quarkus icon indicating copy to clipboard operation
quarkus copied to clipboard

Support security annotations on Jakarta Data repositories

Open michalvavrik opened this issue 1 month ago • 42 comments

  • closes: https://github.com/quarkusio/quarkus/issues/48884

michalvavrik avatar Nov 12 '25 13:11 michalvavrik

/cc @gsmet (hibernate-orm)

quarkus-bot[bot] avatar Nov 12 '25 13:11 quarkus-bot[bot]


:waning_crescent_moon: This workflow status is outdated as a new workflow run has been triggered.


Status for workflow Quarkus Documentation CI

This is the status report for running Quarkus Documentation CI on commit 19b0af3a13e09cd79e4b086be2f4078955048a14.

:white_check_mark: The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

[!WARNING] There are other workflow runs running, you probably need to wait for their status before merging.

quarkus-bot[bot] avatar Nov 12 '25 13:11 quarkus-bot[bot]

🙈 The PR is closed and the preview is expired.

github-actions[bot] avatar Nov 12 '25 13:11 github-actions[bot]


:waning_crescent_moon: This workflow status is outdated as a new workflow run has been triggered.


Status for workflow Quarkus Documentation CI

This is the status report for running Quarkus Documentation CI on commit e1bf3529a058471ba967da2b4bfd574faae86de8.

:white_check_mark: The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

[!WARNING] There are other workflow runs running, you probably need to wait for their status before merging.

quarkus-bot[bot] avatar Nov 12 '25 16:11 quarkus-bot[bot]


:waning_crescent_moon: This workflow status is outdated as a new workflow run has been triggered.


Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit e1bf3529a058471ba967da2b4bfd574faae86de8.

Failing Jobs

Status Name Step Failures Logs Raw logs Build scan
:hourglass: Native Tests - Data7 :warning: Check → Logs Raw logs :construction:

You can consult the Develocity build scans.


Flaky tests - Develocity

:gear: JVM Tests - JDK 17 Windows

:package: extensions/micrometer-opentelemetry/deployment

:x: io.quarkus.micrometer.opentelemetry.deployment.compatibility.MicrometerTimedInterceptorTest.testTimeMethod_AsyncFailed - History

  • Stream has no elements - java.lang.IllegalArgumentException
java.lang.IllegalArgumentException: Stream has no elements
	at io.quarkus.micrometer.opentelemetry.deployment.common.MetricDataFilter.lambda$lastReading$2(MetricDataFilter.java:213)
	at java.base/java.util.Optional.orElseThrow(Optional.java:403)
	at io.quarkus.micrometer.opentelemetry.deployment.common.MetricDataFilter.lastReading(MetricDataFilter.java:213)
	at io.quarkus.micrometer.opentelemetry.deployment.common.MetricDataFilter.lastReadingDataPoint(MetricDataFilter.java:231)
	at io.quarkus.micrometer.opentelemetry.deployment.compatibility.MicrometerTimedInterceptorTest.testTimeMethod_AsyncFailed(MicrometerTimedInterceptorTest.java:150)
	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
	at io.quarkus.test.QuarkusUnitTest.runExtensionMethod(QuarkusUnitTest.java:534)

:x: io.quarkus.micrometer.opentelemetry.deployment.compatibility.MicrometerTimedInterceptorTest.testTimeMethod_Uni - History

  • Stream has no elements - java.lang.IllegalArgumentException
java.lang.IllegalArgumentException: Stream has no elements
	at io.quarkus.micrometer.opentelemetry.deployment.common.MetricDataFilter.lambda$lastReading$2(MetricDataFilter.java:213)
	at java.base/java.util.Optional.orElseThrow(Optional.java:403)
	at io.quarkus.micrometer.opentelemetry.deployment.common.MetricDataFilter.lastReading(MetricDataFilter.java:213)
	at io.quarkus.micrometer.opentelemetry.deployment.common.MetricDataFilter.lastReadingDataPoint(MetricDataFilter.java:231)
	at io.quarkus.micrometer.opentelemetry.deployment.compatibility.MicrometerTimedInterceptorTest.testTimeMethod_Uni(MicrometerTimedInterceptorTest.java:174)
	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
	at io.quarkus.test.QuarkusUnitTest.runExtensionMethod(QuarkusUnitTest.java:534)

:package: extensions/websockets-next/deployment

:x: io.quarkus.websockets.next.test.signatures.SignatureConsumingMultiTest.verifyExecutionOfOnMessageWhenConsumingAndReturningMultis - History

  • Condition with Lambda expression in io.quarkus.websockets.next.test.signatures.SignatureConsumingMultiTest was not fulfilled within 10 seconds. - org.awaitility.core.ConditionTimeoutException
org.awaitility.core.ConditionTimeoutException: Condition with Lambda expression in io.quarkus.websockets.next.test.signatures.SignatureConsumingMultiTest was not fulfilled within 10 seconds.
	at org.awaitility.core.ConditionAwaiter.await(ConditionAwaiter.java:167)
	at org.awaitility.core.CallableCondition.await(CallableCondition.java:78)
	at org.awaitility.core.CallableCondition.await(CallableCondition.java:26)
	at org.awaitility.core.ConditionFactory.until(ConditionFactory.java:1160)
	at org.awaitility.core.ConditionFactory.until(ConditionFactory.java:1129)
	at io.quarkus.websockets.next.test.signatures.SignatureConsumingMultiTest.verifyExecutionOfOnMessageWhenConsumingAndReturningMultis(SignatureConsumingMultiTest.java:53)
	at java.base/java.lang.reflect.Method.invoke(Method.java:569)

:gear: MicroProfile TCKs Tests

:package: tcks/microprofile-lra

:x: org.eclipse.microprofile.lra.tck.TckRecoveryTests.testCancelWhenParticipantIsUnavailable - History

  • Expecting the metric Compensated callback was called Expected: a value equal to or greater than <1> but: <0> was less than <1> - java.lang.AssertionError
java.lang.AssertionError: 
Expecting the metric Compensated callback was called
Expected: a value equal to or greater than <1>
     but: <0> was less than <1>
	at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:20)
	at org.eclipse.microprofile.lra.tck.TckRecoveryTests.assertMetricCallbackCalled(TckRecoveryTests.java:210)
	at org.eclipse.microprofile.lra.tck.TckRecoveryTests.testCancelWhenParticipantIsUnavailable(TckRecoveryTests.java:195)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

quarkus-bot[bot] avatar Nov 12 '25 19:11 quarkus-bot[bot]


:waning_crescent_moon: This workflow status is outdated as a new workflow run has been triggered.


Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit e1bf3529a058471ba967da2b4bfd574faae86de8.

:white_check_mark: The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

You can consult the Develocity build scans.

quarkus-bot[bot] avatar Nov 13 '25 10:11 quarkus-bot[bot]

Also, thanks a lot for working on this @michalvavrik :)

yrodiere avatar Nov 13 '25 16:11 yrodiere

@yrodiere I had a look at Hibernate Processor today, and I probably don't read that code 100 % right, but I think that "it is Hibernate repository" in following cases:

  • it has Jakarta Data repository annotation https://github.com/hibernate/hibernate-orm/blob/018b8eeda3627e114ec25bd48407ccb9c47564ce/tooling/metamodel-generator/src/main/java/org/hibernate/processor/HibernateProcessor.java#L417
  • it has HQL, SQL, FIND annotation https://github.com/hibernate/hibernate-orm/blob/018b8eeda3627e114ec25bd48407ccb9c47564ce/tooling/metamodel-generator/src/main/java/org/hibernate/processor/HibernateProcessor.java#L429
  • it has any of following annotations https://github.com/hibernate/hibernate-orm/blob/018b8eeda3627e114ec25bd48407ccb9c47564ce/tooling/metamodel-generator/src/main/java/org/hibernate/processor/HibernateProcessor.java#L607

And again, maybe I just didn't find right sentence, but I am yet to find this behavior documented. So this is consistency nightmare, I cannot implement this in Quarkus reliably.

I can see hardcoded Quarkus stuff (like packages) in many places in the processor, including org.hibernate.processor.HibernateProcessor. I think org.hibernate.processor.annotation.AnnotationMetaEntity#inheritedAnnotations should just inherit jakarta.annotation.security and io.quarkus.security and that is it. But your solution is better for sure.

I'll close this as this is dead end.

michalvavrik avatar Nov 20 '25 17:11 michalvavrik

  • it has Jakarta Data repository annotation https://github.com/hibernate/hibernate-orm/blob/018b8eeda3627e114ec25bd48407ccb9c47564ce/tooling/metamodel-generator/src/main/java/org/hibernate/processor/HibernateProcessor.java#L417

  • it has HQL, SQL, FIND annotation https://github.com/hibernate/hibernate-orm/blob/018b8eeda3627e114ec25bd48407ccb9c47564ce/tooling/metamodel-generator/src/main/java/org/hibernate/processor/HibernateProcessor.java#L429

Agreed, that seems to match what's documented in https://docs.hibernate.org/orm/7.1/repositories/html_single/

  • it has any of following annotations https://github.com/hibernate/hibernate-orm/blob/018b8eeda3627e114ec25bd48407ccb9c47564ce/tooling/metamodel-generator/src/main/java/org/hibernate/processor/HibernateProcessor.java#L607

That seems related to entity mapping, which the same processor handles as well, so I think we can ignore that.

I'll close this as this is dead end.

Nooo! You were so close!

Could we possibly apply your solution to any class/interface that either:

  • Is annotated with @Repository
  • Has a method annotated with @HQL/@Find/SQL (we can hardcode this list, it should be fairly stable)
  • Or has a superclass matching one of the conditions above

?

Do you need me to try to add that on top of your work? If so we can merge your work and add this later.

I can see hardcoded Quarkus stuff (like packages) in many places in the processor, including org.hibernate.processor.HibernateProcessor. I think org.hibernate.processor.annotation.AnnotationMetaEntity#inheritedAnnotations should just inherit jakarta.annotation.security and io.quarkus.security and that is it.

That... could actually work. We would just need to make sure we only do that in Quarkus applications, because the jakarta.annotation.security part would go against the Jakarta Data spec.

Also, maybe we could report that to the Jakarta Data spec and get some changes. Not sure it would address the Quarkus part, but the Jakarta Security annotations, maybe.

But your solution is better for sure.

My solution was attractive in principle, but as @FroMage pointed out it would not work consistently in all contexts -- in particular it wouldn't work in IDEs, it wouldn't work when putting the processor in the annotation processor path (only in the classpath), ... So it's pretty bad in fact, and yours is great in that it actually works :)

yrodiere avatar Nov 20 '25 17:11 yrodiere

thanks for reply @yrodiere

Could we possibly apply your solution to any class/interface that either: Is annotated with @quarkusio/workshop-writers Has a method annotated with @HQL/@Find/SQL (we can hardcode this list, it should be fairly stable) Or has a superclass matching one of the conditions above

I can do that. I could take it even further and detect any annotation from Hibernate or Jakarta Data package (won't do that, just saying it would cover everything).

My only worry is if it will cover absolutely everything you change in the future, like new variant. I'd suggest that:

  1. I'll do what you suggest.
  2. We document which cases we support and mention that is the scope of support.
  3. We print warning if we detect security annotations on interfaces that also have some Hibernate / Jakarta Data annotations and we do not secure them. It could mean some false positives, but it is better than someone who don't test security having unsecured repositories?

Ok, I'll go back to it later this week, thanks for support.

michalvavrik avatar Nov 20 '25 17:11 michalvavrik

  • I'll do what you suggest.

  • We document which cases we support and mention that is the scope of support.

  • We print warning if we detect security annotations on interfaces that also have some Hibernate / Jakarta Data annotations and we do not secure them. It could mean some false positives, but it is better than someone who don't test security having unsecured repositories?

IMO we can replace steps 2 and 3 with a simple test, similar to ClassNamesTest, where we check that all annotations in the org.hibernate.annotations.processing package are either covered by your code (like @HQL) or explicitly ignored in the test because they are irrelevant (like @Pattern). You could optionally only consider method-targeting annotations -- see ClassNamesTest#findRuntimeAnnotationsByTargetType. That way, if we (@lucamolteni or I) upgrade to a new version of Hibernate ORM that adds new annotations, we'll see the failing test, and will update the list of hardcoded annotation names or the test as necessary.

EDIT: Of course you can still document that we support both Jakarta Data repositories and "plain" Hibernate Data repositories -- it's just that the precise definition of what a Hibernate Data repository is, IMO, is an implementation detail -- any uncovered Hibernate Data repository would be a bug.

On my end I'll also open an issue in the Jakarta Data spec to see if more annotations could be considered as inherited. That will take a few months/years to make its way to user applications though, so your work is still very much useful. Plus I think your previous PR covered other interfaces, not just Jakarta Data repositories, right?

yrodiere avatar Nov 21 '25 09:11 yrodiere

On my end I'll also open an issue in the Jakarta Data spec to see if more annotations could be considered as inherited. That will take a few months/years to make its way to user applications though, so your work is still very much useful. Plus I think your previous PR covered other interfaces, not just Jakarta Data repositories, right?

Fingers crossed: https://github.com/jakartaee/data/issues/1293

yrodiere avatar Nov 21 '25 10:11 yrodiere

Sounds good, thanks for the input as I was unsure how to deal with previous situation.

michalvavrik avatar Nov 21 '25 10:11 michalvavrik

Sorry I did not see this discussion until today. What @yrodiere said seems on point, I agree.

FroMage avatar Nov 21 '25 14:11 FroMage

btw these repositories with only Hibernate annotations HQL, SQL and Find only works with Hibernate ORM Panache. For Hibernate ORM there is abstract class generated, but it is not a CDI bean and does not inherit that interface. I presume it is expected, so no problem.

michalvavrik avatar Nov 24 '25 18:11 michalvavrik

@yrodiere this PR should be ready for you to review (when the time is right for you)

Or has a superclass matching one of the conditions above

From my experience this doesn't work (e.g. myrepo extends myparentrepo and myparentrepo being annotated with @Repository or having methods with @Find ...), app always fails to build. However if you meant that @Repository myrepo has parent class which has secured methods, that works and is tested.

michalvavrik avatar Nov 24 '25 21:11 michalvavrik


:waning_crescent_moon: This workflow status is outdated as a new workflow run has been triggered.


Status for workflow Quarkus Documentation CI

This is the status report for running Quarkus Documentation CI on commit 6e6bf11a8101fcb423bf4102559d3c545f15c6cc.

:white_check_mark: The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

[!WARNING] There are other workflow runs running, you probably need to wait for their status before merging.

quarkus-bot[bot] avatar Nov 24 '25 22:11 quarkus-bot[bot]


:waning_crescent_moon: This workflow status is outdated as a new workflow run has been triggered.


Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit 6e6bf11a8101fcb423bf4102559d3c545f15c6cc.

Failing Jobs

Status Name Step Failures Logs Raw logs Build scan
:x: Native Tests - Build tools and DevTools Set up JDK 17 :warning: Check → Logs Raw logs :construction:
:heavy_check_mark: JVM Integration Tests - JDK 17 Logs Raw logs :construction:
:heavy_check_mark: JVM Integration Tests - JDK 17 Windows Logs Raw logs :construction:
:heavy_check_mark: JVM Integration Tests - JDK 21 Logs Raw logs :construction:
:heavy_check_mark: JVM Integration Tests - JDK 21 Semeru Logs Raw logs :construction:
:x: JVM Integration Tests - JDK 25 Build Failures Logs Raw logs :construction:

Full information is available in the Build summary check run. You can consult the Develocity build scans.

Failures

:gear: JVM Integration Tests - JDK 25 #

- Failing: integration-tests/spring-web 

:package: integration-tests/spring-web

:x: io.quarkus.it.spring.web.SpringSchedulerTest. - History - More details - Source on GitHub

org.junit.jupiter.engine.execution.ConditionEvaluationException: Failed to evaluate condition [io.quarkus.test.junit.QuarkusTestExtension]: Internal error: Test class was loaded with an unexpected classloader (QuarkusClassLoader:Quarkus Base Runtime ClassLoader: TEST for JUnitQuarkusTest-no-profile (QuarkusTest)@727f36dd) or the thread context classloader (jdk.internal.loader.ClassLoaders$AppClassLoader@5bc2b487) was incorrect.
	at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:214)
	at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:197)
	at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:214)
	at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:197)
	at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:214)
	at java.base/java.util.ArrayList$ArrayListSpliterator.tryAdvance(ArrayList.java:1693)
	at java.base/java.util.stream.Referen...

:x: io.quarkus.it.spring.web.SpringSchedulerTest.testCount line 22 - History - More details - Source on GitHub

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:31)
	at org.junit.jupiter.api.Assertions.assertTrue(Assertions.java:183)
	at io.quarkus.it.spring.web.SpringSchedulerTest.testCount(SpringSchedulerTest.java:22)

Flaky tests - Develocity

:gear: JVM Tests - JDK 25

:package: extensions/micrometer-opentelemetry/deployment

:x: io.quarkus.micrometer.opentelemetry.deployment.compatibility.MicrometerTimedInterceptorTest.testTimeMethod_Failed - History

  • Stream has no elements - java.lang.IllegalArgumentException
java.lang.IllegalArgumentException: Stream has no elements
	at io.quarkus.micrometer.opentelemetry.deployment.common.MetricDataFilter.lastReadingDataPoint(MetricDataFilter.java:236)
	at io.quarkus.micrometer.opentelemetry.deployment.compatibility.MicrometerTimedInterceptorTest.testTimeMethod_Failed(MicrometerTimedInterceptorTest.java:100)
	at java.base/java.lang.reflect.Method.invoke(Method.java:565)
	at io.quarkus.test.QuarkusUnitTest.runExtensionMethod(QuarkusUnitTest.java:532)
	at io.quarkus.test.QuarkusUnitTest.interceptTestMethod(QuarkusUnitTest.java:446)
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1604)
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1604)

:package: extensions/smallrye-reactive-messaging/deployment

:x: io.quarkus.smallrye.reactivemessaging.hotreload.ConnectorChangeTest.testUpdatingConnector - History

  • Expecting actual: ["-6","-7","-9","-10","-11","-12","-13","-14"] to start with: ["-6", "-7", "-8", "-9"] - java.lang.AssertionError
java.lang.AssertionError: 

Expecting actual:
  ["-6","-7","-9","-10","-11","-12","-13","-14"]
to start with:
  ["-6", "-7", "-8", "-9"]

	at io.quarkus.smallrye.reactivemessaging.hotreload.ConnectorChangeTest.testUpdatingConnector(ConnectorChangeTest.java:41)

:gear: JVM Tests - JDK 17 Windows

:package: extensions/resteasy-classic/resteasy-mutiny/deployment

:x: io.quarkus.resteasy.mutiny.test.RestEasyMutinyTest.testFailingWithWebApplicationException - History

  • RESTEASY004655: Unable to invoke request: java.net.SocketTimeoutException: Read timed out - jakarta.ws.rs.ProcessingException
jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: java.net.SocketTimeoutException: Read timed out
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:365)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:71)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocationBuilder.get(ClientInvocationBuilder.java:175)
	at io.quarkus.resteasy.mutiny.test.RestEasyMutinyTest.testFailingWithWebApplicationException(RestEasyMutinyTest.java:62)
	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
	at io.quarkus.test.QuarkusUnitTest.runExtensionMethod(QuarkusUnitTest.java:532)

:x: io.quarkus.resteasy.mutiny.test.RestEasyMutinyTest.testHttpResponseAcceptedWithBody - History

  • RESTEASY004655: Unable to invoke request: java.net.SocketTimeoutException: Read timed out - jakarta.ws.rs.ProcessingException
jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: java.net.SocketTimeoutException: Read timed out
	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:365)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:427)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.invoke(ClientInvocation.java:71)
	at org.jboss.resteasy.client.jaxrs.internal.ClientInvocationBuilder.get(ClientInvocationBuilder.java:175)
	at io.quarkus.resteasy.mutiny.test.RestEasyMutinyTest.testHttpResponseAcceptedWithBody(RestEasyMutinyTest.java:86)
	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
	at io.quarkus.test.QuarkusUnitTest.runExtensionMethod(QuarkusUnitTest.java:532)

:gear: MicroProfile TCKs Tests

:package: tcks/microprofile-lra

:x: org.eclipse.microprofile.lra.tck.TckRecoveryTests.testCancelWhenParticipantIsUnavailable - History

  • Expecting the metric Compensated callback was called Expected: a value equal to or greater than <1> but: <0> was less than <1> - java.lang.AssertionError
java.lang.AssertionError: 
Expecting the metric Compensated callback was called
Expected: a value equal to or greater than <1>
     but: <0> was less than <1>
	at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:20)
	at org.eclipse.microprofile.lra.tck.TckRecoveryTests.assertMetricCallbackCalled(TckRecoveryTests.java:210)
	at org.eclipse.microprofile.lra.tck.TckRecoveryTests.testCancelWhenParticipantIsUnavailable(TckRecoveryTests.java:195)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

quarkus-bot[bot] avatar Nov 25 '25 01:11 quarkus-bot[bot]

There is no security involved in io.quarkus.it.spring.web.SpringSchedulerTest, I checked classes invoked by that test. It also passed with JDK 21 etc.. I have tested it locally with Temurin-25.0.1+8 and cannot reproduce it, therefore I think it is unrelated.

michalvavrik avatar Nov 25 '25 09:11 michalvavrik

There are merge conflicts on this branch, I'll resolve them and rebase. No further changes, (so @sberyozkin doesn't need to re-check, the ball is on @yrodiere side now).

michalvavrik avatar Nov 27 '25 11:11 michalvavrik


:waning_crescent_moon: This workflow status is outdated as a new workflow run has been triggered.


Status for workflow Quarkus Documentation CI

This is the status report for running Quarkus Documentation CI on commit 69bf48f79b4583f31e851a4d78f791cb5f857b3d.

:white_check_mark: The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

[!WARNING] There are other workflow runs running, you probably need to wait for their status before merging.

quarkus-bot[bot] avatar Nov 27 '25 11:11 quarkus-bot[bot]


:waning_crescent_moon: This workflow status is outdated as a new workflow run has been triggered.


Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit 69bf48f79b4583f31e851a4d78f791cb5f857b3d.

:white_check_mark: The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

You can consult the Develocity build scans.


Flaky tests - Develocity

:gear: JVM Tests - JDK 21 Semeru

:package: extensions/micrometer-opentelemetry/deployment

:x: io.quarkus.micrometer.opentelemetry.deployment.compatibility.MicrometerTimedInterceptorTest.testTimeMethod - History

  • Stream has no elements - java.lang.IllegalArgumentException
java.lang.IllegalArgumentException: Stream has no elements
	at io.quarkus.micrometer.opentelemetry.deployment.common.MetricDataFilter.lambda$lastReading$2(MetricDataFilter.java:213)
	at java.base/java.util.Optional.orElseThrow(Optional.java:403)
	at io.quarkus.micrometer.opentelemetry.deployment.common.MetricDataFilter.lastReading(MetricDataFilter.java:213)
	at io.quarkus.micrometer.opentelemetry.deployment.common.MetricDataFilter.lastReadingDataPoint(MetricDataFilter.java:231)
	at io.quarkus.micrometer.opentelemetry.deployment.compatibility.MicrometerTimedInterceptorTest.testTimeMethod(MicrometerTimedInterceptorTest.java:77)
	at java.base/java.lang.reflect.Method.invoke(Method.java:586)
	at io.quarkus.test.QuarkusUnitTest.runExtensionMethod(QuarkusUnitTest.java:532)

:gear: MicroProfile TCKs Tests

:package: tcks/microprofile-lra

:x: org.eclipse.microprofile.lra.tck.TckRecoveryTests.testCancelWhenParticipantIsUnavailable - History

  • Expecting the metric Compensated callback was called Expected: a value equal to or greater than <1> but: <0> was less than <1> - java.lang.AssertionError
java.lang.AssertionError: 
Expecting the metric Compensated callback was called
Expected: a value equal to or greater than <1>
     but: <0> was less than <1>
	at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:20)
	at org.eclipse.microprofile.lra.tck.TckRecoveryTests.assertMetricCallbackCalled(TckRecoveryTests.java:210)
	at org.eclipse.microprofile.lra.tck.TckRecoveryTests.testCancelWhenParticipantIsUnavailable(TckRecoveryTests.java:195)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

quarkus-bot[bot] avatar Nov 27 '25 14:11 quarkus-bot[bot]

the ball is on @yrodiere side now

Yes I didn't forget, just... it'll take time. Sorry.

yrodiere avatar Nov 27 '25 15:11 yrodiere

the ball is on @yrodiere side now

Yes I didn't forget, just... it'll take time. Sorry.

No problem, frankly that is why I mentioned you (my hidden agenda). I am fine waiting, but not knowing if a reviewer missed notifications keeps me thinking. My bad.

michalvavrik avatar Nov 27 '25 15:11 michalvavrik

I'll regret this, but I could review if you want?

FroMage avatar Nov 28 '25 11:11 FroMage

I'll regret this, but I could review if you want?

I definitely do want it. I know very little about Hibernate repositories.

michalvavrik avatar Nov 28 '25 11:11 michalvavrik


:waning_crescent_moon: This workflow status is outdated as a new workflow run has been triggered.


Status for workflow Quarkus Documentation CI

This is the status report for running Quarkus Documentation CI on commit 53e8725fe47124daa754906bfafc18e82d89170d.

:white_check_mark: The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

[!WARNING] There are other workflow runs running, you probably need to wait for their status before merging.

quarkus-bot[bot] avatar Nov 30 '25 18:11 quarkus-bot[bot]


:waning_crescent_moon: This workflow status is outdated as a new workflow run has been triggered.


Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit 53e8725fe47124daa754906bfafc18e82d89170d.

Failing Jobs

Status Name Step Failures Logs Raw logs Build scan
:heavy_check_mark: JVM Tests - JDK 17 Logs Raw logs :construction:
:heavy_check_mark: JVM Tests - JDK 21 Logs Raw logs :construction:
:heavy_check_mark: JVM Tests - JDK 21 Semeru Logs Raw logs :construction:
:heavy_check_mark: JVM Tests - JDK 25 Logs Raw logs :construction:
:x: JVM Tests - JDK 17 Windows Build Failures Logs Raw logs :construction:

Full information is available in the Build summary check run. You can consult the Develocity build scans.

Failures

:gear: JVM Tests - JDK 17 Windows #

- Failing: extensions/opentelemetry/deployment 
! Skipped: extensions/liquibase/liquibase-mongodb/deployment extensions/micrometer-opentelemetry/deployment extensions/micrometer-registry-prometheus/deployment and 9 more

:package: extensions/opentelemetry/deployment

:x: io.quarkus.opentelemetry.deployment.instrumentation.GrpcOpenInstrumentationDisabledTest. - History - More details - Source on GitHub

java.lang.RuntimeException: 
io.quarkus.builder.BuildException: Build failure: Build failed due to errors
	[error]: Build step io.quarkus.arc.deployment.ArcProcessor#validate threw an exception: java.lang.NullPointerException: Cannot invoke "io.quarkus.arc.processor.InjectionPointInfo.isProgrammaticLookup()" because "injectionPoint" is null
	at io.quarkus.arc.processor.UnusedBeans.findRemovableBeans(UnusedBeans.java:44)
	at io.quarkus.arc.processor.BeanDeployment.removeUnusedBeans(BeanDeployment.java:498)
	at io.quarkus.arc.processor.BeanDeployment.removeUnusedComponents(BeanDeployment.java:407)
	at io.quarkus.arc.processor.BeanDeployment.init(BeanDeployment.java:354)
	at io.quarkus.arc.processor.BeanProcessor.initialize(BeanProcessor.java:177)

Flaky tests - Develocity

:gear: JVM Tests - JDK 21 Semeru

:package: extensions/micrometer-opentelemetry/deployment

:x: io.quarkus.micrometer.opentelemetry.deployment.compatibility.MicrometerTimedInterceptorTest.testTimeMethod - History

  • Stream has no elements - java.lang.IllegalArgumentException
java.lang.IllegalArgumentException: Stream has no elements
	at io.quarkus.micrometer.opentelemetry.deployment.common.MetricDataFilter.lambda$lastReading$2(MetricDataFilter.java:213)
	at java.base/java.util.Optional.orElseThrow(Optional.java:403)
	at io.quarkus.micrometer.opentelemetry.deployment.common.MetricDataFilter.lastReading(MetricDataFilter.java:213)
	at io.quarkus.micrometer.opentelemetry.deployment.common.MetricDataFilter.lastReadingDataPoint(MetricDataFilter.java:231)
	at io.quarkus.micrometer.opentelemetry.deployment.compatibility.MicrometerTimedInterceptorTest.testTimeMethod(MicrometerTimedInterceptorTest.java:77)
	at java.base/java.lang.reflect.Method.invoke(Method.java:586)
	at io.quarkus.test.QuarkusUnitTest.runExtensionMethod(QuarkusUnitTest.java:532)

:gear: JVM Tests - JDK 25

:package: extensions/smallrye-reactive-messaging/deployment

:x: io.quarkus.smallrye.reactivemessaging.hotreload.ConnectorChangeTest.testUpdatingConnector - History

  • Condition with Lambda expression in io.quarkus.smallrye.reactivemessaging.hotreload.ConnectorChangeTest was not fulfilled within 10 seconds. - org.awaitility.core.ConditionTimeoutException
org.awaitility.core.ConditionTimeoutException: Condition with Lambda expression in io.quarkus.smallrye.reactivemessaging.hotreload.ConnectorChangeTest was not fulfilled within 10 seconds.
	at org.awaitility.core.ConditionAwaiter.await(ConditionAwaiter.java:167)
	at org.awaitility.core.CallableCondition.await(CallableCondition.java:78)
	at org.awaitility.core.CallableCondition.await(CallableCondition.java:26)
	at org.awaitility.core.ConditionFactory.until(ConditionFactory.java:1160)
	at org.awaitility.core.ConditionFactory.until(ConditionFactory.java:1129)
	at io.quarkus.smallrye.reactivemessaging.hotreload.ConnectorChangeTest.testUpdatingConnector(ConnectorChangeTest.java:40)
	at java.base/java.lang.reflect.Method.invoke(Method.java:565)

:gear: Maven Tests - JDK 17

:package: integration-tests/devmode

:x: io.quarkus.test.devui.DevUIGrpcSmokeTest.testTestService - History

  • Too many recursions, message not returned for id [416836094] - java.lang.RuntimeException
java.lang.RuntimeException: Too many recursions, message not returned for id [416836094]
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:175)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:178)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:178)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:178)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:178)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:178)
	at io.quarkus.devui.tests.DevUIJsonRPCTest.objectResultFromJsonRPC(DevUIJsonRPCTest.java:178)

:gear: MicroProfile TCKs Tests

:package: tcks/microprofile-lra

:x: org.eclipse.microprofile.lra.tck.TckRecoveryTests.testCancelWhenParticipantIsUnavailable - History

  • Expecting the metric Compensated callback was called Expected: a value equal to or greater than <1> but: <0> was less than <1> - java.lang.AssertionError
java.lang.AssertionError: 
Expecting the metric Compensated callback was called
Expected: a value equal to or greater than <1>
     but: <0> was less than <1>
	at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:20)
	at org.eclipse.microprofile.lra.tck.TckRecoveryTests.assertMetricCallbackCalled(TckRecoveryTests.java:210)
	at org.eclipse.microprofile.lra.tck.TckRecoveryTests.testCancelWhenParticipantIsUnavailable(TckRecoveryTests.java:195)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

quarkus-bot[bot] avatar Nov 30 '25 21:11 quarkus-bot[bot]


:waning_crescent_moon: This workflow status is outdated as a new workflow run has been triggered.


Status for workflow Quarkus Documentation CI

This is the status report for running Quarkus Documentation CI on commit a5ac9b4e6a42f9df3b418f121d54383f9a455bfe.

:white_check_mark: The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

[!WARNING] There are other workflow runs running, you probably need to wait for their status before merging.

quarkus-bot[bot] avatar Dec 02 '25 21:12 quarkus-bot[bot]


:waning_crescent_moon: This workflow status is outdated as a new workflow run has been triggered.


Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit a5ac9b4e6a42f9df3b418f121d54383f9a455bfe.

Failing Jobs

Status Name Step Failures Logs Raw logs Build scan
:x: JVM Tests - JDK 17 Build Failures Logs Raw logs :construction:
:x: JVM Tests - JDK 21 Build Failures Logs Raw logs :construction:
:heavy_check_mark: JVM Tests - JDK 21 Semeru Logs Raw logs :construction:
:heavy_check_mark: JVM Tests - JDK 25 Logs Raw logs :construction:

You can consult the Develocity build scans.

Failures

:gear: JVM Tests - JDK 17 #

- Failing: extensions/smallrye-openapi/deployment 
! Skipped: extensions/agroal/deployment extensions/elytron-security-jdbc/deployment extensions/flyway/deployment and 49 more

:package: extensions/smallrye-openapi/deployment

:x: Failed to execute goal org.apache.maven.plugins:maven-surefire-plugin:3.5.4:test (default-test) on project quarkus-smallrye-openapi-deployment:

See /home/runner/_work/quarkus/quarkus/extensions/smallrye-openapi/deployment/target/surefire-reports for the individual test results. See dump files (if any exist) [date].dump, [date]-jvmRun[N].dump and [date].dumpstream. There was an error in the forked process


:gear: JVM Tests - JDK 21 #

- Failing: extensions/smallrye-openapi/deployment 
! Skipped: extensions/agroal/deployment extensions/elytron-security-jdbc/deployment extensions/flyway/deployment and 49 more

:package: extensions/smallrye-openapi/deployment

:x: Failed to execute goal org.apache.maven.plugins:maven-surefire-plugin:3.5.4:test (default-test) on project quarkus-smallrye-openapi-deployment:

See /home/runner/_work/quarkus/quarkus/extensions/smallrye-openapi/deployment/target/surefire-reports for the individual test results. See dump files (if any exist) [date].dump, [date]-jvmRun[N].dump and [date].dumpstream. There was an error in the forked process


Flaky tests - Develocity

:gear: JVM Tests - JDK 21 Semeru

:package: extensions/micrometer-opentelemetry/deployment

:x: io.quarkus.micrometer.opentelemetry.deployment.compatibility.MicrometerTimedInterceptorTest.testTimeMethod_Async - History

  • Stream has no elements - java.lang.IllegalArgumentException
java.lang.IllegalArgumentException: Stream has no elements
	at io.quarkus.micrometer.opentelemetry.deployment.common.MetricDataFilter.lastReadingDataPoint(MetricDataFilter.java:236)
	at io.quarkus.micrometer.opentelemetry.deployment.compatibility.MicrometerTimedInterceptorTest.testTimeMethod_Async(MicrometerTimedInterceptorTest.java:126)
	at java.base/java.lang.reflect.Method.invoke(Method.java:586)
	at io.quarkus.test.QuarkusUnitTest.runExtensionMethod(QuarkusUnitTest.java:532)
	at io.quarkus.test.QuarkusUnitTest.interceptTestMethod(QuarkusUnitTest.java:446)
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1596)
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1596)

:gear: MicroProfile TCKs Tests

:package: tcks/microprofile-lra

:x: org.eclipse.microprofile.lra.tck.TckRecoveryTests.testCancelWhenParticipantIsUnavailable - History

  • Expecting the metric Compensated callback was called Expected: a value equal to or greater than <1> but: <0> was less than <1> - java.lang.AssertionError
java.lang.AssertionError: 
Expecting the metric Compensated callback was called
Expected: a value equal to or greater than <1>
     but: <0> was less than <1>
	at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:20)
	at org.eclipse.microprofile.lra.tck.TckRecoveryTests.assertMetricCallbackCalled(TckRecoveryTests.java:210)
	at org.eclipse.microprofile.lra.tck.TckRecoveryTests.testCancelWhenParticipantIsUnavailable(TckRecoveryTests.java:195)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

:gear: JVM Integration Tests - JDK 17 Windows

:package: integration-tests/grpc-hibernate

:x: com.example.grpc.hibernate.BlockingRawTest.shouldAdd - History

  • Condition with Lambda expression in com.example.grpc.hibernate.BlockingRawTestBase was not fulfilled within 30 seconds. - org.awaitility.core.ConditionTimeoutException
org.awaitility.core.ConditionTimeoutException: Condition with Lambda expression in com.example.grpc.hibernate.BlockingRawTestBase was not fulfilled within 30 seconds.
	at org.awaitility.core.ConditionAwaiter.await(ConditionAwaiter.java:167)
	at org.awaitility.core.CallableCondition.await(CallableCondition.java:78)
	at org.awaitility.core.CallableCondition.await(CallableCondition.java:26)
	at org.awaitility.core.ConditionFactory.until(ConditionFactory.java:1160)
	at org.awaitility.core.ConditionFactory.until(ConditionFactory.java:1129)
	at com.example.grpc.hibernate.BlockingRawTestBase.shouldAdd(BlockingRawTestBase.java:59)
	at java.base/java.lang.reflect.Method.invoke(Method.java:569)

quarkus-bot[bot] avatar Dec 03 '25 00:12 quarkus-bot[bot]