chore: import upstream snapshot with attribution

.github/workflows/ci.yml

@@ -0,0 +1,419 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - "conductor-clients/**"
+  pull_request:
+    paths-ignore:
+      - "conductor-clients/**"
+  workflow_dispatch:
+    inputs:
+      redis_es8:
+        description: "Redis + Elasticsearch 8"
+        type: boolean
+        default: true
+      postgres:
+        description: "PostgreSQL"
+        type: boolean
+        default: false
+      mysql:
+        description: "MySQL"
+        type: boolean
+        default: false
+      redis_os3:
+        description: "Redis + OpenSearch 3"
+        type: boolean
+        default: false
+      redis_es7:
+        description: "Redis + Elasticsearch 7"
+        type: boolean
+        default: false
+      cassandra_es7:
+        description: "Cassandra + Elasticsearch 7"
+        type: boolean
+        default: false
+
+jobs:
+  detect-changes:
+    runs-on: ubuntu-latest
+    outputs:
+      heavy-persistence: ${{ steps.filter.outputs.heavy-persistence }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            heavy-persistence:
+              - 'cassandra-persistence/**'
+              - 'es6-persistence/**'
+              - 'es7-persistence/**'
+              - 'es8-persistence/**'
+              - 'mysql-persistence/**'
+              - 'os-persistence/**'
+              - 'os-persistence-v2/**'
+              - 'os-persistence-v3/**'
+              - 'scheduler/cassandra-persistence/**'
+              - 'scheduler/mysql-persistence/**'
+
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+      - name: Free disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet
+          sudo rm -rf /usr/local/lib/android
+          sudo rm -rf /opt/ghc
+      - name: Gradle wrapper validation
+        uses: gradle/wrapper-validation-action@v3
+      - name: Set up Zulu JDK 21
+        uses: actions/setup-java@v5
+        with:
+          distribution: "zulu"
+          java-version: "21"
+      - name: Cache SonarCloud packages
+        uses: actions/cache@v5
+        with:
+          path: ~/.sonar/cache
+          key: ${{ runner.os }}-sonar
+          restore-keys: ${{ runner.os }}-sonar
+      - name: Cache Gradle packages
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: ${{ runner.os }}-gradle-
+      - name: Build with Gradle
+        if: github.ref != 'refs/heads/main'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        run: |
+          ./gradlew build -x :conductor-test-harness:test -x test
+      - name: Build and Publish snapshot
+        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+        run: |
+          echo "Running build for commit ${{ github.sha }}"
+          ./gradlew build -x :conductor-test-harness:test -x test
+      - name: Generate aggregated coverage report
+        if: always()
+        run: ./gradlew jacocoAggregatedReport -x test || true
+      - name: Publish Test Report
+        uses: mikepenz/action-junit-report@v6
+        if: always()
+        with:
+          report_paths: "**/build/test-results/test/TEST-*.xml"
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v7
+        with:
+          name: build-artifacts
+          path: "**/build/reports"
+      - name: Upload coverage report
+        uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: coverage-report
+          path: build/reports/jacoco/aggregated
+  unit-test:
+    needs: detect-changes
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+      - name: Free disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet
+          sudo rm -rf /usr/local/lib/android
+          sudo rm -rf /opt/ghc
+      - name: Set up Zulu JDK 21
+        uses: actions/setup-java@v5
+        with:
+          distribution: "zulu"
+          java-version: "21"
+      - name: Cache Gradle packages
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: ${{ runner.os }}-gradle-
+      - name: Force Docker API Version
+        run: echo 'api.version=1.44' > ~/.docker-java.properties
+      - name: Run unit tests
+        run: |
+          # On main (post-merge): run everything
+          if [ "${{ github.event_name }}" != "pull_request" ]; then
+            ./gradlew test -x :conductor-test-harness:test
+            exit 0
+          fi
+          # On PRs: skip heavy container tests (cassandra, es, mysql, opensearch)
+          # unless their code changed. Redis, postgres, sqlite always run.
+          if [ "${{ needs.detect-changes.outputs.heavy-persistence }}" == "true" ]; then
+            ./gradlew test -x :conductor-test-harness:test
+          else
+            ./gradlew test \
+              -x :conductor-test-harness:test \
+              -x :conductor-cassandra-persistence:test \
+              -x :conductor-scheduler-cassandra-persistence:test \
+              -x :conductor-es6-persistence:test \
+              -x :conductor-es7-persistence:test \
+              -x :conductor-es8-persistence:test \
+              -x :conductor-mysql-persistence:test \
+              -x :conductor-scheduler-mysql-persistence:test \
+              -x :conductor-os-persistence:test \
+              -x :conductor-os-persistence-v2:test \
+              -x :conductor-os-persistence-v3:test
+          fi
+      - name: Publish Test Report
+        uses: mikepenz/action-junit-report@v6
+        if: always()
+        with:
+          report_paths: "**/build/test-results/test/TEST-*.xml"
+          check_name: Unit Test Report
+      - name: Upload unit-test reports
+        uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: unit-test-reports
+          path: "**/build/reports/tests"
+  test-harness:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+      - name: Free disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet
+          sudo rm -rf /usr/local/lib/android
+          sudo rm -rf /opt/ghc
+      - name: Set up Zulu JDK 21
+        uses: actions/setup-java@v5
+        with:
+          distribution: "zulu"
+          java-version: "21"
+      - name: Cache Gradle packages
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: ${{ runner.os }}-gradle-
+      - name: Force Docker API Version
+        run: echo 'api.version=1.44' > ~/.docker-java.properties
+      - name: Cache Docker images
+        uses: actions/cache@v5
+        id: docker-cache
+        with:
+          path: /tmp/docker-images-test-harness.tar
+          key: docker-test-harness-v2
+      - name: Load cached Docker images
+        if: steps.docker-cache.outputs.cache-hit == 'true'
+        run: docker load -i /tmp/docker-images-test-harness.tar || true
+      - name: Run test-harness tests
+        run: |
+          ./gradlew :conductor-test-harness:test
+      - name: Save Docker images for cache
+        if: steps.docker-cache.outputs.cache-hit != 'true'
+        run: |
+          set -euo pipefail
+          docker image prune -f
+          mapfile -t images < <((docker images --format '{{.Repository}}:{{.Tag}}' \
+            | grep -v '<none>' \
+            | grep -E '(^|/)(elasticsearch|redis|postgres|mysql|mongo|cassandra)(:|/)|mockserver/mockserver|opensearchproject/opensearch|testcontainers/|orkesio/') || true)
+          if [ "${#images[@]}" -eq 0 ]; then
+            echo "No Testcontainers-related images to cache; writing empty tar for cache action."
+            tar -cf /tmp/docker-images-test-harness.tar --files-from /dev/null
+            exit 0
+          fi
+          printf '%s\n' "${images[@]}"
+          docker save -o /tmp/docker-images-test-harness.tar "${images[@]}"
+      - name: Publish Test Report
+        uses: mikepenz/action-junit-report@v6
+        if: always()
+        with:
+          report_paths: "test-harness/build/test-results/test/TEST-*.xml"
+      - name: Upload test-harness reports
+        uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: test-harness-reports
+          path: "test-harness/build/reports"
+      - name: Upload test-harness coverage report
+        uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: test-harness-coverage-report
+          path: "test-harness/build/reports/jacoco"
+  generate-e2e-matrix:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+    steps:
+      - id: set-matrix
+        shell: bash
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            items=""
+            [ "${{ inputs.redis_es8 }}"    = "true" ] && items="${items}{\"name\":\"redis-es8\",\"script\":\"./e2e/run_tests-es8.sh\"},"
+            [ "${{ inputs.postgres }}"     = "true" ] && items="${items}{\"name\":\"postgres\",\"script\":\"./e2e/run_tests-postgres.sh\"},"
+            [ "${{ inputs.mysql }}"        = "true" ] && items="${items}{\"name\":\"mysql\",\"script\":\"./e2e/run_tests-mysql.sh\"},"
+            [ "${{ inputs.redis_os3 }}"    = "true" ] && items="${items}{\"name\":\"redis-os3\",\"script\":\"./e2e/run_tests-redis-os3.sh\"},"
+            [ "${{ inputs.redis_es7 }}"    = "true" ] && items="${items}{\"name\":\"redis-es7\",\"script\":\"./e2e/run_tests-redis-es7.sh\"},"
+            [ "${{ inputs.cassandra_es7 }}" = "true" ] && items="${items}{\"name\":\"cassandra-es7\",\"script\":\"./e2e/run_tests-cassandra-es7.sh\"},"
+            items="${items%,}"
+            echo "matrix={\"include\":[${items}]}" >> "$GITHUB_OUTPUT"
+          else
+            echo 'matrix={"include":[{"name":"redis-es8","script":"./e2e/run_tests-es8.sh"}]}' >> "$GITHUB_OUTPUT"
+          fi
+
+  e2e:
+    needs: generate-e2e-matrix
+    if: ${{ needs.generate-e2e-matrix.outputs.matrix != '{"include":[]}' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.generate-e2e-matrix.outputs.matrix) }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+      - name: Free disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet
+          sudo rm -rf /usr/local/lib/android
+          sudo rm -rf /opt/ghc
+      - name: Set up Zulu JDK 21
+        uses: actions/setup-java@v5
+        with:
+          distribution: "zulu"
+          java-version: "21"
+      - name: Cache Gradle packages
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: ${{ runner.os }}-gradle-
+      - name: Run E2E tests (${{ matrix.name }})
+        run: ${{ matrix.script }}
+      - name: Publish Test Report
+        uses: mikepenz/action-junit-report@v6
+        if: always()
+        with:
+          report_paths: "e2e/build/test-results/test/TEST-*.xml"
+      - name: Generate test summary table
+        if: always()
+        shell: python3 {0}
+        run: |
+          import os, glob, xml.etree.ElementTree as ET
+
+          xml_files = glob.glob("e2e/build/test-results/test/TEST-*.xml")
+          rows = []
+          totals = {"passed": 0, "failed": 0, "skipped": 0}
+
+          for f in sorted(xml_files):
+              try:
+                  root = ET.parse(f).getroot()
+              except ET.ParseError:
+                  continue
+              for tc in root.iter("testcase"):
+                  name = tc.get("name", "?")
+                  classname = tc.get("classname", "").split(".")[-1]
+                  duration = float(tc.get("time", 0))
+                  if tc.find("skipped") is not None:
+                      status, totals["skipped"] = "⏭ skip", totals["skipped"] + 1
+                  elif tc.find("failure") is not None or tc.find("error") is not None:
+                      node = tc.find("failure") if tc.find("failure") is not None else tc.find("error")
+                      msg = (node.get("message") or "")[:120]
+                      status, totals["failed"] = f"❌ `{msg}`", totals["failed"] + 1
+                  else:
+                      status, totals["passed"] = "✅", totals["passed"] + 1
+                  rows.append((classname, name, f"{duration:.1f}s", status))
+
+          backend = "${{ matrix.name }}"
+          lines = [
+              f"## E2E results — {backend}",
+              f"**✅ {totals['passed']} passed · ❌ {totals['failed']} failed · ⏭ {totals['skipped']} skipped**",
+              "",
+              "| Class | Test | Duration | Result |",
+              "|-------|------|----------|--------|",
+          ]
+          for cls, name, dur, status in rows:
+              lines.append(f"| {cls} | {name} | {dur} | {status} |")
+
+          summary = os.environ.get("GITHUB_STEP_SUMMARY", "/dev/null")
+          with open(summary, "a") as fh:
+              fh.write("\n".join(lines) + "\n")
+      - name: Upload E2E reports
+        uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: e2e-reports-${{ matrix.name }}
+          path: "e2e/build/reports"
+
+  build-ui:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ui
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: "22"
+          cache: "yarn"
+          cache-dependency-path: ui/yarn.lock
+
+      - name: Install Dependencies
+        run: yarn install
+
+      - name: Build UI
+        run: yarn run build
+
+      - name: Cache Playwright browsers
+        uses: actions/cache@v5
+        id: playwright-cache
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-chromium-${{ hashFiles('ui/yarn.lock') }}
+
+      - name: Install Playwright browsers
+        if: steps.playwright-cache.outputs.cache-hit != 'true'
+        run: npx playwright install --with-deps chromium
+
+      - name: Install Playwright browser deps (cached)
+        if: steps.playwright-cache.outputs.cache-hit == 'true'
+        run: npx playwright install-deps chromium
+
+      - name: Run Playwright E2E Tests
+        run: yarn test:e2e
+
+      - name: Upload Playwright report
+        uses: actions/upload-artifact@v7
+        if: failure()
+        with:
+          name: playwright-report
+          path: ui/playwright-report
+          retention-days: 7

.github/workflows/debug-docker-credentials.yml

@@ -0,0 +1,34 @@
+name: Debug Docker Credentials
+
+on:
+  workflow_dispatch:
+
+jobs:
+  check-docker-user:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check Docker Hub user for API key
+        env:
+          DOCKER_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+          DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}
+        run: |
+          echo "Fetching JWT from Docker Hub..."
+          RESPONSE=$(curl -s -X POST \
+            -H "Content-Type: application/json" \
+            -d "{\"username\": \"${DOCKER_USERNAME}\", \"password\": \"${DOCKER_PASSWORD}\"}" \
+            https://hub.docker.com/v2/users/login)
+
+          JWT=$(echo "$RESPONSE" | jq -r '.token // empty')
+
+          if [ -z "$JWT" ]; then
+            echo "Login failed. Response:"
+            echo "$RESPONSE" | jq .
+            exit 1
+          fi
+
+          echo "Login successful. Fetching user info..."
+          USER_INFO=$(curl -s -H "Authorization: Bearer $JWT" https://hub.docker.com/v2/user/)
+          echo "Raw response:"
+          echo "$USER_INFO" | jq .
+          echo "Docker Hub account info:"
+          echo "$USER_INFO" | jq '{username: .username, full_name: .full_name, email: .email, company: .company, date_joined: .date_joined}'

.github/workflows/deprecate-standalone.yml

@@ -0,0 +1,44 @@
+name: Deprecate conductor-standalone on Docker Hub
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  deprecate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and push :deprecated tag
+        uses: docker/build-push-action@v7
+        with:
+          context: docker/conductor-standalone-deprecation
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: conductoross/conductor-standalone:deprecated
+
+      - name: Update Docker Hub description
+        run: |
+          TOKEN=$(curl -s -X POST "https://hub.docker.com/v2/users/login" \
+            -H "Content-Type: application/json" \
+            -d "{\"username\":\"${{ secrets.DOCKERHUB_USERNAME }}\",\"password\":\"${{ secrets.DOCKERHUB_TOKEN }}\"}" \
+            | jq -r '.token')
+          curl -s -X PATCH "https://hub.docker.com/v2/repositories/conductoross/conductor-standalone/" \
+            -H "Authorization: Bearer ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "{\"full_description\":$(jq -Rs . < docker/conductor-standalone-deprecation/dockerhub-description.md)}"

.github/workflows/generate_gh_pages.yml

@@ -0,0 +1,25 @@
+name: Publish docs via GitHub Pages
+
+permissions:
+  contents: write
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  build:
+    name: Deploy docs
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@v7
+
+      - name: Deploy docs
+        uses: mhausenblas/mkdocs-deploy-gh-pages@master
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CONFIG_FILE: mkdocs.yml
+          REQUIREMENTS: requirements.txt

.github/workflows/publish-next.yaml

@@ -0,0 +1,113 @@
+name: Publish Next (ui-next)
+# Publishes the server with ui-next as a parallel track alongside :latest.
+# Does NOT touch :latest, any versioned release tags, or the existing S3 JARs.
+#
+# Resulting artifacts:
+#   Docker:  conductoross/conductor:next
+#   S3 JAR:  conductor-server-next.jar
+#
+# Test the Docker image:
+#   docker run -p 8080:8080 -p 5000:5000 conductoross/conductor:next
+#   → API / Swagger: http://localhost:8080
+#   → ui-next:       http://localhost:5000
+#
+# Test via the CLI:
+#   conductor server start --version next
+#
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  publish-next:
+    runs-on: ubuntu-latest
+    name: Build and publish ui-next artifacts
+
+    steps:
+      - uses: actions/checkout@v7
+
+      # ── Java ─────────────────────────────────────────────────────────────────
+      - name: Set up Zulu JDK 21
+        uses: actions/setup-java@v5
+        with:
+          distribution: 'zulu'
+          java-version: '21'
+
+      - name: Cache Gradle packages
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: |
+            ${{ runner.os }}-gradle-
+
+      - name: Build Server JAR
+        run: |
+          ./gradlew :conductor-server:build -x test -x spotlessCheck -x shadowJar \
+            -Dorg.gradle.jvmargs=-Xmx2g --no-daemon
+
+      # ── UI (ui-next) ─────────────────────────────────────────────────────────
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '22'
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          version: "10.32.0"
+
+      - name: Build ui-next
+        run: |
+          cd ui-next
+          pnpm install && pnpm build
+
+      # ── Stage pre-built artifacts for PREBUILT=true Docker build ─────────────
+      - name: Stage artifacts
+        run: |
+          mkdir -p docker/server/libs
+          cp server/build/libs/*boot*.jar docker/server/libs/conductor-server.jar
+
+      # ── Docker ───────────────────────────────────────────────────────────────
+      - name: Login to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and push :next image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/server/Dockerfile.next
+          platforms: linux/arm64,linux/amd64
+          push: true
+          build-args: |
+            PREBUILT=true
+          tags: |
+            conductoross/conductor:next
+
+      # ── S3 JAR ───────────────────────────────────────────────────────────────
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.AWS_REGION }}
+
+      - name: Upload :next JAR to S3
+        run: |
+          aws s3 cp server/build/libs/*boot*.jar \
+            s3://${{ secrets.AWS_S3_BUCKET }}/conductor-server-next.jar
+          echo "Published: conductor-server-next.jar"
+          echo "Test with: conductor server start --version next"

.github/workflows/publish.yml

@@ -0,0 +1,114 @@
+name: Publish Conductor OSS toMaven Central
+on:
+  release:
+    types:
+      - released
+      - prereleased
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to publish (e.g., v1.0.0)'
+        required: true
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    name: Gradle Build and Publish
+    steps:
+      - uses: actions/checkout@v7
+      - name: Set up Zulu JDK 21
+        uses: actions/setup-java@v5
+        with:
+          distribution: 'zulu'
+          java-version: '21'
+      - name: Cache Gradle packages
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: |
+            ${{ runner.os }}-gradle-
+      - name: Publish release
+        run: |
+          export VERSION="${{github.ref_name}}"
+          export PUBLISH_VERSION=`echo ${VERSION:1}`
+          echo Publishing version $PUBLISH_VERSION
+          ./gradlew publish -PmavenCentral -Pversion=$PUBLISH_VERSION -Pusername=${{ secrets.SONATYPE_USERNAME }} -Ppassword=${{ secrets.SONATYPE_PASSWORD }}
+        env:
+          ORG_GRADLE_PROJECT_signingKeyId: ${{ secrets.SIGNING_KEY_ID }}
+          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.SIGNING_KEY }}
+          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.SIGNING_PASSWORD }}
+
+  publish-docker:
+    runs-on: ubuntu-latest
+    name: Gradle Build and Publish to Container Registry
+    steps:
+      - uses: actions/checkout@v7
+      - name: Set up Zulu JDK 21
+        uses: actions/setup-java@v5
+        with:
+          distribution: 'zulu'
+          java-version: '21'
+
+      - name: Login to Docker Hub Container Registry
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 'lts/*'
+
+      - name: Build ui-next and embed into server static resources
+        run: |
+          corepack enable
+          cd ui-next
+          pnpm install
+          NODE_OPTIONS=--max-old-space-size=4096 pnpm build
+          cd ..
+          mkdir -p server/src/main/resources/static
+          rm -rf server/src/main/resources/static/*
+          cp -r ui-next/dist/. server/src/main/resources/static/
+
+      - name: Build Server JAR
+        run: |
+          export VERSION="${{github.ref_name}}"
+          export PUBLISH_VERSION=`echo ${VERSION:1}`
+          echo "RELEASE_VERSION=$PUBLISH_VERSION" >> $GITHUB_ENV
+          echo Publishing version $PUBLISH_VERSION
+          ./gradlew :conductor-server:build -x test -x spotlessCheck -x shadowJar -x :conductor-os-persistence-v3:build \
+            -Pversion=$PUBLISH_VERSION
+
+      - name: Stage artifacts for Docker build
+        run: |
+          mkdir -p docker/server/libs
+          cp server/build/libs/*boot*.jar docker/server/libs/conductor-server.jar
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and push Server
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/server/Dockerfile
+          platforms: linux/arm64,linux/amd64
+          push: true
+          build-args: |
+            PREBUILT=true
+          tags: |
+            conductoross/conductor:${{ env.RELEASE_VERSION }}
+            orkesio/orkes-conductor-community-standalone:${{ env.RELEASE_VERSION }}
+            orkesio/orkes-conductor-community:${{ env.RELEASE_VERSION }}
+            ${{ (github.event_name == 'release' && !github.event.release.prerelease && !contains(github.ref_name, 'rc') && !contains(github.ref_name, 'beta') && !contains(github.ref_name, 'alpha')) && 'conductoross/conductor:latest' || '' }}
+            ${{ (github.event_name == 'release' && !github.event.release.prerelease && !contains(github.ref_name, 'rc') && !contains(github.ref_name, 'beta') && !contains(github.ref_name, 'alpha')) && 'orkesio/orkes-conductor-community-standalone:latest' || '' }}
+            ${{ (github.event_name == 'release' && !github.event.release.prerelease && !contains(github.ref_name, 'rc') && !contains(github.ref_name, 'beta') && !contains(github.ref_name, 'alpha')) && 'orkesio/orkes-conductor-community:latest' || '' }}

.github/workflows/publish_build.yaml

@@ -0,0 +1,100 @@
+name: Publish Conductor OSS Server
+on:
+  release:
+    types:
+      - released
+      - prereleased
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to publish (e.g., v1.0.0)'
+        required: true
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    name: Build and Publish the server
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v7
+      - name: Set up Zulu JDK 21
+        uses: actions/setup-java@v5
+        with:
+          distribution: 'zulu'
+          java-version: '21'
+      - name: Cache Gradle packages
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: |
+            ${{ runner.os }}-gradle-
+      - name: Set version
+        id: version
+        run: |
+          # Use inputs.version for workflow_dispatch, or ref_name for release events
+          VERSION="${{ github.event.inputs.version || github.ref_name }}"
+          # Strip the 'v' prefix if present
+          PUBLISH_VERSION="${VERSION#v}"
+          echo "version=$PUBLISH_VERSION" >> $GITHUB_OUTPUT
+          echo "RELEASE_VERSION=$PUBLISH_VERSION" >> $GITHUB_ENV
+          echo "Publishing version: $PUBLISH_VERSION"
+      - name: Build Server JAR
+        run: |
+          ./gradlew :conductor-server:build -x test -x spotlessCheck -x shadowJar -x :conductor-os-persistence-v3:build \
+            -Pversion=${{ steps.version.outputs.version }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 'lts/*'
+
+      - name: Build ui-next and embed into server static resources
+        run: |
+          corepack enable
+          cd ui-next
+          pnpm install
+          NODE_OPTIONS=--max-old-space-size=4096 pnpm build
+          cd ..
+          mkdir -p server/src/main/resources/static
+          rm -rf server/src/main/resources/static/*
+          cp -r ui-next/dist/. server/src/main/resources/static/
+
+      - name: Stage artifacts for Docker build
+        run: |
+          mkdir -p docker/server/libs
+          cp server/build/libs/*boot*.jar docker/server/libs/conductor-server.jar
+
+      - name: Login to Docker Hub Container Registry
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and push Server
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/server/Dockerfile
+          platforms: linux/arm64,linux/amd64
+          push: true
+          build-args: |
+            PREBUILT=true
+          tags: |
+            conductoross/conductor:${{ env.RELEASE_VERSION }}
+            orkesio/orkes-conductor-community-standalone:${{ env.RELEASE_VERSION }}
+            orkesio/orkes-conductor-community:${{ env.RELEASE_VERSION }}
+            ${{ (github.event_name == 'release' && !github.event.release.prerelease) && 'conductoross/conductor:latest' || '' }}
+            ${{ (github.event_name == 'release' && !github.event.release.prerelease) && 'orkesio/orkes-conductor-community-standalone:latest' || '' }}
+            ${{ (github.event_name == 'release' && !github.event.release.prerelease) && 'orkesio/orkes-conductor-community:latest' || '' }}

.github/workflows/publish_s3.yaml

@@ -0,0 +1,84 @@
+name: Publish Conductor Server to S3
+on:
+  push:
+    branches:
+      - docker_build  # TEMPORARY - remove before merging to main
+  release:
+    types:
+      - released
+      - prereleased
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to publish (e.g., v1.0.0)'
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  publish-s3:
+    runs-on: ubuntu-latest
+    name: Build and Publish Server JAR to S3
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Zulu JDK 21
+        uses: actions/setup-java@v5
+        with:
+          distribution: 'zulu'
+          java-version: '21'
+
+      - name: Cache Gradle packages
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: |
+            ${{ runner.os }}-gradle-
+
+      - name: Set version
+        id: version
+        run: |
+          # Use inputs.version for workflow_dispatch, or ref_name for release events
+          VERSION="${{ github.event.inputs.version || github.ref_name }}"
+          # Strip the 'v' prefix if present
+          PUBLISH_VERSION="${VERSION#v}"
+          echo "version=$PUBLISH_VERSION" >> $GITHUB_OUTPUT
+          echo "Publishing version: $PUBLISH_VERSION"
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 'lts/*'
+
+      - name: Build Server module
+        run: |
+          corepack enable
+          ./build_ui_next.sh
+          ./gradlew :conductor-server:bootJar -x test -Pversion=${{ steps.version.outputs.version }}
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.AWS_REGION }}
+
+      - name: Upload Server JAR to S3 (Versioned)
+        run: |
+          aws s3 cp server/build/libs/conductor-server-${{ steps.version.outputs.version }}-boot.jar \
+            s3://${{ secrets.AWS_S3_BUCKET }}/conductor-server-${{ steps.version.outputs.version }}.jar
+
+      - name: Upload Server JAR to S3 (Latest)
+        if: github.event_name == 'release' && !github.event.release.prerelease
+        run: |
+          aws s3 cp server/build/libs/conductor-server-${{ steps.version.outputs.version }}-boot.jar \
+            s3://${{ secrets.AWS_S3_BUCKET }}/conductor-server-latest.jar
+
+      - name: Verify uploads
+        run: |
+          echo "Uploaded conductor-server-${{ steps.version.outputs.version }}.jar"
+          echo "S3 bucket: ${{ secrets.AWS_S3_BUCKET }}"

.github/workflows/release_draft.yml

@@ -0,0 +1,22 @@
+name: Release Drafter
+
+on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - 'conductor-clients/**'
+
+permissions:
+  contents: read
+
+jobs:
+  update_release_draft:
+    permissions:
+      contents: write  # for release-drafter/release-drafter to create a github release
+      pull-requests: write  # for release-drafter/release-drafter to add label to PR
+    runs-on: ubuntu-latest
+    steps:
+      - uses: release-drafter/release-drafter@v7
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/ui-next-ci.yml

@@ -0,0 +1,81 @@
+name: UI v2 CI
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "ui-next/**"
+  push:
+    branches:
+      - main
+    paths:
+      - "ui-next/**"
+
+permissions:
+  contents: read
+
+jobs:
+  lint-format-test:
+    name: Lint, Format & Test
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ui-next
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          version: 10.32.0
+
+      # setup-node must come after pnpm/action-setup so it can locate the store.
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: ui-next/pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Prettier check
+        run: pnpm prettier:check
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Type check
+        run: pnpm typecheck
+
+      - name: Test
+        run: pnpm test
+
+      - name: Build
+        run: pnpm build
+
+  e2e-mocked:
+    name: E2E (Mocked)
+    runs-on: ubuntu-latest
+    needs: lint-format-test
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Run E2E tests in Docker
+        run: docker compose -f docker-compose.snapshots.yml run --rm playwright
+        working-directory: ui-next
+
+      - name: Upload Playwright report
+        uses: actions/upload-artifact@v7
+        if: failure()
+        with:
+          name: playwright-report
+          path: ui-next/playwright-snapshots-report/
+          retention-days: 7

.github/workflows/ui-next-integration-ci.yml

@@ -0,0 +1,103 @@
+name: UI v2 Integration CI
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "ui-next/**"
+  push:
+    branches:
+      - main
+    paths:
+      - "ui-next/**"
+
+permissions:
+  contents: read
+
+jobs:
+  e2e-integration:
+    name: E2E (Integration)
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Free disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet
+          sudo rm -rf /usr/local/lib/android
+          sudo rm -rf /opt/ghc
+          sudo rm -rf /usr/local/share/boost
+          sudo apt-get clean
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          version: 10.32.0
+
+      # setup-node must come after pnpm/action-setup so it can locate the store.
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: ui-next/pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+        working-directory: ui-next
+
+      - name: Cache Playwright browsers
+        id: playwright-cache
+        uses: actions/cache@v5
+        with:
+          path: ~/.cache/ms-playwright
+          key: ${{ runner.os }}-playwright-chromium-${{ hashFiles('ui-next/pnpm-lock.yaml') }}
+
+      - name: Install Playwright browsers
+        if: steps.playwright-cache.outputs.cache-hit != 'true'
+        run: pnpm exec playwright install chromium
+        working-directory: ui-next
+
+      # OS-level dependencies (apt packages) cannot be cached — always install.
+      - name: Install Playwright OS dependencies
+        run: pnpm exec playwright install-deps chromium
+        working-directory: ui-next
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Cache Docker layers for conductor:server
+        uses: actions/cache@v5
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-conductor-server-${{ hashFiles('docker/server/Dockerfile', '**/build.gradle', 'settings.gradle') }}
+          restore-keys: ${{ runner.os }}-conductor-server-
+
+      - name: Build conductor:server Docker image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/server/Dockerfile
+          tags: conductor:server
+          load: true
+          cache-from: type=local,src=/tmp/.buildx-cache
+          cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=min
+
+      - name: Move Docker layer cache
+        run: |
+          rm -rf /tmp/.buildx-cache
+          mv /tmp/.buildx-cache-new /tmp/.buildx-cache
+
+      - name: Run integration E2E tests
+        run: pnpm test:e2e:integration
+        working-directory: ui-next
+
+      - name: Upload Playwright integration report
+        uses: actions/upload-artifact@v7
+        if: failure()
+        with:
+          name: playwright-integration-report
+          path: ui-next/playwright-integration-report/
+          retention-days: 7