From 1b63f2a6c2c5df56c7b70fce9f5d945940d6b03b Mon Sep 17 00:00:00 2001 From: Renn F Date: Thu, 15 Oct 2026 21:09:49 +0200 Subject: [PATCH] chore(engine): pin guard-core-jvm to 6cde4af Moves the pinned engine ref from db716ec to 6cde4af (guard-core-jvm master, the 4.4.0 line) in CI, CodeQL, the release build, settings and the docs, so CI tests the engine code that ships in 4.4.0. --- .github/workflows/ci.yml | 6 +++--- .github/workflows/code-ql.yml | 4 ++-- .github/workflows/release.yml | 4 ++-- CHANGELOG.md | 1 + CONTRIBUTING.md | 2 +- README.md | 4 ++-- docs/examples.md | 2 +- docs/installation.md | 4 ++-- examples/demo-boot/README.md | 4 ++-- examples/demo-boot/settings.gradle.kts | 4 ++-- settings.gradle.kts | 4 ++-- 11 files changed, 20 insertions(+), 19 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d484d3a..a1481e0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,15 +25,15 @@ jobs: with: persist-credentials: false - # The engine dependency: guard-core-jvm pinned at db716ec (full SHA for the + # The engine dependency: guard-core-jvm pinned at 6cde4af (full SHA for the # actions/checkout fetch), checked # out as the sibling directory ./guard-core-jvm and substituted for the # declared com.guardcore:guard-core coordinates by settings.gradle.kts. - - name: Checkout engine (guard-core-jvm @ db716ec) + - name: Checkout engine (guard-core-jvm @ 6cde4af) uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: Guard-Core/guard-core-jvm - ref: db716ec0a038fa3dd0a145211bf6a1f18c178d03 + ref: 6cde4afd08a0172c5f6a41eb8e29ec754288782e path: guard-core-jvm persist-credentials: false diff --git a/.github/workflows/code-ql.yml b/.github/workflows/code-ql.yml index e1cea84..c4b1bf4 100644 --- a/.github/workflows/code-ql.yml +++ b/.github/workflows/code-ql.yml @@ -23,11 +23,11 @@ jobs: # The engine dependency: the composite includeBuild needs the pinned # guard-core-jvm checkout next to the repository (same as ci.yml). - - name: Checkout engine (guard-core-jvm @ db716ec) + - name: Checkout engine (guard-core-jvm @ 6cde4af) uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: Guard-Core/guard-core-jvm - ref: db716ec0a038fa3dd0a145211bf6a1f18c178d03 + ref: 6cde4afd08a0172c5f6a41eb8e29ec754288782e path: guard-core-jvm persist-credentials: false diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cedbf2d..e1b0c03 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -72,11 +72,11 @@ jobs: persist-credentials: false # Same engine checkout as ci.yml (the composite default for tests). - - name: Checkout engine (guard-core-jvm @ db716ec) + - name: Checkout engine (guard-core-jvm @ 6cde4af) uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: Guard-Core/guard-core-jvm - ref: db716ec0a038fa3dd0a145211bf6a1f18c178d03 + ref: 6cde4afd08a0172c5f6a41eb8e29ec754288782e path: guard-core-jvm persist-credentials: false diff --git a/CHANGELOG.md b/CHANGELOG.md index eb66dc3..e73cfa4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,7 @@ ### Changed +- The pinned guard-core-jvm engine ref moves to 6cde4af (guard-core-jvm master, the 4.4.0 line), so CI tests the engine code that ships in 4.4.0. It adds the empty-whitelist fix (an empty global whitelist now means no whitelist, guard-core-jvm#57) on top of db716ec. The lockstep `guardCore` version stays 4.3.3 until 4.4.0 is on Maven Central. - The pinned guard-core-jvm engine ref moves to db716ec, which carries the detection scan budget, semantic header handling and cookie split (guard-core-jvm#53) and the dynamic rules overlay (guard-core-jvm#55). - Telemetry agent support: an `AgentHandlerProtocol` bean (for example guard-agent-jvm's `GuardAgentTelemetry`) is now injected into `GuardMiddleware` by the auto-configuration, adopted into the engine composite on initialization, and stopped through the new `GuardMiddleware.shutdown()` when the context closes. Before this, `guard.enable-agent=true` always degraded with a "W7 artifact" message, because the middleware had no way to receive a handler. The degrade path now only applies when no handler bean is registered. The pinned guard-core-jvm engine ref moves to 9067b7b, whose agent telemetry wiring fix (Guard-Core/guard-core-jvm#48) the handler needs to receive anything. - `GuardMiddleware.shutdown()` now also closes the middleware's own redis handler, and stops the injected agent handler directly when initialization never ran (a lazily initialized app that saw no traffic), so an agent created with `cfg.redis` no longer leaks its persistence connection and daemon thread. It runs under the initialization mutex and is safe to call twice. The README documents that exactly one `AgentHandlerProtocol` bean is supported and adds the guard-agent-jvm dependency line. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 0160b86..53f18d2 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -22,7 +22,7 @@ side in the same directory) at the pinned ref: ```bash git clone https://github.com/Guard-Core/guard-core-jvm ../guard-core-jvm -git -C ../guard-core-jvm checkout db716ec +git -C ../guard-core-jvm checkout 6cde4af ./gradlew build # detekt + ktfmt check + tests (redis-backed tests skip when redis is down) ``` diff --git a/README.md b/README.md index 82ac823..26c1f07 100644 --- a/README.md +++ b/README.md @@ -132,7 +132,7 @@ logs the same "eager init not honored" warning as fastapi-guard. The engine artifact `com.guard-core:guard-core` (groupId is the Central Portal namespace; Kotlin packages stay `com.guardcore.*`) is on Maven Central for consumers. This repository's own build pins the engine from source instead: CI and local builds check out `Guard-Core/guard-core-jvm` at the -pinned ref `db716ec` as the sibling directory `./guard-core-jvm`, and `settings.gradle.kts` +pinned ref `6cde4af` as the sibling directory `./guard-core-jvm`, and `settings.gradle.kts` substitutes the declared coordinates `com.guard-core:guard-core:4.3.3` / `com.guard-core:guard-core-engine:4.3.3` with the included build's projects (the Gradle analog of the Rust path+version pattern). The declared dependency coordinates stay @@ -152,7 +152,7 @@ Local checkout: ```bash git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm -git -C guard-core-jvm checkout db716ec +git -C guard-core-jvm checkout 6cde4af ./gradlew build ``` diff --git a/docs/examples.md b/docs/examples.md index ae14173..fd22279 100644 --- a/docs/examples.md +++ b/docs/examples.md @@ -7,7 +7,7 @@ routes, live Redis-backed rate limiting, and per-route decorator configs. git clone https://github.com/Guard-Core/spring-boot-guard.git cd spring-boot-guard git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm -git -C guard-core-jvm checkout db716ec +git -C guard-core-jvm checkout 6cde4af docker run -d -p 6379:6379 redis:7-alpine ./gradlew :examples:demo-boot:bootRun ``` diff --git a/docs/installation.md b/docs/installation.md index 9fffcbf..479cfcb 100644 --- a/docs/installation.md +++ b/docs/installation.md @@ -23,7 +23,7 @@ packages stay `com.guardcore.*`. ## Engine dependency (includeBuild + dependency substitution) Consumers resolve the engine artifact `com.guard-core:guard-core` from Maven Central. This repository's own build pins the engine from source instead: CI and -local builds check out `Guard-Core/guard-core-jvm` at the pinned ref `db716ec` +local builds check out `Guard-Core/guard-core-jvm` at the pinned ref `6cde4af` as the sibling directory `./guard-core-jvm`, and `settings.gradle.kts` substitutes the declared coordinates `com.guard-core:guard-core:4.3.3` / `com.guard-core:guard-core-engine:4.3.3` with the included build's projects. @@ -32,7 +32,7 @@ The declared dependency coordinates stay `com.guard-core:guard-core:4.3.3` ```bash git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm -git -C guard-core-jvm checkout db716ec +git -C guard-core-jvm checkout 6cde4af ./gradlew build ``` diff --git a/examples/demo-boot/README.md b/examples/demo-boot/README.md index da1d8af..2b5107a 100644 --- a/examples/demo-boot/README.md +++ b/examples/demo-boot/README.md @@ -21,12 +21,12 @@ engine's `SecurityConfig` field names). Prerequisites: -1. Clone Guard-Core/guard-core-jvm at the pinned ref `db716ec` next to this repository +1. Clone Guard-Core/guard-core-jvm at the pinned ref `6cde4af` next to this repository (the engine builds from source via includeBuild until the artifacts publish): ```bash git clone https://github.com/Guard-Core/guard-core-jvm.git guard-core-jvm - git -C guard-core-jvm checkout db716ec + git -C guard-core-jvm checkout 6cde4af ``` 2. A Redis on `localhost:6379` (rate limiting), or set `guard.enable-redis: false` in diff --git a/examples/demo-boot/settings.gradle.kts b/examples/demo-boot/settings.gradle.kts index b9525a2..22d73d3 100644 --- a/examples/demo-boot/settings.gradle.kts +++ b/examples/demo-boot/settings.gradle.kts @@ -15,7 +15,7 @@ rootProject.name = "demo-boot" // The adapter and the engine are consumed from source until both publish: // the adapter repo sits two levels up and the engine at the pinned ref -// db716ec sits next to it (the same includeBuild convention as the adapter). +// 6cde4af sits next to it (the same includeBuild convention as the adapter). includeBuild("../../") { dependencySubstitution { substitute(module("com.guardcore:spring-boot-guard")).using(project(":")) @@ -35,7 +35,7 @@ val engineDir: File = run { ) roots.firstOrNull { it.resolve("settings.gradle.kts").isFile } ?: throw GradleException( - "Clone Guard-Core/guard-core-jvm at the pinned ref db716ec next to the " + + "Clone Guard-Core/guard-core-jvm at the pinned ref 6cde4af next to the " + "spring-boot-guard repository first (or point -PguardCoreJvmDir / " + "GUARD_CORE_JVM_DIR at an existing checkout). Searched: " + roots.joinToString(", ") { it.path }, diff --git a/settings.gradle.kts b/settings.gradle.kts index 7fe2c4f..42b979e 100644 --- a/settings.gradle.kts +++ b/settings.gradle.kts @@ -13,7 +13,7 @@ pluginManagement { // GUARD_CORE_USE_COMPOSITE (environment variable): // unset / "1" / "true" -> composite ON (default). The engine is built from // source via includeBuild + dependency substitution: CI (and local builds) -// check out Guard-Core/guard-core-jvm at the PINNED REF db716ec as the +// check out Guard-Core/guard-core-jvm at the PINNED REF 6cde4af as the // sibling directory ./guard-core-jvm, and the block below substitutes the // declared coordinates com.guard-core:guard-core / // com.guard-core:guard-core-engine with the included build's projects. @@ -63,7 +63,7 @@ if (useComposite) { roots.firstOrNull { it.resolve("settings.gradle.kts").isFile } ?: throw GradleException( "The guard-core-jvm engine checkout was not found. Clone Guard-Core/guard-core-jvm " + - "at the pinned ref db716ec next to this repository (or point -PguardCoreJvmDir / " + + "at the pinned ref 6cde4af next to this repository (or point -PguardCoreJvmDir / " + "GUARD_CORE_JVM_DIR at an existing checkout). Searched: " + roots.joinToString(", ") { it.path }, )