skyflowapi
diff --git a/‎.cspell.json‎
Lines changed: 16 additions & 3 deletions b/‎.cspell.json‎
Lines changed: 16 additions & 3 deletions
diff --git a/‎.github/workflows/beta-release.yml‎
Lines changed: 0 additions & 20 deletions b/‎.github/workflows/beta-release.yml‎
Lines changed: 0 additions & 20 deletions
diff --git a/‎.github/workflows/contract-tests.yml‎
Lines changed: 166 additions & 0 deletions b/‎.github/workflows/contract-tests.yml‎
Lines changed: 166 additions & 0 deletions
diff --git a/‎.github/workflows/endorlabsScan.yml‎
Lines changed: 9 additions & 0 deletions b/‎.github/workflows/endorlabsScan.yml‎
Lines changed: 9 additions & 0 deletions
diff --git a/‎.github/workflows/internal-release.yml‎
Lines changed: 41 additions & 5 deletions b/‎.github/workflows/internal-release.yml‎
Lines changed: 41 additions & 5 deletions
diff --git a/‎.github/workflows/main.yml‎
Lines changed: 56 additions & 4 deletions b/‎.github/workflows/main.yml‎
Lines changed: 56 additions & 4 deletions
@@ -6,6 +6,7 @@
     "**/*.{java,md,xml,yml,yaml,json,txt,properties}"
   ],
   "words": [
+    "japicmp",
     "Skyflow",
     "skyflow",
     "skyflowapi",
@@ -96,9 +97,20 @@
     "nocreds",
     "nodir",
     "detok",
-    "qhdmceurtnlz",
     "ngrok",
-    "obac"
+    "obac",
+    "siom",
+    "vaultid",
+    "recordss",
+    "synthesise",
+    "synthesised",
+    "deserialise",
+    "deserialised",
+    "unmodelled",
+    "recordss",
+    "rarr",
+    "servname",
+    "nodename"
   ],
   "languageSettings": [
     {
@@ -118,7 +130,8 @@
     "**/target/**",
     "*.lock",
     "Rule/**",
-    "src/main/java/com/skyflow/generated/**",
+    "**/src/main/java/com/skyflow/generated/**",
+    "**/generated/**",
     "**/*.ts",
     "**/processed-*",
     "samples/src/main/java/com/example/credentials.json",
 
@@ -0,0 +1,166 @@
+name: Contract Tests
+
+on:
+  pull_request:
+    branches:
+      - main
+      - release/*
+      - flowvault-release/*
+
+jobs:
+  contract-tests:
+    # One job per module so a break in one is reported against that module by name,
+    # and both still run even when the other fails.
+    name: Contract Tests (${{ matrix.module }})
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - module: skyvault
+            artifact: skyflow-java
+          - module: flowvault
+            artifact: skyflow-flowvault-java
+
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: 'maven'
+
+      - name: Verify API surface snapshot
+        run: mvn -B install -pl common,${{ matrix.module }} -am -DskipTests -Dmaven.javadoc.skip=true -Dgpg.skip=true
+
+      - name: Show API surface diff
+        if: failure()
+        run: |
+          echo "### API surface changes detected in ${{ matrix.module }} ###"
+          echo "Compared against ${{ matrix.module }}/api-report/${{ matrix.artifact }}.baseline.jar."
+          echo "If this change is intentional, run:"
+          echo "    scripts/contract-snapshot-update.sh ${{ matrix.module }}"
+          echo "and commit the updated baseline jar."
+          echo ""
+          cat ${{ matrix.module }}/target/japicmp/default-cli.diff || true
+
+      - name: Upload API surface diff on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: api-surface-diff-${{ matrix.module }}
+          path: ${{ matrix.module }}/target/japicmp/**
+          retention-days: 7
+
+      # The step above only shows a diff when the CURRENT build differs from the
+      # committed baseline - once someone runs contract-snapshot-update.sh and
+      # commits the refreshed baseline jar, that check goes green and shows nothing.
+      # A reviewer looking at a green PR that touches api-report/*.baseline.jar
+      # (a binary file) would otherwise have no way to see WHAT was just approved as
+      # the new contract. These steps explicitly diff the OLD committed baseline
+      # (from the PR's base branch) against the NEW committed baseline (from this PR)
+      # and post it as a PR comment, regardless of whether the check above passed.
+      - name: Check if contract baseline was updated in this PR
+        id: baseline-diff-check
+        if: always() && github.event.pull_request
+        run: |
+          git fetch origin "${{ github.event.pull_request.base.ref }}" --depth=1
+          BASELINE="${{ matrix.module }}/api-report/${{ matrix.artifact }}.baseline.jar"
+          if ! git diff --name-only "origin/${{ github.event.pull_request.base.ref }}" HEAD -- "$BASELINE" | grep -q .; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          elif git cat-file -e "origin/${{ github.event.pull_request.base.ref }}:$BASELINE" 2>/dev/null; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          else
+            # Added by this PR rather than modified: the module is getting its
+            # first baseline. git diff reports an addition as a change, but there
+            # is no old snapshot to `git show`, so a plain "true" here would send
+            # the next step into `git show <base>:<path>` and exit 128.
+            echo "changed=new" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Diff old vs new contract baseline
+        if: always() && (steps.baseline-diff-check.outputs.changed == 'true' || steps.baseline-diff-check.outputs.changed == 'new')
+        run: |
+          BASELINE="${{ matrix.module }}/api-report/${{ matrix.artifact }}.baseline.jar"
+
+          if [ "${{ steps.baseline-diff-check.outputs.changed }}" = "new" ]; then
+            {
+              echo "\`$BASELINE\` is **new in this PR** - \`${{ matrix.module }}\` had no committed baseline before, so there is nothing to diff against."
+              echo ""
+              echo "This snapshot becomes the approved contract: every later PR is compared against it, and any incompatible change fails the \`Contract Tests (${{ matrix.module }})\` job until someone regenerates it deliberately. Review it as the starting point, not as a change."
+            } > /tmp/contract-baseline-diff.md
+            cat /tmp/contract-baseline-diff.md
+            exit 0
+          fi
+
+          curl -sL -o /tmp/japicmp-cli.jar "https://repo.maven.apache.org/maven2/com/github/siom79/japicmp/japicmp/0.26.0/japicmp-0.26.0-jar-with-dependencies.jar"
+          mvn -q -B dependency:build-classpath -pl ${{ matrix.module }} -Dmdep.outputFile=/tmp/module-classpath.txt -Dmaven.javadoc.skip=true -Dgpg.skip=true
+          git show "origin/${{ github.event.pull_request.base.ref }}:$BASELINE" > /tmp/old-baseline.jar
+
+          # Same allowlist the poms gate on, so the comment shows the contract and
+          # nothing else. Keep these in sync with the <includes> in the module poms.
+          java -jar /tmp/japicmp-cli.jar \
+            -o /tmp/old-baseline.jar \
+            -n "$BASELINE" \
+            -a protected \
+            -i "com.skyflow.Skyflow;com.skyflow.config;com.skyflow.enums;com.skyflow.errors;com.skyflow.serviceaccount.util;com.skyflow.vault.audit;com.skyflow.vault.bin;com.skyflow.vault.connection;com.skyflow.vault.controller;com.skyflow.vault.data;com.skyflow.vault.detect;com.skyflow.vault.tokens" \
+            --old-classpath "$(cat /tmp/module-classpath.txt)" \
+            --new-classpath "$(cat /tmp/module-classpath.txt)" \
+            -m \
+            --ignore-missing-classes \
+            --markdown > /tmp/contract-baseline-diff.md || true
+
+          cat /tmp/contract-baseline-diff.md
+
+      - name: Comment contract baseline change on PR
+        if: always() && (steps.baseline-diff-check.outputs.changed == 'true' || steps.baseline-diff-check.outputs.changed == 'new')
+        uses: actions/github-script@v7
+        env:
+          BASELINE_STATE: ${{ steps.baseline-diff-check.outputs.changed }}
+        with:
+          script: |
+            const fs = require('fs');
+            const module = '${{ matrix.module }}';
+            const artifact = '${{ matrix.artifact }}';
+            const summary = fs.readFileSync('/tmp/contract-baseline-diff.md', 'utf8');
+            // per-module marker so the two matrix jobs update their own comment
+            const marker = `<!-- contract-baseline-diff:${module} -->`;
+            const isNew = process.env.BASELINE_STATE === 'new';
+            const heading = isNew
+              ? `## Contract baseline added (\`${module}\`)`
+              : `## Contract baseline change detected (\`${module}\`)`;
+            const preamble = isNew
+              ? `This PR adds \`${module}/api-report/${artifact}.baseline.jar\`, the approved public API contract for this module.`
+              : `This PR updates \`${module}/api-report/${artifact}.baseline.jar\` (the approved public API contract). Here is exactly what it changes, comparing the baseline on \`${{ github.event.pull_request.base.ref }}\` against the baseline committed in this PR:`;
+            const body = `${marker}\n${heading}\n\n${preamble}\n\n${summary}`;
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+            const existing = comments.find(c => c.body && c.body.includes(marker));
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body,
+              });
+            }
@@ -36,6 +36,15 @@ jobs:
           name: "credentials.json"
           json: ${{ secrets.TEST_CREDENTIALS_FILE_STRING }}
 
+      - name: Distribute test fixtures to modules
+        run: |
+          # Surefire runs each module's tests with the module directory as the working
+          # directory, so dotenv and ./credentials.json lookups miss the repo-root copies.
+          for module in common skyvault flowvault; do
+            cp .env "$module/.env"
+            cp credentials.json "$module/credentials.json"
+          done
+
       - name: Compile Package
         run: mvn -B package -f pom.xml -Dmaven.javadoc.skip=true
 
 
@@ -1,26 +1,62 @@
-name: Publish package to the JFROG Artifactory
+name: Publish module to the JFROG Artifactory
 on:
   push:
+    # '**' not '*.*': Actions glob '*' does not match '/', so '*.*' let slash
+    # tags (flowvault/v1.0.0) through and fired this branch-only workflow.
     tags-ignore:
-      - '*.*'
+      - '**'
     paths-ignore:
       - "*.md"
     branches:
+      - flowvault-release/*
+      - skyvault-release/*
+      # Legacy: predates the per-module naming, still maps to skyvault.
       - release/*
 
 jobs:
+  resolve-module:
+    runs-on: ubuntu-latest
+    # Skip our own bump commit, or this loops: bump -> push -> release -> bump.
+    # PAT-authenticated pushes DO trigger workflows; GITHUB_TOKEN pushes do not.
+    # build-and-deploy needs this job, so skipping here skips the run.
+    if: ${{ !contains(github.event.head_commit.message, '[AUTOMATED]') }}
+    outputs:
+      module: ${{ steps.set-module.outputs.module }}
+    steps:
+      # Explicit match, no catch-all: defaulting once published the wrong module.
+      - name: Resolve module from branch name
+        id: set-module
+        env:
+          BRANCH: ${{ github.ref_name }}
+        run: |
+          case "$BRANCH" in
+            flowvault-release/*) MODULE="flowvault" ;;
+            skyvault-release/*)  MODULE="skyvault" ;;
+            release/*)           MODULE="skyvault" ;;
+            *)
+              echo "::error::Branch '$BRANCH' does not map to a module."
+              exit 1
+              ;;
+          esac
+          echo "Branch '$BRANCH' -> module '$MODULE'"
+          echo "module=$MODULE" >> "$GITHUB_OUTPUT"
+
   build-and-deploy:
+    needs: resolve-module
     uses: ./.github/workflows/shared-build-and-deploy.yml
     with:
       ref: ${{ github.ref_name }}
       server-id: central
       profile: jfrog
       tag: 'internal'
+      module: ${{ needs.resolve-module.outputs.module }}
     secrets:
       server-username: ${{ secrets.ARTIFACTORY_USERNAME }}
       server-password: ${{ secrets.ARTIFACTORY_PASSWORD }}
       gpg-key: ${{ secrets.JFROG_GPG_KEY }}
       gpg-passphrase: ${{ secrets.JFROG_GPG_PASSPHRASE }}
-      skyflow-credentials: ${{ secrets.SKYFLOW_CREDENTIALS }} >> .env
-      test-expired-token: ${{ secrets.TEST_EXPIRED_TOKEN }} >> .env
-      test-reusable-token: ${{ secrets.TEST_REUSABLE_TOKEN }} >> .env
+      skyflow-credentials: ${{ secrets.SKYFLOW_CREDENTIALS }}
+      test-expired-token: ${{ secrets.TEST_EXPIRED_TOKEN }}
+      test-reusable-token: ${{ secrets.TEST_REUSABLE_TOKEN }}
+      pat-actions: ${{ secrets.PAT_ACTIONS }}
+      test-credentials-file-string: ${{ secrets.TEST_CREDENTIALS_FILE_STRING }}
@@ -30,13 +30,65 @@ jobs:
           echo TEST_EXPIRED_TOKEN=${{ secrets.TEST_EXPIRED_TOKEN }} >> .env
           echo TEST_REUSABLE_TOKEN=${{ secrets.TEST_REUSABLE_TOKEN }} >> .env
 
+      - name: Distribute test fixtures to modules
+        run: |
+          # Surefire runs each module's tests with the module directory as the working
+          # directory, so dotenv and ./credentials.json lookups miss the repo-root copies.
+          for module in common skyvault flowvault; do
+            cp .env "$module/.env"
+            cp credentials.json "$module/credentials.json"
+          done
+
       - name: Build & Run tests with Maven
         run: mvn -B package -f pom.xml -Dmaven.javadoc.skip=true
 
-      - name: Codecov
-        uses: codecov/codecov-action@v2.1.0
+      # JaCoCo records packages as "com/skyflow/..." with no module prefix, and all three
+      # modules share the com.skyflow package (deliberate split-package convention). So
+      # "com/skyflow/config/VaultConfig.java" matches BOTH skyvault and flowvault, Codecov
+      # resolves it to one of them, and the other module's file silently reports no data.
+      # Prefixing each report with its own source root makes every path unique and match the
+      # repo exactly, so all three modules' files are attributed correctly.
+      - name: Qualify JaCoCo report paths with their module
+        run: |
+          for module in common skyvault flowvault; do
+            report="$module/target/site/jacoco/jacoco.xml"
+            if [ ! -f "$report" ]; then
+              echo "Error: expected $report to exist after the build."
+              exit 1
+            fi
+            tmp="$(mktemp)"
+            sed "s|<package name=\"|<package name=\"$module/src/main/java/|g" "$report" > "$tmp"
+            mv "$tmp" "$report"
+          done
+
+      # One upload per module, each with its own flag, so Codecov reports per-module
+      # coverage instead of merging three same-named package trees into one number.
+      - name: Codecov (common)
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_REPO_UPLOAD_TOKEN }}
+          files: common/target/site/jacoco/jacoco.xml
+          flags: common
+          name: codecov-common
+          verbose: true
+          fail_ci_if_error: true
+
+      - name: Codecov (skyvault)
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_REPO_UPLOAD_TOKEN }}
+          files: skyvault/target/site/jacoco/jacoco.xml
+          flags: skyvault
+          name: codecov-skyvault
+          verbose: true
+          fail_ci_if_error: true
+
+      - name: Codecov (flowvault)
+        uses: codecov/codecov-action@v5
         with:
           token: ${{ secrets.CODECOV_REPO_UPLOAD_TOKEN }}
-          files: target/site/jacoco/jacoco.xml
-          name: codecov-skyflow-java
+          files: flowvault/target/site/jacoco/jacoco.xml
+          flags: flowvault
+          name: codecov-flowvault
           verbose: true
+          fail_ci_if_error: true