forked from Cognition-Partner-Workshops/otterworks
-
Notifications
You must be signed in to change notification settings - Fork 0
Java 17 across every JVM service; report-service and legacy-portal to Spring Boot 3.2.5 #275
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
devin-ai-integration
wants to merge
10
commits into
main
Choose a base branch
from
devin/1788425768-java17-boot3
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
10 commits
Select commit
Hold shift + click to select a range
a9028cb
docs: Java 17 / Spring Boot 3.2 migration intake inventory
devin-ai-integration[bot] fa68adc
ci: build report-service and legacy-portal on JDK 17; deps harness me…
devin-ai-integration[bot] 72bca29
legacy-portal: OpenRewrite UpgradeSpringBoot_3_2 (javax->jakarta, Jav…
devin-ai-integration[bot] 5818d2e
legacy-portal: finish Java 17 / Spring Boot 3.2.5 migration
devin-ai-integration[bot] d626ca6
Merge remote-tracking branch 'origin/devin/1788425768-java17-boot3-le…
devin-ai-integration[bot] 40b8fe2
report-service: apply OpenRewrite UpgradeSpringBoot_3_2 recipe output
devin-ai-integration[bot] f42b8c0
report-service: hand-fix post-rewrite for Java 17 / Spring Boot 3.2.5
devin-ai-integration[bot] 1ffccef
Merge remote-tracking branch 'origin/devin/1788425768-java17-boot3-re…
devin-ai-integration[bot] f9a55dc
java17-boot3: MIGRATION_NOTES, permit ERROR dispatch in report-servic…
devin-ai-integration[bot] 11e850b
deps harness: re-record Maven module baselines on JDK 17 (script look…
devin-ai-integration[bot] File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,118 @@ | ||
| # Java 17 / Spring Boot 3.2 migration notes | ||
|
|
||
| Inventory: `docs/java17-migration-intake.yaml`. Every JVM service in the repo is now on | ||
| Java 17 in all three places that count — build file, Dockerfile base images, CI `java-version`. | ||
|
|
||
| | Service | Build | Before | After | Class | | ||
| |---|---|---|---|---| | ||
| | `services/report-service` | Maven | Java 8 / Spring Boot 2.5.15 / `maven:3.8.7-eclipse-temurin-8` + `eclipse-temurin:8-jre` / CI `'8'` | Java 17 / Spring Boot 3.2.5 / `maven:3.9-eclipse-temurin-17` + `eclipse-temurin:17-jre-jammy` / CI `'17'` | migrate | | ||
| | `services/legacy-portal` | Maven (`./mvnw`) | Java 11 / Spring Boot 2.7.18 / `maven:3.9-eclipse-temurin-11` + `eclipse-temurin:11-jre-jammy` / CI `'11'` | Java 17 / Spring Boot 3.2.5 / `maven:3.9-eclipse-temurin-17` + `eclipse-temurin:17-jre-jammy` / CI `'17'` | migrate | | ||
| | `services/auth-service` | Gradle | Java 17 / Spring Boot 3.2.4 / `gradle:8.6-jdk17` + `eclipse-temurin:17-jre-jammy` / CI `'17'` | unchanged (verified) | verify | | ||
| | `services/notification-service` | Gradle KTS (Kotlin 1.9.23, Ktor 2.3.9) | `jvmToolchain(17)` / `gradle:8.6-jdk17` + `eclipse-temurin:17-jre-jammy` / CI `'17'` | unchanged (verified) | jdk-only | | ||
| | `services/analytics-service` | sbt (Scala 3.4.0, Akka HTTP 10.5.3) | `sbtscala/scala-sbt:eclipse-temurin-jammy-17.0.10…` + `eclipse-temurin:17-jre-jammy` / CI `'17'` | unchanged (verified) | jdk-only | | ||
|
|
||
| Excluded: `frontend/client-app/mobile/android` (Android Gradle project, not a server-side JVM service; already on JDK 17). | ||
|
|
||
| ## report-service (Java 8 / Boot 2.5.15 → Java 17 / Boot 3.2.5) | ||
|
|
||
| OpenRewrite `org.openrewrite.java.spring.boot3.UpgradeSpringBoot_3_2` did: | ||
| - Boot parent → 3.2.x, `<java.version>17</java.version>`; dropped the explicit `maven.compiler.*`, | ||
| compiler/surefire plugin versions, `mockito-core` version and the `javax.servlet-api` dependency | ||
| (all managed by the Boot parent or provided by Tomcat 10). | ||
| - `javax.persistence` / `javax.validation` / `javax.annotation` → `jakarta.*` across entities, | ||
| controllers and config. | ||
| - JUnit 4 → JUnit 5 (`@Test`, `@BeforeEach`, `Assertions`, `Assumptions`) in all 7 test classes and | ||
| removed the `junit:junit` dependency and the Jupiter exclusion on `spring-boot-starter-test`. | ||
| - `commons-lang` 2.6 → `commons-lang3` (managed) and `StringUtils` import updates. | ||
| - Removed `spring.mvc.pathmatch.matching-strategy=ant-path-matcher` (SpringFox workaround). | ||
|
|
||
| Hand-fixed after the recipe: | ||
| - Pinned the parent to exactly 3.2.5 (recipe picked the latest 3.2.x). | ||
| - Spring Security 6: `WebSecurityConfigurerAdapter` → `SecurityFilterChain` bean with the lambda | ||
| DSL (`authorizeHttpRequests` / `requestMatchers` / `headers(...)`), plus | ||
| `dispatcherTypeMatchers(DispatcherType.ERROR).permitAll()` so 400/404 responses reach the | ||
| client as JSON errors instead of empty 403s (Security 6 authorizes the ERROR dispatch too). | ||
| - SpringFox 3 (dead, incompatible with Spring 6) → `springdoc-openapi-starter-webmvc-ui` 2.5.0: | ||
| `@Api*` → `@Schema` / `@Operation`, `Docket` → `OpenAPI` bean, docs now at `/v3/api-docs` and | ||
| `/swagger-ui.html` (were `/v2/api-docs`, `/swagger-ui/`); security matchers updated accordingly. | ||
| - Hibernate 6: `Report.errorMessage` (`@Lob String`) annotated `@JdbcTypeCode(SqlTypes.LONGVARCHAR)` | ||
| so the column stays `varchar` instead of becoming a Postgres `oid`. Verified: `reports.error_message` | ||
| is `character varying(32600)` against Postgres 15. | ||
| - Apache HttpClient 4 → HttpClient 5 (Spring 6 dropped the 4.x request factory); read timeout moved to | ||
| `SocketConfig` on the pooling connection manager. | ||
| - Removed the explicit `hibernate.dialect` properties (Hibernate 6 auto-detects and warns otherwise). | ||
| - Dockerfile builder/runtime → `maven:3.9-eclipse-temurin-17` / `eclipse-temurin:17-jre-jammy`. | ||
| - Kept deliberately: `commons-text` 1.9 (CVE-2022-42889 fixture for the dependency-remediation lab), | ||
| POI 4.1.2, iText 5.5.13.3, Guava 28, Commons IO 2.6 — out of scope for this migration. | ||
|
|
||
| `--add-opens`: none. Tests: 50 run / 0 failed / 1 skipped before (JUnit 4, JDK 8) and after (JUnit 5, | ||
| JDK 17); the skipped test is the opt-in dependency-transcript emitter. | ||
|
|
||
| ## legacy-portal (Java 11 / Boot 2.7.18 → Java 17 / Boot 3.2.5) | ||
|
|
||
| OpenRewrite did: | ||
| - Boot parent → 3.2.x, `<java.version>17</java.version>`, dropped redundant `maven.compiler.*`. | ||
| - `javax.persistence` / `javax.validation` / `javax.annotation` → `jakarta.*` in 7 source files | ||
| (`Announcement`, `Feedback`, `UserPreference` entities and their controllers, `PortalBrandingSettings`). | ||
| - Split the `postgres` profile out of `application.yml` into `application-postgres.yml` (Boot 3 no | ||
| longer accepts multi-document profile activation the old way). | ||
|
|
||
| Hand-fixed after the recipe: exact 3.2.5 parent; removed explicit Hibernate dialect settings; | ||
| Dockerfile builder/runtime → `maven:3.9-eclipse-temurin-17` / `eclipse-temurin:17-jre-jammy`; | ||
| removed stale "Java 11" comments in `README.md`/`Dockerfile`. No Spring Security, no `@Lob`, no | ||
| `spring.factories`, no JAXB/Nashorn — as expected coming from 11, there was little beyond the | ||
| namespace change. `commons-configuration2` 2.8.0 kept (transitive `commons-text` 1.9 fixture). | ||
|
|
||
| `--add-opens`: none. Tests: 16 run / 0 failed / 1 skipped before and after. | ||
|
|
||
| ## Shared files (lead) | ||
|
|
||
| - `.github/workflows/ci.yml`, `.github/workflows/docker-build.yml`: report-service and legacy-portal | ||
| jobs now `setup-java` Temurin `'17'` with `cache: maven`. | ||
| - `.github/workflows/deps-remediation.yml`, `security/deps/modules.yaml`, | ||
| `.agents/skills/dependency-cve-remediation/SKILL.md`: the dependency-remediation harness measures | ||
| the two Maven modules on JDK 17 instead of JDK 11. | ||
| - `README.md`: service table no longer describes report-service as Java 8 / Boot 2.5. | ||
|
|
||
| ## Runtime verification (JDK 17, against Postgres 15 via `docker-compose.infra.yml`) | ||
|
|
||
| Both migrated apps start on Boot 3.2.5 with no `spring-boot-properties-migrator` findings | ||
| (only the default `spring.jpa.open-in-view` notice that Boot 2.x also logged). | ||
|
|
||
| report-service (`:8091`): `/health`, `/actuator/health`, `/v3/api-docs`, `/swagger-ui/index.html` → 200; | ||
| `POST /api/v1/reports` → 202, report reaches `COMPLETED` (CSV, 25 rows), `GET /api/v1/reports/{id}` → 200, | ||
| list → 200, `DELETE` → 204, unknown id → 404, bad id → 400 JSON. | ||
|
|
||
| legacy-portal (`:8095`, `postgres` profile): `/health`, `/actuator/health` → 200; announcements | ||
| create 201 / publish 200 / list 200; preferences put+get 200; feedback submit 201 (validation errors | ||
| still 400) / list 200 / average-rating 200; unknown announcement → 404. | ||
|
|
||
| Behaviour differences vs `main` worth knowing: | ||
| - Trailing-slash URLs (`/api/v1/reports/`, `/api/announcements/`) now 404 (Boot 3 / Spring 6 default). | ||
| No caller uses them — the API gateway routes `/api/v1/reports` and the frontend never calls either | ||
| service directly. | ||
| - report-service paths not covered by a security matcher (e.g. `/nope`) now return 403 instead of 404 | ||
| (Security 6 denies unmatched requests). Not reachable through the gateway. | ||
| - Swagger moved from `/v2/api-docs` + `/swagger-ui/` to `/v3/api-docs` + `/swagger-ui.html`. | ||
|
|
||
| ## Dependency-remediation harness | ||
|
|
||
| `security/deps/expected/{report-service,legacy-portal}.json` were re-recorded on JDK 17 | ||
| (`make deps-record MODULE=<id> ALLOW_RERECORD=1 REASON=...`). The previous recordings came from | ||
| JDK 11, where `${script:javascript:3+4}` resolved to `7` via Nashorn; on 17 there is no script | ||
| engine, so the vulnerable-baseline outcome for `attack-script-lookup` is now an | ||
| `IllegalArgumentException`. The remediated contract is unaffected: with a fixed commons-text the | ||
| case must read back `ok` with the literal template, which is still a different outcome from the | ||
| baseline, so the `attack` policy grades exactly as before. Legacy-portal's cases contain no | ||
| script lookup; only its recording metadata changed. `make deps-transcript-baseline` passes on 17. | ||
|
|
||
| ## Follow-ups | ||
|
|
||
| - `services/report-service/UPGRADE_GUIDE.md` and `docs/{CI_STRATEGY,EVENT_DRIVEN_SECURITY,SDLC-COVERAGE}.md`, | ||
| `docs/labs/security-sprint-guide.md`, `.devin/wiki.json` still describe report-service as Java 8; | ||
| the Trivy exclusion for report-service in `security-scan.yml` can be reconsidered now that it is on 17. | ||
| - `infrastructure/helm/report-service/Chart.yaml` description says "Java 8/Spring Boot 2.5" — charts | ||
| ship from upstream `main`, so this needs an upstream PR rather than a change here. | ||
| - Library modernisation deliberately left out: POI 4 → 5, iText 5 → OpenPDF, Guava 28 → 33, | ||
| Commons IO 2.6 → 2.15, `java.util.Date` → `java.time`, RestTemplate → RestClient. | ||
| - Add JWT validation on `/api/v1/reports/**` (pre-existing TODO, unchanged). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| # Intake inventory for the Java 17 / Spring Boot 3.2 migration. The per-service | ||
| # java / framework / dockerfile / ci fields record the state FOUND at intake (pre-migration), | ||
| # which is what `class` was decided from; `targets` is the end state. The post-migration | ||
| # state of every service is in MIGRATION_NOTES.md. | ||
| repo: https://github.com/COG-GTM/otterworks | ||
| default_branch: main | ||
| recorded_from: main@e66f76ca | ||
| services: | ||
| - name: report-service | ||
| path: services/report-service | ||
| build: maven | ||
| java: 8 | ||
| framework: spring-boot 2.5.15 | ||
| dockerfile: maven:3.8.7-eclipse-temurin-8 / eclipse-temurin:8-jre | ||
| ci: ci.yml report-service (java-version '8'), docker-build.yml report-service-tests (java-version '8') | ||
| class: migrate | ||
| notes: SpringFox 3.0, JUnit 4, WebSecurityConfigurerAdapter, @Lob String on Report | ||
| - name: legacy-portal | ||
| path: services/legacy-portal | ||
| build: maven (./mvnw 3.9.9) | ||
| java: 11 | ||
| framework: spring-boot 2.7.18 | ||
| dockerfile: maven:3.9-eclipse-temurin-11 / eclipse-temurin:11-jre-jammy | ||
| ci: ci.yml legacy-portal (java-version '11'), docker-build.yml legacy-portal-tests (java-version '11') | ||
| class: migrate | ||
| - name: auth-service | ||
| path: services/auth-service | ||
| build: gradle | ||
| java: 17 # sourceCompatibility = JavaVersion.VERSION_17 | ||
| framework: spring-boot 3.2.4 | ||
| dockerfile: gradle:8.6-jdk17 / eclipse-temurin:17-jre-jammy | ||
| ci: ci.yml + docker-build.yml (java-version '17') | ||
| class: verify | ||
| - name: notification-service | ||
| path: services/notification-service | ||
| build: gradle-kts | ||
| java: 17 # jvmToolchain(17) | ||
| framework: ktor 2.3.9 (kotlin 1.9.23) | ||
| dockerfile: gradle:8.6-jdk17 / eclipse-temurin:17-jre-jammy | ||
| ci: ci.yml (java-version '17') | ||
| class: jdk-only | ||
| - name: analytics-service | ||
| path: services/analytics-service | ||
| build: sbt | ||
| java: 17 # sbtscala/scala-sbt:eclipse-temurin-jammy-17.0.10 builder | ||
| framework: akka-http 10.5.3 (scala 3.4.0) | ||
| dockerfile: sbtscala/scala-sbt:eclipse-temurin-jammy-17.0.10_7_1.9.9_3.4.1 / eclipse-temurin:17-jre-jammy | ||
| ci: ci.yml (java-version '17') | ||
| class: jdk-only | ||
| shared: | ||
| - .github/workflows/ci.yml # report-service / legacy-portal job blocks pin 8 / 11 | ||
| - .github/workflows/docker-build.yml # report-service-tests / legacy-portal-tests pin 8 / 11 | ||
| - .github/workflows/deps-remediation.yml # installs 17 + 11 (11 as ambient JDK for the Maven modules) | ||
| excluded: | ||
| - frontend/client-app/mobile/android # Android Gradle project, not a JVM service (already JDK 17 per PR #14) | ||
| targets: | ||
| java: 17 | ||
| spring_boot: 3.2.5 | ||
| demo_mode: true | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.