From 3830effcc4da668fd4ca7899a980761244f47f39 Mon Sep 17 00:00:00 2001
From: saurabh-prakash <saurabhp@lambdatest.com>
Date: Fri, 26 Jun 2026 15:16:15 +0530
Subject: [PATCH 1/2] [TE-10262]: add build-only CI to verify karate report
 fatjar on lt-reports

Mirrors lt-reports-cd.yml's build (JDK 17, maven cache, fatjar profile,
verify step) but does not publish. Runs on push and pull_request to
lt-reports so build breakages are caught on PRs before the publish-on-merge
CD runs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/lt-reports-ci.yml | 61 +++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 .github/workflows/lt-reports-ci.yml

diff --git a/.github/workflows/lt-reports-ci.yml b/.github/workflows/lt-reports-ci.yml
new file mode 100644
index 000000000..9fbb8a3a8
--- /dev/null
+++ b/.github/workflows/lt-reports-ci.yml
@@ -0,0 +1,61 @@
+name: lt-reports-ci
+
+# Verifies that the Karate report-integration fatjar builds successfully.
+# This mirrors lt-reports-cd.yml's build (same JDK, cache, profile and
+# verify steps) but stops short of publishing: it only proves the fatjar
+# compiles and is produced, so build breakages on lt-reports are caught
+# on PRs before they reach the publish-on-merge workflow.
+
+on:
+  push:
+    branches:
+      - lt-reports
+  pull_request:
+    branches:
+      - lt-reports
+  workflow_dispatch: {}
+
+jobs:
+  build:
+    name: Build karate report fatjar
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps:
+      - name: git checkout
+        uses: actions/checkout@v4
+
+      - name: set up jdk 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - name: cache maven packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.m2/repository
+          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
+          restore-keys: ${{ runner.os }}-maven-
+
+      # Build the karate-core fatjar (shaded karate-<version>.jar bundling
+      # com.intuit.karate.Main). IMPORTANT: only the `fatjar` profile is active.
+      # Activating `pre-release` alongside it merges the two profiles' shade
+      # executions (both use the default execution id) into an invalid config:
+      #   maven-shade-plugin: Cannot find 'resource' in class ServicesResourceTransformer
+      # build-docker.sh keeps the two profiles in separate invocations for the
+      # same reason. `-pl karate-core -am` builds only karate-core and its parent.
+      - name: build karate-core fatjar
+        run: |
+          mvn -B -ntp clean package -DskipTests \
+            -P fatjar \
+            -pl karate-core -am
+
+      - name: verify fatjar
+        run: |
+          KARATE_VERSION="$(mvn -q -DforceStdout -f karate-core/pom.xml help:evaluate -Dexpression=project.version)"
+          echo "Built karate-core version: ${KARATE_VERSION}"
+          FATJAR="karate-core/target/karate-${KARATE_VERSION}.jar"
+          test -f "${FATJAR}" || { echo "fatjar not found at ${FATJAR}"; ls -lh karate-core/target; exit 1; }
+          ls -lh "${FATJAR}"

From 10a8d7c43b7470917fd0565ca6b19d2be75867fd Mon Sep 17 00:00:00 2001
From: saurabh-prakash <saurabhp@lambdatest.com>
Date: Fri, 26 Jun 2026 15:16:15 +0530
Subject: [PATCH 2/2] [TE-10262]: bump jackson to 2.18.8 to pick up CVE fixes

Bumps jackson-core, jackson-databind and jackson-annotations from 2.18.6
to 2.18.8 (latest published in the 2.18.x line). 2.18.9 (databind-only
micro-patch for CVE-2026-54515) is not yet released to Maven Central.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 karate-core/pom.xml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/karate-core/pom.xml b/karate-core/pom.xml
index b5a0e1836..f9804ec8e 100644
--- a/karate-core/pom.xml
+++ b/karate-core/pom.xml
@@ -27,17 +27,17 @@
             <dependency>
                 <groupId>com.fasterxml.jackson.core</groupId>
                 <artifactId>jackson-core</artifactId>
-                <version>2.18.6</version>
+                <version>2.18.8</version>
             </dependency>
             <dependency>
                 <groupId>com.fasterxml.jackson.core</groupId>
                 <artifactId>jackson-databind</artifactId>
-                <version>2.18.6</version>
+                <version>2.18.8</version>
             </dependency>
             <dependency>
                 <groupId>com.fasterxml.jackson.core</groupId>
                 <artifactId>jackson-annotations</artifactId>
-                <version>2.18.6</version>
+                <version>2.18.8</version>
             </dependency>
         </dependencies>
     </dependencyManagement>