chore: import vaadin-cdi as a Flow module and run its tests in validation

.github/workflows/update-since-tags.yml

@@ -78,6 +78,21 @@ jobs:
           artifacts: |
             vaadin-spring
 
+      # vaadin-cdi needs its own isolated index for the same reason vaadin-spring
+      # does, and the reasoning above applies unchanged: under the same
+      # com.vaadin:vaadin-cdi GAV it kept its own scheme -- 46 releases from
+      # 1.0.0.alpha1 to 16.1.2 -- before the module was imported into this
+      # repository and started releasing with Flow's version number. Pooling
+      # those onto the shared axis would drop 16.x into the gap between Flow 9.2
+      # and 23.0 and rewrite @since across most of the framework.
+      - uses: vaadin/github-actions/reconcile-since-tags@2a6fabc668c09424c29ca789789e9bf0720de8ee
+        with:
+          group-id: com.vaadin
+          version: ${{ inputs.dev }}
+          index-dir: .since-index-cdi
+          artifacts: |
+            vaadin-cdi
+
       - name: Open pull request
         uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
         with:

.github/workflows/validation.yml

@@ -283,6 +283,172 @@ jobs:
         with:
           name: tests-output-it-${{ matrix.current }}
           path: tests-report-*.tgz
+  cdi-tests:
+    name: CDI Tests (${{ matrix.profile }})
+    # The CDI integration tests deploy to a real application server, which the
+    # generic it-tests matrix cannot express, so computeMatrix.js excludes the
+    # module and it runs here instead. Every change runs the tomee profile as
+    # a smoke test; the other four containers only run when the CDI sources
+    # themselves change, since that is when a container specific regression
+    # gets introduced. Needs the TestBench licence, so not for forks.
+    needs: build
+    if: ${{ !github.event.pull_request.head.repo.fork }}
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        profile: [tomee, wildfly, payara, liberty, tomcat-weld]
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        with:
+          ref: ${{env._HEAD_SHA}}
+          # Full history only where the step below actually diffs. tomee is
+          # ungated, so cloning the whole repository for it buys nothing.
+          fetch-depth: ${{ matrix.profile == 'tomee' && 1 || 0 }}
+      - name: Decide whether to run
+        # Same gating as gradle-tests below: a push or a manual run has nothing
+        # to compare against, and a gate that cannot tell what changed has to
+        # run the job rather than report green.
+        #
+        # The root pom counts as a CDI source: it manages weld.version, which
+        # the tomcat-weld profile resolves weld-servlet-shaded from, so a bump
+        # there is exactly the kind of change only the gated containers see.
+        id: decide
+        run: |
+          set -euo pipefail
+          run=true
+          if [ "${{ matrix.profile }}" != "tomee" ]; then
+            DIFF_BASE=
+            case "$GITHUB_EVENT_NAME" in
+              pull_request)
+                if git fetch --no-tags origin \
+                    "+refs/heads/$_BASE_REF:refs/remotes/origin/$_BASE_REF"; then
+                  DIFF_BASE=$(git merge-base HEAD "refs/remotes/origin/$_BASE_REF" || true)
+                fi
+                ;;
+              merge_group)
+                DIFF_BASE=$_MERGE_GROUP_BASE_SHA
+                ;;
+            esac
+            if [ -z "$DIFF_BASE" ]; then
+              echo "No base to compare against, running every container."
+            elif ! CHANGED=$(git diff --name-only "$DIFF_BASE" HEAD); then
+              echo "Could not diff against $DIFF_BASE, running every container."
+            else
+              RELEVANT=$(printf '%s\n' "$CHANGED" | grep -E \
+                '^(vaadin-cdi/|flow-tests/vaadin-cdi-tests/|pom\.xml$|\.github/workflows/validation\.yml$)' || true)
+              if [ -z "$RELEVANT" ]; then
+                echo "No changes to the CDI modules, tomee alone covers this."
+                run=false
+              else
+                echo "Changes to the CDI modules:"
+                printf '%s\n' "$RELEVANT"
+              fi
+            fi
+          fi
+          echo "run=$run" >> "$GITHUB_OUTPUT"
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        if: ${{ steps.decide.outputs.run == 'true' }}
+        with:
+          node-version: '24.21.0'
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        if: ${{ steps.decide.outputs.run == 'true' }}
+        with:
+          version: '11.26.0'
+      - name: Set up JDK
+        if: ${{ steps.decide.outputs.run == 'true' }}
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: "${{ env.JAVA_VERSION }}"
+          distribution: 'temurin'
+      - name: Set flow version to 999.99-SNAPSHOT
+        if: ${{ steps.decide.outputs.run == 'true' }}
+        run: |
+          ./scripts/computeMatrix.js set-version --version=999.99-SNAPSHOT
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        if: ${{ steps.decide.outputs.run == 'true' }}
+        with:
+          path: ~/.m2/repository
+          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
+          restore-keys: ${{ runner.os }}-maven-
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        if: ${{ steps.decide.outputs.run == 'true' && github.run_attempt == 1 }}
+        with:
+          name: saved-workspace
+      - name: Restore Workspace
+        if: ${{ steps.decide.outputs.run == 'true' && github.run_attempt == 1 }}
+        run: |
+          tar xf workspace.tar
+          tar cf - .m2 | (cd ~ && tar xf -)
+      - name: Compile and Install Flow
+        if: ${{ steps.decide.outputs.run == 'true' && github.run_attempt > 1 }}
+        run: |
+          ./scripts/computeMatrix.js set-version --version=999.99-SNAPSHOT
+          cmd="mvn install -B -ntp -DskipTests  -pl \!flow-plugins/flow-gradle-plugin"
+          eval $cmd -T 2C -q || eval $cmd
+      - name: Set TB License
+        if: ${{ steps.decide.outputs.run == 'true' }}
+        env:
+          TB_LICENSE: ${{ secrets.TB_LICENSE }}
+        run: |
+          mkdir -p ~/.vaadin/
+          echo '{"username":"'`echo $TB_LICENSE | cut -d / -f1`'","proKey":"'`echo $TB_LICENSE | cut -d / -f2`'"}' > ~/.vaadin/proKey
+      - name: Verify the no-container build skips its tests
+        # cdi.container.tests.skip only takes effect when no container profile
+        # is active, which no other job exercises: the module lives in the
+        # it-test-modules profile, so `mvn install -DskipTests` leaves it out,
+        # and every leg below passes -P<container>. Assert it here, once, so a
+        # regression surfaces in CI rather than in someone's `mvn verify` over
+        # flow-tests.
+        if: ${{ steps.decide.outputs.run == 'true' && matrix.profile == 'tomee' }}
+        run: |
+          set -e
+          LOG=mvn-cdi-no-profile.out
+          mvn -B -ntp -e -pl flow-tests/vaadin-cdi-tests verify >"$LOG" 2>&1 || {
+            cat "$LOG"; exit 1; }
+          cat "$LOG"
+          if grep -qE '^\[INFO\] Tests run:' "$LOG"; then
+            echo "::error::CDI container tests ran without a container profile"
+            exit 1
+          fi
+          grep -q 'Tests are skipped' "$LOG" || {
+            echo "::error::surefire did not report the tests as skipped"; exit 1; }
+      - name: Run CDI ITs
+        if: ${{ steps.decide.outputs.run == 'true' }}
+        timeout-minutes: 35
+        run: |
+          # enforcer:enforce has to be named explicitly: the Flow parent keeps
+          # the dependencyConvergence rule in the default-cli execution, so no
+          # lifecycle phase evaluates it. Each container profile brings its own
+          # Arquillian adapter, so this is where a divergence would appear.
+          cmd="mvn -V -B -ntp -e -pl flow-tests/vaadin-cdi-tests -P${{ matrix.profile }} -Dcom.vaadin.testbench.Parameters.maxAttempts=2"
+          set -x -e
+          LOG=mvn-cdi-tests-${{ matrix.profile }}.out
+          : > "$LOG"
+          # Detached the same way the it-tests job detaches its Maven, and for
+          # the same reason twice over: these tests fork application server
+          # JVMs that can outlive Maven and pin the step open by holding a pipe
+          # to tee, and piping would also make the step exit with tee's status
+          # instead of Maven's, so a failing container would report success.
+          $cmd enforcer:enforce verify </dev/null >"$LOG" 2>&1 &
+          MVN_PID=$!
+          tail -f --pid=$MVN_PID "$LOG" &
+          wait $MVN_PID
+      - name: Kill leftover Java processes
+        if: ${{ always() && steps.decide.outputs.run == 'true' }}
+        run: |
+          pkill -TERM java || true
+          sleep 2
+          pkill -KILL java || true
+      - name: Package test-report files
+        if: ${{ always() && steps.decide.outputs.run == 'true' }}
+        run: find . -name surefire-reports -o -name failsafe-reports -o -name error-screenshots -o -name "mvn-*.out" | tar -czf tests-report-cdi-${{ matrix.profile }}.tgz -T -
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: ${{ always() && steps.decide.outputs.run == 'true' }}
+        with:
+          name: tests-output-cdi-${{ matrix.profile }}
+          path: tests-report-*.tgz
   gradle-tests:
     name: Gradle Tests
     # Ports the TeamCity 'Gradle Tests' build. Always runs so it can be marked
@@ -556,7 +722,7 @@ jobs:
     # was cancelled, and a skipped required check satisfies branch
     # protection — letting auto-merge proceed past a cancelled IT.
     if: ${{ always() && !github.event.pull_request.head.repo.fork }}
-    needs: [unit-tests, it-tests]
+    needs: [unit-tests, it-tests, cdi-tests]
     runs-on: ubuntu-24.04
     steps:
       - name: Merge Artifacts
@@ -579,7 +745,7 @@ jobs:
         run: |
           ./scripts/computeMatrix.js test-results >> $GITHUB_STEP_SUMMARY
       - name: Set Failure Status
-        if: ${{ always() && (needs.unit-tests.result != 'success' || needs.it-tests.result != 'success') }}
+        if: ${{ always() && (needs.unit-tests.result != 'success' || needs.it-tests.result != 'success' || needs.cdi-tests.result != 'success') }}
         run: |
           echo "🚫 THERE ARE TEST MODULES WITH FAILURES or BEEN CANCELLED" | tee -a $GITHUB_STEP_SUMMARY
           exit 1

CLAUDE.md

@@ -27,6 +27,7 @@ React support).
 - `flow-devloop-daemon`: daemon for the `vaadin-dev` dev loop
 - `flow-tests/`: integration test suite
 - `vaadin-spring`: Spring Framework integration
+- `vaadin-cdi`: CDI integration
 
 See `guidelines/repository.md` for the full module map and
 `guidelines/architecture.md` for how the pieces fit together.

flow-bom/pom.xml

@@ -126,6 +126,11 @@
         <artifactId>vaadin-spring</artifactId>
         <version>${project.version}</version>
       </dependency>
+      <dependency>
+        <groupId>com.vaadin</groupId>
+        <artifactId>vaadin-cdi</artifactId>
+        <version>${project.version}</version>
+      </dependency>
       <dependency>
         <groupId>com.vaadin</groupId>
         <artifactId>flow-webpush</artifactId>

flow-tests/README.md

@@ -34,7 +34,7 @@ copying the test. Never add the same test in two places.
 
 1. Needs a non-Spring-Boot container? → plain `VaadinServlet` / custom servlet
    service: **test-plain-servlet**; Spring MVC without Boot: **test-plain-spring**;
-   CDI: **test-cdi**.
+   CDI: **vaadin-cdi-tests**.
 2. Needs Spring Security? → **test-spring-security** (its url-mapping /
    context-path / method-security / route-path variants live here as profiles).
 3. Needs a specific theme setting? → custom application theme: **test-themes**;
@@ -73,7 +73,7 @@ copying the test. Never add the same test in two places.
 | **test-spring-security** | Spring Security (auth, url-mapping, method / route-path checks) |
 | **test-livereload** | live reload |
 | **test-redeployment** | Spring DevTools restart |
-| **test-cdi** (future) | the CDI container |
+| **vaadin-cdi-tests** | the CDI container (deploys to a real application server, so it runs only under a container profile) |
 
 Some tests need irreducible special infrastructure and keep their own modules:
 `servlet-containers` (non-Jetty containers), `test-multi-war`,
@@ -178,6 +178,7 @@ Active when `-DskipTests` is **not** set (the default).
 | Module | Description |
 |--------|-------------|
 | **servlet-containers** | Aggregator that runs integration tests on servlet containers other than the default Jetty. Contains a `tomcat10` submodule deploying the root-context WAR onto Apache Tomcat 10 via the Cargo plugin. |
+| **vaadin-cdi-tests** | Arquillian suite for the `vaadin-cdi` integration, deploying to TomEE, WildFly, Payara, Open Liberty and Tomcat+Weld: CDI scopes and contexts, the instantiator, push, i18n, templates and deployment validation. Every test needs an application server, so its tests are skipped unless one of the container profiles is active — see [vaadin-cdi-tests/README.md](vaadin-cdi-tests/README.md). |
 
 ## Nightly Profile
 

flow-tests/pom.xml

@@ -384,6 +384,7 @@
         <module>test-custom-frontend-directory</module>
 
         <module>vaadin-spring-tests</module>
+        <module>vaadin-cdi-tests</module>
         <module>test-vaadin-router</module>
         <module>test-react-adapter</module>
         <module>test-react-adapter/pom-production.xml</module>

flow-tests/vaadin-cdi-tests/README.md

@@ -0,0 +1,41 @@
+# Vaadin CDI tests
+
+Arquillian tests for `vaadin-cdi`. Each test deploys a WAR, assembled by
+ShrinkWrap from this module's effective POM, to a real application server, so
+one of the container profiles has to be selected — without a profile the tests
+are skipped rather than failed:
+
+```sh
+mvn verify -pl flow-tests/vaadin-cdi-tests -Ptomee
+```
+
+The available profiles are `tomee`, `wildfly`, `payara`, `liberty` and
+`tomcat-weld`. Validation runs `tomee` for every change and the rest when the
+CDI sources themselves change; see the `cdi-tests` job in
+`.github/workflows/validation.yml`.
+
+Run these on **JDK 21**, the version validation uses. On JDK 24 and later
+`java.security.Policy.setPolicy` throws `UnsupportedOperationException` (the
+Security Manager is gone, JEP 486), and TomEE calls it while installing its
+JACC policy provider, so the container never starts and every test fails with
+`Could not install JACC Policy Provider` rather than anything about CDI.
+
+The tests drive a real Chrome through TestBench, so a `~/.vaadin/proKey` is
+required and browser windows open while they run.
+
+The tests carrying the `SlowTests` category are excluded by default. They
+still need a container, so enable them alongside one:
+
+```sh
+mvn verify -pl flow-tests/vaadin-cdi-tests -Ptomee,slow-tests
+```
+
+### Dependencies for tests
+
+If there is a need to add or remove a dependency from the test module
+the library should be also be added/removed from the `base(String warName)` 
+method in `ArchiveProvider`.
+
+If the tomee execution doesn't return any clear indication on a failure 
+except 404 for a module then running with the wildfly profile will often
+yield better exception information.