IGNITE-28018 Github action hook to control changes inside the messages.

.github/workflows/check-protected-classes.yml

@@ -0,0 +1,117 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Check Protected Classes
+on:
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  check-protected-classes:
+    runs-on: ubuntu-latest
+    name: Check protected classes
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+
+      - name: Check for protected class modifications
+        id: check
+        run: |
+          BASE_SHA=${{ github.event.pull_request.base.sha }}
+          HEAD_SHA=${{ github.event.pull_request.head.sha }}
+
+          CHANGED=$(git diff --name-only --diff-filter=ACMR "$BASE_SHA"..."$HEAD_SHA" -- '*.java')
+          [ -z "$CHANGED" ] && exit 0
+
+          HITS=""
+          while IFS= read -r file; do
+            FQN=$(echo "$file" | sed -n 's|.*/src/main/java/||p' | sed 's|/|.|g; s|\.java$||')
+            [ -z "$FQN" ] && continue
+            if grep -q "^${FQN}$" .github/protected-classes.txt 2>/dev/null; then
+              HITS="${HITS}${file}\n"
+            elif grep -qE '@Order\(|@Argument\(' "$file" 2>/dev/null; then
+              HITS="${HITS}${file} (new, not in registry)\n"
+            fi
+          done <<< "$CHANGED"
+
+          if [ -n "$HITS" ]; then
+            echo "affected=true" >> "$GITHUB_OUTPUT"
+            printf '%b' "$HITS" > /tmp/protected-hits.txt
+          fi
+
+      - name: Comment on PR
+        if: steps.check.outputs.affected == 'true'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const hits = fs.readFileSync('/tmp/protected-hits.txt', 'utf8').trim();
+            const body = [
+              '## Protected Classes Review Required',
+              '',
+              'This PR modifies protected classes (Message/IgniteDataTransferObject hierarchy).',
+              'Changes to these classes can break rolling upgrade compatibility.',
+              '',
+              '**Affected files:**',
+              hits.split('\n').map(f => '- `' + f.trim() + '`').join('\n'),
+              '',
+              '**Checklist:**',
+              '- [ ] New fields added at the end (highest `@Order`)',
+              '- [ ] No existing fields removed or reordered',
+              '- [ ] `directType()` not changed',
+              '- [ ] Field types not changed in binary-incompatible way',
+              '- [ ] Rolling upgrade test covers this change',
+            ].join('\n');
+
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+
+            const existing = comments.find(c => c.body.includes('Protected Classes Review Required'));
+
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body,
+              });
+            }
+
+      - name: Add label
+        if: steps.check.outputs.affected == 'true'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              labels: ['protected-classes'],
+            });

.github/workflows/update-protected-classes.yml

@@ -0,0 +1,58 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Update Protected Classes Registry
+on:
+  pull_request:
+    types: [closed]
+
+jobs:
+  update-registry:
+    if: github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'protected-classes')
+    runs-on: ubuntu-latest
+    name: Update protected classes registry
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.base.ref }}
+
+      - name: Setup java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+
+      - name: Build tools and dependencies
+        run: |
+          ./mvnw install -pl modules/tools -am -DskipTests -B -q
+
+      - name: Copy dependencies
+        run: |
+          ./mvnw dependency:copy-dependencies -pl modules/tools -B -q
+
+      - name: Generate protected-classes.txt
+        run: |
+          java -cp "modules/tools/target/classes:modules/tools/target/dependency/classgraph-*.jar:modules/core/target/classes:modules/core/target/dependency/*" \
+            org.apache.ignite.tools.protectedclasses.ProtectedClassesGenerator \
+            .github/protected-classes.txt
+
+      - name: Commit and push if changed
+        run: |
+          git diff --quiet .github/protected-classes.txt && exit 0
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add .github/protected-classes.txt
+          git commit -m "Update .github/protected-classes.txt after #${{ github.event.pull_request.number }}"
+          git push

modules/tools/pom.xml

@@ -199,5 +199,11 @@
             <artifactId>common-junit48</artifactId>
             <version>${surefire.version}</version>
         </dependency>
+
+        <dependency>
+            <groupId>io.github.classgraph</groupId>
+            <artifactId>classgraph</artifactId>
+            <version>4.8.179</version>
+        </dependency>
     </dependencies>
 </project>

modules/tools/src/main/java/org/apache/ignite/tools/protectedclasses/ProtectedClassesGenerator.java

@@ -0,0 +1,88 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.ignite.tools.protectedclasses;
+
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.nio.file.Paths;
+import java.util.TreeSet;
+import io.github.classgraph.ClassGraph;
+
+/**
+ * Generates a sorted list of protected classes — classes from {@code Message} and {@code IgniteDataTransferObject}
+ * hierarchies, as well as classes containing {@code @Order}-annotated fields, that are part of the wire protocol
+ * and require special review when modified.
+ * <p>
+ * Usage: {@code java ProtectedClassesGenerator <output-file>}
+ */
+public class ProtectedClassesGenerator {
+    /** Base interface for communication messages. */
+    private static final String MESSAGE_INTERFACE = "org.apache.ignite.plugin.extensions.communication.Message";
+
+    /** Base class for data transfer objects. */
+    private static final String IDTO_CLASS = "org.apache.ignite.internal.dto.IgniteDataTransferObject";
+
+    /** Annotation that marks serialized fields in Message classes. */
+    private static final String ORDER_ANNOTATION = "org.apache.ignite.internal.Order";
+
+    /** @param args */
+    public static void main(String[] args) throws IOException {
+        if (args.length < 1) {
+            System.err.println("Usage: ProtectedClassesGenerator <output-file>");
+            System.exit(1);
+        }
+
+        var outputPath = Paths.get(args[0]);
+
+        var protectedClasses = new TreeSet<String>();
+
+        try (var scanResult = new ClassGraph()
+            .enableClassInfo()
+            .enableFieldInfo()
+            .enableAnnotationInfo()
+            .acceptPackages("org.apache.ignite")
+            .scan()
+        ) {
+            scanResult.getClassesImplementing(MESSAGE_INTERFACE)
+                .forEach(cls -> protectedClasses.add(cls.getName()));
+
+            scanResult.getSubclasses(IDTO_CLASS)
+                .forEach(cls -> protectedClasses.add(cls.getName()));
+
+            // Include classes that have fields annotated with @Order.
+            scanResult.getClassesWithFieldAnnotation(ORDER_ANNOTATION)
+                .forEach(cls -> protectedClasses.add(cls.getName()));
+
+            // Include the base classes themselves.
+            protectedClasses.add(MESSAGE_INTERFACE);
+            protectedClasses.add(IDTO_CLASS);
+        }
+
+        try (var writer = new PrintWriter(outputPath.toFile())) {
+            writer.println("# Auto-generated list of protected classes (Message/IgniteDataTransferObject hierarchy).");
+            writer.println("# Changes to these classes require special review.");
+            writer.println("# Regenerated automatically after merging PRs with 'protected-classes' label.");
+
+            for (var clazz : protectedClasses) {
+                writer.println(clazz);
+            }
+        }
+
+        System.out.println("Generated " + outputPath + " with " + protectedClasses.size() + " protected classes.");
+    }
+}

parent/pom.xml

@@ -884,6 +884,7 @@
                                         <exclude>docs/_docs/images/**</exclude>
                                         <exclude>docs/Gemfile</exclude>
                                         <exclude>docs/assets/js/anchor.min.js</exclude><!-- Distributed under the MIT license. The original license header is badly formatted. -->
+                                        <exclude>.github/protected-classes.txt</exclude>
                                     </excludes>
                                 </configuration>
                             </execution>