chore: import upstream snapshot with attribution

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,42 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ""
+labels: 'type: bug'
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**Details**
+Conductor version:
+Persistence implementation: Cassandra, Postgres, MySQL, Dynomite etc
+Queue implementation: Postgres, MySQL, Dynoqueues etc
+Lock: Redis or Zookeeper?
+Workflow definition:
+Task definition:
+Event handler definition:
+
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Code to reproduce (paste relevant snippet):**
+```
+[paste the minimal code that triggers the bug]
+```
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,43 @@
+name: Bug Report
+description: Create a report to help us reproduce and fix the bug
+
+body:
+- type: markdown
+  attributes:
+    value: >
+      #### Before submitting a bug, please make sure the issue hasn't been already addressed by searching through [the existing and past issues](https://github.com/conductor-oss/conductor/issues?q=is%3Aissue%20label%3Abug). 
+- type: textarea
+  attributes:
+    label: Describe the bug
+    description: |
+      Please provide a clear and concise description of what the bug is.
+
+      If relevant, add a minimal example so that we can reproduce the error by running the code. It is very important for the snippet to be as succinct (minimal) as possible, so please take time to trim down any irrelevant code to help us debug efficiently.
+      Your example should be fully self-contained and not rely on any artifact that should be downloaded.
+      For example:
+
+      ```
+      # A succinct reproducing example trimmed down to the essential parts
+      # (any language is fine — Java, Python, Go, JavaScript, etc.)
+      ```
+
+      If the code is too long (hopefully, it isn't), feel free to put it in a public gist and link it in the issue: https://gist.github.com.
+
+      Please also paste or describe the results you observe instead of the expected results. If you observe an error, please paste the error message including the **full** traceback of the exception. It may be relevant to wrap error messages in ```` ```triple quotes blocks``` ````.
+
+    placeholder: |
+      A clear and concise description of what the bug is.
+
+      ```
+      # Sample code to reproduce the problem (any language)
+      ```
+
+      ```
+      The error message you got, with the full traceback.
+      ```
+  validations:
+    required: true
+- type: markdown
+  attributes:
+    value: >
+      Thanks for contributing!

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+ - name: Questions
+   url: https://orkes-conductor.slack.com/join/shared_invite/zt-2vdbx239s-Eacdyqya9giNLHfrCavfaA#/shared-invite/email
+   about: Ask questions and discuss with other Conductor community members

.github/ISSUE_TEMPLATE/documentation.md

@@ -0,0 +1,12 @@
+---
+name: Documentation
+about: Something in the documentation that needs improvement
+title: "[DOC]: "
+labels: 'type: docs'
+assignees: ''
+
+---
+
+## What are you missing in the docs
+
+## Proposed text

.github/ISSUE_TEMPLATE/documentation.yaml

@@ -0,0 +1,24 @@
+name: Documentation
+description: Report an issue related to https://docs.conductor-oss.org/index.html
+
+body:
+- type: markdown
+  attributes:
+    value: >
+      #### Note: Please report your documentation issue in English to ensure it can be understood and addressed by the development team.
+- type: textarea
+  attributes:
+    label: The doc issue
+    description: >
+      A clear and concise description of what content on https://docs.conductor-oss.org/index.html is an issue. 
+  validations:
+    required: true
+- type: textarea
+  attributes:
+    label: Suggest a potential alternative/fix
+    description: >
+      Tell us how we could improve the documentation in this regard.
+- type: markdown
+  attributes:
+    value: >
+      Thanks for contributing!

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Propose a new feature
+title: "[FEATURE]: "
+labels: 'type: feature'
+assignees: ''
+
+---
+
+Please read our [contributor guide](https://github.com/conductor-oss/conductor/blob/main/CONTRIBUTING.md) before creating an issue.   
+Also consider discussing your idea on the [discussion forum](https://github.com/conductor-oss/conductor/discussions) first.
+
+## Describe the Feature Request
+_A clear and concise description of what the feature request is._
+
+## Describe Preferred Solution
+_A clear and concise description of what you want to happen._
+
+## Describe Alternatives
+_A clear and concise description of any alternative solutions or features you've considered._

.github/ISSUE_TEMPLATE/feature_request.yaml

@@ -0,0 +1,29 @@
+name: Feature request
+description: Submit a proposal/request for a new Conductor feature
+
+body:
+- type: markdown
+  attributes:
+    value: >
+      #### Note: Please write your feature request in English to ensure it can be understood and addressed by the development team.
+- type: textarea
+  attributes:
+    label: The feature, motivation and pitch
+    description: >
+      A clear and concise description of the feature proposal. Please outline the motivation for the proposal. Is your feature request related to a specific problem? e.g., *"I'm working on X and would like Y to be possible"*. If this is related to another GitHub issue, please link here too.
+  validations:
+    required: true
+- type: textarea
+  attributes:
+    label: Alternatives
+    description: >
+      A description of any alternative solutions or features you've considered, if any.
+- type: textarea
+  attributes:
+    label: Additional context
+    description: >
+      Add any other context or screenshots about the feature request.
+- type: markdown
+  attributes:
+    value: >
+      Thanks for contributing!

.github/pull_request_template.md

@@ -0,0 +1,21 @@
+Pull Request type
+----
+- [ ] Bugfix
+- [ ] Feature
+- [ ] Refactoring (no functional changes, no api changes)
+- [ ] Build related changes
+- [ ] WHOSUSING.md
+- [ ] Other (please describe):
+
+**NOTE**: Please remember to run `./gradlew spotlessApply` to fix any format violations.
+
+Changes in this PR
+----
+
+_Describe the new behavior from this PR, and why it's needed_
+Issue #
+
+Alternatives considered
+----
+
+_Describe alternative implementation you have considered_

.github/release-drafter.yml

@@ -0,0 +1,39 @@
+template: |
+  ## What’s Changed
+
+  $CHANGES
+
+name-template: 'v$RESOLVED_VERSION'
+tag-template: 'v$RESOLVED_VERSION'
+
+categories:
+  - title: 'IMPORTANT'
+    label: 'type: important'
+  - title: 'New'
+    label: 'type: feature'
+  - title: 'Bug Fixes'
+    label: 'type: bug'
+  - title: 'Refactor'
+    label: 'type: maintenance'
+  - title: 'Documentation'
+    label: 'type: docs'
+  - title: 'Dependency Updates'
+    label: 'type: dependencies'
+
+version-resolver:
+  minor:
+    labels:
+      - 'type: important'
+
+  patch:
+    labels:
+      - 'type: bug'
+      - 'type: maintenance'
+      - 'type: docs'
+      - 'type: dependencies'
+      - 'type: feature'
+
+exclude-labels:
+  - 'skip-changelog'
+  - 'gradle-wrapper'
+  - 'github_actions'

.github/workflows/ci.yml

@@ -0,0 +1,419 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - "conductor-clients/**"
+  pull_request:
+    paths-ignore:
+      - "conductor-clients/**"
+  workflow_dispatch:
+    inputs:
+      redis_es8:
+        description: "Redis + Elasticsearch 8"
+        type: boolean
+        default: true
+      postgres:
+        description: "PostgreSQL"
+        type: boolean
+        default: false
+      mysql:
+        description: "MySQL"
+        type: boolean
+        default: false
+      redis_os3:
+        description: "Redis + OpenSearch 3"
+        type: boolean
+        default: false
+      redis_es7:
+        description: "Redis + Elasticsearch 7"
+        type: boolean
+        default: false
+      cassandra_es7:
+        description: "Cassandra + Elasticsearch 7"
+        type: boolean
+        default: false
+
+jobs:
+  detect-changes:
+    runs-on: ubuntu-latest
+    outputs:
+      heavy-persistence: ${{ steps.filter.outputs.heavy-persistence }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            heavy-persistence:
+              - 'cassandra-persistence/**'
+              - 'es6-persistence/**'
+              - 'es7-persistence/**'
+              - 'es8-persistence/**'
+              - 'mysql-persistence/**'
+              - 'os-persistence/**'
+              - 'os-persistence-v2/**'
+              - 'os-persistence-v3/**'
+              - 'scheduler/cassandra-persistence/**'
+              - 'scheduler/mysql-persistence/**'
+
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+      - name: Free disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet
+          sudo rm -rf /usr/local/lib/android
+          sudo rm -rf /opt/ghc
+      - name: Gradle wrapper validation
+        uses: gradle/wrapper-validation-action@v3
+      - name: Set up Zulu JDK 21
+        uses: actions/setup-java@v5
+        with:
+          distribution: "zulu"
+          java-version: "21"
+      - name: Cache SonarCloud packages
+        uses: actions/cache@v5
+        with:
+          path: ~/.sonar/cache
+          key: ${{ runner.os }}-sonar
+          restore-keys: ${{ runner.os }}-sonar
+      - name: Cache Gradle packages
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: ${{ runner.os }}-gradle-
+      - name: Build with Gradle
+        if: github.ref != 'refs/heads/main'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        run: |
+          ./gradlew build -x :conductor-test-harness:test -x test
+      - name: Build and Publish snapshot
+        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+        run: |
+          echo "Running build for commit ${{ github.sha }}"
+          ./gradlew build -x :conductor-test-harness:test -x test
+      - name: Generate aggregated coverage report
+        if: always()
+        run: ./gradlew jacocoAggregatedReport -x test || true
+      - name: Publish Test Report
+        uses: mikepenz/action-junit-report@v6
+        if: always()
+        with:
+          report_paths: "**/build/test-results/test/TEST-*.xml"
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v7
+        with:
+          name: build-artifacts
+          path: "**/build/reports"
+      - name: Upload coverage report
+        uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: coverage-report
+          path: build/reports/jacoco/aggregated
+  unit-test:
+    needs: detect-changes
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+      - name: Free disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet
+          sudo rm -rf /usr/local/lib/android
+          sudo rm -rf /opt/ghc
+      - name: Set up Zulu JDK 21
+        uses: actions/setup-java@v5
+        with:
+          distribution: "zulu"
+          java-version: "21"
+      - name: Cache Gradle packages
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: ${{ runner.os }}-gradle-
+      - name: Force Docker API Version
+        run: echo 'api.version=1.44' > ~/.docker-java.properties
+      - name: Run unit tests
+        run: |
+          # On main (post-merge): run everything
+          if [ "${{ github.event_name }}" != "pull_request" ]; then
+            ./gradlew test -x :conductor-test-harness:test
+            exit 0
+          fi
+          # On PRs: skip heavy container tests (cassandra, es, mysql, opensearch)
+          # unless their code changed. Redis, postgres, sqlite always run.
+          if [ "${{ needs.detect-changes.outputs.heavy-persistence }}" == "true" ]; then
+            ./gradlew test -x :conductor-test-harness:test
+          else
+            ./gradlew test \
+              -x :conductor-test-harness:test \
+              -x :conductor-cassandra-persistence:test \
+              -x :conductor-scheduler-cassandra-persistence:test \
+              -x :conductor-es6-persistence:test \
+              -x :conductor-es7-persistence:test \
+              -x :conductor-es8-persistence:test \
+              -x :conductor-mysql-persistence:test \
+              -x :conductor-scheduler-mysql-persistence:test \
+              -x :conductor-os-persistence:test \
+              -x :conductor-os-persistence-v2:test \
+              -x :conductor-os-persistence-v3:test
+          fi
+      - name: Publish Test Report
+        uses: mikepenz/action-junit-report@v6
+        if: always()
+        with:
+          report_paths: "**/build/test-results/test/TEST-*.xml"
+          check_name: Unit Test Report
+      - name: Upload unit-test reports
+        uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: unit-test-reports
+          path: "**/build/reports/tests"
+  test-harness:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+      - name: Free disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet
+          sudo rm -rf /usr/local/lib/android
+          sudo rm -rf /opt/ghc
+      - name: Set up Zulu JDK 21
+        uses: actions/setup-java@v5
+        with:
+          distribution: "zulu"
+          java-version: "21"
+      - name: Cache Gradle packages
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: ${{ runner.os }}-gradle-
+      - name: Force Docker API Version
+        run: echo 'api.version=1.44' > ~/.docker-java.properties
+      - name: Cache Docker images
+        uses: actions/cache@v5
+        id: docker-cache
+        with:
+          path: /tmp/docker-images-test-harness.tar
+          key: docker-test-harness-v2
+      - name: Load cached Docker images
+        if: steps.docker-cache.outputs.cache-hit == 'true'
+        run: docker load -i /tmp/docker-images-test-harness.tar || true
+      - name: Run test-harness tests
+        run: |
+          ./gradlew :conductor-test-harness:test
+      - name: Save Docker images for cache
+        if: steps.docker-cache.outputs.cache-hit != 'true'
+        run: |
+          set -euo pipefail
+          docker image prune -f
+          mapfile -t images < <((docker images --format '{{.Repository}}:{{.Tag}}' \
+            | grep -v '<none>' \
+            | grep -E '(^|/)(elasticsearch|redis|postgres|mysql|mongo|cassandra)(:|/)|mockserver/mockserver|opensearchproject/opensearch|testcontainers/|orkesio/') || true)
+          if [ "${#images[@]}" -eq 0 ]; then
+            echo "No Testcontainers-related images to cache; writing empty tar for cache action."
+            tar -cf /tmp/docker-images-test-harness.tar --files-from /dev/null
+            exit 0
+          fi
+          printf '%s\n' "${images[@]}"
+          docker save -o /tmp/docker-images-test-harness.tar "${images[@]}"
+      - name: Publish Test Report
+        uses: mikepenz/action-junit-report@v6
+        if: always()
+        with:
+          report_paths: "test-harness/build/test-results/test/TEST-*.xml"
+      - name: Upload test-harness reports
+        uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: test-harness-reports
+          path: "test-harness/build/reports"
+      - name: Upload test-harness coverage report
+        uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: test-harness-coverage-report
+          path: "test-harness/build/reports/jacoco"
+  generate-e2e-matrix:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+    steps:
+      - id: set-matrix
+        shell: bash
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            items=""
+            [ "${{ inputs.redis_es8 }}"    = "true" ] && items="${items}{\"name\":\"redis-es8\",\"script\":\"./e2e/run_tests-es8.sh\"},"
+            [ "${{ inputs.postgres }}"     = "true" ] && items="${items}{\"name\":\"postgres\",\"script\":\"./e2e/run_tests-postgres.sh\"},"
+            [ "${{ inputs.mysql }}"        = "true" ] && items="${items}{\"name\":\"mysql\",\"script\":\"./e2e/run_tests-mysql.sh\"},"
+            [ "${{ inputs.redis_os3 }}"    = "true" ] && items="${items}{\"name\":\"redis-os3\",\"script\":\"./e2e/run_tests-redis-os3.sh\"},"
+            [ "${{ inputs.redis_es7 }}"    = "true" ] && items="${items}{\"name\":\"redis-es7\",\"script\":\"./e2e/run_tests-redis-es7.sh\"},"
+            [ "${{ inputs.cassandra_es7 }}" = "true" ] && items="${items}{\"name\":\"cassandra-es7\",\"script\":\"./e2e/run_tests-cassandra-es7.sh\"},"
+            items="${items%,}"
+            echo "matrix={\"include\":[${items}]}" >> "$GITHUB_OUTPUT"
+          else
+            echo 'matrix={"include":[{"name":"redis-es8","script":"./e2e/run_tests-es8.sh"}]}' >> "$GITHUB_OUTPUT"
+          fi
+
+  e2e:
+    needs: generate-e2e-matrix
+    if: ${{ needs.generate-e2e-matrix.outputs.matrix != '{"include":[]}' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.generate-e2e-matrix.outputs.matrix) }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+      - name: Free disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet
+          sudo rm -rf /usr/local/lib/android
+          sudo rm -rf /opt/ghc
+      - name: Set up Zulu JDK 21
+        uses: actions/setup-java@v5
+        with:
+          distribution: "zulu"
+          java-version: "21"
+      - name: Cache Gradle packages
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: ${{ runner.os }}-gradle-
+      - name: Run E2E tests (${{ matrix.name }})
+        run: ${{ matrix.script }}
+      - name: Publish Test Report
+        uses: mikepenz/action-junit-report@v6
+        if: always()
+        with:
+          report_paths: "e2e/build/test-results/test/TEST-*.xml"
+      - name: Generate test summary table
+        if: always()
+        shell: python3 {0}
+        run: |
+          import os, glob, xml.etree.ElementTree as ET
+
+          xml_files = glob.glob("e2e/build/test-results/test/TEST-*.xml")
+          rows = []
+          totals = {"passed": 0, "failed": 0, "skipped": 0}
+
+          for f in sorted(xml_files):
+              try:
+                  root = ET.parse(f).getroot()
+              except ET.ParseError:
+                  continue
+              for tc in root.iter("testcase"):
+                  name = tc.get("name", "?")
+                  classname = tc.get("classname", "").split(".")[-1]
+                  duration = float(tc.get("time", 0))
+                  if tc.find("skipped") is not None:
+                      status, totals["skipped"] = "⏭ skip", totals["skipped"] + 1
+                  elif tc.find("failure") is not None or tc.find("error") is not None:
+                      node = tc.find("failure") if tc.find("failure") is not None else tc.find("error")
+                      msg = (node.get("message") or "")[:120]
+                      status, totals["failed"] = f"❌ `{msg}`", totals["failed"] + 1
+                  else:
+                      status, totals["passed"] = "✅", totals["passed"] + 1
+                  rows.append((classname, name, f"{duration:.1f}s", status))
+
+          backend = "${{ matrix.name }}"
+          lines = [
+              f"## E2E results — {backend}",
+              f"**✅ {totals['passed']} passed · ❌ {totals['failed']} failed · ⏭ {totals['skipped']} skipped**",
+              "",
+              "| Class | Test | Duration | Result |",
+              "|-------|------|----------|--------|",
+          ]
+          for cls, name, dur, status in rows:
+              lines.append(f"| {cls} | {name} | {dur} | {status} |")
+
+          summary = os.environ.get("GITHUB_STEP_SUMMARY", "/dev/null")
+          with open(summary, "a") as fh:
+              fh.write("\n".join(lines) + "\n")
+      - name: Upload E2E reports
+        uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: e2e-reports-${{ matrix.name }}
+          path: "e2e/build/reports"
+
+  build-ui:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ui
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: "22"
+          cache: "yarn"
+          cache-dependency-path: ui/yarn.lock
+
+      - name: Install Dependencies
+        run: yarn install
+
+      - name: Build UI
+        run: yarn run build
+
+      - name: Cache Playwright browsers
+        uses: actions/cache@v5
+        id: playwright-cache
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-chromium-${{ hashFiles('ui/yarn.lock') }}
+
+      - name: Install Playwright browsers
+        if: steps.playwright-cache.outputs.cache-hit != 'true'
+        run: npx playwright install --with-deps chromium
+
+      - name: Install Playwright browser deps (cached)
+        if: steps.playwright-cache.outputs.cache-hit == 'true'
+        run: npx playwright install-deps chromium
+
+      - name: Run Playwright E2E Tests
+        run: yarn test:e2e
+
+      - name: Upload Playwright report
+        uses: actions/upload-artifact@v7
+        if: failure()
+        with:
+          name: playwright-report
+          path: ui/playwright-report
+          retention-days: 7

.github/workflows/debug-docker-credentials.yml

@@ -0,0 +1,34 @@
+name: Debug Docker Credentials
+
+on:
+  workflow_dispatch:
+
+jobs:
+  check-docker-user:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check Docker Hub user for API key
+        env:
+          DOCKER_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+          DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
+        run: |
+          echo "Fetching JWT from Docker Hub..."
+          RESPONSE=$(curl -s -X POST \
+            -H "Content-Type: application/json" \
+            -d "{\"username\": \"${DOCKER_USERNAME}\", \"password\": \"${DOCKER_PASSWORD}\"}" \
+            https://hub.docker.com/v2/users/login)
+
+          JWT=$(echo "$RESPONSE" | jq -r '.token // empty')
+
+          if [ -z "$JWT" ]; then
+            echo "Login failed. Response:"
+            echo "$RESPONSE" | jq .
+            exit 1
+          fi
+
+          echo "Login successful. Fetching user info..."
+          USER_INFO=$(curl -s -H "Authorization: Bearer $JWT" https://hub.docker.com/v2/user/)
+          echo "Raw response:"
+          echo "$USER_INFO" | jq .
+          echo "Docker Hub account info:"
+          echo "$USER_INFO" | jq '{username: .username, full_name: .full_name, email: .email, company: .company, date_joined: .date_joined}'

.github/workflows/deprecate-standalone.yml

@@ -0,0 +1,44 @@
+name: Deprecate conductor-standalone on Docker Hub
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  deprecate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and push :deprecated tag
+        uses: docker/build-push-action@v7
+        with:
+          context: docker/conductor-standalone-deprecation
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: conductoross/conductor-standalone:deprecated
+
+      - name: Update Docker Hub description
+        run: |
+          TOKEN=$(curl -s -X POST "https://hub.docker.com/v2/users/login" \
+            -H "Content-Type: application/json" \
+            -d "{\"username\":\"${{ secrets.DOCKERHUB_USERNAME }}\",\"password\":\"${{ secrets.DOCKERHUB_TOKEN }}\"}" \
+            | jq -r '.token')
+          curl -s -X PATCH "https://hub.docker.com/v2/repositories/conductoross/conductor-standalone/" \
+            -H "Authorization: Bearer ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "{\"full_description\":$(jq -Rs . < docker/conductor-standalone-deprecation/dockerhub-description.md)}"

.github/workflows/generate_gh_pages.yml

@@ -0,0 +1,25 @@
+name: Publish docs via GitHub Pages
+
+permissions:
+  contents: write
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  build:
+    name: Deploy docs
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@v7
+
+      - name: Deploy docs
+        uses: mhausenblas/mkdocs-deploy-gh-pages@master
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CONFIG_FILE: mkdocs.yml
+          REQUIREMENTS: requirements.txt

.github/workflows/publish-next.yaml

@@ -0,0 +1,113 @@
+name: Publish Next (ui-next)
+# Publishes the server with ui-next as a parallel track alongside :latest.
+# Does NOT touch :latest, any versioned release tags, or the existing S3 JARs.
+#
+# Resulting artifacts:
+#   Docker:  conductoross/conductor:next
+#   S3 JAR:  conductor-server-next.jar
+#
+# Test the Docker image:
+#   docker run -p 8080:8080 -p 5000:5000 conductoross/conductor:next
+#   → API / Swagger: http://localhost:8080
+#   → ui-next:       http://localhost:5000
+#
+# Test via the CLI:
+#   conductor server start --version next
+#
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  publish-next:
+    runs-on: ubuntu-latest
+    name: Build and publish ui-next artifacts
+
+    steps:
+      - uses: actions/checkout@v7
+
+      # ── Java ─────────────────────────────────────────────────────────────────
+      - name: Set up Zulu JDK 21
+        uses: actions/setup-java@v5
+        with:
+          distribution: 'zulu'
+          java-version: '21'
+
+      - name: Cache Gradle packages
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: |
+            ${{ runner.os }}-gradle-
+
+      - name: Build Server JAR
+        run: |
+          ./gradlew :conductor-server:build -x test -x spotlessCheck -x shadowJar \
+            -Dorg.gradle.jvmargs=-Xmx2g --no-daemon
+
+      # ── UI (ui-next) ─────────────────────────────────────────────────────────
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '22'
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          version: "10.32.0"
+
+      - name: Build ui-next
+        run: |
+          cd ui-next
+          pnpm install && pnpm build
+
+      # ── Stage pre-built artifacts for PREBUILT=true Docker build ─────────────
+      - name: Stage artifacts
+        run: |
+          mkdir -p docker/server/libs
+          cp server/build/libs/*boot*.jar docker/server/libs/conductor-server.jar
+
+      # ── Docker ───────────────────────────────────────────────────────────────
+      - name: Login to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and push :next image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/server/Dockerfile.next
+          platforms: linux/arm64,linux/amd64
+          push: true
+          build-args: |
+            PREBUILT=true
+          tags: |
+            conductoross/conductor:next
+
+      # ── S3 JAR ───────────────────────────────────────────────────────────────
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.AWS_REGION }}
+
+      - name: Upload :next JAR to S3
+        run: |
+          aws s3 cp server/build/libs/*boot*.jar \
+            s3://${{ secrets.AWS_S3_BUCKET }}/conductor-server-next.jar
+          echo "Published: conductor-server-next.jar"
+          echo "Test with: conductor server start --version next"

.github/workflows/publish.yml

@@ -0,0 +1,114 @@
+name: Publish Conductor OSS toMaven Central
+on:
+  release:
+    types:
+      - released
+      - prereleased
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to publish (e.g., v1.0.0)'
+        required: true
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    name: Gradle Build and Publish
+    steps:
+      - uses: actions/checkout@v7
+      - name: Set up Zulu JDK 21
+        uses: actions/setup-java@v5
+        with:
+          distribution: 'zulu'
+          java-version: '21'
+      - name: Cache Gradle packages
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: |
+            ${{ runner.os }}-gradle-
+      - name: Publish release
+        run: |
+          export VERSION="${{github.ref_name}}"
+          export PUBLISH_VERSION=`echo ${VERSION:1}`
+          echo Publishing version $PUBLISH_VERSION
+          ./gradlew publish -PmavenCentral -Pversion=$PUBLISH_VERSION -Pusername=${{ secrets.SONATYPE_USERNAME }} -Ppassword=${{ secrets.SONATYPE_PASSWORD }}
+        env:
+          ORG_GRADLE_PROJECT_signingKeyId: ${{ secrets.SIGNING_KEY_ID }}
+          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.SIGNING_KEY }}
+          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.SIGNING_PASSWORD }}
+
+  publish-docker:
+    runs-on: ubuntu-latest
+    name: Gradle Build and Publish to Container Registry
+    steps:
+      - uses: actions/checkout@v7
+      - name: Set up Zulu JDK 21
+        uses: actions/setup-java@v5
+        with:
+          distribution: 'zulu'
+          java-version: '21'
+
+      - name: Login to Docker Hub Container Registry
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 'lts/*'
+
+      - name: Build ui-next and embed into server static resources
+        run: |
+          corepack enable
+          cd ui-next
+          pnpm install
+          NODE_OPTIONS=--max-old-space-size=4096 pnpm build
+          cd ..
+          mkdir -p server/src/main/resources/static
+          rm -rf server/src/main/resources/static/*
+          cp -r ui-next/dist/. server/src/main/resources/static/
+
+      - name: Build Server JAR
+        run: |
+          export VERSION="${{github.ref_name}}"
+          export PUBLISH_VERSION=`echo ${VERSION:1}`
+          echo "RELEASE_VERSION=$PUBLISH_VERSION" >> $GITHUB_ENV
+          echo Publishing version $PUBLISH_VERSION
+          ./gradlew :conductor-server:build -x test -x spotlessCheck -x shadowJar -x :conductor-os-persistence-v3:build \
+            -Pversion=$PUBLISH_VERSION
+
+      - name: Stage artifacts for Docker build
+        run: |
+          mkdir -p docker/server/libs
+          cp server/build/libs/*boot*.jar docker/server/libs/conductor-server.jar
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and push Server
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/server/Dockerfile
+          platforms: linux/arm64,linux/amd64
+          push: true
+          build-args: |
+            PREBUILT=true
+          tags: |
+            conductoross/conductor:${{ env.RELEASE_VERSION }}
+            orkesio/orkes-conductor-community-standalone:${{ env.RELEASE_VERSION }}
+            orkesio/orkes-conductor-community:${{ env.RELEASE_VERSION }}
+            ${{ (github.event_name == 'release' && !github.event.release.prerelease && !contains(github.ref_name, 'rc') && !contains(github.ref_name, 'beta') && !contains(github.ref_name, 'alpha')) && 'conductoross/conductor:latest' || '' }}
+            ${{ (github.event_name == 'release' && !github.event.release.prerelease && !contains(github.ref_name, 'rc') && !contains(github.ref_name, 'beta') && !contains(github.ref_name, 'alpha')) && 'orkesio/orkes-conductor-community-standalone:latest' || '' }}
+            ${{ (github.event_name == 'release' && !github.event.release.prerelease && !contains(github.ref_name, 'rc') && !contains(github.ref_name, 'beta') && !contains(github.ref_name, 'alpha')) && 'orkesio/orkes-conductor-community:latest' || '' }}

.github/workflows/publish_build.yaml

@@ -0,0 +1,100 @@
+name: Publish Conductor OSS Server
+on:
+  release:
+    types:
+      - released
+      - prereleased
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to publish (e.g., v1.0.0)'
+        required: true
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    name: Build and Publish the server
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v7
+      - name: Set up Zulu JDK 21
+        uses: actions/setup-java@v5
+        with:
+          distribution: 'zulu'
+          java-version: '21'
+      - name: Cache Gradle packages
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: |
+            ${{ runner.os }}-gradle-
+      - name: Set version
+        id: version
+        run: |
+          # Use inputs.version for workflow_dispatch, or ref_name for release events
+          VERSION="${{ github.event.inputs.version || github.ref_name }}"
+          # Strip the 'v' prefix if present
+          PUBLISH_VERSION="${VERSION#v}"
+          echo "version=$PUBLISH_VERSION" >> $GITHUB_OUTPUT
+          echo "RELEASE_VERSION=$PUBLISH_VERSION" >> $GITHUB_ENV
+          echo "Publishing version: $PUBLISH_VERSION"
+      - name: Build Server JAR
+        run: |
+          ./gradlew :conductor-server:build -x test -x spotlessCheck -x shadowJar -x :conductor-os-persistence-v3:build \
+            -Pversion=${{ steps.version.outputs.version }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 'lts/*'
+
+      - name: Build ui-next and embed into server static resources
+        run: |
+          corepack enable
+          cd ui-next
+          pnpm install
+          NODE_OPTIONS=--max-old-space-size=4096 pnpm build
+          cd ..
+          mkdir -p server/src/main/resources/static
+          rm -rf server/src/main/resources/static/*
+          cp -r ui-next/dist/. server/src/main/resources/static/
+
+      - name: Stage artifacts for Docker build
+        run: |
+          mkdir -p docker/server/libs
+          cp server/build/libs/*boot*.jar docker/server/libs/conductor-server.jar
+
+      - name: Login to Docker Hub Container Registry
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and push Server
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/server/Dockerfile
+          platforms: linux/arm64,linux/amd64
+          push: true
+          build-args: |
+            PREBUILT=true
+          tags: |
+            conductoross/conductor:${{ env.RELEASE_VERSION }}
+            orkesio/orkes-conductor-community-standalone:${{ env.RELEASE_VERSION }}
+            orkesio/orkes-conductor-community:${{ env.RELEASE_VERSION }}
+            ${{ (github.event_name == 'release' && !github.event.release.prerelease) && 'conductoross/conductor:latest' || '' }}
+            ${{ (github.event_name == 'release' && !github.event.release.prerelease) && 'orkesio/orkes-conductor-community-standalone:latest' || '' }}
+            ${{ (github.event_name == 'release' && !github.event.release.prerelease) && 'orkesio/orkes-conductor-community:latest' || '' }}

.github/workflows/publish_s3.yaml

@@ -0,0 +1,84 @@
+name: Publish Conductor Server to S3
+on:
+  push:
+    branches:
+      - docker_build  # TEMPORARY - remove before merging to main
+  release:
+    types:
+      - released
+      - prereleased
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to publish (e.g., v1.0.0)'
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  publish-s3:
+    runs-on: ubuntu-latest
+    name: Build and Publish Server JAR to S3
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Zulu JDK 21
+        uses: actions/setup-java@v5
+        with:
+          distribution: 'zulu'
+          java-version: '21'
+
+      - name: Cache Gradle packages
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: |
+            ${{ runner.os }}-gradle-
+
+      - name: Set version
+        id: version
+        run: |
+          # Use inputs.version for workflow_dispatch, or ref_name for release events
+          VERSION="${{ github.event.inputs.version || github.ref_name }}"
+          # Strip the 'v' prefix if present
+          PUBLISH_VERSION="${VERSION#v}"
+          echo "version=$PUBLISH_VERSION" >> $GITHUB_OUTPUT
+          echo "Publishing version: $PUBLISH_VERSION"
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 'lts/*'
+
+      - name: Build Server module
+        run: |
+          corepack enable
+          ./build_ui_next.sh
+          ./gradlew :conductor-server:bootJar -x test -Pversion=${{ steps.version.outputs.version }}
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.AWS_REGION }}
+
+      - name: Upload Server JAR to S3 (Versioned)
+        run: |
+          aws s3 cp server/build/libs/conductor-server-${{ steps.version.outputs.version }}-boot.jar \
+            s3://${{ secrets.AWS_S3_BUCKET }}/conductor-server-${{ steps.version.outputs.version }}.jar
+
+      - name: Upload Server JAR to S3 (Latest)
+        if: github.event_name == 'release' && !github.event.release.prerelease
+        run: |
+          aws s3 cp server/build/libs/conductor-server-${{ steps.version.outputs.version }}-boot.jar \
+            s3://${{ secrets.AWS_S3_BUCKET }}/conductor-server-latest.jar
+
+      - name: Verify uploads
+        run: |
+          echo "Uploaded conductor-server-${{ steps.version.outputs.version }}.jar"
+          echo "S3 bucket: ${{ secrets.AWS_S3_BUCKET }}"

.github/workflows/release_draft.yml

@@ -0,0 +1,22 @@
+name: Release Drafter
+
+on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - 'conductor-clients/**'
+
+permissions:
+  contents: read
+
+jobs:
+  update_release_draft:
+    permissions:
+      contents: write  # for release-drafter/release-drafter to create a github release
+      pull-requests: write  # for release-drafter/release-drafter to add label to PR
+    runs-on: ubuntu-latest
+    steps:
+      - uses: release-drafter/release-drafter@v7
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/ui-next-ci.yml

@@ -0,0 +1,81 @@
+name: UI v2 CI
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "ui-next/**"
+  push:
+    branches:
+      - main
+    paths:
+      - "ui-next/**"
+
+permissions:
+  contents: read
+
+jobs:
+  lint-format-test:
+    name: Lint, Format & Test
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ui-next
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          version: 10.32.0
+
+      # setup-node must come after pnpm/action-setup so it can locate the store.
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: ui-next/pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Prettier check
+        run: pnpm prettier:check
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Type check
+        run: pnpm typecheck
+
+      - name: Test
+        run: pnpm test
+
+      - name: Build
+        run: pnpm build
+
+  e2e-mocked:
+    name: E2E (Mocked)
+    runs-on: ubuntu-latest
+    needs: lint-format-test
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Run E2E tests in Docker
+        run: docker compose -f docker-compose.snapshots.yml run --rm playwright
+        working-directory: ui-next
+
+      - name: Upload Playwright report
+        uses: actions/upload-artifact@v7
+        if: failure()
+        with:
+          name: playwright-report
+          path: ui-next/playwright-snapshots-report/
+          retention-days: 7

.github/workflows/ui-next-integration-ci.yml

@@ -0,0 +1,103 @@
+name: UI v2 Integration CI
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "ui-next/**"
+  push:
+    branches:
+      - main
+    paths:
+      - "ui-next/**"
+
+permissions:
+  contents: read
+
+jobs:
+  e2e-integration:
+    name: E2E (Integration)
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Free disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet
+          sudo rm -rf /usr/local/lib/android
+          sudo rm -rf /opt/ghc
+          sudo rm -rf /usr/local/share/boost
+          sudo apt-get clean
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          version: 10.32.0
+
+      # setup-node must come after pnpm/action-setup so it can locate the store.
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: ui-next/pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+        working-directory: ui-next
+
+      - name: Cache Playwright browsers
+        id: playwright-cache
+        uses: actions/cache@v5
+        with:
+          path: ~/.cache/ms-playwright
+          key: ${{ runner.os }}-playwright-chromium-${{ hashFiles('ui-next/pnpm-lock.yaml') }}
+
+      - name: Install Playwright browsers
+        if: steps.playwright-cache.outputs.cache-hit != 'true'
+        run: pnpm exec playwright install chromium
+        working-directory: ui-next
+
+      # OS-level dependencies (apt packages) cannot be cached — always install.
+      - name: Install Playwright OS dependencies
+        run: pnpm exec playwright install-deps chromium
+        working-directory: ui-next
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Cache Docker layers for conductor:server
+        uses: actions/cache@v5
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-conductor-server-${{ hashFiles('docker/server/Dockerfile', '**/build.gradle', 'settings.gradle') }}
+          restore-keys: ${{ runner.os }}-conductor-server-
+
+      - name: Build conductor:server Docker image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/server/Dockerfile
+          tags: conductor:server
+          load: true
+          cache-from: type=local,src=/tmp/.buildx-cache
+          cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=min
+
+      - name: Move Docker layer cache
+        run: |
+          rm -rf /tmp/.buildx-cache
+          mv /tmp/.buildx-cache-new /tmp/.buildx-cache
+
+      - name: Run integration E2E tests
+        run: pnpm test:e2e:integration
+        working-directory: ui-next
+
+      - name: Upload Playwright integration report
+        uses: actions/upload-artifact@v7
+        if: failure()
+        with:
+          name: playwright-integration-report
+          path: ui-next/playwright-integration-report/
+          retention-days: 7