From b953f908125038a41aa40105e9d6de159197e028 Mon Sep 17 00:00:00 2001 From: Renn F Date: Thu, 15 Oct 2026 15:45:36 +0200 Subject: [PATCH] chore(engine): pin guard-core-jvm to db716ec Moves the engine ref in CI, CodeQL, release, settings and docs from 09dfddf to db716ec, which carries the detection scan budget and the dynamic rules overlay. Closes #24 --- .github/workflows/ci.yml | 6 +++--- .github/workflows/code-ql.yml | 4 ++-- .github/workflows/release.yml | 4 ++-- CHANGELOG.md | 1 + CONTRIBUTING.md | 2 +- README.md | 4 ++-- docs/examples.md | 2 +- docs/installation.md | 4 ++-- examples/demo-boot/README.md | 4 ++-- examples/demo-boot/settings.gradle.kts | 4 ++-- settings.gradle.kts | 4 ++-- 11 files changed, 20 insertions(+), 19 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 84b7966..d484d3a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,15 +25,15 @@ jobs: with: persist-credentials: false - # The engine dependency: guard-core-jvm pinned at 09dfddf (full SHA for the + # The engine dependency: guard-core-jvm pinned at db716ec (full SHA for the # actions/checkout fetch), checked # out as the sibling directory ./guard-core-jvm and substituted for the # declared com.guardcore:guard-core coordinates by settings.gradle.kts. - - name: Checkout engine (guard-core-jvm @ 09dfddf) + - name: Checkout engine (guard-core-jvm @ db716ec) uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: Guard-Core/guard-core-jvm - ref: 09dfddf77d1b25e7d79a03f8a37fe781ed30f236 + ref: db716ec0a038fa3dd0a145211bf6a1f18c178d03 path: guard-core-jvm persist-credentials: false diff --git a/.github/workflows/code-ql.yml b/.github/workflows/code-ql.yml index 8acef54..e1cea84 100644 --- a/.github/workflows/code-ql.yml +++ b/.github/workflows/code-ql.yml @@ -23,11 +23,11 @@ jobs: # The engine dependency: the composite includeBuild needs the pinned # guard-core-jvm checkout next to the repository (same as ci.yml). - - name: Checkout engine (guard-core-jvm @ 09dfddf) + - name: Checkout engine (guard-core-jvm @ db716ec) uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: Guard-Core/guard-core-jvm - ref: 09dfddf77d1b25e7d79a03f8a37fe781ed30f236 + ref: db716ec0a038fa3dd0a145211bf6a1f18c178d03 path: guard-core-jvm persist-credentials: false diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b15faf8..cedbf2d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -72,11 +72,11 @@ jobs: persist-credentials: false # Same engine checkout as ci.yml (the composite default for tests). - - name: Checkout engine (guard-core-jvm @ 09dfddf) + - name: Checkout engine (guard-core-jvm @ db716ec) uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: Guard-Core/guard-core-jvm - ref: 09dfddf77d1b25e7d79a03f8a37fe781ed30f236 + ref: db716ec0a038fa3dd0a145211bf6a1f18c178d03 path: guard-core-jvm persist-credentials: false diff --git a/CHANGELOG.md b/CHANGELOG.md index 05f9386..eb66dc3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,7 @@ ### Changed +- The pinned guard-core-jvm engine ref moves to db716ec, which carries the detection scan budget, semantic header handling and cookie split (guard-core-jvm#53) and the dynamic rules overlay (guard-core-jvm#55). - Telemetry agent support: an `AgentHandlerProtocol` bean (for example guard-agent-jvm's `GuardAgentTelemetry`) is now injected into `GuardMiddleware` by the auto-configuration, adopted into the engine composite on initialization, and stopped through the new `GuardMiddleware.shutdown()` when the context closes. Before this, `guard.enable-agent=true` always degraded with a "W7 artifact" message, because the middleware had no way to receive a handler. The degrade path now only applies when no handler bean is registered. The pinned guard-core-jvm engine ref moves to 9067b7b, whose agent telemetry wiring fix (Guard-Core/guard-core-jvm#48) the handler needs to receive anything. - `GuardMiddleware.shutdown()` now also closes the middleware's own redis handler, and stops the injected agent handler directly when initialization never ran (a lazily initialized app that saw no traffic), so an agent created with `cfg.redis` no longer leaks its persistence connection and daemon thread. It runs under the initialization mutex and is safe to call twice. The README documents that exactly one `AgentHandlerProtocol` bean is supported and adds the guard-agent-jvm dependency line. - Dependencies: netty is pinned to 4.1.139.Final through `platform(io.netty:netty-bom)`. lettuce-core 6.8.2 declares netty 4.1.125, which carries twelve advisories fixed by 4.1.137 at the latest. The pin is declared here as well as in the guard-core-jvm facade, so this lockfile stays the same whichever engine revision the build resolves. The four netty osv-scanner suppressions are removed; the Spring Boot test-scope suppressions stay. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index a01a8ab..0160b86 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -22,7 +22,7 @@ side in the same directory) at the pinned ref: ```bash git clone https://github.com/Guard-Core/guard-core-jvm ../guard-core-jvm -git -C ../guard-core-jvm checkout 09dfddf +git -C ../guard-core-jvm checkout db716ec ./gradlew build # detekt + ktfmt check + tests (redis-backed tests skip when redis is down) ``` diff --git a/README.md b/README.md index 466d533..82ac823 100644 --- a/README.md +++ b/README.md @@ -132,7 +132,7 @@ logs the same "eager init not honored" warning as fastapi-guard. The engine artifact `com.guard-core:guard-core` (groupId is the Central Portal namespace; Kotlin packages stay `com.guardcore.*`) is on Maven Central for consumers. This repository's own build pins the engine from source instead: CI and local builds check out `Guard-Core/guard-core-jvm` at the -pinned ref `09dfddf` as the sibling directory `./guard-core-jvm`, and `settings.gradle.kts` +pinned ref `db716ec` as the sibling directory `./guard-core-jvm`, and `settings.gradle.kts` substitutes the declared coordinates `com.guard-core:guard-core:4.3.3` / `com.guard-core:guard-core-engine:4.3.3` with the included build's projects (the Gradle analog of the Rust path+version pattern). The declared dependency coordinates stay @@ -152,7 +152,7 @@ Local checkout: ```bash git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm -git -C guard-core-jvm checkout 09dfddf +git -C guard-core-jvm checkout db716ec ./gradlew build ``` diff --git a/docs/examples.md b/docs/examples.md index 8a6bee1..ae14173 100644 --- a/docs/examples.md +++ b/docs/examples.md @@ -7,7 +7,7 @@ routes, live Redis-backed rate limiting, and per-route decorator configs. git clone https://github.com/Guard-Core/spring-boot-guard.git cd spring-boot-guard git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm -git -C guard-core-jvm checkout 09dfddf +git -C guard-core-jvm checkout db716ec docker run -d -p 6379:6379 redis:7-alpine ./gradlew :examples:demo-boot:bootRun ``` diff --git a/docs/installation.md b/docs/installation.md index f71ac75..9fffcbf 100644 --- a/docs/installation.md +++ b/docs/installation.md @@ -23,7 +23,7 @@ packages stay `com.guardcore.*`. ## Engine dependency (includeBuild + dependency substitution) Consumers resolve the engine artifact `com.guard-core:guard-core` from Maven Central. This repository's own build pins the engine from source instead: CI and -local builds check out `Guard-Core/guard-core-jvm` at the pinned ref `09dfddf` +local builds check out `Guard-Core/guard-core-jvm` at the pinned ref `db716ec` as the sibling directory `./guard-core-jvm`, and `settings.gradle.kts` substitutes the declared coordinates `com.guard-core:guard-core:4.3.3` / `com.guard-core:guard-core-engine:4.3.3` with the included build's projects. @@ -32,7 +32,7 @@ The declared dependency coordinates stay `com.guard-core:guard-core:4.3.3` ```bash git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm -git -C guard-core-jvm checkout 09dfddf +git -C guard-core-jvm checkout db716ec ./gradlew build ``` diff --git a/examples/demo-boot/README.md b/examples/demo-boot/README.md index 5cd0586..da1d8af 100644 --- a/examples/demo-boot/README.md +++ b/examples/demo-boot/README.md @@ -21,12 +21,12 @@ engine's `SecurityConfig` field names). Prerequisites: -1. Clone Guard-Core/guard-core-jvm at the pinned ref `09dfddf` next to this repository +1. Clone Guard-Core/guard-core-jvm at the pinned ref `db716ec` next to this repository (the engine builds from source via includeBuild until the artifacts publish): ```bash git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm - git -C guard-core-jvm checkout 09dfddf + git -C guard-core-jvm checkout db716ec ``` 2. A Redis on `localhost:6379` (rate limiting), or set `guard.enable-redis: false` in diff --git a/examples/demo-boot/settings.gradle.kts b/examples/demo-boot/settings.gradle.kts index 5076dde..b9525a2 100644 --- a/examples/demo-boot/settings.gradle.kts +++ b/examples/demo-boot/settings.gradle.kts @@ -15,7 +15,7 @@ rootProject.name = "demo-boot" // The adapter and the engine are consumed from source until both publish: // the adapter repo sits two levels up and the engine at the pinned ref -// 09dfddf sits next to it (the same includeBuild convention as the adapter). +// db716ec sits next to it (the same includeBuild convention as the adapter). includeBuild("../../") { dependencySubstitution { substitute(module("com.guardcore:spring-boot-guard")).using(project(":")) @@ -35,7 +35,7 @@ val engineDir: File = run { ) roots.firstOrNull { it.resolve("settings.gradle.kts").isFile } ?: throw GradleException( - "Clone Guard-Core/guard-core-jvm at the pinned ref 09dfddf next to the " + + "Clone Guard-Core/guard-core-jvm at the pinned ref db716ec next to the " + "spring-boot-guard repository first (or point -PguardCoreJvmDir / " + "GUARD_CORE_JVM_DIR at an existing checkout). Searched: " + roots.joinToString(", ") { it.path }, diff --git a/settings.gradle.kts b/settings.gradle.kts index 3732ab6..7fe2c4f 100644 --- a/settings.gradle.kts +++ b/settings.gradle.kts @@ -13,7 +13,7 @@ pluginManagement { // GUARD_CORE_USE_COMPOSITE (environment variable): // unset / "1" / "true" -> composite ON (default). The engine is built from // source via includeBuild + dependency substitution: CI (and local builds) -// check out Guard-Core/guard-core-jvm at the PINNED REF 09dfddf as the +// check out Guard-Core/guard-core-jvm at the PINNED REF db716ec as the // sibling directory ./guard-core-jvm, and the block below substitutes the // declared coordinates com.guard-core:guard-core / // com.guard-core:guard-core-engine with the included build's projects. @@ -63,7 +63,7 @@ if (useComposite) { roots.firstOrNull { it.resolve("settings.gradle.kts").isFile } ?: throw GradleException( "The guard-core-jvm engine checkout was not found. Clone Guard-Core/guard-core-jvm " + - "at the pinned ref 09dfddf next to this repository (or point -PguardCoreJvmDir / " + + "at the pinned ref db716ec next to this repository (or point -PguardCoreJvmDir / " + "GUARD_CORE_JVM_DIR at an existing checkout). Searched: " + roots.joinToString(", ") { it.path }, )