chore: Align project structure and update dependencies - #12
Merged
Conversation
- Add npm caching to maven.yml workflow (all jobs) - Add npm caching to maven-release.yml workflow - Add npm caching to integration-tests.yml workflow - Add npm caching to benchmark.yml workflow This prevents "429 Too Many Requests" errors when downloading npm packages from registry.npmjs.org during builds. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
Structural refactoring to adopt OAuthSheriff's evolved build infrastructure, benchmarking architecture, and CI/CD patterns. P1 - Foundation upgrades: - Parent POM: cui-java-parent 1.1.4 -> 1.4.4 - Quarkus: 3.23.3 -> 3.32.1, Node v20 -> v22, npm 10.5 -> 10.9.2 - BOM renamed: bom -> api-sheriff-bom, jjwt 0.12.6 -> 0.13.0 - DevUI SPI: quarkus-vertx-http-dev-ui-spi -> quarkus-devui-deployment-spi - Added .mvn/jvm.config for JDK 22+ compatibility P2 - Benchmarking architecture: - Renamed benchmark-library -> benchmark-core - Renamed benchmark-integration-quarkus -> benchmark-integration-wrk - Added benchmarking-common dependency (0.4.1) for shared infrastructure - Replaced old JMH integration code with WRK-based WrkResultPostProcessor - Replaced 15 bash scripts with single Python benchmark-pages.py - Removed all HTML/JSON template files (now generated by benchmarking-common) - Upgraded: gson 2.13.2, hdrhistogram 2.2.2, commons-io 2.21.0 P3 - CI/CD workflow modernization: - Expanded .github/project.yml with full build configuration - Replaced inline workflows with reusable ones from cuioss-organization v0.6.2 - Modernized benchmark.yml: GitHub App tokens, Python script, direct git push - Added dependabot-auto-merge, dependency-review, scorecards, claude workflows P5 - Documentation: - Restructured CLAUDE.md to stub referencing agents.md - Created agents.md with full development guidance - Removed obsolete doc/ai-rules.md Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Address Gemini review comment: the verifyCuiLoggingGuidelines command referenced /Users/oliver/git/cui-llm-rules/standards/logging which is not portable. Changed to a repository-relative reference. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Consolidate all AI guidance back into CLAUDE.md instead of splitting across two files. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace the stub+agents.md split with a single comprehensive CLAUDE.md covering build commands, code standards, pre-1.0 rules, logging, testing, OpenRewrite markers, security, and git workflow. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The module contained only a trivial stub benchmark (single getStatus() call) with no meaningful JMH tests. Remove it entirely along with all references in CI workflows, Python script, CLAUDE.md, and JMH dependency management. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
API Sheriff is a standalone Quarkus app, not a reusable extension. The extension pattern (runtime/deployment split, BOM, separate library) was unnecessary overhead inherited from the OAuthSheriff template. Changes: - Merge api-sheriff-library + api-sheriff-quarkus into unified api-sheriff/ - Replace @buildstep processor with @RegisterForReflection annotations - Delete bom/, deployment module, ApiSheriffRecorder, ApiSheriffProcessor - Promote integration-tests from nested to root-level module - Absorb dependency/plugin management from BOM + quarkus-parent into root POM - Update Docker, CI/CD, scripts, and docs for new structure Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove unnecessary parent POM nesting (benchmarking/benchmark-integration-wrk) and promote to a single top-level benchmark-integration module. Replace performance-scoring.adoc with a link to the OAuthSheriff original. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Move application code (QuarkusMain, REST resource) from api-sheriff-integration-tests into api-sheriff module, making it the standalone deployable application that produces the native executable. - Move TestApplication → ApiSheriffApplication in api-sheriff - Move TestResource → GatewayResource (@path("/api")) in gateway package - Add application.properties with production defaults to api-sheriff - Add native profile, Jandex plugin, resteasy-jackson and prometheus deps - Simplify integration-tests to pure test coordinator (no compile Quarkus deps) - Update Dockerfiles to COPY runner from api-sheriff/target - Switch distroless Dockerfile to ubi9-quarkus-micro-image - Move all test-specific config to docker-compose environment variables - Update build/start scripts to target api-sheriff module - Fix OpenRewrite markers in GatewayResource and BaseIntegrationTest Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…k tests - Add api-sheriff/src/main/docker/Dockerfile.native for production deployments without baked-in certificates - Fix ApiSheriffIntegrationIT paths from /test/ to /api/ and update response assertion to match GatewayResource output - Add GatewayEndpointBenchmarkTest for /api/health and /api/info WRK output parsing validation - Fix ../mvnw path bug in benchmark-integration pom.xml - Add deployment section to README.adoc and docker build commands to CLAUDE.md Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove quarkus.virtual-threads.shutdown-timeout (non-existent property, caused duration parse error) - Remove api.sheriff.health.enabled (not wired to any @ConfigProperty) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Test what we deliver: production Dockerfiles now live in api-sheriff/src/main/docker/ and integration tests use them directly. Test-specific configuration (TLS truststore, certificates) is injected at docker-compose level instead of being baked into separate Dockerfiles. - Dockerfile.native: distroless production image (digest-pinned, nonroot, no shell, no baked-in certs) - Dockerfile.native.jfr: UBI micro with JFR profiling support - Delete redundant test Dockerfiles from integration-tests module - docker-compose: use production images with command: for truststore flags and volume mounts for certificates - Fix Dockerfile reference in pom.xml and start script Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Align with OAuthSheriff pattern: Quarkus app logs via file logging to mounted volume, Keycloak logs via docker logs dump before container shutdown. Both log files land in target/ for CI artifact collection. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove jjwt (3), easymock, weld-junit5, quarkus-config-yaml, quarkus-hibernate-validator, quarkus-security, quarkus-scheduler, quarkus-vertx-http, jakarta.servlet-api, jakarta.json-api, junit-jupiter-params, parsson, rest-assured, slf4j bridges, awaitility, jboss-logmanager from api-sheriff. Remove dev-ui-tests from integration-tests. Remove version properties and BOM entries from parent. None were imported in any Java source file. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Move benchmarking-common version to root-level version.oauth-sheriff property. Remove gson, HdrHistogram, and commons-io — all transitive from benchmarking-common. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Wire complete WRK benchmark pipeline following OAuthSheriff's proven pattern: Dockerfile.wrk, Lua scripts, shell runners, Prometheus monitoring, and Maven exec-plugin integration to invoke WrkResultPostProcessor. New files: - Dockerfile.wrk (Alpine + wrk + Lua scripts) - Lua scripts for /q/health/live and /api/health - Shell scripts: pre-flight health check + 2 benchmark runners - prometheus.yml for metrics scraping Modified: - docker-compose.yml: add Prometheus and WRK services - pom.xml: add 4 exec-maven-plugin executions in benchmark profile Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…cessor Remove 8 unused constants referencing JWT validation endpoints that don't exist in API Sheriff. Replace test resource files with actual API Sheriff benchmark data (healthLiveCheck, gatewayHealth) and update all tests to match the real benchmark names and URLs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…d dns:api-sheriff to SAN Remove dead JVM flags (no effect in native image), redundant QUARKUS_LOG_LEVEL, verbose network driver_opts (all defaults). Rename network jwt-integration to api-sheriff. Add dns:api-sheriff to certificate SAN for WRK container connectivity. Regenerate certificates with updated DNAME and SAN. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
All issuer, health, metrics, and cache properties were copied from OAuthSheriff but have no @ConfigProperty or @ConfigMapping backing in the codebase. Quarkus silently ignores them at runtime. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Move JFR-specific Docker configuration (image tag, dockerfile, volume) out of the base docker-compose.yml into a separate override file, matching the OAuthSheriff pattern. Shell scripts and Maven profiles now use `-f` compose flags instead of environment variable substitution. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…9000 Separate operational endpoints (health, metrics) from application traffic by enabling the Quarkus management interface on a dedicated plain HTTP port. This follows the Keycloak pattern already in the project, eliminates TLS complexity for probes, and allows Prometheus to scrape without insecure_skip_verify. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Redundant prefix removed since the module is already inside the API-Sheriff repository. Updated all references across POMs, GitHub Actions workflows, shell scripts, and CLAUDE.md. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Shorter, cleaner name since the repository context already implies API Sheriff. Updated all references across POMs, GitHub Actions workflows, shell scripts, Dockerfile, documentation, and CLAUDE.md. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Pin image to digest for supply-chain security: quay.io/keycloak/keycloak:26.5.4@sha256:ae8efb0d218d8921334b03a2dbee7069a0b868240691c50a3ffc9f42fabba8b4 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request focuses on a major refactoring effort to align the project's architecture with modern best practices and enhance its security and performance capabilities. The changes consolidate the module structure, update critical dependencies, and introduce a robust benchmarking system. The overall impact is a cleaner, more secure, and more performant API Gateway application, with improved development and operational tooling. Highlights
Changelog
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request includes changes to the project's configuration, documentation, and build process. Specifically, it adds a description and various configurations to .github/project.yml, enables native access in .mvn/jvm.config, updates CLAUDE.md with project structure and build commands, modifies README.adoc to reflect the project's focus, removes api-sheriff-library documentation, and updates several files related to the Quarkus integration, including removing the de.cuioss.sheriff.api.test.TestDataGenerator class. The code review comments suggest removing the --enable-native-access=ALL-UNNAMED flag due to security concerns and improving the robustness of the Docker image size extraction command in integration-tests/scripts/start-integration-container.sh by using the $AVAILABLE_IMAGE variable directly.
| @@ -0,0 +1 @@ | |||
| --enable-native-access=ALL-UNNAMED | |||
There was a problem hiding this comment.
The use of --enable-native-access=ALL-UNNAMED is a broad flag that disables module encapsulation for native access across all unnamed modules. This can introduce security vulnerabilities and make the application harder to maintain and update, as it bypasses the protections of the Java Platform Module System. It is strongly recommended to avoid this flag. If native access is strictly necessary for a specific dependency, please scope it down to only the required module (e.g., --enable-native-access=your.specific.module). If it is not needed, this file should be removed.
|
|
||
| # Show actual image size | ||
| IMAGE_SIZE=$(docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}" | grep api-sheriff-integration-tests | awk '{print $2}' | head -1) | ||
| IMAGE_SIZE=$(docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}" | grep "api-sheriff:" | grep -v integration | awk '{print $2}' | head -1) |
There was a problem hiding this comment.
The command to extract the Docker image size is a bit brittle. It uses grep "api-sheriff:" | grep -v integration, which might fail or return incorrect results if other images with similar names exist. Since the correct image tag is already determined and stored in the $AVAILABLE_IMAGE variable earlier in the script, it would be more robust to use that variable directly to find the image size.
Suggested change
| IMAGE_SIZE=$(docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}" | grep "api-sheriff:" | grep -v integration | awk '{print $2}' | head -1) | |
| IMAGE_SIZE=$(docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}" | grep "^${AVAILABLE_IMAGE}$" | awk '{print $2}' | head -1) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
api-sheriff,integration-tests,benchmarks)Test plan
./mvnw -Ppre-commit clean verify -DskipTests— passes./mvnw clean install— passes./mvnw clean verify -Pintegration-tests -pl integration-tests -am— 4/4 tests pass./mvnw clean verify -pl benchmarks -Pbenchmark— benchmarks run successfully🤖 Generated with Claude Code