refactor(ci): enforce the Java 17 SDK build contract

.github/actions/get-hugegraph-commit/action.yml

@@ -47,7 +47,7 @@ runs:
             core.exportVariable('COMMIT_REF', result.fetchRef);
             core.setOutput('commit_id', result.sha);
             core.setOutput('fetch_ref', result.fetchRef);
-            core.info(`Server baseline: ${process.env.SERVER_REPOSITORY} ${result.fetchRef} (${result.sha})`);
+            core.info(`Server baseline: ${process.env.SERVER_REPOSITORY} ${/^[0-9a-f]{40}$/i.test(result.fetchRef) ? result.fetchRef.slice(0, 6) : result.fetchRef} (${result.sha.slice(0, 6)})`);
           } catch (error) {
             core.setFailed(`Failed to get HugeGraph commit: ${error.message}`);
           }

.github/actions/get-hugegraph-commit/resolve.cjs

@@ -45,8 +45,16 @@ module.exports = async function resolve(github, { repository, ref = '', pr = '',
     sha = commit.sha;
   }
   if (!/^[0-9a-f]{40}$/i.test(sha)) throw new Error('Server API returned an invalid commit SHA');
-  if (expectedCommit && sha.toLowerCase() !== expectedCommit.toLowerCase()) {
-    throw new Error(`Server ref moved: expected ${expectedCommit}, resolved ${sha}`);
+  if (expectedCommit) {
+    if (sha.toLowerCase() !== expectedCommit.toLowerCase()) {
+      throw new Error(`Server ref moved: expected ${expectedCommit.slice(0, 6)}, resolved ${sha.slice(0, 6)}`);
+    }
+  }
+  if (/^[0-9a-f]{40}$/i.test(ref)) {
+    if (sha.toLowerCase() !== ref.toLowerCase()) {
+      throw new Error('Server API returned a commit different from the selected SHA');
+    }
+    fetchRef = sha;
   }
   return { sha, fetchRef };
 };

.github/actions/get-hugegraph-commit/resolve.test.cjs

@@ -57,7 +57,7 @@ test('resolves PR head from the selected repository', async () => {
 
 test('rejects invalid or ambiguous selectors before calling GitHub', async () => {
   for (const input of [{ repository: '../repo' }, { ref: 'master', pr: '42' },
-    { pr: '1.5' }, { pr: '0' }, { expectedCommit: 'short' }]) {
+    { pr: '1.5' }, { pr: '0' }, { expectedCommit: 'short' }, { expectedCommit: sha.slice(0, 6) }]) {
     const { github, calls } = client();
     await assert.rejects(resolve(github, { repository: 'apache/hugegraph', ...input }));
     assert.equal(calls.length, 0);
@@ -71,3 +71,12 @@ test('fails closed for a moved branch or API error', async () => {
   github.rest.repos.getCommit = async () => { throw new Error('Not Found'); };
   await assert.rejects(resolve(github, { repository: 'example/server', ref: 'missing' }), /Not Found/);
 });
+
+test('verifies a full commit selector and fetch identity', async () => {
+  const { github, calls } = client();
+  assert.deepEqual(await resolve(github, { repository: 'apache/hugegraph',
+    ref: sha, expectedCommit: sha }), { sha, fetchRef: sha });
+  assert.deepEqual(calls, [['commit', { owner: 'apache', repo: 'hugegraph', ref: sha }]]);
+  await assert.rejects(resolve(github, { repository: 'apache/hugegraph',
+    ref: 'b'.repeat(40) }), /different from the selected SHA/);
+});

.github/actions/setup-candidate-sdk/action.yml

@@ -6,11 +6,11 @@ inputs:
     description: 'GitHub owner/repository for the candidate SDK'
     default: 'apache/hugegraph'
   ref:
-    description: 'Fetchable candidate source ref'
-    default: 'd9abcd4317fb36128e7e4d209139ec7f3a28cdfc'
+    description: 'Immutable candidate source commit'
+    default: 'e62c961e00221569d4f955abbadf60faee45b283'
   expected-commit:
-    description: 'Locked full candidate source commit'
-    default: 'd9abcd4317fb36128e7e4d209139ec7f3a28cdfc'
+    description: 'Locked candidate source commit'
+    default: 'e62c961e00221569d4f955abbadf60faee45b283'
 
 outputs:
   repository:
@@ -55,9 +55,18 @@ runs:
       run: |
         candidate_repo=$(mktemp -d "$RUNNER_TEMP/hugegraph-candidate-m2.XXXXXX")
         server_build=$(mktemp -d "$RUNNER_TEMP/hugegraph-candidate-build.XXXXXX")
+        source_dir="$server_build/source"
+        if [[ -d "$HOME/.m2/repository" ]]; then
+          rsync -a --exclude='/org/apache/hugegraph/' --exclude='/candidate-sdk-manifest.json' \
+            "$HOME/.m2/repository/" "$candidate_repo/"
+        fi
         bash "$GITHUB_WORKSPACE/hugegraph-client/assembly/travis/install-candidate-sdk.sh" \
-          "$SERVER_COMMIT" "$server_build/hugegraph" "$candidate_repo"
-        archives=("$server_build"/hugegraph/hugegraph-server/apache-hugegraph-*.tar.gz)
+          "$SERVER_COMMIT" "$source_dir" "$candidate_repo"
+        # Retain downloaded third-party inputs for the existing Maven cache.
+        mkdir -p "$HOME/.m2/repository"
+        rsync -a --exclude='/org/apache/hugegraph/' --exclude='/candidate-sdk-manifest.json' \
+          "$candidate_repo/" "$HOME/.m2/repository/"
+        archives=("$source_dir"/hugegraph-server/apache-hugegraph-*.tar.gz)
         if [[ ${#archives[@]} -ne 1 || ! -f "${archives[0]}" ]]; then
           printf 'Expected one candidate server archive, found: %s\n' "${archives[*]}" >&2
           exit 1

.github/actions/setup-hugegraph-server/action.yml

@@ -1,5 +1,5 @@
 name: Setup HugeGraph Server
-description: Build an immutable fixture once, or start an independent test service
+description: Prepare an immutable release or candidate fixture, or start an independent test service
 inputs:
   mode:
     description: 'standalone (legacy), build (upload), or start (download)'
@@ -8,17 +8,20 @@ inputs:
     description: Workflow-local immutable fixture artifact name
     default: ''
   repository:
-    description: GitHub owner/repository containing the Server source
+    description: Server source repository (Java 11 release requires apache/hugegraph)
     default: apache/hugegraph
   fetch-ref:
     description: Fetchable source ref (must resolve to commit-id)
     default: ''
   commit-id:
-    description: Exact Server commit SHA
+    description: Exact Server commit SHA (Java 11 release requires the locked 1.7.0 commit)
     required: true
   java-version:
     description: JDK major used for the build and runtime
     default: '11'
+  release-version:
+    description: Fixed official Server release used by Java 11 compatibility fixtures
+    default: '1.7.0'
   java-home:
     description: Optional fixture JDK scoped to this subprocess; keeps Toolchain JDK unchanged
     default: ''
@@ -37,22 +40,23 @@ runs:
       with:
         name: ${{ inputs.artifact-name }}
         path: ${{ runner.temp }}/hugegraph-fixture
-    - name: Restore exact Server build cache
+    - name: Restore exact Server fixture cache
       if: inputs.mode == 'build'
       uses: actions/cache@v4
       with:
         path: ~/hugegraph-fixture-cache
-        key: server-fixture-v1-${{ runner.os }}-${{ runner.arch }}-${{ inputs.repository }}-${{ inputs.commit-id }}-jdk${{ inputs.java-version }}-${{ hashFiles('.github/actions/setup-hugegraph-server/action.yml', '.github/actions/setup-hugegraph-server/fixture.sh', '.github/actions/setup-hugegraph-server/manifest.py', '.github/actions/setup-java-env/action.yml', '.github/configs/settings.xml', 'hugegraph-client/assembly/travis/checkout-server.sh', 'hugegraph-client/assembly/travis/start-hugegraph-servers.sh', 'hugegraph-*/assembly/travis/install-hugegraph-from-source.sh', 'hugegraph-hubble/hubble-dist/assembly/travis/download-hugegraph.sh') }}
+        key: server-fixture-v2-${{ runner.os }}-${{ runner.arch }}-${{ inputs.repository }}-${{ inputs.commit-id }}-release${{ inputs.release-version }}-jdk${{ inputs.java-version }}-${{ hashFiles('.github/actions/setup-hugegraph-server/action.yml', '.github/actions/setup-hugegraph-server/fixture.sh', '.github/actions/setup-hugegraph-server/manifest.py', '.github/actions/setup-hugegraph-server/release.py', '.github/actions/setup-java-env/action.yml', '.github/configs/settings.xml', 'hugegraph-client/assembly/travis/checkout-server.sh', 'hugegraph-client/assembly/travis/install-candidate-sdk.sh', 'hugegraph-client/assembly/travis/start-hugegraph-servers.sh', 'hugegraph-*/assembly/travis/install-hugegraph-from-source.sh', 'hugegraph-hubble/hubble-dist/assembly/travis/download-hugegraph.sh') }}
     - name: Prepare fixture or start service
       shell: bash
       env:
         FIXTURE_MODE: ${{ inputs.mode }}
         FIXTURE_REPOSITORY: ${{ inputs.repository }}
         FIXTURE_COMMIT: ${{ inputs.commit-id }}
         FIXTURE_REF: ${{ inputs.fetch-ref }}
-        FIXTURE_BUILD_INPUTS: ${{ hashFiles('.github/actions/setup-hugegraph-server/action.yml', '.github/actions/setup-hugegraph-server/fixture.sh', '.github/actions/setup-hugegraph-server/manifest.py', '.github/actions/setup-java-env/action.yml', '.github/configs/settings.xml', 'hugegraph-client/assembly/travis/checkout-server.sh', 'hugegraph-client/assembly/travis/start-hugegraph-servers.sh', 'hugegraph-*/assembly/travis/install-hugegraph-from-source.sh', 'hugegraph-hubble/hubble-dist/assembly/travis/download-hugegraph.sh') }}
+        FIXTURE_BUILD_INPUTS: ${{ hashFiles('.github/actions/setup-hugegraph-server/action.yml', '.github/actions/setup-hugegraph-server/fixture.sh', '.github/actions/setup-hugegraph-server/manifest.py', '.github/actions/setup-hugegraph-server/release.py', '.github/actions/setup-java-env/action.yml', '.github/configs/settings.xml', 'hugegraph-client/assembly/travis/checkout-server.sh', 'hugegraph-client/assembly/travis/install-candidate-sdk.sh', 'hugegraph-client/assembly/travis/start-hugegraph-servers.sh', 'hugegraph-*/assembly/travis/install-hugegraph-from-source.sh', 'hugegraph-hubble/hubble-dist/assembly/travis/download-hugegraph.sh') }}
         FIXTURE_PLATFORM: ${{ runner.os }}-${{ runner.arch }}
         FIXTURE_JAVA: ${{ inputs.java-version }}
+        FIXTURE_RELEASE_VERSION: ${{ inputs.release-version }}
         FIXTURE_JAVA_HOME: ${{ inputs.java-home }}
         ISOLATE_FIXTURE_REPO: ${{ inputs.isolate-maven-repo }}
         FIXTURE_DIR: ${{ runner.temp }}/hugegraph-fixture
@@ -85,6 +89,10 @@ runs:
           export TRAVIS_DIR
           server_build=$(mktemp -d "${RUNNER_TEMP:-${TMPDIR:-/tmp}}/hugegraph-build.XXXXXX")
           cd "$server_build"
+          if [[ "$FIXTURE_MODE" == standalone ]]; then
+            FIXTURE_MODE=build bash "$FIXTURE_ACTION/fixture.sh"
+            export FIXTURE_MODE=start
+          fi
           if [[ -f "$TRAVIS_DIR/install-hugegraph-from-source.sh" ]]; then
             bash "$TRAVIS_DIR/install-hugegraph-from-source.sh" "$FIXTURE_COMMIT"
           else

.github/actions/setup-hugegraph-server/fixture.sh

@@ -22,15 +22,29 @@ FIXTURE_REPOSITORY=${FIXTURE_REPOSITORY:-${SERVER_REPOSITORY:-apache/hugegraph}}
 FIXTURE_COMMIT=${FIXTURE_COMMIT:-${1:-}}
 FIXTURE_REF=${FIXTURE_REF:-$FIXTURE_COMMIT}
 FIXTURE_JAVA=${FIXTURE_JAVA:-11}
+FIXTURE_RELEASE_VERSION=${FIXTURE_RELEASE_VERSION:-1.7.0}
 FIXTURE_DIR=${FIXTURE_DIR:-${RUNNER_TEMP:-${TMPDIR:-/tmp}}/hugegraph-fixture}
 FIXTURE_HELPER=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/manifest.py
 FIXTURE_BUILD_INPUTS=${FIXTURE_BUILD_INPUTS:-$(python3 "$FIXTURE_HELPER" inputs)}
 FIXTURE_PLATFORM=${FIXTURE_PLATFORM:-$(uname -sm)}
-FIXTURE_CONFIG="package -DskipTests -Dmaven.javadoc.skip=true -ntp;schema=1;inputs=$FIXTURE_BUILD_INPUTS;platform=$FIXTURE_PLATFORM"
-export FIXTURE_REPOSITORY FIXTURE_COMMIT FIXTURE_JAVA FIXTURE_CONFIG FIXTURE_DIR
+if [[ "$FIXTURE_JAVA" == 17 ]]; then
+    FIXTURE_BUILD_COMMAND=candidate-sdk-install
+else
+    FIXTURE_BUILD_COMMAND="asf-release-$FIXTURE_RELEASE_VERSION"
+fi
+FIXTURE_CONFIG="$FIXTURE_BUILD_COMMAND;schema=2;inputs=$FIXTURE_BUILD_INPUTS;platform=$FIXTURE_PLATFORM"
+export FIXTURE_REPOSITORY FIXTURE_COMMIT FIXTURE_JAVA FIXTURE_CONFIG FIXTURE_DIR FIXTURE_RELEASE_VERSION
 [[ "$FIXTURE_REPOSITORY" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]
 [[ "$FIXTURE_COMMIT" =~ ^[0-9a-f]{40}$ ]]
-[[ "$FIXTURE_JAVA" =~ ^[0-9]+$ ]]
+[[ "$FIXTURE_JAVA" == 11 || "$FIXTURE_JAVA" == 17 ]] || {
+    echo 'Fixture requires JDK 11 for the official release or JDK 17 for the candidate SDK' >&2
+    exit 1
+}
+
+if [[ "$FIXTURE_JAVA" == 11 ]]; then
+    # Reject caller/source mismatch before restoring a cache or downloading bytes.
+    python3 "${FIXTURE_HELPER%/*}/release.py" validate
+fi
 
 fixture_validate_java() {
     actual_java=$(java -version 2>&1 | sed -n 's/.*version "\([0-9][0-9]*\).*".*/\1/p' | head -1)
@@ -39,7 +53,7 @@ fixture_validate_java() {
 
 fixture_verify() { python3 "$FIXTURE_HELPER" verify; }
 fixture_build() {
-    local cache_key cache_dir source_dir archive
+    local cache_key cache_dir source_dir archive candidate_repo=''
     cache_key=$(printf '%s\n' "$FIXTURE_REPOSITORY" "$FIXTURE_COMMIT" "$FIXTURE_JAVA" "$FIXTURE_CONFIG" | shasum -a 256 | cut -d ' ' -f 1)
     cache_dir="${HOME}/hugegraph-fixture-cache/$cache_key"
     mkdir -p "$FIXTURE_DIR"
@@ -50,19 +64,27 @@ fixture_build() {
     fi
     rm -f "$FIXTURE_DIR/server.tar.gz" "$FIXTURE_DIR/manifest.json"
     fixture_validate_java
-    source_dir="$(mktemp -d "${TMPDIR:-/tmp}/hg-fixture-source.XXXXXX")/source"
-    SERVER_REPOSITORY=$FIXTURE_REPOSITORY SERVER_FETCH_REF=$FIXTURE_REF \
-        bash "${FIXTURE_HELPER%/*}/../../../hugegraph-client/assembly/travis/checkout-server.sh" "$FIXTURE_COMMIT" "$source_dir"
-    (cd "$source_dir" && mvn package -DskipTests -Dmaven.javadoc.skip=true -ntp)
-    archive=$(find "$source_dir/hugegraph-server" -maxdepth 1 -name 'apache-hugegraph-*.tar.gz' -print)
-    [[ -n "$archive" && -f "$archive" ]]
-    cp "$archive" "$FIXTURE_DIR/server.tar.gz"
-    export FIXTURE_ARCHIVE_NAME=${archive##*/}
+    if [[ "$FIXTURE_JAVA" == 17 ]]; then
+        source_dir="$(mktemp -d "${TMPDIR:-/tmp}/hg-fixture-source.XXXXXX")/source"
+        # Reuse the verified SDK build's same-source distribution and isolated repository.
+        candidate_repo=$(mktemp -d "${TMPDIR:-/tmp}/hg-fixture-sdk-m2.XXXXXX")
+        SERVER_REPOSITORY=$FIXTURE_REPOSITORY SERVER_FETCH_REF=$FIXTURE_REF \
+            bash "${FIXTURE_HELPER%/*}/../../../hugegraph-client/assembly/travis/install-candidate-sdk.sh" \
+                "$FIXTURE_COMMIT" "$source_dir" "$candidate_repo"
+        archive=$(find "$source_dir/hugegraph-server" -maxdepth 1 -name 'apache-hugegraph-*.tar.gz' -print)
+        [[ -n "$archive" && -f "$archive" ]]
+        cp "$archive" "$FIXTURE_DIR/server.tar.gz"
+        export FIXTURE_ARCHIVE_NAME=${archive##*/}
+    else
+        python3 "${FIXTURE_HELPER%/*}/release.py" download
+        export FIXTURE_ARCHIVE_NAME=$(python3 "${FIXTURE_HELPER%/*}/release.py" name)
+    fi
     python3 "$FIXTURE_HELPER" create
     fixture_verify
     mkdir -p "$cache_dir"
     cp "$FIXTURE_DIR/server.tar.gz" "$FIXTURE_DIR/manifest.json" "$cache_dir/"
-    rm -rf "$source_dir"
+    if [[ -n "${source_dir:-}" ]]; then rm -rf "$source_dir"; fi
+    if [[ -n "$candidate_repo" ]]; then rm -rf "$candidate_repo"; fi
 }
 fixture_copy_archive() {
     fixture_validate_java

.github/actions/setup-hugegraph-server/manifest.py

@@ -23,14 +23,18 @@
 import re
 import sys
 
+import release
+
 if sys.argv[1] == "inputs":
     repo = pathlib.Path(__file__).resolve().parents[3]
     patterns = (
         '.github/actions/setup-hugegraph-server/action.yml',
         '.github/actions/setup-hugegraph-server/fixture.sh',
         '.github/actions/setup-hugegraph-server/manifest.py',
+        '.github/actions/setup-hugegraph-server/release.py',
         '.github/actions/setup-java-env/action.yml', '.github/configs/settings.xml',
         'hugegraph-client/assembly/travis/checkout-server.sh',
+        'hugegraph-client/assembly/travis/install-candidate-sdk.sh',
         'hugegraph-client/assembly/travis/start-hugegraph-servers.sh',
         'hugegraph-*/assembly/travis/install-hugegraph-from-source.sh',
         'hugegraph-hubble/hubble-dist/assembly/travis/download-hugegraph.sh',
@@ -45,13 +49,25 @@
 root = pathlib.Path(os.environ["FIXTURE_DIR"])
 identity = {key.lower(): os.environ["FIXTURE_" + key] for key in
             ("REPOSITORY", "COMMIT", "JAVA", "CONFIG")}
+try:
+    if identity["java"] == "11":
+        identity.update(release.identity(os.environ.get("FIXTURE_RELEASE_VERSION", release.VERSION),
+                                        identity["repository"], identity["commit"]))
+    else:
+        identity.update(source_kind="candidate-sdk")
+except ValueError as error:
+    sys.exit(str(error))
+
+
 def digest():
     h = hashlib.sha256()
     with (root / "server.tar.gz").open("rb") as stream:
         for chunk in iter(lambda: stream.read(1024 * 1024), b""):
             h.update(chunk)
     return h.hexdigest()
 try:
+    if identity["java"] == "11":
+        release.verify(root / "server.tar.gz")
     if sys.argv[1] == "create":
         data = dict(identity, archive_name=os.environ["FIXTURE_ARCHIVE_NAME"], sha256=digest())
         (root / "manifest.json").write_text(json.dumps(data, sort_keys=True) + "\n")
@@ -63,6 +79,8 @@ def digest():
             raise ValueError("fixture origin, commit, JDK or build configuration mismatch")
         if not re.fullmatch(r"apache-hugegraph-[A-Za-z0-9_.-]+\.tar\.gz", data.get("archive_name", "")):
             raise ValueError("invalid archive name")
+        if identity["java"] == "11" and data.get("archive_name") != release.ARCHIVE_NAME:
+            raise ValueError("official Server release archive name mismatch")
         if data.get("sha256") != digest():
             raise ValueError("fixture checksum mismatch")
         if sys.argv[1] == "name":