Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .envrc
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
if has nix; then
if ! has nix_direnv_version || ! nix_direnv_version 3.0.6; then
source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/3.0.6/direnvrc" "sha256-RYcUJaRMf8oF5LznDrlCXbkOQrywm0HDv1VjYGaJGdM="
fi
fi

source_env_if_exists .envrc.local
19 changes: 0 additions & 19 deletions .github/workflows/ci.yml

This file was deleted.

28 changes: 0 additions & 28 deletions .github/workflows/ci_linux_windows.yml

This file was deleted.

30 changes: 0 additions & 30 deletions .github/workflows/java_versions.yml

This file was deleted.

27 changes: 0 additions & 27 deletions .github/workflows/publish-docs.yml

This file was deleted.

50 changes: 50 additions & 0 deletions .github/workflows/publish-github-packages.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
name: Publish to GitHub Packages

# Manually triggered release of the GrowthBook SDK artifact to our GitHub
# Packages Maven registry.
on:
workflow_dispatch:
inputs:
neloBuild:
description: 'Nelo re-cut number; version becomes <upstream version>-nelo.<N>'
required: true
default: '1'
version:
description: 'Optional full version override; leave blank to derive from the tag'
required: false
default: ''
modules:
description: 'Gradle publish tasks to run'
required: true
default: ':lib:publish'
type: choice
options:
- ':lib:publish'
- 'publish'

permissions:
contents: read
packages: write

jobs:
publish:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

# Use exact JDK versions pinned with nix
- uses: DeterminateSystems/nix-installer-action@main

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 security Mutable actions in publishing job

The package-write workflow executes DeterminateSystems/nix-installer-action@main and actions/checkout@v4, so those references can later resolve to unreviewed code and make releases non-reproducible or expose the job token. Pin both actions to reviewed full commit SHAs.

How this was verified: Both mutable references execute before Gradle in a job granted packages: write.

Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/publish-github-packages.yml
Line: 36

Comment:
**Mutable actions in publishing job**

The package-write workflow executes `DeterminateSystems/nix-installer-action@main` and `actions/checkout@v4`, so those references can later resolve to unreviewed code and make releases non-reproducible or expose the job token. Pin both actions to reviewed full commit SHAs.

**How this was verified:** Both mutable references execute before Gradle in a job granted `packages: write`.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Fix in Claude Code Fix in Codex


# The version normally derives from the checked-out tag's gradle.properties plus the
# -nelo.<N> suffix the root build.gradle appends, so it always matches the code being
# built. `version` is upstream's own project property, so the optional override needs
# no patched file; the overlay vendor-qualifies it either way.
- name: Publish to GitHub Packages
run: |
nix develop --command bash -c './gradlew ${{ inputs.modules }} \
-PneloBuild="${{ inputs.neloBuild }}" \
${{ inputs.version != '' && format('-Pversion="{0}"', inputs.version) || '' }} \
--console=plain --stacktrace'
env:
GITHUB_ACTOR: ${{ github.actor }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
60 changes: 0 additions & 60 deletions .github/workflows/release-please.yml

This file was deleted.

2 changes: 2 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -7,3 +7,5 @@ build
bin
.vscode
.DS_Store

/.direnv
2 changes: 1 addition & 1 deletion .release-please-manifest.json
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
{
".": "0.10.10"
".": "0.11.0"
}
26 changes: 26 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,31 @@
# Changelog

## [0.11.0](https://github.com/growthbook/growthbook-sdk-java/compare/v0.10.10...0.11.0) (2026-08-04)


### ⚠ BREAKING CHANGES

* update OkHttp dependencies to version 5.4.0 ([#218](https://github.com/growthbook/growthbook-sdk-java/issues/218))

### Features

* add Caffeine cache adapter module ([#220](https://github.com/growthbook/growthbook-sdk-java/issues/220)) ([bee3e01](https://github.com/growthbook/growthbook-sdk-java/commit/bee3e010ac7b4a2be4c9df59ddbdda9c3470d44d))
* add configuration validation at client start-up ([#223](https://github.com/growthbook/growthbook-sdk-java/issues/223)) ([f0fb1ae](https://github.com/growthbook/growthbook-sdk-java/commit/f0fb1aecbfdf8f713a39b6e8ca0c44b6f9eda3c2))
* add custom fields ([#217](https://github.com/growthbook/growthbook-sdk-java/issues/217)) ([06c2b98](https://github.com/growthbook/growthbook-sdk-java/commit/06c2b98b68fd37695efc5ad9bd9fdf870707ff94))
* add diagnostics API ([#219](https://github.com/growthbook/growthbook-sdk-java/issues/219)) ([32925a6](https://github.com/growthbook/growthbook-sdk-java/commit/32925a6b9140808197424eb2aa26ce73d899ae3b))
* add JCache (JSR-107) cache adapter module ([#221](https://github.com/growthbook/growthbook-sdk-java/issues/221)) ([621121e](https://github.com/growthbook/growthbook-sdk-java/commit/621121e4d2fc84e2efa11213727601dc3e3cb044))
* add remote evaluation support ([#216](https://github.com/growthbook/growthbook-sdk-java/issues/216)) ([393fdc8](https://github.com/growthbook/growthbook-sdk-java/commit/393fdc8fd4eec5f346556192fe19ad936905ab7d))
* Typed feature access ([#224](https://github.com/growthbook/growthbook-sdk-java/issues/224)) ([45c57b4](https://github.com/growthbook/growthbook-sdk-java/commit/45c57b45fec74427c4acbae0e5de296d033e5d50))


### Bug Fixes

* apply 200 response payload when x-sse-support header is absent ([#231](https://github.com/growthbook/growthbook-sdk-java/issues/231)) ([e1e3b13](https://github.com/growthbook/growthbook-sdk-java/commit/e1e3b130fcf3abbe87c38c5e594f8f7141325407))
* correct sticky bucketing logic in single-user and multi-user modes ([#211](https://github.com/growthbook/growthbook-sdk-java/issues/211)) ([1ffd7dc](https://github.com/growthbook/growthbook-sdk-java/commit/1ffd7dc30de0fc5e2e56c80cdb69d9ff746aeda1))
* handle double forced variation values ([#213](https://github.com/growthbook/growthbook-sdk-java/issues/213)) ([0e5cb83](https://github.com/growthbook/growthbook-sdk-java/commit/0e5cb83fcb1126e7cdf4d6bf5fdf21bb37187a6f))
* prevent unhandled exceptions when processing empty SSE event payloads ([#214](https://github.com/growthbook/growthbook-sdk-java/issues/214)) ([c509792](https://github.com/growthbook/growthbook-sdk-java/commit/c509792a3492ac443f3685b07de7fcff8dbcbf24))
* update OkHttp dependencies to version 5.4.0 ([#218](https://github.com/growthbook/growthbook-sdk-java/issues/218)) ([72bb348](https://github.com/growthbook/growthbook-sdk-java/commit/72bb348765dc10cca78710dd1e1e6cd487ad4808))

## [0.10.10](https://github.com/growthbook/growthbook-sdk-java/compare/v0.10.9...0.10.10) (2026-05-08)


Expand Down
48 changes: 48 additions & 0 deletions build.gradle
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
/*
* Nelo fork overlay.
*
* Upstream has no root build script, so everything fork-specific lives here and every
* upstream file — lib/build.gradle, gradle.properties, the cache adapter modules — stays
* byte-identical. That keeps syncing with upstream a fast-forward instead of a merge.
*
* Upstream already declares a `GitHubPackages` publishing repository (and reads
* GITHUB_ACTOR / GITHUB_TOKEN from the environment); it just points at its own registry.
* We only redirect the URL to ours.
*
* WHY THIS FORK EXISTS: upstream does not publish com.github.growthbook:lib to Maven
* Central, and JitPack 403s in CI. So we rebuild upstream's tagged release unchanged and
* republish it to our own GitHub Packages registry, letting api-v2 consume it as a binary
* instead of building the SDK from source. No SDK behaviour is forked -- if upstream ever
* ships to Maven Central, this repo can be retired.
*/

// Every artifact we publish is vendor-qualified as <upstream version>-nelo.<N>, so a Nelo
// rebuild can never be mistaken for -- or collide with -- a genuine upstream release, and
// we can re-cut the same upstream version (.2, .3) if a build needs redoing. The base
// version tracks upstream's gradle.properties, so it cannot go stale on the next sync.
// Re-cut with -PneloBuild=2; an explicit -Pversion=x.y.z-nelo.N is passed through as-is.
def neloBuild = findProperty('neloBuild') ?: '1'

gradle.beforeProject { p ->
def v = p.version.toString()
if (v != 'unspecified' && !v.contains('-nelo.')) {
p.version = "${v}-nelo.${neloBuild}"
}
}

subprojects {
// Upstream's gradle.properties sets `group=com.github.growthbook ` with a trailing
// space. lib/build.gradle reassigns the group so it escapes, but the cache adapter
// modules inherit it and Gradle rejects the publication outright:
// "groupId (com.github.growthbook ) is not a valid Maven identifier".
// Trim it here so `./gradlew publish` works for every module.
group = group.toString().trim()

plugins.withId('maven-publish') {
publishing.repositories.withType(MavenArtifactRepository).all { repo ->
if (repo.name == 'GitHubPackages') {
repo.url = uri('https://maven.pkg.github.com/nelo/growthbook-sdk-java')
}
}
}
}
59 changes: 59 additions & 0 deletions flake.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading