fix: etcd auto-compaction + proxy nil-guard + operator anti-affinity

.github/workflows/ci.yml

@@ -46,7 +46,11 @@ jobs:
       - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v5
         with:
           go-version-file: go.mod
-          cache-dependency-path: go.sum
+          cache-dependency-path: |
+            go.sum
+            addons/processors/skeleton/go.sum
+            addons/processors/sql-processor/go.sum
+            addons/processors/iceberg-processor/go.sum
 
       - name: Prepare Go build cache
         run: mkdir -p "$GOCACHE"
@@ -57,6 +61,9 @@ jobs:
       - name: Run go test -race ./...
         run: go test -race ./...
 
+      - name: Run nested module tests
+        run: make test-nested-modules
+
   go-coverage:
     name: Go Coverage Gate
     runs-on: ubuntu-latest
@@ -76,6 +83,7 @@ jobs:
       - name: Enforce coverage floor
         run: bash hack/check_coverage.sh 45
 
+
   helm-lint:
     name: Helm Lint
     runs-on: ubuntu-latest

.github/workflows/codeql.yml

@@ -0,0 +1,66 @@
+# Copyright 2025 Alexander Alten (novatechflow), NovaTechflow (novatechflow.com).
+# This project is supported and financed by Scalytics, Inc. (www.scalytics.io).
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language:
+          - go
+          - javascript-typescript
+          - python
+          - actions
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-extended,security-and-quality
+          config: |
+            paths-ignore:
+              - '**/node_modules/**'
+              - '**/target/**'
+              - '**/*.egg-info/**'
+              - 'third_party/**'
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/docker.yml

@@ -21,7 +21,7 @@ on:
       - 'v*'
   workflow_dispatch:
 
-permissions: read-all
+permissions: {}
 
 jobs:
   build-and-push:
@@ -36,6 +36,10 @@ jobs:
             image: kafscale-broker
             context: .
             file: deploy/docker/broker.Dockerfile
+          # lfs-proxy removed: LFS moved into the broker/console
+          # (internal/console/lfs_*.go); deploy/docker/lfs-proxy.Dockerfile no
+          # longer exists. A dedicated kafscale-lfs-proxy image conflicts with
+          # the in-broker LFS. Do not re-add this matrix entry.
           - name: operator
             image: kafscale-operator
             context: .
@@ -67,7 +71,7 @@ jobs:
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Log in to GHCR
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -82,7 +86,7 @@ jobs:
             type=ref,event=tag
 
       - name: Build and push
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: ${{ matrix.context }}
           file: ${{ matrix.file }}

.github/workflows/scorecard.yml

@@ -46,6 +46,6 @@ jobs:
           publish_results: true
 
       - name: Upload results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@19b2f06db2b6f5108140aeb04014ef02b648f789 # v3
+        uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v3
         with:
           sarif_file: results.sarif

.gitignore

@@ -13,11 +13,14 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+Makefile-MK # Ignore build and IDE files
+
 # Binaries
 /bin/
 /dist/
 /out/
 /tmp/
+/.tmp/
 /.gopath/
 
 # Build artifacts
@@ -31,10 +34,14 @@
 *.key
 coverage*.out
 .build/
+target/
+**/target/
+spark-warehouse/
 
 # Local Go cache (use GOCACHE=.gocache for hermetic builds/tests)
 .gocache/
 .cache/
+.tools/
 
 # Go modules/vendor
 /vendor/
@@ -53,6 +60,7 @@ coverage*.out
 *.swp
 *.swo
 .DS_Store
+.claude/
 
 # Addon processor artifacts
 addons/processors/**/bin/
@@ -79,3 +87,28 @@ proto/**/*.swagger.json
 _site/
 Gemfile
 Gemfile.lock
+
+# Ignore demo node_modules
+examples/E50_JS-kafscale-demo/node_modules/
+
+# Go compiled binaries (top-level)
+/e2e-client
+/lfs-proxy
+/proxy
+
+# Java build artifacts
+target/
+dependency-reduced-pom.xml
+
+# JavaScript/Node.js
+node_modules/
+package-lock.json
+lfs-client-sdk/**/dist/
+
+# Python
+__pycache__/
+*.pyc
+*.egg-info/
+
+# Test output
+records.txt

.nvmrc

@@ -0,0 +1 @@
+24

CONTRIBUTING.md

@@ -47,6 +47,7 @@ The CI workflow checks for missing headers and fails if new files are added with
 Pull requests must include strict test coverage for the changes they introduce. At a minimum:
 
 - Add or extend unit tests for all non-trivial logic.
+- Run `make commit-check` before opening or updating a PR.
 - Run the relevant e2e suite(s). Broker changes should run:
   - `make test-produce-consume`
   - `make test-consumer-group` (if group behavior is affected)
@@ -66,6 +67,7 @@ Common invocations:
 
 - `make build`
 - `make test`
+- `make commit-check`
 - `make test-full`
 
 The policy above (tests for new functionality) is enforced in code review and CI.
@@ -89,6 +91,7 @@ major changes and explicitly lists any known CVE fixes (or "None").
 ## Development Workflow
 
 See `docs/development.md` for build/test commands, environment variables, and local setup.
+Before submitting a PR, run `make commit-check` and fix any reported issues.
 
 ## Code of Conduct