bug: Maven property ${platform.branch} not expanded in buf antrun execution

[pflynn-virtru]

Summary

The ${platform.branch} Maven property is being passed as a literal string to the buf command during the antrun generateSources phase, instead of being expanded to its actual value. This causes the build to fail with:

[exec] Failure: could not clone https://github.com/opentdf/platform.git: exit status 128
[exec] fatal: couldn't find remote ref ${platform.branch}

Environment

• Java SDK version: v0.7.5 (LTS)
• Observed in: opentdf/tests X-Test workflow
• Build tool: Maven with antrun plugin

Steps to Reproduce

1. Build the Java SDK v0.7.5 with default pom.xml settings
2. Maven antrun executes buf generate which attempts to clone platform repo
3. The ${platform.branch} property is passed literally instead of resolved

Expected Behavior

The platform.branch property should be resolved to its value (e.g., protocol/go/v0.5.0 or main) before being passed to the buf command.

Actual Behavior

Git receives the literal string ${platform.branch} as the branch name:

fatal: couldn't find remote ref ${platform.branch}

Relevant Logs

From X-Test workflow run:

platform.branch already defined in .../java/src/main/sdk/pom.xml, skipping.
Using default platform branch from pom.xml
[INFO]      [exec] Failure: could not clone https://github.com/opentdf/platform.git: exit status 128
[INFO]      [exec] fatal: couldn't find remote ref ${platform.branch}

Possible Cause

The antrun plugin may not be configured to filter/expand Maven properties in the exec command arguments, or the property reference syntax in the antrun build.xml may be incorrect.

References

• Observed in: https://github.com/opentdf/tests/actions/runs/21037716570
• Related PR: chore(ci): Improve X-Test workflow performance tests#378

[pflynn-virtru]

Root Cause Analysis

The issue is not in this repo (java-sdk), but in the opentdf/tests repo's post-checkout script.

The Problem

The file xtest/sdk/scripts/post-checkout-java.sh in the tests repo attempts to add the <platform.branch> property to older java-sdk versions that don't have it. However, v0.7.5's sdk/pom.xml has no <properties> section, causing the sed insertion to silently fail:

# This sed command finds nothing to match in v0.7.5:
$SED_CMD '/<properties>/a \
      <platform.branch>main</platform.branch>' "$POM_FILE"

The subsequent sed command to replace branch=main with branch=${platform.branch} does succeed, leaving the pom.xml with an undefined variable reference.

Version Analysis

Version	<properties> section	Result
v0.7.5	NO	Script fails silently, ${platform.branch} undefined
v0.7.6+	YES	Script works correctly

Suggested Fix (in opentdf/tests repo)

Option A: Create <properties> section if missing before inserting:

if ! grep -q "<properties>" "$POM_FILE"; then
  $SED_CMD '/<packaging>jar<\/packaging>/a \
    <properties>\
    </properties>' "$POM_FILE"
fi

Option B: Skip modification entirely for versions using hardcoded branch=main:

if grep -q 'branch=main' "$POM_FILE"; then
  echo "Using hardcoded branch=main, no modification needed."
  continue
fi

Option B is simpler and avoids modifying pom.xml unnecessarily for older versions.

[pflynn-virtru]

Update: Root Cause Identified

After further investigation, the root cause is in the opentdf/tests repository, not java-sdk.

Location

xtest/sdk/scripts/post-checkout-java.sh - This script is supposed to inject the platform.branch property into older Java SDK versions that don't have it defined.

The Bug

The script fails silently when the pom.xml has no <properties> section (as in v0.7.5):

# Line 37-38: This sed command assumes <properties> exists
$SED_CMD '/<properties>/a \
      <platform.branch>main</platform.branch>' "$POM_FILE"

# Line 42: This ALWAYS runs, replacing branch=main with ${platform.branch}
$SED_CMD 's/branch=main/branch=${platform.branch}/g' "$POM_FILE"

What happens with v0.7.5:

1. Script checks if <platform.branch> exists → it does (in buf.gen.yaml reference)
2. Script skips adding the property (line 29-32)
3. OR if no <properties> section exists, the sed on line 37-38 silently does nothing
4. Line 42 still runs, replacing branch=main with literal ${platform.branch}
5. Maven can't resolve the property → buf receives literal ${platform.branch} → git clone fails

Suggested Fixes (for opentdf/tests)

Option A: Check for <properties> section before sed

if ! grep -q "<properties>" "$POM_FILE"; then
  echo "No <properties> section in $POM_FILE, adding one..."
  $SED_CMD '/<project/a \
    <properties>\
      <platform.branch>main</platform.branch>\
    </properties>' "$POM_FILE"
else
  # existing logic
fi

Option B: Use xmlstarlet or yq for robust XML editing

xmlstarlet ed -s "/project/properties" -t elem -n "platform.branch" -v "main" "$POM_FILE"

Option C: Skip property replacement for versions that already have hardcoded branch

# Don't replace branch=main if we couldn't add the property
if grep -q "<platform.branch>main</platform.branch>" "$POM_FILE"; then
  $SED_CMD 's/branch=main/branch=${platform.branch}/g' "$POM_FILE"
fi

Next Steps

This issue should be tracked in opentdf/tests. I'll create a follow-up issue there.

[pflynn-virtru]

Follow-up issue created in opentdf/tests: opentdf/tests#379