Skip to content

Introduce thin Maven Profile for Minimal Runtime Distribution#4530

Open
manel-martos wants to merge 18 commits intofinos:masterfrom
TradeHeader:feature/leanjar
Open

Introduce thin Maven Profile for Minimal Runtime Distribution#4530
manel-martos wants to merge 18 commits intofinos:masterfrom
TradeHeader:feature/leanjar

Conversation

@manel-martos
Copy link
Copy Markdown
Contributor

@manel-martos manel-martos commented Mar 16, 2026

Build Modernization — Introduce thin Maven Profile for Minimal Runtime Distribution

Background

The current cdm-java (rosetta-source) distribution bundles a significant volume of supplemental resources into the primary runtime artifact. This results in an artifact size of approximately 65 MB in Maven Central, which leads to unnecessary memory overhead and an expanded security surface area in production and cloud-native environments.

By decoupling the core generated model logic from these supplemental files, this PR provides a "Thin JAR" alternative that improves deployment efficiency, reduces class-loading times, and simplifies security compliance audits.

What is being released?

  • Introduction of the thin Maven Profile: An opt-in build configuration that generates a lean runtime artifact.
  • Secondary Artifact with Maven Classifier: Implementation of the thin classifier, allowing the build to generate a secondary, lean JAR (e.g., cdm-java-thin.jar) alongside the standard distribution ensuring full backward compatibility for existing pipelines.
  • Targeted Resource Exclusions: The following resources are excluded from the thin artifact to minimize bloat:
<excludes>
    <exclude>build-resources/**</exclude>
    <exclude>cdm-sample-files/**</exclude>
    <exclude>config/**</exclude>
    <exclude>functions/**</exclude>
    <exclude>ingest/**</exclude>
    <exclude>ingestions/**</exclude>
    <exclude>mapping-analytics/**</exclude>
    <exclude>release/**</exclude>
    <exclude>result-json-files/**</exclude>
    <exclude>schemas/**</exclude>
    <exclude>**/rosetta/*.rosetta</exclude>
</excludes>

Review Directions

Maintainers and users can verify the build locally by running:
mvn clean install -Pthin -DskipTests

This should produce both the standard JAR and the new -thin.jar artifact in the target directory and local .m2 repository.

@manel-martos manel-martos requested a review from a team as a code owner March 16, 2026 15:52
@netlify
Copy link
Copy Markdown

netlify bot commented Mar 16, 2026

Deploy Preview for finos-cdm ready!

Name Link
🔨 Latest commit 0dd3c9e
🔍 Latest deploy log https://app.netlify.com/projects/finos-cdm/deploys/69bd43283a2fa60008c91a99
😎 Deploy Preview https://deploy-preview-4530--finos-cdm.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@manel-martos manel-martos linked an issue Mar 16, 2026 that may be closed by this pull request
dependabot bot and others added 13 commits March 17, 2026 11:29
Bumps [minimatch](https://github.com/isaacs/minimatch) and [serve-handler](https://github.com/vercel/serve-handler). These dependencies needed to be updated together.

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.5)

Updates `serve-handler` from 6.1.6 to 6.1.7
- [Release notes](https://github.com/vercel/serve-handler/releases)
- [Commits](vercel/serve-handler@6.1.6...6.1.7)

---
updated-dependencies:
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
- dependency-name: serve-handler
  dependency-version: 6.1.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Hugo Hills <39260692+hugohills-regnosys@users.noreply.github.com>
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.3.3 to 3.4.1.
- [Commits](WebReflection/flatted@v3.3.3...v3.4.1)

---
updated-dependencies:
- dependency-name: flatted
  dependency-version: 3.4.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Hugo Hills <39260692+hugohills-regnosys@users.noreply.github.com>
Bumps [svgo](https://github.com/svg/svgo) from 2.8.0 to 2.8.2.
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v2.8.0...v2.8.2)

---
updated-dependencies:
- dependency-name: svgo
  dependency-version: 2.8.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [axios](https://github.com/axios/axios) and [@docusaurus/plugin-google-gtag](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag). These dependencies needed to be updated together.

Updates `axios` from 1.12.2 to 1.13.6
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.12.2...v1.13.6)

Updates `@docusaurus/plugin-google-gtag` from 2.3.0 to 3.9.2
- [Release notes](https://github.com/facebook/docusaurus/releases)
- [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG-v2.md)
- [Commits](https://github.com/facebook/docusaurus/commits/v3.9.2/packages/docusaurus-plugin-google-gtag)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.13.6
  dependency-type: direct:production
- dependency-name: "@docusaurus/plugin-google-gtag"
  dependency-version: 3.9.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…0bd36c0e9f-Bug_4469_CDM7

[7.x.x] - Akash Patel Qualification: Qualify_AssetClass_ForeignExchange - Add an or condition to the fx asset class qualification function
Bumps [webpack](https://github.com/webpack/webpack) from 5.101.3 to 5.105.0.
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.101.3...v5.105.0)

---
updated-dependencies:
- dependency-name: webpack
  dependency-version: 5.105.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Hugo Hills <39260692+hugohills-regnosys@users.noreply.github.com>
Bumps [eslint](https://github.com/eslint/eslint) from 8.57.1 to 9.39.2.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v8.57.1...v9.39.2)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 9.39.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Self Service - release process update

* deleted release.md

---------

Co-authored-by: CDM-ReleaseManagement-OT <oscar.twomey+cdm@regnosys.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Introduce thin Maven Profile for Minimal Runtime Distribution

4 participants