Fix groups api calls

Dockerfile

@@ -3,7 +3,7 @@ COPY . /usr/src/app
 WORKDIR /usr/src/app
 RUN mvn clean install -DskipTests=true
 
-FROM adoptopenjdk/openjdk11:alpine
+FROM aehrc/jre:openjdk-17
 LABEL maintainer="SNOMED International <tooling@snomed.org>"
 
 ARG SUID=1042
@@ -18,11 +18,51 @@ RUN apk add git
 RUN mkdir /app
 WORKDIR /app
 
-# Clone in the drools rules needed
-RUN git clone https://github.com/IHTSDO/snomed-drools-rules.git
+# Both clones are PINNED. Unpinned, the image is not reproducible: what you get
+# depends on when it was built, so an image that works can stop working with no
+# change to this repository. That is not hypothetical - it is what happened on
+# 2026-08-07. This image had not been rebuilt since 2024-05-24; the first
+# rebuild picked up two years of upstream drift and RVF failed to start with
+#
+#   FileNotFoundException: .../release-type-delta-previous-snapshot-validation-
+#                              inferred-relationship_EDITION.sql
+#
+# because IHTSDO removed the _EDITION variants in 9cea111 (2024-08-19) while our
+# mounted manifest.xml still references four of them.
+#
+# When bumping either pin, check it against the OTHER side of the pairing:
+#   - assertions must satisfy every sqlFile in the mounted manifest.xml
+#   - rules must not call service methods absent from ${snomed-drools.version}
 
-# Clone validation assertions
-RUN git clone https://github.com/IHTSDO/snomed-release-validation-assertions.git
+# Drools rules, pinned as a matched pair with snomed-drools 5.7.0 in pom.xml.
+# VERIFIED: at this commit the rules compile against 5.7.0 with zero errors.
+#
+# It is the LAST commit before the rules started using the domain type
+# org.ihtsdo.drools.domain.Annotation (b64999b, 2026-04-09), which exists only
+# from snomed-drools 6.0.0. Moving this pin forward past b64999b without also
+# moving snomed-drools forward does not fail loudly - DRL resolves Annotation to
+# the unrelated org.kie.api.definition.type.Annotation and reports errors about
+# methods nobody wrote:
+#
+#   unable to resolve method: org.kie.api.definition.type.Annotation.active()
+#
+# and Drools then silently contributes nothing while the build goes green.
+#
+# Going to 6.0.0 is not currently possible: it is compiled for Java 25 (class
+# file version 69) and this image runs 17. That needs upstream's PIP-1048
+# amazoncorretto:17->25 bump, which is part of the IHTSDO catch-up. Until then
+# these rules are deliberately four months behind current develop.
+ARG DROOLS_RULES_REF=45e0d9e21f8cd8a15a89c4b417f413b108496278
+RUN git clone https://github.com/IHTSDO/snomed-drools-rules.git \
+    && git -C snomed-drools-rules checkout --quiet ${DROOLS_RULES_REF}
+
+# Validation assertions. Pinned to the repository state as at 2024-05-23, which
+# is what the last known-good image (build 4556, 2024-05-24) was built from.
+# Verified: all four _EDITION scripts referenced by the mounted manifest.xml
+# resolve at this commit.
+ARG ASSERTIONS_REF=fad36466277ca633e0bc6844a3b4a83d3698ea97
+RUN git clone https://github.com/IHTSDO/snomed-release-validation-assertions.git \
+    && git -C snomed-release-validation-assertions checkout --quiet ${ASSERTIONS_REF}
 
 RUN mkdir /app/store
 RUN mkdir /app/store/releases

azure-pipelines.yml

@@ -0,0 +1,56 @@
+name: rvf-$(Date:yyyyMMdd)$(Rev:.r)
+
+trigger:
+  branches:
+    include:
+      - 'groups-api-fix'
+      - 'support-stored-proc-file'
+pool:
+  vmImage: 'ubuntu-latest'
+
+variables:
+  mavenCache: $(Pipeline.Workspace)/.m2/repository
+  mavenOptions: '-Dmaven.repo.local=$(mavenCache)'
+  # Only the production branch may publish `latest` - that is the tag
+  # values.yaml pins, so anything else pushing it silently replaces what the
+  # nightly runs. Every other branch publishes under its own name, which is
+  # also what the :catchup image needs.
+  ${{ if eq(variables['Build.SourceBranchName'], 'groups-api-fix') }}:
+    imageTag: 'latest'
+  ${{ else }}:
+    imageTag: $(Build.SourceBranchName)
+
+stages:
+  - stage: build
+    displayName: Build
+    jobs:
+      - job: build
+        displayName: Build
+        steps:
+          - task: Cache@2
+            displayName: Cache Maven local repo
+            inputs:
+              key: 'maven | "$(Agent.OS)" | **/pom.xml'
+              restoreKeys: |
+                maven | "$(Agent.OS)"
+                maven
+              path: $(mavenCache)
+          - task: MavenAuthenticate@0
+            inputs:
+              artifactsFeeds: 'mavenbuild'
+          - task: Docker@2
+            inputs:
+              containerRegistry: $(acr_registry)
+              command: 'login'
+          - task: Maven@3
+            displayName: Build and verify
+            inputs:
+              mavenPomFile: 'pom.xml'
+              options: '-Ddocker.image.prefix=$(acr_repo) -Ddocker.image.tag=$(imageTag)'
+              mavenOptions: '$(mavenOptions)'
+              javaHomeOption: 'JDKVersion'
+              jdkVersionOption: '1.17'
+              jdkArchitectureOption: 'x64'
+              publishJUnitResults: true
+              testResultsFiles: '**/surefire-reports/TEST-*.xml'
+              goals: 'clean install dockerfile:build dockerfile:push'

docker-compose.yml

@@ -7,7 +7,7 @@ volumes:
 
 services:
   db:
-    image: mysql:5.7
+    image: mysql:8.0.28
     restart: always
     environment:
       - MYSQL_ROOT_PASSWORD=snomed
@@ -21,7 +21,7 @@ services:
     volumes:
       - mysql:/var/lib/mysql
     command:
-      mysqld --sql_mode="NO_ENGINE_SUBSTITUTION,STRICT_TRANS_TABLES" --lower_case_table_names=1
+      mysqld --local-infile=ON --sql_mode="NO_ENGINE_SUBSTITUTION,STRICT_TRANS_TABLES" --lower_case_table_names=1
   rvf:
     image: snomedinternational/release-validation-framework:latest
     container_name: rvf
@@ -31,7 +31,7 @@ services:
     ports:
       - 8081:8081
     environment:
-      - SPRING_DATASOURCE_URL=jdbc:mysql://db:3306/?useSSL=false
+      - SPRING_DATASOURCE_URL=jdbc:mysql://db:3306/?useSSL=false&allowLoadLocalInfile=true&allowPublicKeyRetrieval=true
       - SPRING_DATASOURCE_USERNAME=root
       - SPRING_DATASOURCE_PASSWORD=snomed
       - rvf.assertion.resource.local.path=./snomed-release-validation-assertions/

pom.xml

@@ -18,6 +18,15 @@
     <properties>
         <skip.integration.tests>true</skip.integration.tests>
         <packageName>rvf-api</packageName>
+        <!-- Overridden per branch by azure-pipelines.yml. See dockerfile-maven-plugin below. -->
+        <docker.image.tag>latest</docker.image.tag>
+        <!-- Override snomed-parent-bom 2.0.0's pin of snomed-drools 4.0.0.
+             The snomed-drools-rules content RVF loads at runtime calls methods
+             that only exist from 5.7.0 (isInactiveConceptSameAs,
+             isSemanticTagCompatibleWithinHierarchy). Against 4.0.0 the rules
+             fail to compile, Drools contributes no results, and the build
+             still reports success. -->
+        <snomed-drools.version>5.7.0</snomed-drools.version>
     </properties>
 
     <scm>
@@ -178,6 +187,35 @@
             <groupId>org.springframework.cloud</groupId>
             <artifactId>spring-cloud-aws-autoconfigure</artifactId>
         </dependency>
+        <!-- AWS SDK v2, required at RUNTIME by snomed-drools 5.7.0.
+             It is compiled against resource-manager 7.7.0, whose ResourceManager
+             and RuleExecutor reference software.amazon.awssdk types (S3Client,
+             AwsCredentialsProvider). snomed-parent-bom 2.0.0 manages
+             otf-common - and with it resource-manager - down to 6.0.0, which is
+             the older spring-cloud-aws-core line and brings only AWS SDK v1, so
+             those types are absent and class loading fails:
+                 NoClassDefFoundError:
+                 software/amazon/awssdk/auth/credentials/AwsCredentialsProvider
+             That is thrown while ValidationRunner sets Drools up, so it fails
+             the ENTIRE validation - TestResult comes back null and no report is
+             produced. Before the 5.7.0 bump Drools never reached this code, so
+             the gap was invisible.
+             Declared explicitly rather than by letting otf-common resolve
+             forward to 7.7.0: that line is Jakarta + SDK v2 throughout and
+             pulls javax.jms -> jakarta.jms and AmazonS3 -> S3Client migrations
+             into four files. That migration belongs in the IHTSDO catch-up,
+             which does it wholesale, not duplicated on this Java 17 branch.
+             Version tracks what the resource-manager 7.7.0 chain resolves. -->
+        <dependency>
+            <groupId>software.amazon.awssdk</groupId>
+            <artifactId>auth</artifactId>
+            <version>2.20.63</version>
+        </dependency>
+        <dependency>
+            <groupId>software.amazon.awssdk</groupId>
+            <artifactId>s3</artifactId>
+            <version>2.20.63</version>
+        </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter</artifactId>
@@ -292,6 +330,14 @@
                 <version>1.4.13</version>
                 <configuration>
                     <repository>${docker.image.prefix}/${project.artifactId}</repository>
+                    <!-- Without an explicit tag this plugin defaults to `latest`, so
+                         EVERY build - including a one-off queued against an
+                         experimental branch - overwrites the tag the Helm chart
+                         pulls. That is not hypothetical: on 2026-08-10 two builds
+                         from abandoned branches replaced production's image in
+                         succession. The pipeline sets this per branch; the default
+                         here keeps a bare `mvn dockerfile:push` behaving as before. -->
+                    <tag>${docker.image.tag}</tag>
                     <buildArgs>
                         <JAR_FILE>target/${project.build.finalName}.jar</JAR_FILE>
                     </buildArgs>
@@ -351,6 +397,18 @@
                     </execution>
                 </executions>
             </plugin>
+
+            <plugin>
+                <groupId>org.owasp</groupId>
+                <artifactId>dependency-check-maven</artifactId>
+                <version>8.3.1</version>
+                <executions>
+                    <execution>
+                        <phase>none</phase>
+                    </execution>
+                </executions>
+            </plugin>
+
         </plugins>
     </build>
 

src/main/java/org/ihtsdo/rvf/core/data/model/ExecutionCommand.java

@@ -18,14 +18,14 @@ public class ExecutionCommand {
 	@GeneratedValue
 	Long id;
 
-	@Column(columnDefinition = "text")
+	@Column(columnDefinition = "longtext")
 	String template = null;
 	@JsonBackReference
 	@OneToOne(fetch = FetchType.EAGER, mappedBy = "command")
 	Test test;
 	@ElementCollection(fetch = FetchType.EAGER)
 	@CollectionTable(name="command_statements", joinColumns=@JoinColumn(name="command_id"))
-	@Column(name="statement", columnDefinition = "text")
+	@Column(name="statement", columnDefinition = "longtext")
 	@OrderColumn(name="statement_index")
 	List<String> statements = new ArrayList<>();
 

src/main/java/org/ihtsdo/rvf/core/service/AssertionExecutionService.java

@@ -1,8 +1,22 @@
 package org.ihtsdo.rvf.core.service;
 
+import java.sql.*;
+import java.util.Map;
+import java.util.concurrent.Callable;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.Future;
+import java.util.regex.Pattern;
+import java.util.stream.Collectors;
+
+import javax.annotation.Resource;
+import javax.naming.ConfigurationException;
+import javax.naming.ConfigurationException;
 import org.apache.commons.dbcp.BasicDataSource;
 import org.ihtsdo.rvf.core.data.model.*;
 import org.ihtsdo.rvf.core.service.config.MysqlExecutionConfig;
+import org.ihtsdo.rvf.core.service.util.MySqlQueryTransformer;
 import org.ihtsdo.rvf.importer.AssertionGroupImporter.ProductName;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -208,7 +222,7 @@ private void executeCommand(final Assertion assertion, final MysqlExecutionConfi
 			else {
 				if (sqlStatement.startsWith("create table")){
 					// only add engine if we do not create using a like statement
-					if (!(sqlStatement.contains("like") || sqlStatement.contains("as"))) {
+					if (!sqlStatement.toUpperCase().contains(" ENGINE") && !(sqlStatement.contains("like") || sqlStatement.contains("as"))) {
 						sqlStatement = sqlStatement + " ENGINE = MyISAM";
 					}
 				}
@@ -218,59 +232,10 @@ private void executeCommand(final Assertion assertion, final MysqlExecutionConfi
 	}
 
 	private List<String> transformSql(String[] parts, Assertion assertion, MysqlExecutionConfig config) throws ConfigurationException {
-		List<String> result = new ArrayList<>();
-		String defaultCatalog = dataSource.getDefaultCatalog();
-		String prospectiveSchema = config.getProspectiveVersion();
-		final String[] nameParts = config.getProspectiveVersion().split("_");
-		String defaultModuleId = StringUtils.hasLength(config.getDefaultModuleId()) ? config.getDefaultModuleId() : (nameParts.length >= 2 ? ProductName.toModuleId(nameParts[1]) : "NOT_SUPPLIED");
-		String includedModules = config.getIncludedModules().stream().collect(Collectors.joining(","));
-		String version = (nameParts.length >= 3 ? nameParts[2] : "NOT_SUPPLIED");
-
-		String previousReleaseSchema = config.getPreviousVersion();
-		String dependencyReleaseSchema = config.getExtensionDependencyVersion();
-
-		//We need both these schemas to exist
-		if (prospectiveSchema == null) {
-			throw new ConfigurationException (FAILED_TO_FIND_RVF_DB_SCHEMA + prospectiveSchema);
-		}
-
-		if (config.isReleaseValidation() && !config.isFirstTimeRelease() && previousReleaseSchema == null) {
-			throw new ConfigurationException (FAILED_TO_FIND_RVF_DB_SCHEMA + previousReleaseSchema);
-		}
-		for( String part : parts) {
-			if ((part.contains("<PREVIOUS>") && previousReleaseSchema == null)
-				|| (part.contains("<DEPENDENCY>") && dependencyReleaseSchema == null)) {
-				continue;
-			}
-
-			logger.debug("Original sql statement: {}", part);
-			// remove all SQL comments - //TODO might throw errors for -- style comments
-			final Pattern commentPattern = Pattern.compile("/\\*.*?\\*/", Pattern.DOTALL);
-			part = commentPattern.matcher(part).replaceAll("");
-			// replace all substitutions for exec
-			part = part.replaceAll("<RUNID>", String.valueOf(config.getExecutionId()));
-			part = part.replaceAll("<ASSERTIONUUID>", String.valueOf(assertion.getAssertionId()));
-			part = part.replaceAll("<MODULEID>", defaultModuleId);
-			part = part.replaceAll("<MODULEIDS>", includedModules);
-			part = part.replaceAll("<VERSION>", version);
-			// watch out for any 's that users might have introduced
-			part = part.replaceAll("qa_result", defaultCatalog+ "." + qaResulTableName);
-			part = part.replaceAll("<PROSPECTIVE>", prospectiveSchema);
-			part = part.replaceAll("<TEMP>", prospectiveSchema);
-			if (previousReleaseSchema != null) {
-				part = part.replaceAll("<PREVIOUS>", previousReleaseSchema);
-			}
-			if (dependencyReleaseSchema != null) {
-				part = part.replaceAll("<DEPENDENCY>", dependencyReleaseSchema);
-			}
-			part = part.replaceAll("<DELTA>", deltaTableSuffix);
-			part = part.replaceAll("<SNAPSHOT>", snapshotTableSuffix);
-			part = part.replaceAll("<FULL>", fullTableSuffix);
-			part.trim();
-			logger.debug("Transformed sql statement: {}", part);
-			result.add(part);
-		}
-		return result;
+		String qaResult = dataSource.getDefaultCatalog()+ "." + qaResulTableName;
+		MySqlQueryTransformer queryTransformer = new MySqlQueryTransformer();
+		Map configMap = Map.of("qa_result", qaResult, "<ASSERTIONUUID>", String.valueOf(assertion.getAssertionId()));
+		return queryTransformer.transformSql(parts, config, configMap);
 	}
 
 

src/main/java/org/ihtsdo/rvf/core/service/DroolsRulesValidationService.java

@@ -208,7 +208,12 @@ public ValidationStatusReport runDroolsAssertions(ValidationRunConfig validation
 				}
 
 				//Run validation
-				invalidContents = droolsRF2Validator.validateRF2Files(extractedRF2FilesDirectories, CollectionUtils.isEmpty(previousReleaseDirectories) ? null : previousReleaseDirectories, droolsRulesSets, effectiveDate, null, true);
+				// 5.7.0 inserted an assertionExclusionList parameter in 4th position. We pass
+				// null: this fork filters by module below, after the call, using its own
+				// common-authoring group logic rather than the validator's module parameter.
+				Set<String> assertionExclusionList = null;
+				Set<String> modulesForValidator = null;
+				invalidContents = droolsRF2Validator.validateRF2Files(extractedRF2FilesDirectories, CollectionUtils.isEmpty(previousReleaseDirectories) ? null : previousReleaseDirectories, droolsRulesSets, assertionExclusionList, effectiveDate, modulesForValidator, true);
 
 				// Filter the results based on component's module IDs if the package is an extension
 				String moduleIdStr = validationConfig.getIncludedModules();