[WIP] Shared core support using Panama (only Java 23+)

.github/workflows/bump.yaml

@@ -11,13 +11,13 @@ jobs:
     name: Bump release version
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install dasel
         run: curl -sSLf "$(curl -sSLf https://api.github.com/repos/tomwright/dasel/releases/latest | grep browser_download_url | grep linux_amd64 | grep -v .gz | cut -d\" -f 4)" -L -o dasel && chmod +x dasel && mv ./dasel /usr/local/bin/dasel
       - name: Bump version overwriting libs.versions.toml
         run: dasel -f gradle/libs.versions.toml put -t string -v "${{ github.event.inputs.version }}" ".versions.restate"
       - name: Create version bump PR
-        uses: peter-evans/create-pull-request@v3
+        uses: peter-evans/create-pull-request@v8
         with:
           title: "[Release] Bump to ${{ github.event.inputs.version }}"
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/dependency-submission.yml

@@ -12,11 +12,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
-          java-version: 17
+          java-version: 25
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          cache-workspaces: sdk-core/src/main/rust
       - name: Generate and submit dependency graph
-        uses: gradle/actions/dependency-submission@v4
+        uses: gradle/actions/dependency-submission@v6

.github/workflows/docker.yaml

@@ -16,33 +16,48 @@ jobs:
   sdk-test-docker:
     if: github.repository_owner == 'restatedev'
     runs-on: warp-ubuntu-latest-x64-4x
-    name: "Create test-services Docker Image"
-
+    name: "Create test-services Docker Image (JRE ${{ matrix.jreVersion }})"
+    strategy:
+      fail-fast: false
+      matrix:
+        # 17 & 21 -> pure-Java state machine (17 also published as :main); 25 -> Panama/FFM state machine.
+        jreVersion: [ 17, 21, 25 ]
+
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           repository: restatedev/sdk-java
 
       - name: Setup Java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
-          java-version: '21'
+          java-version: '25'
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
+
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          cache-workspaces: sdk-core/src/main/rust
 
       - name: Log into GitHub container registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.GHCR_REGISTRY }}
           username: ${{ env.GHCR_REGISTRY_USERNAME }}
           password: ${{ env.GHCR_REGISTRY_TOKEN }}
 
-      - name: Build restatedev/test-services-java image
-        run: ./gradlew -Djib.console=plain :test-services:jibDockerBuild
+      - name: Build restatedev/test-services-java image (JRE ${{ matrix.jreVersion }})
+        run: ./gradlew -Djib.console=plain :test-services:jibDockerBuild -PtestServicesJre=${{ matrix.jreVersion }}
 
-      - name: Push restatedev/test-services-java:main image
+      - name: Push restatedev/test-services-java image
         run: |
-          docker tag restatedev/test-services-java ghcr.io/restatedev/test-services-java:main
-          docker push ghcr.io/restatedev/test-services-java:main
+          docker tag restatedev/test-services-java ghcr.io/restatedev/test-services-java:main-jre${{ matrix.jreVersion }}
+          docker push ghcr.io/restatedev/test-services-java:main-jre${{ matrix.jreVersion }}
+          # The minimum-Java (pure-Java state machine) image is also the default :main tag.
+          if [ "${{ matrix.jreVersion }}" = "17" ]; then
+            docker tag restatedev/test-services-java ghcr.io/restatedev/test-services-java:main
+            docker push ghcr.io/restatedev/test-services-java:main
+          fi

.github/workflows/integration.yaml

@@ -62,7 +62,13 @@ jobs:
   sdk-test-suite:
     if: github.repository_owner == 'restatedev'
     runs-on: warp-ubuntu-latest-x64-4x
-    name: "Features integration test"
+    name: "Features integration test (JRE ${{ matrix.jreVersion }})"
+    strategy:
+      fail-fast: false
+      matrix:
+        # 17 & 21 exercise the pure-Java state machine; 25 activates the Panama/FFM state machine.
+        # When an external serviceImage is supplied, the build is skipped and both entries run it.
+        jreVersion: [ 17, 21, 25 ]
     permissions:
       contents: read
       issues: read
@@ -71,12 +77,12 @@ jobs:
       actions: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           repository: restatedev/sdk-java
 
       - name: Set up Docker containerd snapshotter
-        uses: docker/setup-docker-action@v4
+        uses: docker/setup-docker-action@v5
         with:
           version: "v28.5.2"
           set-host: true
@@ -93,13 +99,13 @@ jobs:
       # We must use download-artifact to get artifacts created during *this* workflow run, ie by workflow call
       - name: Download restate snapshot from in-progress workflow
         if: ${{ inputs.restateCommit != '' && github.event_name != 'workflow_dispatch' }}
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: restate.tar
       # In the workflow dispatch case where the artifact was created in a previous run, we can download as normal
       - name: Download restate snapshot from completed workflow
         if: ${{ inputs.restateCommit != '' && github.event_name == 'workflow_dispatch' }}
-        uses: dawidd6/action-download-artifact@v3
+        uses: dawidd6/action-download-artifact@v21
         with:
           repo: restatedev/restate
           workflow: ci.yml
@@ -114,18 +120,24 @@ jobs:
 
       - name: Setup Java
         if: ${{ inputs.serviceImage == '' }}
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
-          java-version: '21'
+          java-version: '25'
 
       - name: Setup Gradle
         if: ${{ inputs.serviceImage == '' }}
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
+
+      - name: Install Rust toolchain
+        if: ${{ inputs.serviceImage == '' }}
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          cache-workspaces: sdk-core/src/main/rust
 
       - name: Build restatedev/test-services-java image
         if: ${{ inputs.serviceImage == '' }}
-        run: ./gradlew -Djib.console=plain :test-services:jibDockerBuild
+        run: ./gradlew -Djib.console=plain :test-services:jibDockerBuild -PtestServicesJre=${{ matrix.jreVersion }}
 
       # Pre-emptively pull the test-services image to avoid affecting execution time
       - name: Pull test services image
@@ -135,9 +147,9 @@ jobs:
 
       - name: Run test tool
         continue-on-error: ${{ inputs.continueOnError == 'true' }}
-        uses: restatedev/e2e/sdk-tests@v1.0
+        uses: restatedev/e2e/sdk-tests@v2.1
         with:
           envVars: ${{ inputs.envVars }}
-          testArtifactOutput: ${{ inputs.testArtifactOutput != '' && inputs.testArtifactOutput || 'sdk-java-integration-test-report' }}
+          testArtifactOutput: ${{ inputs.testArtifactOutput != '' && format('{0}-jre{1}', inputs.testArtifactOutput, matrix.jreVersion) || format('sdk-java-integration-test-report-jre{0}', matrix.jreVersion) }}
           restateContainerImage: ${{ inputs.restateCommit != '' && 'localhost/restatedev/restate-commit-download:latest' || (inputs.restateImage != '' && inputs.restateImage || 'ghcr.io/restatedev/restate:main') }}
           serviceContainerImage: ${{ inputs.serviceImage != '' && inputs.serviceImage || 'restatedev/test-services-java' }}

.github/workflows/native.yaml

@@ -0,0 +1,103 @@
+name: Native build
+
+# Cross-compiles the Rust shared-core wrapper (sdk-core/src/main/rust) for every supported
+# platform, smoke-tests the produced library, and uploads it as an artifact. The release pipeline
+# downloads these artifacts and overlays them into the single (uber) sdk-core jar.
+
+on:
+  pull_request:
+    paths:
+      - 'sdk-core/src/main/rust/**'
+      - '.github/workflows/native.yaml'
+  workflow_dispatch:
+  workflow_call:
+
+jobs:
+  build:
+    name: "Build native (${{ matrix.target }})"
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: x86_64-unknown-linux-gnu
+            runner: ubuntu-latest
+            cross: false
+            rustflags: ""
+          - target: aarch64-unknown-linux-gnu
+            runner: ubuntu-latest
+            cross: true
+            rustflags: ""
+          # musl is statically linked by default, which can't produce a cdylib (.so); disabling
+          # crt-static makes the target dynamically linkable so the shared library can be built.
+          - target: x86_64-unknown-linux-musl
+            runner: ubuntu-latest
+            cross: true
+            rustflags: "-C target-feature=-crt-static"
+          - target: aarch64-unknown-linux-musl
+            runner: ubuntu-latest
+            cross: true
+            rustflags: "-C target-feature=-crt-static"
+          # macOS runners are expensive; comment out the darwin targets to disable them.
+          # x86_64 darwin disabled for now — re-enable if Intel Mac support is needed.
+          # - target: x86_64-apple-darwin
+          #   runner: macos-13
+          #   cross: false
+          #   rustflags: ""
+          - target: aarch64-apple-darwin
+            runner: macos-14
+            cross: false
+            rustflags: ""
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          target: ${{ matrix.target }}
+          cache-workspaces: sdk-core/src/main/rust
+
+      - name: Install cross
+        if: ${{ matrix.cross }}
+        run: cargo install cross --git https://github.com/cross-rs/cross --locked
+
+      - name: Build cdylib
+        working-directory: sdk-core/src/main/rust
+        env:
+          # `cross` forwards RUSTFLAGS into the build container.
+          RUSTFLAGS: ${{ matrix.rustflags }}
+        run: |
+          if [ "${{ matrix.cross }}" = "true" ]; then
+            cross build --release --target ${{ matrix.target }}
+          else
+            cargo build --release --target ${{ matrix.target }}
+          fi
+
+      - name: Locate library
+        id: lib
+        working-directory: sdk-core/src/main/rust
+        run: |
+          dir="target/${{ matrix.target }}/release"
+          file=$(ls "$dir"/librestate_sdk_core.so "$dir"/librestate_sdk_core.dylib 2>/dev/null | head -1)
+          if [ -z "$file" ]; then echo "no library produced for ${{ matrix.target }}"; exit 1; fi
+          echo "path=sdk-core/src/main/rust/$file" >> "$GITHUB_OUTPUT"
+          echo "file=$file" >> "$GITHUB_OUTPUT"
+
+      - name: Smoke test (exported C symbols present)
+        working-directory: sdk-core/src/main/rust
+        run: |
+          f="${{ steps.lib.outputs.file }}"
+          # Linux uses `nm -D` (no symbol prefix); macOS uses `nm -gU` (leading underscore).
+          if [ "$RUNNER_OS" = "macOS" ]; then list="nm -gU"; pre="_"; else list="nm -D"; pre=""; fi
+          for sym in init vm_new vm_free free_buffer vm_sys_call vm_take_notification; do
+            $list "$f" 2>/dev/null | grep -qE "[ ]${pre}${sym}$" || { echo "missing exported symbol: $sym"; exit 1; }
+          done
+          echo "All expected symbols present in $f"
+
+      - name: Upload native library
+        uses: actions/upload-artifact@v7
+        with:
+          name: native-${{ matrix.target }}
+          path: ${{ steps.lib.outputs.path }}
+          if-no-files-found: error

.github/workflows/publish-test-results.yml

@@ -2,7 +2,7 @@ name: Publish test results
 
 on:
   workflow_run:
-    workflows: [ "CI" ]
+    workflows: [ "Tests" ]
     types:
       - completed
 

.github/workflows/release-docs.yml

@@ -24,24 +24,28 @@ jobs:
     runs-on: warp-ubuntu-latest-x64-4x
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
-          java-version: '21'
+          java-version: '25'
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          cache-workspaces: sdk-core/src/main/rust
 
       - name: Build Javadocs
         run: gradle :sdk-aggregated-javadocs:javadoc
       - name: Build Kotlin docs
-        run: gradle :dokkaHtmlMultiModule
+        run: gradle :dokkaGenerate
 
       - name: Move stuff around
-        run: mkdir _site && mv ./sdk-aggregated-javadocs/build/docs/javadoc _site/javadocs && mv ./build/dokka/htmlMultiModule _site/ktdocs
+        run: mkdir _site && mv ./sdk-aggregated-javadocs/build/docs/javadoc _site/javadocs && mv ./build/dokka/html _site/ktdocs
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
 
   # Deployment job
   deploy:
@@ -53,4 +57,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/release.yml

@@ -10,15 +10,20 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
-      - name: Set up JDK ${{ matrix.java }}
-        uses: actions/setup-java@v3
+      - uses: actions/checkout@v6
+      - name: Set up JDK 25
+        uses: actions/setup-java@v5
         with:
-          java-version: 17
-          distribution: 'adopt'
+          java-version: '25'
+          distribution: 'temurin'
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
+
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          cache-workspaces: sdk-core/src/main/rust
 
       # Retrieve the version of the SDK
       - name: Install dasel