BREAKING CHANGE(hubble): introduce new version V2

.codex-task/GLOBAL-TODO.md

@@ -0,0 +1,11 @@
+# 全局 TODO
+
+仅记录各 goal 完成后仍有价值、但不属于已完成 goal 的后续事项。
+
+## Hubble 2.0
+
+- 完成 Hubble UI/UX 重构：基于真实双模式与 Chrome 基线完成三方向选型，交付“理解图、准备数据、查询分析”三个核心旅程，并以能力映射、可访问性、性能和发布包回归收口。
+- 现代化 React、Ant Design、X6/Graphin/G6、Dagre 与构建链；先固化核心页面、图交互、性能和浏览器回归基线，再分批升级并清理兼容层。
+- HugeGraph Server 提供保留 Schema 的 data-only clear API 后，恢复 Hubble“仅清数据”能力及权限、默认图和失败合同测试。
+- 重构 Gremlin Basic 认证，移除 HTTP Session 中的短期明文凭据，并验证 token 生命周期。
+- 发布加固：建立逐 JAR license/native allowlist 与 NOTICE 审计，RC 使用正式发布密钥验证 `.sha512`/`.asc`。

.github/actions/get-hugegraph-commit/action.yml

@@ -1,22 +1,49 @@
-name: 'Get HugeGraph stable commit id'
-description: 'Fetch the latest HugeGraph release commit SHA and expose it as output and env variable'
+name: 'Get HugeGraph commit id'
+description: 'Fetch a HugeGraph PR or latest release commit SHA and expose it as output and env variable'
+
+inputs:
+  server-pr-number:
+    description: 'HugeGraph Server PR number to use as integration baseline'
+    required: false
+    default: ''
 
 outputs:
   commit_id:
-    description: 'The commit SHA of the latest HugeGraph release'
+    description: 'The HugeGraph commit SHA selected as integration baseline'
     value: ${{ steps.get-commit.outputs.commit_id }}
+  fetch_ref:
+    description: 'Fetchable HugeGraph git ref selected as integration baseline'
+    value: ${{ steps.get-commit.outputs.fetch_ref }}
 
 runs:
   using: composite
   steps:
     - name: Get HugeGraph stable commit id
       id: get-commit
-      uses: actions/github-script@v7
+      uses: actions/github-script@v9
       with:
         script: |
           const owner = 'apache';
           const repo = 'hugegraph';
+          const serverPrNumber = '${{ inputs.server-pr-number }}';
           try {
+            if (serverPrNumber) {
+              const pull_number = Number(serverPrNumber);
+              if (!Number.isInteger(pull_number) || pull_number <= 0) {
+                throw new Error(`Invalid server PR number: ${serverPrNumber}`);
+              }
+              const { data: pull } = await github.rest.pulls.get({
+                owner, repo, pull_number
+              });
+              const sha = pull.head.sha;
+              const fetchRef = `refs/pull/${pull_number}/head`;
+              core.exportVariable('COMMIT_ID', sha);
+              core.exportVariable('COMMIT_REF', fetchRef);
+              core.setOutput('commit_id', sha);
+              core.setOutput('fetch_ref', fetchRef);
+              console.log(`Using HugeGraph Server PR #${pull_number} ${fetchRef} (${sha})`);
+              return;
+            }
             const { data: release } = await github.rest.repos.getLatestRelease({ owner, repo });
             const tagName = release.tag_name;
             const { data: ref } = await github.rest.git.getRef({
@@ -30,7 +57,9 @@ runs:
               throw new Error(`Unexpected ref type: ${ref.object.type}`);
             }
             core.exportVariable('COMMIT_ID', sha);
+            core.exportVariable('COMMIT_REF', `refs/tags/${tagName}`);
             core.setOutput('commit_id', sha);
+            core.setOutput('fetch_ref', `refs/tags/${tagName}`);
             console.log(`Using HugeGraph release ${tagName} (${sha})`);
           } catch (error) {
             core.setFailed(`Failed to get HugeGraph commit: ${error.message}`);

.github/actions/setup-java-env/action.yml

@@ -19,7 +19,7 @@ runs:
   using: composite
   steps:
     - name: Install JDK ${{ inputs.java-version }}
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@v5
       with:
         java-version: ${{ inputs.java-version }}
         distribution: ${{ inputs.distribution }}

.github/actions/upload-coverage/action.yml

@@ -14,7 +14,7 @@ runs:
   using: composite
   steps:
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@v4
+      uses: codecov/codecov-action@v7
       with:
         token: ${{ inputs.token }}
-        file: ${{ inputs.file }}
+        files: ${{ inputs.file }}

.github/labeler.yml

@@ -18,16 +18,19 @@
 #
 # Pull Request Labeler Github Action Configuration: https://github.com/marketplace/actions/labeler
 
-name: Add Scope Label
-
 client:
-  - hugegraph-client*/**/*
-#  - hugegraph-client-go/**/*
+  - changed-files:
+      - any-glob-to-any-file: 'hugegraph-client*/**/*'
+#      - any-glob-to-any-file: 'hugegraph-client-go/**/*'
 hubble:
-  - hugegraph-hubble/**/*
+  - changed-files:
+      - any-glob-to-any-file: 'hugegraph-hubble/**/*'
 loader:
-  - hugegraph-loader/**/*
+  - changed-files:
+      - any-glob-to-any-file: 'hugegraph-loader/**/*'
 tools:
-  - hugegraph-tools/**/*
+  - changed-files:
+      - any-glob-to-any-file: 'hugegraph-tools/**/*'
 spark:
-  - hugegraph-spark-connector/**/*
+  - changed-files:
+      - any-glob-to-any-file: 'hugegraph-spark-connector/**/*'

.github/workflows/client-ci.yml

@@ -5,7 +5,7 @@ on:
   push:
     branches:
       - master
-      - /^release-.*$/
+      - 'release-*'
     paths:
       - hugegraph-client/**
       - hugegraph-dist/**
@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: Fetch code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 2
 

.github/workflows/client-go-ci.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches:
       - master
-      - /^release-.*$/
+      - 'release-*'
     paths:
       - hugegraph-client-go/**
       - hugegraph-dist/**
@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: Fetch Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 2
 
@@ -52,9 +52,10 @@ jobs:
           commit-id: ${{ steps.get-commit.outputs.commit_id }}
 
       - name: Init Go env
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: '1.x'
+          cache-dependency-path: hugegraph-client-go/go.sum
 
       - name: Go test
         run: |

.github/workflows/codeql-analysis.yml

@@ -38,10 +38,10 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v7
 
     - name: Setup Java JDK
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@v5
       with:
         distribution: 'zulu'
         java-version: '11'
@@ -53,12 +53,12 @@ jobs:
         mv -vf .github/configs/settings.xml $HOME/.m2/settings.xml
 
     - name: Use Node.js 16
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v6
       with:
         node-version: '16'
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -73,7 +73,7 @@ jobs:
     # If this step fails, then you should remove it and run the build manually (see below)
     - if: matrix.language == 'python' || matrix.language == 'javascript'
       name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@v4
 
     - if: matrix.language == 'java'
       name: Build Java
@@ -91,12 +91,12 @@ jobs:
     #   ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v4
 
   dependency-review:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v2
+        uses: actions/dependency-review-action@v5.0.0