chore: post-consolidation follow-ups (ADR-072)

.github/workflows/go.yml

@@ -12,7 +12,7 @@ permissions:
   contents: read
 
 jobs:
-  build-test:
+  build-test-go:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/java.yml

@@ -12,7 +12,7 @@ permissions:
   contents: read
 
 jobs:
-  build-test:
+  build-test-java:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -32,6 +32,14 @@ jobs:
   dependency-check:
     name: SCA scan
     runs-on: ubuntu-latest
+    # Without NVD_API_KEY (not yet configured for this repo), the OWASP
+    # plugin falls back to NVD's free/unauthenticated API for its CVE
+    # database sync, which NVD rate-limits aggressively enough to hang for
+    # hours rather than fail -- confirmed live: a run sat "in progress" on
+    # this exact step for over an hour with zero output before being
+    # cancelled. Fail fast instead of silently burning Actions minutes on
+    # every PR until the secret exists.
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 

.github/workflows/node.yml

@@ -12,7 +12,7 @@ permissions:
   contents: read
 
 jobs:
-  test:
+  test-node:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/python.yml

@@ -12,7 +12,7 @@ permissions:
   contents: read
 
 jobs:
-  test:
+  test-python:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

BACKLOG.md

@@ -0,0 +1,46 @@
+# Keyorix SDKs Backlog
+
+Working list of upcoming and deferred work. Newest decisions at the top of
+each section. For architectural rationale see the `keyorix` repo's ADRs
+(`docs/adr-072-sdk-consolidation.md` and successors).
+
+## In progress / next
+
+- **All four SDKs: restrict URL schemes on the caller-supplied server URL.**
+  Found during ADR-072's Phase 7 supply-chain audit. `python/keyorix.py`
+  calls `urllib.request.urlopen` on `server_url` with no scheme
+  restriction, producing 4 Medium bandit findings (B310) currently
+  suppressed by `continue-on-error: true` in `python.yml`. In a general
+  library this is a Medium; in a secrets client it is the difference
+  between reaching the vault and silently reading a local file or reaching
+  an unintended host, whenever `server_url` originates from an env var or
+  config an attacker can influence. Reachable schemes include `file://`
+  and `ftp://`. Fix: allow `https://` only, with `http://` permitted
+  solely for explicit localhost/loopback — matching the pattern the Go MCP
+  server's `KEYORIX_URL` validation already establishes in the `keyorix`
+  repo (`docs/mcp.md`'s "HTTPS enforced" section). This is a per-language
+  HTTP client concern, not Python-specific — the other three SDKs
+  (`go/keyorix.go`, `node/keyorix.js`, `java/KeyorixClient.java`) all
+  build their request URL from the same kind of caller-supplied base URL
+  and need the same audit, not just Python's. Not implemented here —
+  backlog entry only.
+
+- **All four SDKs: errors embed the raw server response body verbatim.**
+  Also found during Phase 7. On any non-2xx response — including the
+  get-secret-value call specifically — every SDK's shared request-error
+  path embeds the server's raw response body into the thrown
+  error/exception message (`go/keyorix.go`, `node/keyorix.js`,
+  `python/keyorix.py`, `java/KeyorixClient.java` all do this identically).
+  Low practical risk today (a *failed* request didn't return the secret
+  value itself), but it's an unconditional trust-and-relay of upstream
+  content into a client-facing error that every SDK's own README
+  quick-start passes straight to `log.Fatal(err)` / `console.error` /
+  equivalent — exactly the path that lands in application logs and stack
+  traces. This is the concrete candidate for the generation ADR's required
+  redaction test; the Go MCP server's `genericReadError`
+  (`internal/mcp/tools.go` in the `keyorix` repo) is the in-house
+  precedent to follow — a generic client-facing message, with the real
+  detail logged separately for an operator, not echoed back verbatim. Not
+  implemented here — backlog entry only.
+
+## Done

java/README.md

@@ -1,4 +1,4 @@
-# keyorix-java
+# Java SDK
 
 Java SDK for Keyorix — lightweight on-premise secrets manager.
 
@@ -11,8 +11,8 @@ Add to your `pom.xml`:
 ```xml
 <dependency>
     <groupId>com.keyorix</groupId>
-    <artifactId>keyorix-java</artifactId>
-    <version>0.1.0</version>
+    <artifactId>keyorix-sdk</artifactId>
+    <version>0.2.1</version>
 </dependency>
 ```
 

java/pom.xml

@@ -5,13 +5,13 @@
     <modelVersion>4.0.0</modelVersion>
 
     <groupId>com.keyorix</groupId>
-    <artifactId>keyorix-java</artifactId>
+    <artifactId>keyorix-sdk</artifactId>
     <version>0.2.1</version>
     <packaging>jar</packaging>
 
-    <name>keyorix-java</name>
+    <name>keyorix-sdk</name>
     <description>Java SDK for Keyorix — lightweight on-premise secrets manager</description>
-    <url>https://github.com/keyorixhq/keyorix-java</url>
+    <url>https://github.com/keyorixhq/keyorix-sdks/tree/main/java</url>
 
     <licenses>
         <license>
@@ -34,7 +34,7 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <junit.version>5.10.1</junit.version>
         <sonar.organization>keyorixhq</sonar.organization>
-        <sonar.projectKey>keyorixhq_keyorix-java</sonar.projectKey>
+        <sonar.projectKey>keyorixhq_keyorix-sdks</sonar.projectKey>
         <sonar.host.url>https://sonarcloud.io</sonar.host.url>
         <sonar.coverage.jacoco.xmlReportPaths>${project.build.directory}/site/jacoco/jacoco.xml</sonar.coverage.jacoco.xmlReportPaths>
     </properties>

node/examples/petstore/README.md

@@ -1,6 +1,6 @@
 # Keyorix Pet Store (Node.js)
 
-Node.js example app demonstrating keyorix-node SDK in production.
+Node.js example app demonstrating the Keyorix Node.js SDK in production.
 Fetches DB password from Keyorix at startup. Zero hardcoded credentials.
 
 ## Quick start

python/README.md

@@ -1,4 +1,4 @@
-# keyorix-py
+# Python SDK
 
 Python client for Keyorix — lightweight on-premise secrets manager.
 

python/examples/petstore/README.md

@@ -1,6 +1,6 @@
 # Keyorix Pet Store (Python)
 
-Python example app demonstrating keyorix-python SDK in production.
+Python example app demonstrating the Keyorix Python SDK in production.
 Fetches DB password from Keyorix at startup. Zero hardcoded credentials.
 
 ## Quick start

python/pyproject.toml

@@ -1,6 +1,6 @@
 [build-system]
 requires = ["setuptools>=68"]
-build-backend = "setuptools.backends.legacy:build"
+build-backend = "setuptools.build_meta"
 
 [project]
 name = "keyorix"
@@ -38,6 +38,9 @@ dev = [
     "cyclonedx-bom>=4.0",
 ]
 
+[tool.setuptools]
+py-modules = ["keyorix"]
+
 [tool.bandit]
 targets = ["keyorix.py"]
 skips = []