joboe migration

[cleverchuk]

Summary

Migrates the build system from Maven to Gradle (Kotlin DSL) and refactors Metadata / Context to read trace context from the OpenTelemetry API instead of relying solely on internal thread-local state.

How to review

The bulk of the diff (~294 Java files) is Spotless reformatting with no functional changes. Focus review on:

1. refactor metadata to use otel api — the OTel API integration and deprecations
2. migrate to gradle — build scripts, shadow/relocation rules, publishing config, and CI pipeline changes

---

Refactor Metadata to use OpenTelemetry API

Motivation

The thread-local Metadata approach works correctly today, but the goal is to transition context propagation to the OpenTelemetry API so that the internal thread-local plumbing can eventually be removed entirely.

Changes

• Metadata now accepts a SpanContext — A new constructor copies trace ID, span ID, and trace flags directly from the OTel SpanContext, avoiding hex-string round-trips.
• Context.getMetadata() falls back to the current OTel span — When the thread-local metadata has an unset task ID, it checks Span.current().getSpanContext(). If valid, it constructs a Metadata from it. This bridges the gap during the transition: callers get correct context regardless of whether it was set via the old thread-local path or via OTel.
• Context.startTrace() removed — Trace creation is now the caller's responsibility. Tests that used it were updated to create a randomized Metadata and set it explicitly via Context.setMetadata().
• setMetadata, clearMetadata deprecated — Marked for future removal. Javadoc directs callers to use io.opentelemetry.context.Context.makeCurrent() instead.
• Dependencies added — opentelemetry-api (1.59.0) added to sampling and core modules; jaxb-api added to core for XML bind support.

---

Migrate to Gradle

Motivation

The downstream consumer of this code, solarwinds-apm-java, already uses Gradle. This migration aligns the build system so that when these modules are copied into that repository, they integrate without build-system translation. It also eliminates Maven's XML-heavy configuration in favor of Gradle's type-safe Kotlin DSL, improving incremental builds and simplifying multi-module dependency wiring (especially for shadow JAR consumption).

Build structure

• Root build.gradle.kts — Applies java-library, Spotless, Lombok, and Shadow plugins. Configures Java 8 toolchain, JUnit 5, common test dependencies, Spotless (Google Java Format), and Maven publishing to GitHub Packages across all subprojects.
• settings.gradle.kts — Centralized repository declarations (FAIL_ON_PROJECT_REPOS), foojay toolchain resolver, and apm-proto GitHub Packages repository with credential handling via env vars or Gradle properties.
• gradle.properties — Single source of truth for project version (11.0.0-SNAPSHOT).
• Module build files are minimal, declaring only module-specific dependencies and tasks.

Shadow JAR configuration

core and sampling use the Shadow plugin to produce fat JARs with relocated packages:

• sampling — Relocates Caffeine, Checker Framework, and ErrorProne under com.solarwinds.joboe.sampling.shaded.*.
• core — Relocates gRPC/Netty/Protobuf, OkHttp, Kotlin, and Google libs under com.solarwinds.joboe.shaded.*. Explicitly excludes io.opentelemetry.** and org.json.** from relocation so they remain on the consumer's classpath.
• Both modules expose a shadowElements configuration so downstream modules (e.g., metrics) depend on the shaded artifact rather than the raw JAR.

Dependency scope changes

• opentelemetry-api and opentelemetry-context are compileOnly in core and sampling (provided by the agent at runtime).
• org.json is compileOnly in config and metrics (provided by the host application).

CI/CD updates

• push.yml — Replaced mvn verify with ./gradlew build; updated artifact upload paths from target/ to build/; shading checks now read version from gradle.properties; removed the separate metrics shading check (metrics no longer produces a shadow JAR).
• codeql.yml — Switched to ./gradlew assemble; JDK bumped to 17 (required by Gradle toolchain, still targets Java 8 bytecode).
• release.yml (new) — Replaces maven.yml; publishes via ./gradlew publish -DreleaseVersion=...; version extracted from gradle.properties via a helper script.
• maven.yml deleted.
• All workflows set GITHUB_USERNAME / GITHUB_TOKEN at the env level instead of per-step.

Code formatting

All 294 Java source files were reformatted by Spotless (Google Java Format). No functional changes in those files.

Cleanup

• All pom.xml files (root + 5 modules) deleted.
• .gitignore updated to exclude .gradle/ and **/build/.

[github-advanced-security]

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

[Copilot]

Pull request overview

This PR migrates the build system from Maven to Gradle (Kotlin DSL) and refactors Metadata/Context to integrate with the OpenTelemetry API for context propagation, replacing reliance on internal thread-local state.

Changes:

• Refactored Metadata and Context to read trace context from OpenTelemetry API (Span.current().getSpanContext()) when thread-local metadata is unset
• Migrated build configuration from Maven (pom.xml) to Gradle (Kotlin DSL) with centralized dependency management and shadow JAR relocation rules
• Updated CI/CD workflows to use Gradle commands (./gradlew build, ./gradlew publish) instead of Maven

Reviewed changes

Copilot reviewed 174 out of 319 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
core/src/main/java/com/solarwinds/joboe/core/Context.java	Added OpenTelemetry API integration to fallback to current span context when thread-local metadata is unset; deprecated setMetadata/clearMetadata methods
core/build.gradle.kts	New Gradle build file defining shadow JAR configuration with package relocation rules excluding io.opentelemetry.** and org.json.**
.github/workflows/push.yml	Updated CI workflow from Maven to Gradle; changed artifact paths from target/ to build/; updated shading checks to read version from gradle.properties
.github/workflows/release.yml	New Gradle-based release workflow replacing maven.yml
core/src/test/java/com/solarwinds/joboe/core/TestReporterTest.java	Replaced Context.startTrace() calls with manual metadata creation via new Metadata() and Context.setMetadata()
All other Java files	Spotless reformatting (Google Java Format) with no functional changes

[tammy-baylis-swi]

This first commit you pointed out looks ok, and the ci/cd are all passing 👍

CodeQL found more than 20 potential problems in the proposed changes.

It would be nice if the more severe CodeQL failures could be addressed: https://github.com/solarwinds/joboe/runs/65161017468?pr=53

[cleverchuk]

This first commit you pointed out looks ok, and the ci/cd are all passing 👍

CodeQL found more than 20 potential problems in the proposed changes.

It would be nice if the more severe CodeQL failures could be addressed: https://github.com/solarwinds/joboe/runs/65161017468?pr=53

This first commit you pointed out looks ok, and the ci/cd are all passing 👍

CodeQL found more than 20 potential problems in the proposed changes.

It would be nice if the more severe CodeQL failures could be addressed: https://github.com/solarwinds/joboe/runs/65161017468?pr=53

Unfortunately, those won't be addressed. The one about algorithm is required by backend. The index out of bound error, though a legitimate concern, it isn't serious. That code path is not used at all and when used, it would run as a separate process started from a shell and the index out of bound would happen if provided with incorrect argument. This is the expected behavior.

[tammy-baylis-swi]

Thanks Chubi for those explanations!

Lgtm based on discussion.