build: harden Docker, expand CI coverage, add linting, pin verapdf; fix version script path

.github/workflows/coverage.yml

@@ -1,4 +1,4 @@
-name: Test & Coverage (JaCoCo -> Codecov)
+name: Test & Coverage (Java/Node/Python -> Codecov)
 
 on:
   pull_request:
@@ -30,3 +30,57 @@ jobs:
           files: java/opendataloader-pdf-core/target/site/jacoco/jacoco.xml
           fail_ci_if_error: true
           token: ${{ secrets.CODECOV_TOKEN }}
+
+  node-coverage:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+      - name: Install deps
+        run: pnpm install --frozen-lockfile
+        working-directory: ./node/opendataloader-pdf
+      - name: Run tests with coverage
+        run: pnpm exec vitest run --coverage.enabled --coverage.reporter=lcov --coverage.include=src/**
+        working-directory: ./node/opendataloader-pdf
+      - name: Upload Node coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          files: node/opendataloader-pdf/coverage/lcov.info
+          fail_ci_if_error: false
+          token: ${{ secrets.CODECOV_TOKEN }}
+
+  python-coverage:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.x'
+      - name: Install coverage
+        run: pip install coverage
+        working-directory: ./python/opendataloader-pdf
+      - name: Run tests with coverage
+        run: |
+          python -m coverage run -m unittest discover -s tests -p "test_*.py"
+          python -m coverage xml -o coverage.xml
+        working-directory: ./python/opendataloader-pdf
+      - name: Upload Python coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          files: python/opendataloader-pdf/coverage.xml
+          fail_ci_if_error: false
+          token: ${{ secrets.CODECOV_TOKEN }}

build-scripts/set_version.py

@@ -4,7 +4,7 @@
 import re
 import sys
 
-def set_version(version_file, pom_file, pyproject_toml_file):
+def set_version(version_file, pom_file, setup_py_file):
     with open(version_file, 'r') as f:
         version = f.read().strip()
 
@@ -16,30 +16,30 @@ def set_version(version_file, pom_file, pyproject_toml_file):
         f.write(pom_content)
     print(f"Updated Maven POM version to {version}")
 
-    # Update Python pyproject.toml
-    with open(pyproject_toml_file, 'r') as f:
-        pyproject_content = f.read()
-    pyproject_content = re.sub(r'version = ".*"', f'version = "{version}"', pyproject_content, count=1)
-    with open(pyproject_toml_file, 'w') as f:
-        f.write(pyproject_content)
-    print(f"Updated Python pyproject.toml version to {version}")
+    # Update Python setup.py
+    with open(setup_py_file, 'r') as f:
+        setup_content = f.read()
+    setup_content = re.sub(r'version=\".*\"', f'version=\"{version}\"', setup_content, count=1)
+    with open(setup_py_file, 'w') as f:
+        f.write(setup_content)
+    print(f"Updated Python setup.py version to {version}")
 
 if __name__ == "__main__":
     # Paths are relative to the monorepo root
     root_dir = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
 
     version_path = os.path.join(root_dir, 'VERSION')
     java_pom_path = os.path.join(root_dir, 'java', 'pom.xml')
-    python_pyproject_path = os.path.join(root_dir, 'python', 'packages', 'opendataloader_pdf', 'pyproject.toml')
+    python_setup_path = os.path.join(root_dir, 'python', 'opendataloader-pdf', 'setup.py')
 
     if not os.path.exists(version_path):
         print(f"Error: VERSION file not found at {version_path}")
         sys.exit(1)
     if not os.path.exists(java_pom_path):
         print(f"Error: Java pom.xml not found at {java_pom_path}")
         sys.exit(1)
-    if not os.path.exists(python_pyproject_path):
-        print(f"Error: Python pyproject.toml not found at {python_pyproject_path}")
+    if not os.path.exists(python_setup_path):
+        print(f"Error: Python setup.py not found at {python_setup_path}")
         sys.exit(1)
 
-    set_version(version_path, java_pom_path, python_pyproject_path)
+    set_version(version_path, java_pom_path, python_setup_path)

java/checkstyle.xml

@@ -0,0 +1,13 @@
+<?xml version="1.0"?>
+<!DOCTYPE module PUBLIC "-//Checkstyle//DTD Checkstyle Configuration 1.3//EN" "https://checkstyle.org/dtds/configuration_1_3.dtd">
+<module name="Checker">
+  <module name="TreeWalker">
+    <module name="UnusedImports"/>
+    <module name="WhitespaceAfter"/>
+    <module name="WhitespaceAround"/>
+    <module name="NoWhitespaceAfter"/>
+    <module name="NoWhitespaceBefore"/>
+    <module name="NeedBraces"/>
+    <module name="EmptyBlock"/>
+  </module>
+</module>

java/opendataloader-pdf-cli/Dockerfile

@@ -1,4 +1,6 @@
-FROM eclipse-temurin:11-jre
+FROM eclipse-temurin:17-jre-alpine@sha256:f6ba7667f56ecf95646288862deb66c52fced48fa375111b4f6ff21745b380c7
 WORKDIR /app
 COPY target/opendataloader-pdf-cli-*.jar opendataloader-pdf-cli.jar
+RUN addgroup -S app && adduser -S -G app appuser && chown -R appuser:app /app
+USER appuser
 ENTRYPOINT ["java","-jar","opendataloader-pdf-cli.jar"]

java/opendataloader-pdf-cli/pom.xml

@@ -45,6 +45,42 @@
 
     <build>
         <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-checkstyle-plugin</artifactId>
+                <version>3.3.1</version>
+                <configuration>
+                    <configLocation>${project.basedir}/../checkstyle.xml</configLocation>
+                    <encoding>${project.build.sourceEncoding}</encoding>
+                    <consoleOutput>true</consoleOutput>
+                    <failsOnError>true</failsOnError>
+                </configuration>
+                <executions>
+                    <execution>
+                        <phase>verify</phase>
+                        <goals>
+                            <goal>check</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+            <plugin>
+                <groupId>com.github.spotbugs</groupId>
+                <artifactId>spotbugs-maven-plugin</artifactId>
+                <version>4.8.6.1</version>
+                <configuration>
+                    <effort>Max</effort>
+                    <threshold>Low</threshold>
+                </configuration>
+                <executions>
+                    <execution>
+                        <phase>verify</phase>
+                        <goals>
+                            <goal>check</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
             <plugin>
                 <artifactId>maven-compiler-plugin</artifactId>
             </plugin>

java/opendataloader-pdf-core/pom.xml

@@ -86,6 +86,42 @@
             </resource>
         </resources>
         <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-checkstyle-plugin</artifactId>
+                <version>3.3.1</version>
+                <configuration>
+                    <configLocation>${project.basedir}/../checkstyle.xml</configLocation>
+                    <encoding>${project.build.sourceEncoding}</encoding>
+                    <consoleOutput>true</consoleOutput>
+                    <failsOnError>true</failsOnError>
+                </configuration>
+                <executions>
+                    <execution>
+                        <phase>verify</phase>
+                        <goals>
+                            <goal>check</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+            <plugin>
+                <groupId>com.github.spotbugs</groupId>
+                <artifactId>spotbugs-maven-plugin</artifactId>
+                <version>4.8.6.1</version>
+                <configuration>
+                    <effort>Max</effort>
+                    <threshold>Low</threshold>
+                </configuration>
+                <executions>
+                    <execution>
+                        <phase>verify</phase>
+                        <goals>
+                            <goal>check</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>flatten-maven-plugin</artifactId>

java/pom.xml

@@ -50,7 +50,7 @@
         <maven.compiler.source>11</maven.compiler.source>
         <maven.compiler.target>11</maven.compiler.target>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <verapdf.version>[1.29.0,1.30.0-RC)</verapdf.version>
+        <verapdf.version>1.29.0</verapdf.version>
         <junit.jupiter.version>5.14.0</junit.jupiter.version>
         <assertj.version>3.27.6</assertj.version>
         <commons.cli.version>1.10.0</commons.cli.version>

node/opendataloader-pdf/.eslintrc.json

@@ -0,0 +1,10 @@
+{
+  "root": true,
+  "parser": "@typescript-eslint/parser",
+  "plugins": ["@typescript-eslint"],
+  "extends": ["eslint:recommended", "plugin:@typescript-eslint/recommended"],
+  "env": { "node": true, "es2022": true },
+  "ignorePatterns": ["dist", "lib"],
+  "parserOptions": { "sourceType": "module", "ecmaVersion": "latest" },
+  "rules": {}
+}

node/opendataloader-pdf/package.json

@@ -19,7 +19,9 @@
     "setup": "node ./scripts/setup.cjs",
     "build": "pnpm run setup && tsup",
     "test": "vitest",
-    "format": "prettier --write \"**/*.{ts,js,json,md}\""
+    "format": "prettier --write \"**/*.{ts,js,json,md}\"",
+    "lint": "eslint \"src/**/*.ts\"",
+    "lint:fix": "eslint \"src/**/*.ts\" --fix"
   },
   "repository": {
     "type": "git",
@@ -51,6 +53,9 @@
   },
   "devDependencies": {
     "@types/node": "^24.10.1",
+    "@typescript-eslint/eslint-plugin": "^8.13.0",
+    "@typescript-eslint/parser": "^8.13.0",
+    "eslint": "^9.14.0",
     "glob": "^12.0.0",
     "prettier": "^3.6.2",
     "tsup": "^8.5.1",

python/opendataloader-pdf/pyproject.toml

@@ -1,3 +1,15 @@
 [build-system]
 requires = ["setuptools>=61.0", "wheel"]
 build-backend = "setuptools.build_meta"
+
+[tool.black]
+line-length = 100
+
+[tool.ruff]
+line-length = 100
+target-version = "py39"
+exclude = ["dist", "build"]
+
+[tool.ruff.lint]
+select = ["E", "F", "I"]
+ignore = []