mohityadav766 · Oct 14, 2026 · Oct 14, 2026 · Oct 14, 2026 · Oct 14, 2026 · Oct 14, 2026
@@ -0,0 +1,108 @@
+name: CI Java reactor
+description: >-
+  Build the Maven reactor the integration tests need once per run and share it, or
+  restore it in a job that only runs tests. `mode: build` installs the reactor
+  (`-pl :openmetadata-integration-tests -am`, tests skipped) and uploads the
+  project's own artifacts as one bundle; `mode: restore` downloads that bundle,
+  checks it belongs to the checked-out commit, and unpacks it into ~/.m2.
+inputs:
+  mode:
+    description: build | restore
+    required: true
+  artifact-name:
+    description: Name of the bundle artifact in this run.
+    required: false
+    default: java-reactor
+  retention-days:
+    description: Kept long enough for re-runs and for entries that use this run as their parent.
+    required: false
+    default: '3'
+runs:
+  using: composite
+  steps:
+    - name: Build and bundle the reactor
+      if: ${{ inputs.mode == 'build' }}
+      shell: bash
+      env:
+        SOURCE_SHA: ${{ github.sha }}
+      run: |
+        project_version="$(mvn --quiet --non-recursive help:evaluate \
+          -Dexpression=project.version -DforceStdout -Dstyle.color=never)"
+        if [[ ! "$project_version" =~ ^[A-Za-z0-9][A-Za-z0-9._+-]*$ ]]; then
+          echo "Invalid Maven project version: $project_version"
+          exit 1
+        fi
+        project_repository="$HOME/.m2/repository/org/open-metadata"
+        # A restored ~/.m2 cache can hold this version from another commit; it must
+        # not leak into the bundle.
+        if [[ -d "$project_repository" ]]; then
+          find "$project_repository" -mindepth 2 -maxdepth 2 -type d \
+            -name "$project_version" -prune -exec rm -rf -- {} +
+        fi
+        mvn -B -DskipTests -DskipITs -Dspring-boot.repackage.skip=true --no-snapshot-updates \
+          clean install -pl :openmetadata-integration-tests -am
+
+        staging="$RUNNER_TEMP/java-reactor-repository"
+        bundle="$RUNNER_TEMP/java-reactor"
+        mkdir -p "$staging/org/open-metadata" "$bundle"
+        count=0
+        while IFS= read -r -d '' version_directory; do
+          artifact_id="$(basename "$(dirname "$version_directory")")"
+          mkdir -p "$staging/org/open-metadata/$artifact_id"
+          cp -a "$version_directory" "$staging/org/open-metadata/$artifact_id/"
+          count=$((count + 1))
+        done < <(find "$project_repository" -mindepth 2 -maxdepth 2 -type d \
+          -name "$project_version" -print0)
+        if (( count == 0 )); then
+          echo "The Maven build did not install any reactor artifacts."
+          exit 1
+        fi
+        find "$staging" -type f -name '*-boot.jar' -delete
+        tar -C "$staging" -czf "$bundle/reactor-repository.tar.gz" org
+        (cd "$bundle" && sha256sum reactor-repository.tar.gz > reactor-repository.sha256)
+        printf '%s\n' "$project_version" > "$bundle/project-version.txt"
+        printf '%s\n' "$SOURCE_SHA" > "$bundle/source-sha.txt"
+        du -h "$bundle/reactor-repository.tar.gz" | tee -a "$GITHUB_STEP_SUMMARY"
+
+    - name: Upload the reactor bundle
+      if: ${{ inputs.mode == 'build' }}
+      uses: actions/upload-artifact@v7
+      with:
+        name: ${{ inputs.artifact-name }}
+        overwrite: true
+        path: ${{ runner.temp }}/java-reactor
+        if-no-files-found: error
+        retention-days: ${{ inputs.retention-days }}
+        compression-level: 0
+
+    - name: Download the reactor bundle
+      if: ${{ inputs.mode == 'restore' }}
+      uses: actions/download-artifact@v7
+      with:
+        name: ${{ inputs.artifact-name }}
+        path: ${{ runner.temp }}/java-reactor
+
+    - name: Restore the reactor into ~/.m2
+      if: ${{ inputs.mode == 'restore' }}
+      shell: bash
+      run: |
+        bundle="$RUNNER_TEMP/java-reactor"
+        (cd "$bundle" && sha256sum --check reactor-repository.sha256)
+        project_version="$(<"$bundle/project-version.txt")"
+        source_sha="$(<"$bundle/source-sha.txt")"
+        if [[ ! "$project_version" =~ ^[A-Za-z0-9][A-Za-z0-9._+-]*$ ]]; then
+          echo "Invalid Maven project version: $project_version"
+          exit 1
+        fi
+        if [[ "$(git rev-parse HEAD)" != "$source_sha" ]]; then
+          echo "The build artifact does not match the checked-out commit."
+          exit 1
+        fi
+        project_repository="$HOME/.m2/repository/org/open-metadata"
+        if [[ -d "$project_repository" ]]; then
+          find "$project_repository" -mindepth 2 -maxdepth 2 -type d \
+            -name "$project_version" -prune -exec rm -rf -- {} +
+        fi
+        mkdir -p "$HOME/.m2/repository"
+        tar -C "$HOME/.m2/repository" -xzf "$bundle/reactor-repository.tar.gz"
+        test -s "$project_repository/openmetadata-service/$project_version/openmetadata-service-$project_version.jar"
@@ -0,0 +1,49 @@
+name: CI system dependencies
+description: >-
+  The apt packages and ANTLR CLI the Java test jobs need, installed with every
+  fetch bounded and retried. The hosted runners' Azure apt mirror intermittently
+  blackholes connections; unbounded, apt falls back to archive.ubuntu.com and can
+  hang until the job timeout with no output.
+runs:
+  using: composite
+  steps:
+    - name: Install Ubuntu dependencies
+      shell: bash
+      run: |
+        sudo tee /etc/apt/apt.conf.d/99-ci-timeouts >/dev/null <<'APTCONF'
+        Acquire::Retries "3";
+        Acquire::http::Timeout "30";
+        Acquire::https::Timeout "30";
+        Acquire::http::No-Cache "true";
+        APTCONF
+        # The whole retry budget stays inside the caller's step timeout, so a
+        # truncated retry can still say why it gave up.
+        APT_BUDGET=600
+        APT_DEADLINE=$((SECONDS + APT_BUDGET))
+        apt_retry() {
+          local limit=$1; shift
+          local i remaining
+          for i in 1 2 3; do
+            remaining=$((APT_DEADLINE - SECONDS))
+            if [ "$remaining" -le 30 ]; then
+              echo "::error::apt-get $1 gave up: exhausted the ${APT_BUDGET}s apt budget"
+              return 1
+            fi
+            if [ "$limit" -gt "$remaining" ]; then
+              limit=$remaining
+            fi
+            if sudo timeout "$limit" apt-get "$@"; then
+              return 0
+            fi
+            if [ "$i" -lt 3 ]; then
+              echo "::warning::apt-get $1 failed or hung (attempt $i/3); retrying in 10s"
+              sleep 10
+            fi
+          done
+          echo "::error::apt-get $1 failed after 3 attempts"
+          return 1
+        }
+        apt_retry 240 update
+        apt_retry 300 install -y unixodbc-dev python3-venv librdkafka-dev gcc libsasl2-dev \
+          build-essential libssl-dev libffi-dev libevent-dev jq
+        sudo make install_antlr_cli
@@ -0,0 +1,138 @@
+{
+  "schemaVersion": 1,
+  "statusContext": "merge-gate",
+  "shadowStatusContext": "merge-gate (shadow)",
+  "workflow": ".github/workflows/ci.yml",
+  "summaryJob": "ci-summary",
+  "verify": {
+    "entryRuns": 3,
+    "parentRuns": 3,
+    "maxFailingTests": 10,
+    "timeoutMinutes": 45,
+    "parentArtifactWaitMinutes": 15,
+    "suites": {
+      "java-it": {
+        "jobs": [
+          "it / *"
+        ],
+        "maxFailingTests": 20
+      },
+      "python": {
+        "jobs": [
+          "py-it / *"
+        ],
+        "maxFailingTests": 20
+      },
+      "playwright": {
+        "jobs": [
+          "playwright / *"
+        ],
+        "maxFailingTests": 10
+      }
+    }
+  },
+  "budgets": {
+    "maxAttempts": 2,
+    "maxInfraRerunsPerPrPerDay": 3,
+    "maxRerunsPerHour": 8,
+    "maxEntryAgeMinutes": 180,
+    "maxPrRerunsPerHour": 20
+  },
+  "strictPaths": [
+    ".github/**",
+    ".claude/**",
+    "openmetadata-integration-tests/pom.xml",
+    "openmetadata-ui/src/main/resources/ui/playwright.config.ts",
+    "ingestion/noxfile.py",
+    "ingestion/setup.py",
+    "ingestion/pyproject.toml"
+  ],
+  "deterministicJobs": [
+    "static / *"
+  ],
+  "verifyJobs": [
+    "verify / *"
+  ],
+  "deterministicSignatures": [
+    {
+      "id": "compile-error",
+      "pattern": "COMPILATION ERROR|cannot find symbol|error TS\\d{4}:"
+    },
+    {
+      "id": "build-commit-mismatch",
+      "pattern": "The build artifact does not match the checked-out commit"
+    },
+    {
+      "id": "merge-group-validation",
+      "pattern": "Merge-group validation failed: (authorization|planning|nonemptyPlan)"
+    }
+  ],
+  "infraClassifications": [
+    "setup_failure",
+    "infrastructure_failure",
+    "missing_results",
+    "hung_test"
+  ],
+  "infraSteps": "^(Set up job|Complete job|Checkout.*|Free [Dd]isk [Ss]pace.*|Install (Ubuntu|system|apt).*|Install .*(?:[Pp]ackages|[Dd]ependencies|deps|CLI)\\b.*|Download .*|(?:Post )?Run [\\w.-]+/[\\w.-]+@.*|Restore .*|Set ?up (Java|JDK|Python|Node|uv|Docker|Buildx|Openmetadata Test Environment).*|Start .*(environment|services|stack).*|Prepare .*|Login to .*|Pull .*image.*|Build [\\w.-]+/[\\w.-]+@.*)$",
+  "infraSignatures": [
+    {
+      "id": "apt-budget",
+      "pattern": "exhausted the \\d+s apt budget|apt-get .* failed after \\d+ attempts"
+    },
+    {
+      "id": "artifact-transport",
+      "pattern": "FinalizeArtifact.*\\(403\\)|\\(409\\) Conflict: an artifact with this name already exists|Failed to (upload|download) artifact"
+    },
+    {
+      "id": "runner-lost",
+      "pattern": "lost communication with the server|received a shutdown signal|The runner has received a shutdown signal|The operation was canceled"
+    },
+    {
+      "id": "disk-full",
+      "pattern": "No space left on device"
+    },
+    {
+      "id": "maven-transfer",
+      "pattern": "Could not transfer artifact .* (50\\d|Gateway|Service Unavailable)|Connection reset by peer"
+    },
+    {
+      "id": "pypi",
+      "pattern": "pypi\\.org.*(50\\d|Service Unavailable|timed out)|Request failed after \\d+ retries"
+    },
+    {
+      "id": "container-not-ready",
+      "pattern": "failed on setup with .*(not ready|TimeoutError|ConnectionError)|Container startup failed|Could not find a valid Docker environment|RyukResourceReaper|Could not connect to Ryuk|ContainerLaunchException|Timed out waiting for (?:container port to open|log output matching)"
+    },
+    {
+      "id": "docker-pull",
+      "pattern": "toomanyrequests|pull rate limit|manifest unknown.*registry"
+    },
+    {
+      "id": "lane-wedge",
+      "pattern": "exit code 124|unexpected end of stream on http://localhost"
+    },
+    {
+      "id": "killed",
+      "pattern": "exit code 1(37|43)\\b|Killed\\b.*out of memory|OOMKilled"
+    },
+    {
+      "id": "action-image",
+      "pattern": "Docker build failed with exit code"
+    },
+    {
+      "id": "network",
+      "pattern": "Connection reset by peer|ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|getaddrinfo|socket hang up|Temporary failure in name resolution|Could not resolve host|Name or service not known|No route to host|Network is unreachable|TLS handshake timeout|SSL_ERROR_SYSCALL|net/http: request canceled|connect timed out|Read timed out|Remote host terminated the handshake"
+    },
+    {
+      "id": "registry-5xx",
+      "pattern": "(?:registry\\.npmjs\\.org|registry\\.yarnpkg\\.com|repo1?\\.maven\\.org|repo\\.maven\\.apache\\.org|maven\\.pkg\\.github\\.com|pypi\\.org|files\\.pythonhosted\\.org|ghcr\\.io|docker\\.io|registry-1\\.docker\\.io|objects\\.githubusercontent\\.com|codeload\\.github\\.com|api\\.github\\.com|archive\\.ubuntu\\.com|ports\\.ubuntu\\.com|security\\.ubuntu\\.com)[^\\n]{0,160}\\b(?:429|50[0234])\\b|\\b(?:429|50[0234])\\b[^\\n]{0,160}(?:registry\\.npmjs\\.org|registry\\.yarnpkg\\.com|repo1?\\.maven\\.org|repo\\.maven\\.apache\\.org|maven\\.pkg\\.github\\.com|pypi\\.org|files\\.pythonhosted\\.org|ghcr\\.io|docker\\.io|registry-1\\.docker\\.io|objects\\.githubusercontent\\.com|codeload\\.github\\.com|api\\.github\\.com|archive\\.ubuntu\\.com|ports\\.ubuntu\\.com|security\\.ubuntu\\.com)"
+    }
+  ],
+  "testFailureMarkers": "(?m)Tests run: \\d+, Failures: [1-9]|Tests run: \\d+, Failures: \\d+, Errors: [1-9]|There (?:are|were) test failures|Tests:\\s+\\d+ failed|^FAILED \\S+::|=+ \\d+ failed|FAILED \\(failures=",
+  "transient": {
+    "maxAttempts": 3,
+    "triageMaxJobs": 5,
+    "excerptLines": 300,
+    "excerptChars": 16000
+  }
+}
@@ -0,0 +1,16 @@
+"""AI helpers for the merge gate. Advisory, with one bounded exception: a triage answer
+can earn a job a re-run, and nothing here can forgive a failure or pass an entry.
+
+Role 1, explaining an ejection, is `explain.py`. `triage.py` reads a job that failed
+without test evidence and says whether it was a transient blip; merge_gate_triage.py is
+its only caller. The modules split the work so each trust boundary has one owner:
+
+  sanitize     text crossing a boundary: CI evidence into the model, model text out
+  bundle       the deterministic, size-capped evidence the model sees
+  fingerprint  failure identity (reused from the gate) and the bounded verdict cache
+  repro        local repro commands from the repo's planners, never from the model
+  model        the one Messages API call and the checks on what comes back
+  render       the PR comment section
+  usage        token cost, the usage record and the daily cap
+  triage       the blip question, its checked answer and its cache
+"""