw -f java/pom.xml -B -ntp | |
| -pl inference-sdk-parent,inference-sdk-core,inference-sdk-embed | |
| com.diffplug.spotless:spotless-maven-plugin:3.4.0:check | |
| - name: SpotBugs check | |
| run: >- | |
| ./mvnw -f java/pom.xml -B -ntp | |
| -pl inference-sdk-parent,inference-sdk-core,inference-sdk-embed | |
| com.github.spotbugs:spotbugs-maven-plugin:4.9.8.3:check | |
| - name: Upload test reports | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: test-reports-${{ matrix.arch }} | |
| path: | | |
| **/target/surefire-reports/** | |
| **/target/failsafe-reports/** | |
| retention-days: 7 | |
| network-isolation: | |
| name: network-isolation (linux/amd64) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| needs: verify | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: actions/setup-java@v5 | |
| with: | |
| distribution: temurin | |
| java-version: "25" | |
| cache: maven | |
| # Resolve all deps BEFORE we cut egress so the offline run has | |
| # everything it needs locally. Model fetch is skipped here (same | |
| # rationale as the verify job — full fetch runs in package-artifacts.yml). | |
| - name: Resolve Maven dependencies (online) | |
| run: ./mvnw -f java/pom.xml -B -ntp dependency:go-offline | |
| - name: Block egress and run verify offline | |
| # Drop OUTPUT egress except loopback. Any runtime network call from the | |
| # JVM under test will fail, exercising spec §11.2 case 47. | |
| run: | | |
| set -euo pipefail | |
| sudo iptables -I OUTPUT -o lo -j ACCEPT | |
| sudo iptables -A OUTPUT -m owner --uid-owner $(id -u) -j REJECT | |
| ./mvnw -f java/pom.xml -B -ntp -o -Dfetch.models.skip=true verify -Pnetwork-isolation | |
| sudo iptables -D OUTPUT -m owner --uid-owner $(id -u) -j REJECT || true | |
| javadoc: | |
| name: javadoc (linux/amd64) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| needs: verify | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: actions/setup-java@v5 | |
| with: | |
| distribution: temurin | |
| java-version: "25" | |
| cache: maven | |
| - name: Aggregate JavaDoc | |
| run: ./mvnw -f java/pom.xml -B -ntp javadoc:aggregate | |
| - name: Upload JavaDoc artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: javadoc | |
| path: java/target/site/apidocs/ | |
| retention-days: 14 |