[WIP] Shared core support using Panama (only Java 23+)

.github/workflows/dependency-submission.yml

@@ -17,6 +17,8 @@ jobs:
         uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
-          java-version: 17
+          java-version: 25
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
       - name: Generate and submit dependency graph
         uses: gradle/actions/dependency-submission@v4

.github/workflows/docker.yaml

@@ -16,8 +16,13 @@ jobs:
   sdk-test-docker:
     if: github.repository_owner == 'restatedev'
     runs-on: warp-ubuntu-latest-x64-4x
-    name: "Create test-services Docker Image"
-
+    name: "Create test-services Docker Image (JRE ${{ matrix.jreVersion }})"
+    strategy:
+      fail-fast: false
+      matrix:
+        # 17 & 21 -> pure-Java state machine (17 also published as :main); 25 -> Panama/FFM state machine.
+        jreVersion: [ 17, 21, 25 ]
+
     steps:
       - uses: actions/checkout@v4
         with:
@@ -27,22 +32,30 @@ jobs:
         uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
-          java-version: '21'
+          java-version: '25'
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v4
 
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+
       - name: Log into GitHub container registry
         uses: docker/login-action@v2
         with:
           registry: ${{ env.GHCR_REGISTRY }}
           username: ${{ env.GHCR_REGISTRY_USERNAME }}
           password: ${{ env.GHCR_REGISTRY_TOKEN }}
 
-      - name: Build restatedev/test-services-java image
-        run: ./gradlew -Djib.console=plain :test-services:jibDockerBuild
+      - name: Build restatedev/test-services-java image (JRE ${{ matrix.jreVersion }})
+        run: ./gradlew -Djib.console=plain :test-services:jibDockerBuild -PtestServicesJre=${{ matrix.jreVersion }}
 
-      - name: Push restatedev/test-services-java:main image
+      - name: Push restatedev/test-services-java image
         run: |
-          docker tag restatedev/test-services-java ghcr.io/restatedev/test-services-java:main
-          docker push ghcr.io/restatedev/test-services-java:main
+          docker tag restatedev/test-services-java ghcr.io/restatedev/test-services-java:main-jre${{ matrix.jreVersion }}
+          docker push ghcr.io/restatedev/test-services-java:main-jre${{ matrix.jreVersion }}
+          # The minimum-Java (pure-Java state machine) image is also the default :main tag.
+          if [ "${{ matrix.jreVersion }}" = "17" ]; then
+            docker tag restatedev/test-services-java ghcr.io/restatedev/test-services-java:main
+            docker push ghcr.io/restatedev/test-services-java:main
+          fi

.github/workflows/integration.yaml

@@ -62,7 +62,13 @@ jobs:
   sdk-test-suite:
     if: github.repository_owner == 'restatedev'
     runs-on: warp-ubuntu-latest-x64-4x
-    name: "Features integration test"
+    name: "Features integration test (JRE ${{ matrix.jreVersion }})"
+    strategy:
+      fail-fast: false
+      matrix:
+        # 17 & 21 exercise the pure-Java state machine; 25 activates the Panama/FFM state machine.
+        # When an external serviceImage is supplied, the build is skipped and both entries run it.
+        jreVersion: [ 17, 21, 25 ]
     permissions:
       contents: read
       issues: read
@@ -117,15 +123,19 @@ jobs:
         uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
-          java-version: '21'
+          java-version: '25'
 
       - name: Setup Gradle
         if: ${{ inputs.serviceImage == '' }}
         uses: gradle/actions/setup-gradle@v4
 
+      - name: Install Rust toolchain
+        if: ${{ inputs.serviceImage == '' }}
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+
       - name: Build restatedev/test-services-java image
         if: ${{ inputs.serviceImage == '' }}
-        run: ./gradlew -Djib.console=plain :test-services:jibDockerBuild
+        run: ./gradlew -Djib.console=plain :test-services:jibDockerBuild -PtestServicesJre=${{ matrix.jreVersion }}
 
       # Pre-emptively pull the test-services image to avoid affecting execution time
       - name: Pull test services image
@@ -135,9 +145,9 @@ jobs:
 
       - name: Run test tool
         continue-on-error: ${{ inputs.continueOnError == 'true' }}
-        uses: restatedev/e2e/sdk-tests@v1.0
+        uses: restatedev/e2e/sdk-tests@v2.1
         with:
           envVars: ${{ inputs.envVars }}
-          testArtifactOutput: ${{ inputs.testArtifactOutput != '' && inputs.testArtifactOutput || 'sdk-java-integration-test-report' }}
+          testArtifactOutput: ${{ inputs.testArtifactOutput != '' && format('{0}-jre{1}', inputs.testArtifactOutput, matrix.jreVersion) || format('sdk-java-integration-test-report-jre{0}', matrix.jreVersion) }}
           restateContainerImage: ${{ inputs.restateCommit != '' && 'localhost/restatedev/restate-commit-download:latest' || (inputs.restateImage != '' && inputs.restateImage || 'ghcr.io/restatedev/restate:main') }}
           serviceContainerImage: ${{ inputs.serviceImage != '' && inputs.serviceImage || 'restatedev/test-services-java' }}

.github/workflows/native.yaml

@@ -0,0 +1,102 @@
+name: Native build
+
+# Cross-compiles the Rust shared-core wrapper (sdk-core/src/main/rust) for every supported
+# platform, smoke-tests the produced library, and uploads it as an artifact. The release pipeline
+# downloads these artifacts and overlays them into the single (uber) sdk-core jar.
+
+on:
+  pull_request:
+    paths:
+      - 'sdk-core/src/main/rust/**'
+      - '.github/workflows/native.yaml'
+  workflow_dispatch:
+  workflow_call:
+
+jobs:
+  build:
+    name: "Build native (${{ matrix.target }})"
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: x86_64-unknown-linux-gnu
+            runner: ubuntu-latest
+            cross: false
+            rustflags: ""
+          - target: aarch64-unknown-linux-gnu
+            runner: ubuntu-latest
+            cross: true
+            rustflags: ""
+          # musl is statically linked by default, which can't produce a cdylib (.so); disabling
+          # crt-static makes the target dynamically linkable so the shared library can be built.
+          - target: x86_64-unknown-linux-musl
+            runner: ubuntu-latest
+            cross: true
+            rustflags: "-C target-feature=-crt-static"
+          - target: aarch64-unknown-linux-musl
+            runner: ubuntu-latest
+            cross: true
+            rustflags: "-C target-feature=-crt-static"
+          # macOS runners are expensive; comment out the darwin targets to disable them.
+          # x86_64 darwin disabled for now — re-enable if Intel Mac support is needed.
+          # - target: x86_64-apple-darwin
+          #   runner: macos-13
+          #   cross: false
+          #   rustflags: ""
+          - target: aarch64-apple-darwin
+            runner: macos-14
+            cross: false
+            rustflags: ""
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          target: ${{ matrix.target }}
+
+      - name: Install cross
+        if: ${{ matrix.cross }}
+        run: cargo install cross --git https://github.com/cross-rs/cross --locked
+
+      - name: Build cdylib
+        working-directory: sdk-core/src/main/rust
+        env:
+          # `cross` forwards RUSTFLAGS into the build container.
+          RUSTFLAGS: ${{ matrix.rustflags }}
+        run: |
+          if [ "${{ matrix.cross }}" = "true" ]; then
+            cross build --release --target ${{ matrix.target }}
+          else
+            cargo build --release --target ${{ matrix.target }}
+          fi
+
+      - name: Locate library
+        id: lib
+        working-directory: sdk-core/src/main/rust
+        run: |
+          dir="target/${{ matrix.target }}/release"
+          file=$(ls "$dir"/librestate_sdk_core.so "$dir"/librestate_sdk_core.dylib 2>/dev/null | head -1)
+          if [ -z "$file" ]; then echo "no library produced for ${{ matrix.target }}"; exit 1; fi
+          echo "path=sdk-core/src/main/rust/$file" >> "$GITHUB_OUTPUT"
+          echo "file=$file" >> "$GITHUB_OUTPUT"
+
+      - name: Smoke test (exported C symbols present)
+        working-directory: sdk-core/src/main/rust
+        run: |
+          f="${{ steps.lib.outputs.file }}"
+          # Linux uses `nm -D` (no symbol prefix); macOS uses `nm -gU` (leading underscore).
+          if [ "$RUNNER_OS" = "macOS" ]; then list="nm -gU"; pre="_"; else list="nm -D"; pre=""; fi
+          for sym in init vm_new vm_free free_buffer vm_sys_call vm_take_notification; do
+            $list "$f" 2>/dev/null | grep -qE "[ ]${pre}${sym}$" || { echo "missing exported symbol: $sym"; exit 1; }
+          done
+          echo "All expected symbols present in $f"
+
+      - name: Upload native library
+        uses: actions/upload-artifact@v4
+        with:
+          name: native-${{ matrix.target }}
+          path: ${{ steps.lib.outputs.path }}
+          if-no-files-found: error

.github/workflows/release-docs.yml

@@ -28,17 +28,19 @@ jobs:
       - uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
-          java-version: '21'
+          java-version: '25'
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v4
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
 
       - name: Build Javadocs
         run: gradle :sdk-aggregated-javadocs:javadoc
       - name: Build Kotlin docs
-        run: gradle :dokkaHtmlMultiModule
+        run: gradle :dokkaGenerate
 
       - name: Move stuff around
-        run: mkdir _site && mv ./sdk-aggregated-javadocs/build/docs/javadoc _site/javadocs && mv ./build/dokka/htmlMultiModule _site/ktdocs
+        run: mkdir _site && mv ./sdk-aggregated-javadocs/build/docs/javadoc _site/javadocs && mv ./build/dokka/html _site/ktdocs
 
       - name: Upload artifact
         uses: actions/upload-pages-artifact@v3

.github/workflows/release.yml

@@ -11,15 +11,18 @@ jobs:
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
-      - name: Set up JDK ${{ matrix.java }}
-        uses: actions/setup-java@v3
+      - name: Set up JDK 25
+        uses: actions/setup-java@v4
         with:
-          java-version: 17
-          distribution: 'adopt'
+          java-version: '25'
+          distribution: 'temurin'
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v4
 
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+
       # Retrieve the version of the SDK
       - name: Install dasel
         run: curl -sSLf "$(curl -sSLf https://api.github.com/repos/tomwright/dasel/releases/latest | grep browser_download_url | grep linux_amd64 | grep -v .gz | cut -d\" -f 4)" -L -o dasel && chmod +x dasel && mv ./dasel /usr/local/bin/dasel

.github/workflows/tests.yml

@@ -9,24 +9,32 @@ on:
 
 jobs:
   build-and-test:
-    name: Build and test (Java ${{ matrix.java }})
+    name: Build and test
     runs-on: warp-ubuntu-latest-x64-4x
-    timeout-minutes: 10
-    strategy:
-      fail-fast: false
-      matrix:
-        java: [ 17, 21, 25 ]
+    # The full `./gradlew build` now also compiles the Rust shared-core cdylib (release) before
+    # the JVM build + tests, so 10m is too tight on a cold runner.
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
-      - name: Set up JDK ${{ matrix.java }}
-        uses: actions/setup-java@v3
+      # The SDK is built with JDK 25: the jextract Gradle plugin requires the Gradle daemon to run
+      # on JDK 21+, and the FFM/Panama path needs the JDK 25 toolchain. Cross-JRE (17/21/25) runtime
+      # coverage is provided by the integration test container matrix (integration.yaml).
+      - name: Set up JDK 25
+        uses: actions/setup-java@v4
         with:
-          java-version: ${{ matrix.java }}
-          distribution: 'adopt'
+          java-version: '25'
+          distribution: 'temurin'
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v4
 
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          # This action bundles Swatinem/rust-cache; point it at the crate's subdirectory (the
+          # default targets the repo root and misses it), so the cdylib build is cached across runs.
+          cache-workspaces: sdk-core/src/main/rust
+
       - name: Pull Restate docker image
         run: docker pull ghcr.io/restatedev/restate:main
 
@@ -37,28 +45,33 @@ jobs:
         if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: Test results (Java ${{ matrix.java }})
+          name: Test results
           path: "**/test-results/test/*.xml"
 
   test-javadocs:
     name: Test Javadocs and dokka
     runs-on: warp-ubuntu-latest-x64-4x
-    timeout-minutes: 10
+    # Building the docs also compiles the Rust cdylib (for the jextract header), so bump from 10m.
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-java@v4
         with:
-          # We test with same Java version and distribution used by the Docs script
-          # https://github.com/restatedev/documentation/blob/main/.github/workflows/pre-release.yml
           distribution: 'temurin'
-          java-version: '21'
+          java-version: '25'
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v4
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          # This action bundles Swatinem/rust-cache; point it at the crate's subdirectory (the
+          # default targets the repo root and misses it), so the cdylib build is cached across runs.
+          cache-workspaces: sdk-core/src/main/rust
 
       - name: Build Javadocs
         run: gradle :sdk-aggregated-javadocs:javadoc
       - name: Build Kotlin docs
-        run: gradle :dokkaHtmlMultiModule
+        run: gradle :dokkaGenerate
 
   event_file:
     name: "Event File"

.gitignore

@@ -37,4 +37,5 @@ build
 kls_database.db
 .kotlin
 
-.restate
+.restate
+/sdk-core/src/main/rust/target/