Merge pull request #2855 from hongwei1/develop-obp

Thin-jar packaging, connector stability fixes, and portable/robust CI test tooling

Author: simonredfern

.github/Dockerfile_PreBuild

@@ -3,7 +3,8 @@ FROM eclipse-temurin:25-jre-alpine
 RUN addgroup -S obp && adduser -S -h /app -G obp obp
 
 # Copy OBP source code
-# Copy build artifact (JAR file) from maven build
+# Copy build artifact (JAR file) and its runtime dependencies from maven build
+COPY /obp-api/target/lib /app/lib
 COPY /obp-api/target/obp-api.jar /app/obp-api.jar
 WORKDIR /app
 USER obp

.github/workflows/build_container.yml

@@ -51,10 +51,12 @@ jobs:
           # Test classes must be in target/test-classes for the test shards.
           # `clean` for a guaranteed-correct build. A no-clean Zinc incremental cache
           # (actions/cache of target/) was measured and saved only ~17s: compile time is
-          # dominated by Maven startup + dependency resolution + packaging the ~297MB fat
-          # jar + install — NOT by Scala compilation (a zero-source-change rebuild was
-          # still 333s vs 350s). The stale-risk class of no-clean incremental builds is
-          # not worth ~2.7% of wall-clock, so we keep a full clean build.
+          # dominated by Maven startup + dependency resolution + install — NOT by Scala
+          # compilation (a zero-source-change rebuild was still 333s vs 350s; this was
+          # measured before the fat-jar-to-thin-jar switch, so the packaging share of
+          # that number no longer applies and hasn't been re-measured). The stale-risk
+          # class of no-clean incremental builds is not worth ~2.7% of wall-clock, so we
+          # keep a full clean build.
           MAVEN_OPTS="-Xmx3G -Xss2m -XX:MaxMetaspaceSize=1G" \
             mvn clean install -T 4 -Pprod -DskipTests
 
@@ -69,7 +71,10 @@ jobs:
             obp-commons/target/
 
       - name: Save .jar artifact
-        run: mkdir -p ./push && cp obp-api/target/obp-api.jar ./push/
+        run: |
+          mkdir -p ./push
+          cp obp-api/target/obp-api.jar ./push/
+          cp -r obp-api/target/lib ./push/lib
 
       - uses: actions/upload-artifact@v4
         with:
@@ -409,8 +414,14 @@ jobs:
             maven-build-shard${{ matrix.shard }}.log | head -200 || true
           echo ""
           echo "=== FAILING TEST SCENARIOS (with 30 lines context) ==="
-          if grep -C 30 -n "\*\*\* FAILED \*\*\*" maven-build-shard${{ matrix.shard }}.log; then
-            echo "Failing tests detected in shard ${{ matrix.shard }}."
+          # maven.test.failure.ignore=true (root pom) makes mvn exit 0 even when a suite
+          # aborts entirely — "*** FAILED ***" alone misses that, since scalatest prints
+          # "*** RUN ABORTED ***" / "*** SUITE ABORTED ***" instead for e.g. an
+          # ExceptionInInitializerError, and neither pattern was being checked. That let
+          # a genuinely aborted suite report CI green silently.
+          if grep -C 30 -n -E "\*\*\* FAILED \*\*\*|\*\*\* RUN ABORTED \*\*\*|\*\*\* SUITE ABORTED \*\*\*" \
+              maven-build-shard${{ matrix.shard }}.log; then
+            echo "Failing/aborted tests detected in shard ${{ matrix.shard }}."
             exit 1
           else
             echo "No failing tests detected in shard ${{ matrix.shard }}."

.github/workflows/build_pull_request.yml

@@ -65,7 +65,10 @@ jobs:
             obp-commons/target/
 
       - name: Save .jar artifact
-        run: mkdir -p ./pull && cp obp-api/target/obp-api.jar ./pull/
+        run: |
+          mkdir -p ./pull
+          cp obp-api/target/obp-api.jar ./pull/
+          cp -r obp-api/target/lib ./pull/lib
 
       - uses: actions/upload-artifact@v4
         with:
@@ -404,8 +407,14 @@ jobs:
             maven-build-shard${{ matrix.shard }}.log | head -200 || true
           echo ""
           echo "=== FAILING TEST SCENARIOS (with 30 lines context) ==="
-          if grep -C 30 -n "\*\*\* FAILED \*\*\*" maven-build-shard${{ matrix.shard }}.log; then
-            echo "Failing tests detected in shard ${{ matrix.shard }}."
+          # maven.test.failure.ignore=true (root pom) makes mvn exit 0 even when a suite
+          # aborts entirely — "*** FAILED ***" alone misses that, since scalatest prints
+          # "*** RUN ABORTED ***" / "*** SUITE ABORTED ***" instead for e.g. an
+          # ExceptionInInitializerError, and neither pattern was being checked. That let
+          # a genuinely aborted suite report CI green silently.
+          if grep -C 30 -n -E "\*\*\* FAILED \*\*\*|\*\*\* RUN ABORTED \*\*\*|\*\*\* SUITE ABORTED \*\*\*" \
+              maven-build-shard${{ matrix.shard }}.log; then
+            echo "Failing/aborted tests detected in shard ${{ matrix.shard }}."
             exit 1
           else
             echo "No failing tests detected in shard ${{ matrix.shard }}."

README.md

@@ -76,11 +76,29 @@ java -jar obp-api/target/obp-api.jar
 
 The http4s server binds to `hostname` / `dev.port` as configured in your props file (defaults are `127.0.0.1` and `8080`).
 
-No `--add-opens` flags are needed on the command line: the executable jar's manifest carries
+`obp-api.jar` is a thin jar: it contains only this module's classes and resources. Its
+runtime dependencies are copied to the sibling `obp-api/target/lib/` directory by the build,
+and the jar's manifest carries a `Class-Path` entry pointing at `lib/`, so the jar and `lib/`
+must stay next to each other — copying the jar alone is not enough to run it.
+
+No `--add-opens` flags are needed on the command line: the jar's manifest also carries
 an `Add-Opens` attribute (JEP 261) with all modules the runtime needs (CGLib proxy generation,
 Kryo serialization, Pekko remoting, Scala runtime reflection). Only when launching via a
-custom classpath (`java -cp ... bootstrap.http4s.Http4sServer`) do the flags need to be passed
-explicitly, since the manifest is only honored by `java -jar`.
+custom classpath does the manifest not apply, since it is only honored by `java -jar`; the
+equivalent form needs the flags passed explicitly:
+
+```sh
+java --add-opens java.base/java.lang=ALL-UNNAMED \
+     --add-opens java.base/java.lang.reflect=ALL-UNNAMED \
+     --add-opens java.base/java.util=ALL-UNNAMED \
+     --add-opens java.base/java.lang.invoke=ALL-UNNAMED \
+     --add-opens java.base/java.util.jar=ALL-UNNAMED \
+     --add-opens java.base/sun.reflect.generics.reflectiveObjects=ALL-UNNAMED \
+     --add-opens java.base/java.io=ALL-UNNAMED \
+     --add-opens java.base/java.util.concurrent=ALL-UNNAMED \
+     --add-opens java.base/java.security=ALL-UNNAMED \
+     -cp "obp-api/target/obp-api.jar:obp-api/target/lib/*" bootstrap.http4s.Http4sServer
+```
 
 [Note: How to run via IntelliJ IDEA](obp-api/src/main/docs/glossary/Run_via_IntelliJ_IDEA.md)
 

branding.md

@@ -9,5 +9,6 @@ RUN --mount=type=cache,target=$HOME/.m2 MAVEN_OPTS="-Xmx3G -Xss2m" mvn install -
 RUN --mount=type=cache,target=$HOME/.m2 MAVEN_OPTS="-Xmx3G -Xss2m" mvn install -DskipTests -pl obp-api
 
 FROM eclipse-temurin:25-jre-alpine
+COPY --from=maven /usr/src/OBP-API/obp-api/target/lib /app/lib
 COPY --from=maven /usr/src/OBP-API/obp-api/target/obp-api.jar /app/obp-api.jar
 ENTRYPOINT ["java", "-jar", "/app/obp-api.jar"]

development/docker/Dockerfile

@@ -4,16 +4,12 @@ WORKDIR /app
 
 # Copy Maven configuration files
 COPY pom.xml .
-COPY build.sbt .
 
 # Copy source code and necessary project files
 COPY obp-api/ ./obp-api/
 COPY obp-commons/ ./obp-commons/
-COPY project/ ./project/
 
-# Copy other necessary files for the build
-COPY jitpack.yml .
-COPY web-app_2_3.dtd .
+
 
 EXPOSE 8080
 

development/docker/Dockerfile.dev

@@ -124,7 +124,7 @@ fi
 
 echo ""
 echo "✓ Build completed successfully"
-echo "✓ JAR created: obp-api/target/obp-api.jar"
+echo "✓ JAR created: obp-api/target/obp-api.jar (thin jar — runtime deps in obp-api/target/lib/)"
 echo "✓ Build log saved to: build.log"
 echo ""
 
@@ -147,7 +147,10 @@ JAVA_OPTS="--add-opens java.base/java.lang=ALL-UNNAMED \
 --add-opens java.base/java.util=ALL-UNNAMED \
 --add-opens java.base/java.lang.invoke=ALL-UNNAMED \
 --add-opens java.base/java.util.jar=ALL-UNNAMED \
---add-opens java.base/sun.reflect.generics.reflectiveObjects=ALL-UNNAMED"
+--add-opens java.base/sun.reflect.generics.reflectiveObjects=ALL-UNNAMED \
+--add-opens java.base/java.io=ALL-UNNAMED \
+--add-opens java.base/java.util.concurrent=ALL-UNNAMED \
+--add-opens java.base/java.security=ALL-UNNAMED"
 
 RUNTIME_LOG=/tmp/obp-api.log
 

flushall_build_and_run.sh

@@ -292,7 +292,7 @@ fi
 
 echo ""
 echo "✓ Fast build completed successfully"
-echo "✓ JAR created: obp-api/target/obp-api.jar"
+echo "✓ JAR created: obp-api/target/obp-api.jar (thin jar — runtime deps in obp-api/target/lib/)"
 echo "✓ Build log saved to: fast_build.log"
 echo ""
 
@@ -315,7 +315,10 @@ JAVA_OPTS="--add-opens java.base/java.lang=ALL-UNNAMED \
 --add-opens java.base/java.util=ALL-UNNAMED \
 --add-opens java.base/java.lang.invoke=ALL-UNNAMED \
 --add-opens java.base/java.util.jar=ALL-UNNAMED \
---add-opens java.base/sun.reflect.generics.reflectiveObjects=ALL-UNNAMED"
+--add-opens java.base/sun.reflect.generics.reflectiveObjects=ALL-UNNAMED \
+--add-opens java.base/java.io=ALL-UNNAMED \
+--add-opens java.base/java.util.concurrent=ALL-UNNAMED \
+--add-opens java.base/java.security=ALL-UNNAMED"
 
 if [ "$RUN_BACKGROUND" = true ]; then
     # Run in background with output to log file

flushall_fast_build_and_run.sh

@@ -568,6 +568,7 @@
   </dependencies>
 
   <build>
+    <finalName>obp-api</finalName>
     <plugins>
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
@@ -586,8 +587,8 @@
             <forkMode>once</forkMode>
             <junitxml>.</junitxml>
             <filereports>WDF TestSuite.txt</filereports>
-            <!-- Keep this module list identical to the shaded-jar manifest's Add-Opens
-                 (below, near maven-shade-plugin's ManifestResourceTransformer): a module
+            <!-- Keep this module list identical to the thin-jar manifest's Add-Opens
+                 (below, near maven-jar-plugin's manifestEntries): a module
                  opened for the test JVM but not production (or vice versa) causes an
                  InaccessibleObjectException that only reproduces in whichever environment
                  is missing it. -->
@@ -738,57 +739,57 @@
           <release>${java.version}</release>
         </configuration>
       </plugin>
-      <!-- maven-shade-plugin: Create executable fat JAR with all dependencies -->
+      <!-- Thin JAR: project classes/resources only. Runnable via `java -jar` because the
+           manifest carries Main-Class + Class-Path (relative lib/) + Add-Opens.
+           JEP 261: the `java -jar` launcher honors Add-Opens from the manifest.
+           Required on JDK 17+ for CGLib (StarConnector proxy generation via
+           ClassLoader.defineClass), Kryo/chill serialization, Pekko remoting and
+           Scala runtime reflection. development/docker/Dockerfile (local dev
+           image) relies on this and launches with a plain `java -jar`.
+           .github/Dockerfile_PreBuild (the production image) instead keeps its
+           own explicit "add-opens" ENTRYPOINT flags — that is the combination
+           actually verified against the K8s deployment, so don't remove it in
+           favor of this manifest alone without re-verifying in that environment.
+           Keep this module list identical to the scalatest-maven-plugin argLine
+           above (surefire test JVM): a module opened here but not there (or vice
+           versa) causes an InaccessibleObjectException that only reproduces in
+           whichever environment is missing it. -->
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
-        <artifactId>maven-shade-plugin</artifactId>
-        <version>3.5.1</version>
+        <artifactId>maven-jar-plugin</artifactId>
+        <version>3.4.2</version>
         <configuration>
-          <shadedArtifactAttached>false</shadedArtifactAttached>
-          <createDependencyReducedPom>false</createDependencyReducedPom>
-          <transformers>
-            <transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
+          <archive>
+            <manifest>
               <mainClass>bootstrap.http4s.Http4sServer</mainClass>
-              <!-- JEP 261: the `java -jar` launcher honors Add-Opens from the manifest.
-                   Required on JDK 17+ for CGLib (StarConnector proxy generation via
-                   ClassLoader.defineClass), Kryo/chill serialization, Pekko remoting and
-                   Scala runtime reflection. development/docker/Dockerfile (local dev
-                   image) relies on this and launches with a plain `java -jar`.
-                   .github/Dockerfile_PreBuild (the production image) instead keeps its
-                   own explicit "add-opens" ENTRYPOINT flags — that is the combination
-                   actually verified against the K8s deployment, so don't remove it in
-                   favor of this manifest alone without re-verifying in that environment.
-                   Keep this module list identical to the scalatest-maven-plugin argLine
-                   above (surefire test JVM): a module opened here but not there (or vice
-                   versa) causes an InaccessibleObjectException that only reproduces in
-                   whichever environment is missing it. -->
-              <manifestEntries>
-                <Add-Opens>java.base/java.lang java.base/java.lang.reflect java.base/java.util java.base/java.lang.invoke java.base/java.util.jar java.base/sun.reflect.generics.reflectiveObjects java.base/java.io java.base/java.util.concurrent java.base/java.security</Add-Opens>
-              </manifestEntries>
-            </transformer>
-            <transformer implementation="org.apache.maven.plugins.shade.resource.AppendingTransformer">
-              <resource>reference.conf</resource>
-            </transformer>
-          </transformers>
-          <filters>
-            <filter>
-              <artifact>*:*</artifact>
-              <excludes>
-                <exclude>META-INF/*.SF</exclude>
-                <exclude>META-INF/*.DSA</exclude>
-                <exclude>META-INF/*.RSA</exclude>
-              </excludes>
-            </filter>
-          </filters>
-          <finalName>obp-api</finalName>
+              <addClasspath>true</addClasspath>
+              <classpathPrefix>lib/</classpathPrefix>
+            </manifest>
+            <manifestEntries>
+              <Add-Opens>java.base/java.lang java.base/java.lang.reflect java.base/java.util java.base/java.lang.invoke java.base/java.util.jar java.base/sun.reflect.generics.reflectiveObjects java.base/java.io java.base/java.util.concurrent java.base/java.security</Add-Opens>
+            </manifestEntries>
+          </archive>
         </configuration>
+      </plugin>
+
+      <!-- Copy runtime dependencies to target/lib/ (sibling of obp-api.jar) -->
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-dependency-plugin</artifactId>
+        <version>3.8.1</version>
         <executions>
           <execution>
-            <id>make-fat-jar</id>
-            <phase>package</phase>
+            <id>copy-runtime-deps</id>
+            <phase>prepare-package</phase>
             <goals>
-              <goal>shade</goal>
+              <goal>copy-dependencies</goal>
             </goals>
+            <configuration>
+              <outputDirectory>${project.build.directory}/lib</outputDirectory>
+              <includeScope>runtime</includeScope>
+              <overWriteReleases>false</overWriteReleases>
+              <overWriteSnapshots>true</overWriteSnapshots>
+            </configuration>
           </execution>
         </executions>
       </plugin>