Repository navigation
chore: post-consolidation follow-ups (ADR-072) - #4
Merged
Merged
Conversation
groupId com.keyorix already carries the product name; the -java suffix is
redundant in a Java-only ecosystem and breaks symmetry with npm's
@keyorixhq/sdk and PyPI's keyorix. Nothing is published under com.keyorix
yet, so this is free now and permanent (a groupId+artifactId is immutable
once published to Maven Central) once it isn't.
Searched the whole repo for other keyorix-java references before
committing: only .gitignore's provenance comment ("# java/ (from
keyorix-java/.gitignore)") remains, correctly untouched -- that's the old
repo's name in prose, not a package identity. Everything else that WAS
package identity is updated in this commit, not left half-consistent:
pom.xml's <name> (paired display name) and <url> (was pointing at the
now-archived standalone repo, now points at java/ in keyorix-sdks), and
README.md's title and dependency snippet (also fixed the snippet's stale
0.1.0 version to match pom.xml's actual 0.2.1 while touching that block).
Judgment call, flagging explicitly rather than silently deciding: pom.xml's
sonar.projectKey also said keyorix-java (the old repo's SonarCloud
project). Changed to keyorixhq_keyorix-sdks -- a single combined project
for the whole consolidated repo, matching keyorix's own ADR-070 precedent
of folding multiple directories into one SonarCloud project rather than
maintaining one per subdirectory. This is a config-string update only, not
an actual SonarCloud registration (that remains a manual setup step, same
as the npm/PyPI defensive registrations).
Verified: `mvn -q -DskipTests package` from java/ produces
target/keyorix-sdk-0.2.1.jar (and the matching sources jar) -- the new
artifactId resolves and the build isn't broken by the rename.
Signed-off-by: Andrei Beshkov <andrey.beshkov@gmail.com>
Repo-wide search for keyorix-java/-go/-node/-python/-py as package or module identity (java's own instance already handled in the previous commit). Found three real hits, distinct from the .gitignore/CI-comment provenance notes that are correctly left alone (repo names in archive- pointer prose, not package identity, per the same distinction applied throughout this consolidation): - python/README.md's own title said "# keyorix-py" -- stale even by the old repo's own naming (the actual repo was keyorix-python, not keyorix-py) and never fixed when go/node/java's READMEs were retitled during the consolidation. Its `pip install keyorix` line was already correct and untouched. - node/examples/petstore/README.md and python/examples/petstore/README.md both described "the keyorix-node SDK" / "the keyorix-python SDK" -- informal prose, not an install instruction, but still names a package that doesn't exist under that name; a reader could reasonably go looking for it. go/examples/petstore/README.md has no equivalent sentence to begin with; nothing to fix there. Signed-off-by: Andrei Beshkov <andrey.beshkov@gmail.com>
New BACKLOG.md (this repo didn't have one yet), recording two findings from ADR-072's Phase 7 supply-chain audit that weren't fixed as part of the consolidation -- both are SDK behavior changes, out of scope for that work: - URL scheme restriction on the caller-supplied server URL (bandit B310 in python/keyorix.py specifically, but the same unrestricted-scheme pattern exists in all four SDKs' request-URL construction). - All four SDKs embedding the raw server response body into thrown errors on non-2xx responses -- the candidate for a required redaction test in the eventual generation ADR, with the Go MCP server's genericReadError as the precedent to follow. Not implemented here -- backlog entries only. Signed-off-by: Andrei Beshkov <andrey.beshkov@gmail.com>
go.yml and java.yml both named their primary job build-test; node.yml and python.yml both named theirs test. These are separate, path-filtered workflow files, so GitHub matches required-status-checks by literal context name (confirmed from keyorix's own protection config, e.g. "Analyze (server)" vs "Analyze (operator)" are distinguished precisely by rendering as different names) -- an identical job name across two path-filtered workflows means a PR touching both languages would show two check-runs with the same name, and a required check on that name could be satisfied by either one succeeding. A broken Go build could hide behind a passing Java build under the same nominal gate, or vice versa. Renamed: build-test -> build-test-go (go.yml), build-test -> build-test-java (java.yml), test -> test-node (node.yml), test -> test-python (python.yml). No `needs:` references anywhere in these files depended on the old names (checked before renaming). Verified: every job ID across all five workflow files is now unique (11 total, zero duplicates), and actionlint is clean. Prerequisite for setting keyorix-sdks' branch protection to the keyorix repo's equivalent -- found while drafting that config, not yet applied. Signed-off-by: Andrei Beshkov <andrey.beshkov@gmail.com>
PR #4's CI surfaced this: pyproject.toml's build-backend was "setuptools.backends.legacy:build", which doesn't exist on the CI runner's setuptools -- "Dependency audit (pip-audit)" and "SBOM (CycloneDX)" both failed at `pip install ".[dev]"` with BackendUnavailable: Cannot import 'setuptools.backends.legacy'. Predates this consolidation entirely (present since keyorix-python's v0.1.0, 2026-04-20, verified via git show on the original commit) -- it just never got exercised in CI before, since no CI existed for python until this consolidation wired it up. Correct value is the standard setuptools.build_meta. That alone wasn't sufficient: with the real backend actually running package auto-discovery, it found two top-level modules in a flat layout (keyorix.py and test_keyorix.py) and refused to guess which to package. Added [tool.setuptools] py-modules = ["keyorix"] to make it explicit (also verified the correct TOML key is hyphenated py-modules, not py_modules -- the latter fails setuptools' own pyproject.toml schema validation). Verified end-to-end in a fresh venv, not just that it doesn't error: `pip install ".[dev]"` succeeds and builds a real wheel (keyorix-0.2.1-py3-none-any.whl), pip-audit exits 0 ("no known vulnerabilities found"), cyclonedx-py's SBOM command exits 0, bandit still reads its config correctly (exit 1, the same 4 already-documented findings -- not a regression), and python -m unittest test_keyorix.py still passes 6/6. Signed-off-by: Andrei Beshkov <andrey.beshkov@gmail.com>
Caught live on PR #4: the "Run OWASP Dependency Check" step sat in_progress for over an hour with zero output, then confirmed via the GitHub API it genuinely wasn't moving. Without NVD_API_KEY (not configured for this repo yet), dependency-check-maven falls back to NVD's free/unauthenticated API for its CVE database sync, which NVD rate-limits aggressively enough to hang rather than fail. Cancelled the stuck run (repos/.../actions/runs/.../cancel) and added timeout-minutes: 15 so this fails fast on future PRs instead of quietly burning Actions minutes for hours until the secret exists. Signed-off-by: Andrei Beshkov <andrey.beshkov@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
keyorix-java->keyorix-sdk, matching@keyorixhq/sdk/PyPIkeyorixsymmetry.groupId com.keyorixunchanged. Updated every adjacent reference (pom.xml's<name>/<url>/sonar.projectKey, README's title + dependency snippet). Verified:mvn -q -DskipTests packageproduceskeyorix-sdk-0.2.1.jar.keyorix-java/-go/-node/-python/-pyas package/module identity (distinct from repo names in archive-pointer prose, which are left alone). Fixedpython/README.md's stale title and both Node/Python petstore examples' descriptions of "the keyorix-node/-python SDK."genericReadErrorin the Go MCP server as precedent).go.yml/java.ymlboth had a job namedbuild-test;node.yml/python.ymlboth had one namedtest. Since these are separate path-filtered workflow files, GitHub's required-status-check matching by literal name means a passing check from one language could silently satisfy what was meant to gate a different one. Renamed tobuild-test-go/build-test-java/test-node/test-python— all 11 job IDs across the repo now unique, verified via a full scan.Test plan
mvn -q -DskipTests package(java/) — produceskeyorix-sdk-0.2.1.jaractionlinton all modified workflow files — clean