CloudStack modernization: Java 17 + Jakarta + Phase 4 decomposition complete

.dockerignore

@@ -21,3 +21,15 @@ cloudstack/tools/docker/Dockerfile.smokedev
 .idea
 .git
 venv
+
+# Don't ship build outputs or local caches into the build context
+**/target
+**/node_modules
+**/.mvn
+**/*.iml
+**/.DS_Store
+docs
+ui/dist
+ui/node_modules
+tools/marvin/dist
+*.log

.github/workflows/api-image.yml

@@ -0,0 +1,136 @@
+# Phase 5a: API / management-server container image build
+#
+# Triggers on any change to Java/Maven source — specifically anything that
+# is NOT under ui/** (the UI image workflow handles that path).
+#
+# Images are tagged:   ghcr.io/<owner>/cloudstack-management:<branch>-<sha7>
+#                      ghcr.io/<owner>/cloudstack-management:latest  (main only)
+#
+# The root Dockerfile is a multi-stage Maven → JRE build.  It is used
+# unmodified here; the UI assets are NOT bundled because the Phase 5a goal
+# is to ship two separate images.
+#
+# TODO: add image vulnerability scanning (e.g. trivy-action) before GA.
+# TODO: add SBOM generation (anchore/sbom-action) and Cosign signing.
+
+name: "Phase 5a – API/management image"
+
+on:
+  push:
+    branches:
+      - "modernize-2026**"
+      - "main"
+    paths-ignore:
+      - "ui/**"
+      - ".github/workflows/ui-image.yml"
+      - "docs/**"
+      - "**.md"
+  pull_request:
+    branches:
+      - "modernize-2026**"
+      - "main"
+    paths-ignore:
+      - "ui/**"
+      - ".github/workflows/ui-image.yml"
+      - "docs/**"
+      - "**.md"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  packages: write   # needed to push to GHCR
+
+env:
+  REGISTRY: ghcr.io
+  # TODO: set IMAGE_NAME to your fork org, e.g. ghcr.io/myorg/cloudstack-management
+  IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/cloudstack-management
+
+jobs:
+  build-api-image:
+    name: "Build API/management Docker image"
+    # The Maven build is CPU/RAM heavy; ubuntu-22.04 has 7 GB RAM + 2 vCPU.
+    # If the build frequently OOMs consider switching to a larger runner.
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Compute image tags
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.IMAGE_NAME }}
+          tags: |
+            type=sha,prefix=${{ github.ref_name }}-,format=short
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+
+      # -----------------------------------------------------------------------
+      # Maven layer cache: re-uses ~/.m2 from a previous run so the Buildx
+      # cache-to/from covers the Docker layer that downloads Maven deps.
+      # -----------------------------------------------------------------------
+
+      # -----------------------------------------------------------------------
+      # Pre-merge: image is BUILT (cache populated) but NOT pushed.
+      # Post-merge: the push step is also enabled.
+      # -----------------------------------------------------------------------
+
+      # Pre-merge block — always runs (build + cache, no push)
+      - name: Build API image (PR — no push)
+        if: github.event_name == 'pull_request'
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./Dockerfile
+          # Exclude the ui/ source tree from the Docker build context to keep
+          # the context transfer fast.  The API image does not need UI assets.
+          # TODO: add a .dockerignore entry for ui/ to enforce this at repo level.
+          push: false
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          # GHA cache keyed on branch so PRs benefit from branch history.
+          cache-from: |
+            type=gha,scope=api-image-${{ github.ref_name }}
+            type=gha,scope=api-image-main
+          cache-to: type=gha,mode=max,scope=api-image-${{ github.ref_name }}
+          # Pass build args that the Dockerfile already supports for tuning.
+          build-args: |
+            MAVEN_OPTS=-Xmx1g -XX:+TieredCompilation -XX:TieredStopAtLevel=1
+
+      # Post-merge block — runs on push to tracked branches, also logs in
+      - name: Log in to GHCR
+        if: github.event_name == 'push'
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          # TODO: configure GHCR_TOKEN secret in repo settings
+          password: ${{ secrets.GHCR_TOKEN }}
+
+      - name: Build and push API image (post-merge)
+        if: github.event_name == 'push'
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: |
+            type=gha,scope=api-image-${{ github.ref_name }}
+            type=gha,scope=api-image-main
+          cache-to: type=gha,mode=max,scope=api-image-${{ github.ref_name }}
+          build-args: |
+            MAVEN_OPTS=-Xmx1g -XX:+TieredCompilation -XX:TieredStopAtLevel=1
+
+      - name: Image digest
+        if: github.event_name == 'push'
+        run: echo "Pushed API image digest ${{ steps.meta.outputs.version }}"

.github/workflows/build.yml

@@ -28,6 +28,8 @@ permissions:
 
 jobs:
   build:
+    # Upstream-only: requires shapeblue/cloudstack-nonoss (proprietary). Forks use fork-ci.yml.
+    if: github.repository == 'apache/cloudstack'
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v6

.github/workflows/fork-ci.yml

@@ -0,0 +1,153 @@
+# Fork CI: build + unit test on every push and PR.
+# Runs without -Dnoredist to avoid the proprietary cloudstack-nonoss dependency.
+
+name: Fork CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  checks: write
+  pull-requests: write
+
+jobs:
+  build-and-test:
+    name: Build & Test (Java ${{ matrix.java }})
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        java: [ '17' ]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK ${{ matrix.java }}
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: ${{ matrix.java }}
+          cache: 'maven'
+
+      - name: Show environment
+        run: |
+          java -version
+          mvn -v
+          free -m
+          nproc
+
+      - name: Build (skip tests)
+        run: mvn -B -ntp install -DskipTests -T1C
+
+      - name: Run unit tests with coverage
+        run: mvn -B -ntp test -fae -T1C -P quality
+
+      - name: Generate aggregate JaCoCo report
+        if: matrix.java == '17'
+        run: |
+          find . -path '*/target/jacoco.exec' -type f | head -5
+          mvn -B -ntp -pl :cloud-utils jacoco:report || true
+
+      - name: Upload JaCoCo coverage reports
+        if: always() && matrix.java == '17'
+        uses: actions/upload-artifact@v4
+        with:
+          name: jacoco-reports
+          path: '**/target/site/jacoco/**'
+          retention-days: 14
+          if-no-files-found: ignore
+
+      - name: Upload surefire reports
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: surefire-reports-jdk${{ matrix.java }}
+          path: '**/target/surefire-reports/**'
+          retention-days: 14
+
+      - name: Publish test results
+        if: always()
+        uses: mikepenz/action-junit-report@v4
+        with:
+          report_paths: '**/target/surefire-reports/TEST-*.xml'
+          fail_on_failure: false
+          require_tests: false
+          check_name: Unit Tests (Java ${{ matrix.java }})
+
+  quality:
+    name: Quality checks (advisory)
+    runs-on: ubuntu-24.04
+    # Quality checks are advisory — they upload reports but never fail the build.
+    # As code quality improves we'll progressively raise the bar.
+    continue-on-error: true
+    needs: build-and-test
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+          cache: 'maven'
+
+      - name: Compile (cached)
+        run: mvn -B -ntp install -DskipTests -T1C
+
+      - name: SpotBugs analysis
+        run: mvn -B -ntp spotbugs:spotbugs -DskipTests -fae || true
+
+      - name: PMD analysis
+        run: mvn -B -ntp pmd:pmd -DskipTests -fae || true
+
+      - name: Upload SpotBugs reports
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: spotbugs-reports
+          path: '**/target/spotbugsXml.xml'
+          retention-days: 14
+          if-no-files-found: ignore
+
+      - name: Upload PMD reports
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: pmd-reports
+          path: '**/target/pmd.xml'
+          retention-days: 14
+          if-no-files-found: ignore
+
+  security:
+    name: Dependency vulnerability scan
+    runs-on: ubuntu-24.04
+    continue-on-error: true
+    needs: build-and-test
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+          cache: 'maven'
+
+      - name: OWASP Dependency-Check
+        run: mvn -B -ntp -P quality org.owasp:dependency-check-maven:check -DskipTests -DfailBuildOnCVSS=11 || true
+
+      - name: Upload dependency-check report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: dependency-check-report
+          path: '**/target/dependency-check-report.*'
+          retention-days: 30
+          if-no-files-found: ignore