[szymeo]

Summary

ci: release automatically from conventional commits

Publish malini/01J96EB3EF000E04FF3BC52E4A against main.

• .github/workflows/ci.yml
• .github/workflows/pr-title.yml

Validation

• Passed - Validation: node --test 'scripts/*.test.ts'

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[szymeo]

Lead review: logdash moved from services to domains, so the smoke test must use the domain model instead of a project.

• LOGDASH_API_KEY becomes the ingest key of one shared domain, "SDK smoke tests" (its Settings page, "Ingest key": one write-only key for every app on the domain). The owner adds it, replacing this repo's old per-service key.
• Send with the SDK's app option set to java-sdk, so each SDK shows up as its own app on that domain.
• LOGDASH_PERSONAL_API_KEY is a read-only key (Logs read, Metrics read) restricted to that domain. GET https://api.logdash.io/personal-api-keys/whoami returns access: { kind: "clusters", ids: [domainId] }. Fail with a clear message unless the kind is clusters and there is an id.
• Read logs from GET /clusters/{domainId}/logs?apps=java-sdk (narrowed to this run's seed) and metrics from GET /clusters/{domainId}/metrics (each entry has app, name, value: match on app and name), both with the same bearer. Drop /projects/{id}/....
• Never print an API key, not even one CI masks.

Check paths, query params and response shapes against logdash-io/logdash.io: apps/backend/src/log/core/log-core.controller.ts (readClusterLogs, ReadClusterLogsQuery in log/core/dto/cluster-logs.query.ts) and apps/backend/src/metric/core/metric-core.controller.ts (readClusterMetrics). The check program needs the app option, so it runs against the version this PR releases; before that, a manual run on this branch is not expected to pass.

[szymeo]

Lead review: no blocking findings. The release runs only after every check and the version job, deploys through the Central Portal profile (autoPublish true, waitUntil published), and tags last; the smoke test gets only its two secrets. Three small fixes before merge:

• Make the release re-runnable: if gh release create fails after a successful deploy, every rerun fails at deploy (Central rejects an existing version) and the tag never appears. Before deploying, ask the Central Portal whether $V is already published (GET https://central.sonatype.com/api/v1/publisher/published?namespace=io.logdash&name=logdash&version=$V with the portal token as a bearer, {"published":true} means skip), then tag.
• ci.yml release checkout: persist-credentials: false, so the write token is not on disk while Maven plugins run.
• pr-title.yml: permissions: {} above jobs:.