Harden the 0.2.0 production preview

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -18,12 +18,16 @@ body:
         1. Configure with...
         2. Call...
         3. Observe...
+    validations:
+      required: true
 
   - type: textarea
     id: expected
     attributes:
       label: Expected behavior
       placeholder: What you expected to happen.
+    validations:
+      required: true
 
   - type: dropdown
     id: module
@@ -40,13 +44,17 @@ body:
     id: version
     attributes:
       label: Library version
-      placeholder: "0.1.0"
+      placeholder: "0.1.1 or commit SHA"
+    validations:
+      required: true
 
   - type: input
     id: java-version
     attributes:
       label: Java version
       placeholder: "17"
+    validations:
+      required: true
 
   - type: dropdown
     id: framework
@@ -57,3 +65,21 @@ body:
         - LangChain4j
         - None (standalone)
         - Other
+    validations:
+      required: true
+
+  - type: input
+    id: framework-versions
+    attributes:
+      label: Framework versions
+      description: Include Spring Boot and Spring AI or LangChain4j versions, or enter "n/a".
+      placeholder: "Spring Boot 3.5.16, Spring AI 1.1.8"
+    validations:
+      required: true
+
+  - type: textarea
+    id: diagnostics
+    attributes:
+      label: Relevant configuration and logs
+      description: Remove API keys, credentials, model content, and other sensitive data.
+      render: shell

.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+
+updates:
+  - package-ecosystem: maven
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 3

.github/pull_request_template.md

@@ -1,21 +1,14 @@
-## Summary
+## What changed
 
 <!-- What does this PR do and why? -->
 
-## Changes
-
--
-
 ## Testing
 
 <!-- How did you verify this works? -->
 
 ## Checklist
 
-- [ ] Compiles without errors (`mvn compile`)
-- [ ] All unit tests pass (`mvn test`)
-- [ ] New functionality has test coverage
-- [ ] Core module stays Java 11 compatible
-- [ ] No hardcoded API keys or secrets
-- [ ] Tracing wrappers handle setup failures gracefully (no app-breaking exceptions)
-- [ ] Streaming instrumentation uses raw `Span` without `makeCurrent()` (see DESIGN.md #13)
+- [ ] `./mvnw -B -ntp clean verify` passes
+- [ ] Tests cover the changed behavior
+- [ ] Public API or user-facing behavior is documented
+- [ ] No credentials or captured model data are included

.github/workflows/ci.yml

@@ -14,16 +14,20 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  quality:
+    name: quality and supply chain
+    uses: ./.github/workflows/quality.yml
+
   verify:
     name: verify (Java 17, package + Javadoc)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
       - name: Set up Java 17
-        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: temurin
           java-version: 17
@@ -32,18 +36,25 @@ jobs:
       - name: Clean verify
         run: ./mvnw -B -ntp clean verify
 
+      - name: Verify coverage artifacts
+        run: |
+          test -s langfuse-otel-core/target/jacoco.exec
+          test -s langfuse-otel-core/target/site/jacoco/jacoco.xml
+          test -s langfuse-otel-spring-boot-starter/target/jacoco.exec
+          test -s langfuse-otel-spring-boot-starter/target/site/jacoco/jacoco.xml
+
   core:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         java: [11, 17, 21]
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
       - name: Set up Java ${{ matrix.java }}
-        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: temurin
           java-version: ${{ matrix.java }}
@@ -58,12 +69,12 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          # Baseline: minimum supported versions
+          # Baseline: minimum supported, security-patched versions
           - java: 17
-            spring-ai-version: '1.0.0'
+            spring-ai-version: '1.0.9'
             langchain4j-version: '1.0.0'
           - java: 21
-            spring-ai-version: '1.0.0'
+            spring-ai-version: '1.0.9'
             langchain4j-version: '1.0.0'
           # Latest stable releases on the Spring AI 1.x line and LangChain4j
           - java: 17
@@ -72,21 +83,14 @@ jobs:
           - java: 21
             spring-ai-version: '1.1.8'
             langchain4j-version: '1.18.0'
-          # Current stable releases
-          - java: 17
-            spring-ai-version: '2.0.0'
-            langchain4j-version: '1.18.0'
-          - java: 21
-            spring-ai-version: '2.0.0'
-            langchain4j-version: '1.18.0'
     name: starter (java-${{ matrix.java }}, spring-ai-${{ matrix.spring-ai-version }}, lc4j-${{ matrix.langchain4j-version }})
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
       - name: Set up Java ${{ matrix.java }}
-        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: temurin
           java-version: ${{ matrix.java }}
@@ -104,31 +108,34 @@ jobs:
     runs-on: ubuntu-latest
     needs: [verify]
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
       - name: Set up Java 17
-        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: temurin
           java-version: 17
           cache: maven
 
       - name: Install snapshot artifacts
-        run: ./mvnw -B -ntp -DskipTests install
+        run: ./mvnw -B -ntp -DskipTests -Djacoco.skip=true install
 
       - name: Compile Spring AI consumer
         run: ./mvnw -B -ntp -f examples/spring-ai-example/pom.xml -DskipTests verify
 
       - name: Compile LangChain4j consumer
         run: ./mvnw -B -ntp -f examples/langchain4j-example/pom.xml -DskipTests verify
 
+      - name: Verify core and prompt client compatibility
+        run: ./mvnw -B -ntp -f consumer-tests/core-prompt-consumer/pom.xml verify
+
   integration-status:
     name: live export smoke status (explicit opt-in)
     runs-on: ubuntu-latest
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    needs: [verify, core, starter, consumer-smoke]
+    needs: [quality, verify, core, starter, consumer-smoke]
     outputs:
       enabled: ${{ steps.configuration.outputs.enabled }}
     env:
@@ -186,12 +193,12 @@ jobs:
       LANGFUSE_HOST: ${{ secrets.LANGFUSE_HOST }}
       LANGFUSE_TEST_PROMPT_NAME: ${{ secrets.LANGFUSE_TEST_PROMPT_NAME }}
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
       - name: Set up Java 17
-        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: temurin
           java-version: 17

.github/workflows/quality.yml

@@ -0,0 +1,101 @@
+name: Quality and supply chain
+
+on:
+  workflow_call:
+    inputs:
+      checkout_ref:
+        description: Commit or ref to audit
+        required: false
+        type: string
+  workflow_dispatch:
+  schedule:
+    - cron: '17 2 * * 1'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: quality-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    name: static analysis, licenses, SBOM, vulnerabilities
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          ref: ${{ inputs.checkout_ref || github.sha }}
+          persist-credentials: false
+
+      - name: Set up Java 17
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        with:
+          distribution: temurin
+          java-version: 17
+          cache: maven
+
+      - name: Build quality evidence
+        run: >-
+          ./mvnw -B -ntp -Pquality
+          -DskipTests
+          -Djacoco.skip=true
+          -Dmaven.javadoc.skip=true
+          clean verify
+
+      - name: Validate quality evidence
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          test -s target/bom.json
+          test -s target/generated-sources/license/THIRD-PARTY.txt
+          test -s langfuse-otel-core/target/spotbugsXml.xml
+          test -s langfuse-otel-spring-boot-starter/target/spotbugsXml.xml
+
+          jq -e '
+            .bomFormat == "CycloneDX"
+            and .specVersion == "1.6"
+            and .metadata.component.type == "library"
+            and ((.components // []) | length > 0)
+            and ((.dependencies // []) | length > 0)
+          ' target/bom.json > /dev/null
+
+      - name: Audit all dependency vulnerabilities
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          scan-type: sbom
+          scan-ref: target/bom.json
+          scanners: vuln
+          format: json
+          output: target/trivy-vulnerabilities.json
+          exit-code: '0'
+          severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
+          list-all-pkgs: true
+          hide-progress: true
+          timeout: 10m
+          version: v0.72.0
+
+      - name: Reject high and critical dependency vulnerabilities
+        run: |
+          jq -e '
+            [
+              .Results[]?.Vulnerabilities[]?
+              | select(.Severity == "HIGH" or .Severity == "CRITICAL")
+            ]
+            | length == 0
+          ' target/trivy-vulnerabilities.json > /dev/null
+
+      - name: Retain quality evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: quality-evidence-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            target/bom.json
+            target/generated-sources/license/THIRD-PARTY.txt
+            target/trivy-vulnerabilities.json
+            langfuse-otel-core/target/spotbugsXml.xml
+            langfuse-otel-spring-boot-starter/target/spotbugsXml.xml
+          if-no-files-found: warn
+          retention-days: 14