Cicd updates

.github/workflows/gradle-build.yml

@@ -9,17 +9,27 @@ on:
       - 'helm/**'
       - 'docker-compose/**'
       - 'structures-js/**'
-      - 'webdocs/**' 
+      - 'webdocs/**'
       - 'website/**'
+  pull_request:
+    branches:
+      - develop
+    paths-ignore:
+      - 'helm/**'
+      - 'docker-compose/**'
+      - 'structures-js/**'
+      - 'webdocs/**'
+      - 'website/**'
+
+concurrency:
+  group: gradle-build-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   gradle_build_and_publish:
     name: Build and Publish
     runs-on: ubuntu-latest
     steps:
-      - name: Cancel Previous Runs
-        uses: styfle/cancel-workflow-action@0.12.1
-
       - name: Checkout code
         uses: actions/checkout@v4
 
@@ -34,16 +44,39 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v4
 
+      # gradle.properties holds the plain version. Effective version by event:
+      #   PR           -> <base>-pr<PR#>.<sha>  (pullable image to test the PR)
+      #   develop push -> <base>-SNAPSHOT       (development build)
+      #   main push    -> <base>                (release, published as-is)
+      - name: Determine build version
+        id: ver
+        run: |
+          BASE=$(grep '^structuresVersion=' gradle.properties | cut -d= -f2)
+          BASE=${BASE%-SNAPSHOT}
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            SHORT_SHA=$(echo "${{ github.event.pull_request.head.sha }}" | cut -c1-7)
+            VERSION="${BASE}-pr${{ github.event.pull_request.number }}.${SHORT_SHA}"
+            echo "gradle_args=-PstructuresVersion=${VERSION}" >> "$GITHUB_OUTPUT"
+          elif [[ "${{ github.ref_name }}" == "main" ]]; then
+            VERSION="${BASE}"
+            echo "gradle_args=-Prelease" >> "$GITHUB_OUTPUT"
+          else
+            VERSION="${BASE}-SNAPSHOT"
+            echo "gradle_args=" >> "$GITHUB_OUTPUT"
+          fi
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "Building version ${VERSION}"
+
       - name: Build with Gradle
         id: gradle_build
         continue-on-error: true
         env:
           TESTCONTAINERS_RYUK_DISABLED: true
-        run: ./gradlew build 
+        run: ./gradlew build ${{ steps.ver.outputs.gradle_args }}
 
       - name: Publish to Maven Central with JReleaser
-        if: ${{ steps.gradle_build.outcome == 'success' }}
-        run: ./gradlew publish && ./gradlew jreleaserDeploy --info
+        if: ${{ github.event_name == 'push' && steps.gradle_build.outcome == 'success' }}
+        run: ./gradlew publish ${{ steps.ver.outputs.gradle_args }} && ./gradlew jreleaserDeploy --info ${{ steps.ver.outputs.gradle_args }}
         env:
           JRELEASER_MAVENCENTRAL_USERNAME: ${{ secrets.MAVEN_TOKEN_USERNAME }}
           JRELEASER_MAVENCENTRAL_TOKEN: ${{ secrets.MAVEN_TOKEN_PASSWORD }}
@@ -52,9 +85,11 @@ jobs:
           JRELEASER_GPG_SECRET_KEY: ${{ secrets.GPG_KEY_NEW }}
           JRELEASER_GPG_PASSPHRASE: ${{ secrets.GPG_KEY_PASS_NEW }}
 
+      # Fork and dependabot PRs do not receive the Docker Hub secrets, so only
+      # publish images for pushes and same-repo PRs.
       - name: Publish to Docker Hub
-        if: ${{ steps.gradle_build.outcome == 'success' }}
-        run: ./gradlew bootBuildImage --publishImage
+        if: ${{ steps.gradle_build.outcome == 'success' && (github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]')) }}
+        run: ./gradlew bootBuildImage --publishImage ${{ steps.ver.outputs.gradle_args }}
         env:
           DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
           DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
@@ -92,6 +127,10 @@ jobs:
       - name: Run E2E Tests
         id: run_e2e_tests
         continue-on-error: true
+        env:
+          # Shell env overrides the gradle.properties env-file in compose
+          # interpolation, so e2e pulls the image this run just published
+          structuresVersion: ${{ steps.ver.outputs.version }}
         run: |
           cd structures-js/structures-e2e
           gradle pnpmInstall
@@ -111,7 +150,7 @@ jobs:
           path: gh-pages
 
       - name: Generate Allure report
-        uses: simple-elf/allure-report-action@v1.13
+        uses: simple-elf/allure-report-action@v1.15
         id: allure-report
         with:
           allure_results: allure-results
@@ -135,7 +174,7 @@ jobs:
           context: 'Test Report'
           description: 'Passed'
           state: 'success'
-          sha: ${{ github.sha }}
+          sha: ${{ github.event.pull_request.head.sha || github.sha }}
           target_url: https://mindsignited.github.io/structures/allure/${{ github.run_number }}
 
       - name: Check If Failure
@@ -151,5 +190,3 @@ jobs:
 
           # Optionally mark the job as failed
           exit 1
-
-          https://mindsignited.github.io/structures/webdocs/guide/overview.html

.github/workflows/structures-js-publish.yml

@@ -0,0 +1,96 @@
+name: Publish structures-js packages
+
+# Not wired up to automatic triggers yet — run manually from the Actions tab.
+# To enable automatic publishing, replace `on:` with:
+#   on:
+#     push:
+#       branches:
+#         - develop
+#       tags:
+#         - 'v*'
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: structures-js-publish-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  publish:
+    name: Publish @kinotic/structures-api and @kinotic/structures-cli
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: 'https://registry.npmjs.org'
+          scope: '@kinotic'
+          cache: pnpm
+          cache-dependency-path: |
+            structures-js/structures-api/pnpm-lock.yaml
+            structures-js/structures-cli/pnpm-lock.yaml
+
+      - name: Determine version and dist-tag
+        id: ver
+        run: |
+          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
+            VERSION="${GITHUB_REF#refs/tags/v}"
+            DIST_TAG="latest"
+          else
+            BASE=$(node -p "require('./structures-js/structures-api/package.json').version")
+            BASE=${BASE%%-*}
+            SHORT_SHA=$(git rev-parse --short=7 HEAD)
+            VERSION="${BASE}-dev.${SHORT_SHA}"
+            DIST_TAG="dev"
+          fi
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "dist_tag=${DIST_TAG}" >> "$GITHUB_OUTPUT"
+          echo "Publishing version ${VERSION} with dist-tag ${DIST_TAG}"
+
+      - name: Set version in structures-api
+        working-directory: structures-js/structures-api
+        run: npm version --no-git-tag-version --allow-same-version "${{ steps.ver.outputs.version }}"
+
+      - name: Install structures-api deps
+        working-directory: structures-js/structures-api
+        run: pnpm install --frozen-lockfile
+
+      - name: Build structures-api
+        working-directory: structures-js/structures-api
+        run: pnpm build
+
+      - name: Publish structures-api to npm
+        working-directory: structures-js/structures-api
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: pnpm publish --access public --no-git-checks --tag "${{ steps.ver.outputs.dist_tag }}"
+
+      - name: Set version and pin api dep in structures-cli
+        working-directory: structures-js/structures-cli
+        run: |
+          npm version --no-git-tag-version --allow-same-version "${{ steps.ver.outputs.version }}"
+          node -e "
+            const fs = require('fs');
+            const p = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+            p.dependencies['@kinotic/structures-api'] = '${{ steps.ver.outputs.version }}';
+            fs.writeFileSync('package.json', JSON.stringify(p, null, 2) + '\n');
+          "
+
+      - name: Install structures-cli deps
+        working-directory: structures-js/structures-cli
+        run: pnpm install --no-frozen-lockfile
+
+      - name: Publish structures-cli to npm
+        working-directory: structures-js/structures-cli
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: pnpm publish --access public --no-git-checks --tag "${{ steps.ver.outputs.dist_tag }}"

.github/workflows/version-check.yml

@@ -0,0 +1,54 @@
+name: Version Check
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  require_version_bump:
+    name: Require version bump
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Compare version with base branch
+        run: |
+          HEAD_VERSION=$(grep '^structuresVersion=' gradle.properties | cut -d= -f2)
+
+          git fetch origin "${{ github.base_ref }}" --depth=1
+          BASE_VERSION=$(git show "origin/${{ github.base_ref }}:gradle.properties" | grep '^structuresVersion=' | cut -d= -f2)
+
+          # The numeric core ignores any pre-release suffix (-SNAPSHOT, -rc1, ...)
+          HEAD_CORE=${HEAD_VERSION%%-*}
+          BASE_CORE=${BASE_VERSION%%-*}
+
+          echo "Base (${{ github.base_ref }}): ${BASE_VERSION}"
+          echo "Head: ${HEAD_VERSION}"
+
+          fail() { echo "::error::$1"; exit 1; }
+
+          if [[ "${HEAD_CORE}" == "${BASE_CORE}" ]]; then
+            if [[ "${HEAD_VERSION}" == "${BASE_VERSION}" ]]; then
+              fail "structuresVersion is still ${HEAD_VERSION}; bump it in gradle.properties before merging to ${{ github.base_ref }} (releases are immutable in Maven Central)"
+            elif [[ "${HEAD_VERSION}" == "${HEAD_CORE}" ]]; then
+              # pre-release -> release promotion of the same version (e.g. 3.6.0-rc1 -> 3.6.0)
+              echo "Version promotion OK: ${BASE_VERSION} -> ${HEAD_VERSION}"
+            elif [[ "${BASE_VERSION}" == "${BASE_CORE}" ]]; then
+              fail "structuresVersion ${HEAD_VERSION} is a pre-release of ${BASE_VERSION}, which is already released"
+            else
+              # both pre-releases of the same version: head must sort after base
+              HIGHEST=$(printf '%s\n%s\n' "${BASE_VERSION}" "${HEAD_VERSION}" | sort -V | tail -1)
+              if [[ "${HIGHEST}" != "${HEAD_VERSION}" ]]; then
+                fail "structuresVersion ${HEAD_VERSION} is lower than ${BASE_VERSION} on ${{ github.base_ref }}"
+              fi
+              echo "Version bump OK: ${BASE_VERSION} -> ${HEAD_VERSION}"
+            fi
+          else
+            HIGHEST=$(printf '%s\n%s\n' "${BASE_CORE}" "${HEAD_CORE}" | sort -V | tail -1)
+            if [[ "${HIGHEST}" != "${HEAD_CORE}" ]]; then
+              fail "structuresVersion ${HEAD_VERSION} is lower than ${BASE_VERSION} on ${{ github.base_ref }}"
+            fi
+            echo "Version bump OK: ${BASE_VERSION} -> ${HEAD_VERSION}"
+          fi

buildSrc/src/main/groovy/org.kinotic.java-application-conventions.gradle

@@ -34,18 +34,51 @@ dependencies {
 // bootBuildImage task source https://github.com/spring-projects/spring-boot/blob/main/spring-boot-project/spring-boot-tools/spring-boot-gradle-plugin/src/main/java/org/springframework/boot/gradle/tasks/bundling/BootBuildImage.java
 // Paketo options here https://paketo.io/docs/howto/java/#configure-the-jvm-at-runtime
 //                     https://paketo.io/docs/reference/java-reference/
+
+// Full --add-opens set recommended by Apache Ignite for JDK 11+
+// https://ignite.apache.org/docs/latest/quick-start/java#running-ignite-with-java-11-or-later
+// A missing entry surfaces at runtime as InaccessibleObjectException during Ignite marshalling
+def igniteAddOpens = [
+        'java.base/jdk.internal.access',
+        'java.base/jdk.internal.misc',
+        'java.base/sun.nio.ch',
+        'java.base/sun.util.calendar',
+        'java.management/com.sun.jmx.mbeanserver',
+        'jdk.internal.jvmstat/sun.jvmstat.monitor',
+        'java.base/sun.reflect.generics.reflectiveObjects',
+        'jdk.management/com.sun.management.internal',
+        'java.base/java.io',
+        'java.base/java.nio',
+        'java.base/java.net',
+        'java.base/java.util',
+        'java.base/java.util.concurrent',
+        'java.base/java.util.concurrent.locks',
+        'java.base/java.util.concurrent.atomic',
+        'java.base/java.lang',
+        'java.base/java.lang.invoke',
+        'java.base/java.lang.reflect',
+        'java.base/java.math',
+        'java.sql/java.sql',
+        'java.base/java.time',
+        'java.base/java.text',
+        'java.management/sun.management',
+        'java.desktop/java.awt.font'
+].collect { "--add-opens=${it}=ALL-UNNAMED" }.join(' ')
+
 bootBuildImage {
     network = "host"
-    publish = true
+    // Local builds only produce the image; CI publishes by passing --publishImage
+    publish = false
     imageName = "mindsignited/${project.name}:${project.version}"
-    tags = (!version.endsWith('SNAPSHOT') ?
+    // Only release versions (no -SNAPSHOT / -prN.sha suffix) may claim the latest tag
+    tags = (!version.contains('-') ?
             [
                     "mindsignited/${project.name}:latest"
             ]
             : [])
     environment = [
             "BPE_DELIM_JAVA_TOOL_OPTIONS" : " ",
-            "BPE_APPEND_JAVA_TOOL_OPTIONS": "-XX:+UseG1GC -XX:+ScavengeBeforeFullGC -XX:+DisableExplicitGC --add-opens=jdk.management/com.sun.management.internal=ALL-UNNAMED --add-opens=java.base/jdk.internal.misc=ALL-UNNAMED --add-opens=java.base/sun.nio.ch=ALL-UNNAMED --add-opens=java.management/com.sun.jmx.mbeanserver=ALL-UNNAMED --add-opens=java.base/sun.reflect.generics.reflectiveObjects=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.base/java.nio=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED"
+            "BPE_APPEND_JAVA_TOOL_OPTIONS": "-XX:+UseG1GC -XX:+ScavengeBeforeFullGC -XX:+DisableExplicitGC ${igniteAddOpens}".toString()
     ]
     docker {
         publishRegistry {

buildSrc/src/main/groovy/org.kinotic.java-common-conventions.gradle

@@ -5,7 +5,18 @@ plugins {
 }
 
 group 'org.kinotic'
-version "${structuresVersion}"
+
+// gradle.properties holds the plain version (e.g. 3.5.8). Development builds get
+// -SNAPSHOT appended automatically; CI passes -Prelease on main to publish the
+// version as-is (stripping a leftover -SNAPSHOT so the guard and the build agree),
+// and PR builds pass an explicit -PstructuresVersion override.
+def effectiveVersion = "${structuresVersion}"
+if (hasProperty('release')) {
+    effectiveVersion = effectiveVersion - '-SNAPSHOT'
+} else if (!effectiveVersion.contains('-')) {
+    effectiveVersion += '-SNAPSHOT'
+}
+version effectiveVersion
 sourceCompatibility = '21'
 
 repositories {