Code build

.github/workflows/.disabled/pre-commit.yml.disabled

@@ -0,0 +1,54 @@
+# -----------------------------------------------------------------------------
+# DISABLED WORKFLOW (kept for reference)
+#
+# This is the default pre-commit workflow intended to run on GitHub-hosted
+# `ubuntu-latest` runners. It has been disabled by renaming the file to end in
+# `.yml.disabled` so GitHub Actions will not discover or execute it. The active
+# workflow used by this repo is `pre-commit.yml`, which targets the SEMOSS
+# self-hosted CodeBuild runner (`codebuild-semoss-github-runner-...`).
+#
+# To restore this default workflow (e.g., if migrating back to GitHub-hosted
+# runners), rename this file back to `pre-commit-default.yml` and remove or
+# rename the self-hosted variant.
+# -----------------------------------------------------------------------------
+
+name: Pre-commit
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Set up Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: '24'
+
+    - name: Install pnpm
+      uses: pnpm/action-setup@v4
+      with:
+        version: 10
+
+    - name: Install dependencies and run frontend linting
+      run: |
+        if [ -d "client" ]; then
+          pnpm install
+          pnpm exec biome format --write && pnpm exec biome lint
+        else
+          echo "No client directory found, skipping frontend linting"
+        fi
+
+    - name: Set up Python
+      uses: actions/setup-python@v4
+      with:
+        python-version: '3.12.9'
+
+    # Official pre-commit action handles caching automatically
+    - uses: pre-commit/action@v3.0.1
+      with:
+        extra_args: --all-files --show-diff-on-failure

.github/workflows/.disabled/unit-test.yml.disabled

@@ -0,0 +1,73 @@
+# -----------------------------------------------------------------------------
+# DISABLED WORKFLOW (kept for reference)
+#
+# This is the default unit-test workflow intended to run on GitHub-hosted
+# `ubuntu-latest` runners. It has been disabled by renaming the file to end in
+# `.yml.disabled` so GitHub Actions will not discover or execute it. The active
+# workflow used by this repo is `unit-test.yml`, which targets the SEMOSS
+# self-hosted CodeBuild runner (`codebuild-semoss-github-runner-...`).
+#
+# To restore this default workflow (e.g., if migrating back to GitHub-hosted
+# runners), rename this file back to `unit-test-default.yml` and remove or
+# rename the self-hosted variant.
+# -----------------------------------------------------------------------------
+
+name: Run Unit Tests
+
+on:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      snapshot:
+        description: 'CI version snapshot'
+        required: true
+        default: '5.3.0-SNAPSHOT'
+        type: choice
+        options:
+          - '5.3.0-SNAPSHOT'
+          # Add other snapshot versions as needed here!
+      clean_install:
+        description: 'Run `mvn clean install -U` to force-update dependencies'
+        required: true
+        default: false
+        type: boolean
+
+jobs:
+  test:
+    name: Run Test Suite
+    runs-on: ubuntu-latest
+    container: maven:3.9.9-amazoncorretto-21-debian
+    env:
+      SNAPSHOT: ${{ inputs.snapshot || '5.3.0-SNAPSHOT' }}
+      CLEAN_INSTALL: ${{ inputs.clean_install || 'false' }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Cache Maven packages
+        id: cache-maven
+        uses: actions/cache@v4
+        with:
+          path: /root/.m2/repository
+          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}-${{ env.SNAPSHOT }}
+          restore-keys: |
+            ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}-
+            ${{ runner.os }}-maven-
+
+      - name: Maven Install
+        if: steps.cache-maven.outputs.cache-hit != 'true' || env.CLEAN_INSTALL == 'true'
+        run: |
+          echo "Clean install: ${CLEAN_INSTALL}"
+          echo "Version snapshot: ${SNAPSHOT}"
+          if [ "${CLEAN_INSTALL}" = "true" ]; then
+            echo "Running mvn clean install with -U flag"
+            mvn -B clean install -U -DskipTests=true -Dci.version="${SNAPSHOT}"
+          else
+            echo "Running mvn install without -U flag"
+            mvn -B install -DskipTests=true -Dci.version="${SNAPSHOT}"
+          fi
+
+      - name: Run Unit Tests
+        run: mvn -B ${{ steps.cache-maven.outputs.cache-hit == 'true' && '-o' || '' }} test -Dci.version="${SNAPSHOT}"
+

.github/workflows/pre-commit.yml

@@ -6,20 +6,23 @@ on:
 
 jobs:
   pre-commit:
-    runs-on: ubuntu-latest
+    runs-on: codebuild-semoss-github-runner-${{ github.run_id }}-${{ github.run_attempt }}
+    container: public.ecr.aws/docker/library/python:3.12-bookworm
     steps:
     - uses: actions/checkout@v4
 
-    - name: Set up Node.js
-      uses: actions/setup-node@v4
-      with:
-        node-version: '24'
-
     - name: Install pnpm
       uses: pnpm/action-setup@v4
       with:
         version: 10
-
+
+    - name: Set up Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: '24'
+        cache: 'pnpm'
+        cache-dependency-path: 'client/pnpm-lock.yaml'
+
     - name: Install dependencies and run frontend linting
       run: |
         if [ -d "client" ]; then
@@ -28,13 +31,58 @@ jobs:
         else
           echo "No client directory found, skipping frontend linting"
         fi
-
-    - name: Set up Python
-      uses: actions/setup-python@v4
+
+    # Python 3.12 is provided by the container
+    - name: Compute cache keys
+      id: keys
+      run: |
+        echo "pre-commit=$(sha256sum .pre-commit-config.yaml | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+
+    - name: Cache pre-commit hook environments
+      uses: actions/cache@v4
       with:
-        python-version: '3.12.9'
-
-    # Official pre-commit action handles caching automatically
-    - uses: pre-commit/action@v3.0.1
+        path: ~/.cache/pre-commit
+        key: pre-commit-py3.12-${{ steps.keys.outputs.pre-commit }}
+        restore-keys: |
+          pre-commit-py3.12-
+
+    - name: Cache uv downloads
+      uses: actions/cache@v4
+      with:
+        path: |
+          ~/.cache/uv
+          ~/.local/share/uv
+        key: uv-py3.12-${{ runner.os }}
+        restore-keys: |
+          uv-py3.12-
+
+    - name: Cache OpenJDK 17
+      id: cache-jdk
+      uses: actions/cache@v4
       with:
-        extra_args: --all-files --show-diff-on-failure
+        path: /usr/lib/jvm/java-17-openjdk-amd64
+        key: jdk-17-bookworm-${{ runner.os }}
+
+    - name: Install OpenJDK 17 headless (required by pretty-format-java hook)
+      if: steps.cache-jdk.outputs.cache-hit != 'true'
+      run: |
+        apt-get update
+        apt-get install -y --no-install-recommends openjdk-17-jre-headless
+
+    - name: Set up Java environment
+      run: |
+        echo "JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64" >> "$GITHUB_ENV"
+        echo "/usr/lib/jvm/java-17-openjdk-amd64/bin" >> "$GITHUB_PATH"
+        java -version
+
+    - name: Install uv
+      run: |
+        if ! command -v uv >/dev/null 2>&1; then
+          curl -LsSf https://astral.sh/uv/install.sh | sh
+        fi
+        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+    - name: Run pre-commit
+      run: |
+        uv tool install pre-commit
+        uv tool run pre-commit run --all-files --show-diff-on-failure

.github/workflows/unit-test.yml

@@ -21,24 +21,38 @@ on:
 jobs:
   test:
     name: Run Test Suite
-    runs-on: ubuntu-latest
-    container: maven:3.9.9-amazoncorretto-21-debian
+    runs-on: codebuild-semoss-github-runner-${{ github.run_id }}-${{ github.run_attempt }}
+    container: public.ecr.aws/docker/library/maven:3.9.9-amazoncorretto-21-debian
     env:
       SNAPSHOT: ${{ inputs.snapshot || '5.3.0-SNAPSHOT' }}
       CLEAN_INSTALL: ${{ inputs.clean_install || 'false' }}
 
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
-
+
+      # Computes a cache key from the root pom.xml. This project is a single-module
+      # Maven project, so hashing the root pom.xml alone is sufficient.
+      #
+      # For a multi-module Maven project, hash every pom.xml in the tree instead:
+      #   run: echo "hash=$(find . -name pom.xml -not -path '*/target/*' -print0 \
+      #     | sort -z | xargs -0 sha256sum | sha256sum | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+      #
+      # Note: we compute the hash in a shell step instead of using the built-in
+      # hashFiles() expression because hashFiles() fails on this self-hosted
+      # CodeBuild runner due to a workspace-path resolution issue.
+      - name: Compute pom.xml hash
+        id: pom-hash
+        run: echo "hash=$(sha256sum pom.xml | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+
       - name: Cache Maven packages
         id: cache-maven
         uses: actions/cache@v4
         with:
           path: /root/.m2/repository
-          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}-${{ env.SNAPSHOT }}
+          key: ${{ runner.os }}-maven-${{ steps.pom-hash.outputs.hash }}-${{ env.SNAPSHOT }}
           restore-keys: |
-            ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}-
+            ${{ runner.os }}-maven-${{ steps.pom-hash.outputs.hash }}-
             ${{ runner.os }}-maven-
 
       - name: Maven Install