feat: complete auth architecture refactor and repository updates

Author: SunnyX6

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -7,7 +7,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        请尽量提供可复现信息，避免“无法定位”的描述。
+        Please provide reproducible details and avoid non-actionable descriptions.
   - type: input
     id: module
     attributes:

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -7,7 +7,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        先说问题，再说方案。避免只给“想法标题”。
+        Describe the problem first, then the solution. Avoid only giving an idea title.
   - type: textarea
     id: problem
     attributes:

.github/workflows/ci.yml

@@ -11,11 +11,13 @@ on:
 jobs:
   quality:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 60
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Setup Java 21
         uses: actions/setup-java@v4
@@ -29,18 +31,315 @@ jobs:
         with:
           python-version: "3.11"
 
+      - name: Setup Node 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: |
+            web/datapillar-studio/package-lock.json
+            web/datapillar-web-site/package-lock.json
+
+      - name: Detect changed files
+        id: changed
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            base_sha="${{ github.event.pull_request.base.sha }}"
+          else
+            base_sha="${{ github.event.before }}"
+          fi
+          head_sha="${{ github.sha }}"
+
+          if [[ -z "$base_sha" || "$base_sha" =~ ^0+$ ]]; then
+            base_sha="$(git rev-list --max-parents=0 HEAD)"
+          fi
+
+          mapfile -t changed_files < <(git diff --name-only "$base_sha" "$head_sha")
+          if [[ ${#changed_files[@]} -eq 0 ]]; then
+            mapfile -t changed_files < <(git ls-files)
+          fi
+
+          printf '%s\n' "${changed_files[@]}" > /tmp/changed_files.txt
+
+          echo "base_sha=$base_sha" >> "$GITHUB_OUTPUT"
+          echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT"
+
+          {
+            echo "files<<EOF"
+            cat /tmp/changed_files.txt
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
+          if grep -q '^datapillar-gravitino/' /tmp/changed_files.txt; then
+            echo "has_gravitino=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_gravitino=false" >> "$GITHUB_OUTPUT"
+          fi
+
+          if grep -Eq '^web/datapillar-studio/' /tmp/changed_files.txt; then
+            echo "has_web_studio=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_web_studio=false" >> "$GITHUB_OUTPUT"
+          fi
+
+          if grep -Eq '^web/datapillar-web-site/' /tmp/changed_files.txt; then
+            echo "has_web_site=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_web_site=false" >> "$GITHUB_OUTPUT"
+          fi
+
+          if grep -Eq '^(datapillar-ai|datapillar-oneagentic|datapillar-airflow-plugin)/.*\.py$' /tmp/changed_files.txt; then
+            echo "has_python_changes=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_python_changes=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Validate local scripts syntax
         run: |
           bash -n scripts/start-local-all.sh
           bash -n scripts/stop-local-all.sh
+          bash -n scripts/check-gravitino-rpc-contract-consistency.sh
+          bash -n datapillar-gravitino/scripts/merge-overlay-conf.sh
+          bash -n datapillar-gravitino/scripts/check-overlay-decoupling.sh
+
+      - name: Gravitino RPC contract guards
+        run: |
+          bash scripts/check-gravitino-rpc-contract-consistency.sh
 
-      - name: Python syntax smoke check (datapillar-ai)
-        run: python -m compileall -q datapillar-ai/src
+      - name: Gravitino decoupling guards
+        run: |
+          cd datapillar-gravitino
+          ./scripts/check-overlay-decoupling.sh
 
-      - name: Maven test-compile (core modules)
+      - name: Self-module naming and weak-exception gate
+        env:
+          BASE_SHA: ${{ steps.changed.outputs.base_sha }}
+          HEAD_SHA: ${{ steps.changed.outputs.head_sha }}
+        run: |
+          python3 - <<'PY'
+          import ast
+          import os
+          import re
+          import subprocess
+          from pathlib import Path
+
+          changed_files = [
+              line.strip()
+              for line in Path('/tmp/changed_files.txt').read_text(encoding='utf-8').splitlines()
+              if line.strip()
+          ]
+
+          self_prefixes = (
+              'datapillar-ai/',
+              'datapillar-oneagentic/',
+              'datapillar-airflow-plugin/',
+              'datapillar-common/',
+              'datapillar-auth/',
+              'datapillar-studio-service/',
+              'datapillar-api-gateway/',
+              'datapillar-openlineage/',
+              'datapillar-distribution/',
+              'web/datapillar-studio/',
+              'web/datapillar-web-site/',
+          )
+
+          def in_scope(path: str) -> bool:
+              if not path.startswith(self_prefixes):
+                  return False
+              if path.startswith('datapillar-gravitino/'):
+                  return False
+              if '/tests/' in path or '/test/' in path or '/src/test/' in path:
+                  return False
+              if '/.venv/' in path or '/.uv-cache/' in path:
+                  return False
+              return True
+
+          java_pattern = re.compile(
+              r'^(?:\s*@.*\n)*\s*(?:public|protected|private|default)\s+(?:static\s+)?(?:final\s+)?(?:synchronized\s+)?(?:<[^>]+>\s+)?[A-Za-z0-9_<>,\[\].?]+\s+([A-Za-z_][A-Za-z0-9_]*)\s*\(',
+              re.M,
+          )
+          py_except = re.compile(r'\bexcept\s+Exception(?:\s+as\s+\w+)?\s*:')
+          java_catch = re.compile(r'\bcatch\s*\(\s*Exception\s+\w+\s*\)')
+
+          redline_hits = []
+          review_hits = []
+          weak_hits = []
+
+          for path in changed_files:
+              if not in_scope(path):
+                  continue
+              file_path = Path(path)
+              if not file_path.exists():
+                  continue
+              suffix = file_path.suffix
+              if suffix not in {'.py', '.java'}:
+                  continue
+
+              source = file_path.read_text(encoding='utf-8', errors='ignore')
+
+              if suffix == '.py':
+                  try:
+                      tree = ast.parse(source, filename=path)
+                  except Exception:
+                      continue
+                  for node in ast.walk(tree):
+                      if not isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                          continue
+                      name = node.name
+                      length = len(name)
+                      line = getattr(node, 'lineno', 1)
+                      if length > 32:
+                          redline_hits.append(f'{path}:{line}:{name} ({length})')
+                      elif 25 <= length <= 32:
+                          review_hits.append(f'{path}:{line}:{name} ({length})')
+              else:
+                  for match in java_pattern.finditer(source):
+                      name = match.group(1)
+                      length = len(name)
+                      line = source.count('\n', 0, match.start()) + 1
+                      if length > 32:
+                          redline_hits.append(f'{path}:{line}:{name} ({length})')
+                      elif 25 <= length <= 32:
+                          review_hits.append(f'{path}:{line}:{name} ({length})')
+
+              diff = subprocess.run(
+                  ['git', 'diff', '--unified=0', '--no-color', os.environ['BASE_SHA'], os.environ['HEAD_SHA'], '--', path],
+                  capture_output=True,
+                  text=True,
+                  check=False,
+              ).stdout.splitlines()
+
+              for line in diff:
+                  if not line.startswith('+') or line.startswith('+++'):
+                      continue
+                  payload = line[1:]
+                  if py_except.search(payload):
+                      weak_hits.append(
+                          f'{path}:New except Exception, need specific exception handling.'
+                      )
+                  if java_catch.search(payload):
+                      weak_hits.append(
+                          f'{path}:New catch(Exception), need specific exception handling.'
+                      )
+
+          if review_hits:
+              print('Naming review tips (25-32):')
+              for item in sorted(set(review_hits)):
+                  print(item)
+
+          if redline_hits:
+              print('Naming gate failed: function/method name length must not exceed 32.')
+              for item in sorted(set(redline_hits)):
+                  print(item)
+              raise SystemExit(1)
+
+          if weak_hits:
+              print('Exception handling gate failed: weak exception handling mode is forbidden.')
+              for item in sorted(set(weak_hits)):
+                  print(item)
+              raise SystemExit(1)
+          PY
+
+      - name: Install Python quality tools
+        if: steps.changed.outputs.has_python_changes == 'true'
+        run: |
+          python -m pip install --upgrade pip
+          pip install ruff black
+
+      - name: Frontend lockfile and artifact gate
+        if: steps.changed.outputs.has_web_studio == 'true' || steps.changed.outputs.has_web_site == 'true'
+        run: |
+          python3 - <<'PY'
+          from pathlib import Path
+          import subprocess
+
+          modules = ["web/datapillar-studio", "web/datapillar-web-site"]
+          errors: list[str] = []
+
+          for module in modules:
+              lock_candidates = [
+                  Path(module) / "package-lock.json",
+                  Path(module) / "pnpm-lock.yaml",
+                  Path(module) / "yarn.lock",
+              ]
+              existing = [str(path) for path in lock_candidates if path.exists()]
+              if len(existing) != 1:
+                  errors.append(
+                      f"{module}:There must be exactly one lock file(package-lock/pnpm-lock/yarn.lock), current={existing}"
+                  )
+
+          tracked_files = subprocess.run(
+              ["git", "ls-files"],
+              capture_output=True,
+              text=True,
+              check=True,
+          ).stdout.splitlines()
+          tracked_tsbuildinfo = [
+              path
+              for path in tracked_files
+              if path.endswith(".tsbuildinfo")
+              and (
+                  path.startswith("web/datapillar-studio/")
+                  or path.startswith("web/datapillar-web-site/")
+              )
+          ]
+          if tracked_tsbuildinfo:
+              errors.append(
+                  f"Frontend build artifacts must not be tracked: {tracked_tsbuildinfo}"
+              )
+
+          if errors:
+              print("Frontend gate failed:")
+              for item in errors:
+                  print(item)
+              raise SystemExit(1)
+          PY
+
+      - name: Python quality checks (self modules)
+        if: steps.changed.outputs.has_python_changes == 'true'
+        run: |
+          set -euo pipefail
+          mapfile -t py_files < <(grep -E '^(datapillar-ai|datapillar-oneagentic|datapillar-airflow-plugin)/.*\.py$' /tmp/changed_files.txt \
+            | grep -Ev '/tests?/|/\.venv/|/\.uv-cache/' \
+            || true)
+          if [[ ${#py_files[@]} -eq 0 ]]; then
+            echo "No changed python source files, skip."
+            exit 0
+          fi
+          ruff check "${py_files[@]}"
+          black --check "${py_files[@]}"
+          python -m py_compile "${py_files[@]}"
+
+      - name: Maven test (self modules)
         run: |
           mvn -q \
-            -pl datapillar-common,datapillar-auth,datapillar-studio-service,datapillar-api-gateway,datapillar-openlineage \
+            -pl datapillar-common,datapillar-auth,datapillar-studio-service,datapillar-api-gateway,datapillar-openlineage,datapillar-distribution \
             -am \
-            -DskipTests \
-            test-compile
+            test
+
+      - name: Frontend gate (datapillar-studio)
+        if: steps.changed.outputs.has_web_studio == 'true'
+        run: |
+          cd web/datapillar-studio
+          npm ci
+          npm run lint
+          npm run type-check
+          npm run test
+
+      - name: Frontend gate (datapillar-web-site)
+        if: steps.changed.outputs.has_web_site == 'true'
+        run: |
+          cd web/datapillar-web-site
+          npm ci
+          npm run lint
+          npm run type-check
+          npm run test
+
+      - name: Gravitino native gate
+        if: steps.changed.outputs.has_gravitino == 'true'
+        run: |
+          cd datapillar-gravitino
+          ./gradlew check