feat: add --redact/--compress/--open for heap-dump, jstall bundle, and JRE-only fallback

.github/workflows/build-and-snapshot.yml

@@ -231,14 +231,13 @@ jobs:
             ```sh
             # on Mac arm64
             cf install-plugin https://github.com/SAP/cf-cli-java-plugin/releases/download/snapshot/cf-cli-java-plugin-macos-arm64
-            # on Windows x86
-            cf install-plugin https://github.com/SAP/cf-cli-java-plugin/releases/download/snapshot/cf-cli-java-plugin-windows-amd64
-            # on Linux x86
+            # on Windows amd64
+            cf install-plugin https://github.com/SAP/cf-cli-java-plugin/releases/download/snapshot/cf-cli-java-plugin-windows-amd64.exe
+            # on Linux amd64
             cf install-plugin https://github.com/SAP/cf-cli-java-plugin/releases/download/snapshot/cf-cli-java-plugin-linux-amd64
             ```
 
             **Note:** On Linux and macOS, if you get a permission error, run `chmod +x [cf-cli-java-plugin]` on the plugin binary.
-            On Windows, the plugin will refuse to install unless the binary has the `.exe` file extension.
 
             You can verify that the plugin is successfully installed by looking for `java` in the output of `cf plugins`.
 

.github/workflows/build.py

@@ -1,5 +1,10 @@
 import os
 import platform
+import subprocess
+import sys
+import tarfile
+import urllib.request
+import zipfile
 
 os.makedirs('dist', exist_ok=True)
 
@@ -19,6 +24,47 @@
 arch = arch_map[platform.machine().lower()]
 print(f"Building for {os_name} {arch}")
 
-import sys
-rc = os.system(f"go build -o dist/cf-cli-java-plugin-{os_name}-{arch}")
-sys.exit(rc >> 8 if os.name != 'nt' else rc)
+HPROF_BASE = "https://github.com/parttimenerd/hprof-analyzer/releases/download/nightly"
+
+# All platform binaries must exist before go build (go:embed requires them all).
+hprof_targets = [
+    ("hprof-analyzer-x86_64-unknown-linux-musl.tar.gz",  "hprof-analyzer-x86_64-unknown-linux-musl/hprof-redact",   "dist/hprof-redact-linux-amd64",      False),
+    ("hprof-analyzer-aarch64-unknown-linux-musl.tar.gz", "hprof-analyzer-aarch64-unknown-linux-musl/hprof-redact",  "dist/hprof-redact-linux-arm64",      False),
+    ("hprof-analyzer-aarch64-apple-darwin.tar.gz",       "hprof-analyzer-aarch64-apple-darwin/hprof-redact",        "dist/hprof-redact-darwin-arm64",     False),
+    ("hprof-analyzer-x86_64-pc-windows-msvc.zip",        "hprof-analyzer-x86_64-pc-windows-msvc/hprof-redact.exe",  "dist/hprof-redact-windows-amd64.exe", True),
+    ("hprof-analyzer-aarch64-pc-windows-msvc.zip",       "hprof-analyzer-aarch64-pc-windows-msvc/hprof-redact.exe", "dist/hprof-redact-windows-arm64.exe", True),
+]
+
+for archive_name, member, dest, is_zip in hprof_targets:
+    if os.path.exists(dest) and os.path.getsize(dest) > 0:
+        print(f"  {dest} already present, skipping")
+        continue
+    url = f"{HPROF_BASE}/{archive_name}"
+    print(f"  Downloading {archive_name} -> {dest}")
+    tmp = dest + ".tmp"
+    try:
+        urllib.request.urlretrieve(url, tmp)
+        if is_zip:
+            with zipfile.ZipFile(tmp) as zf:
+                data = zf.read(member)
+        else:
+            with tarfile.open(tmp, "r:gz") as tf:
+                data = tf.extractfile(member).read()
+        with open(dest, "wb") as f:
+            f.write(data)
+        os.chmod(dest, 0o755)
+    except Exception as e:
+        # windows-arm64 may not always have a release; create an empty placeholder
+        # so go:embed compiles (the plugin will report "not available" at runtime).
+        print(f"  Warning: could not download {archive_name}: {e}; creating empty placeholder")
+        open(dest, "wb").close()
+    finally:
+        if os.path.exists(tmp):
+            os.remove(tmp)
+
+if "--deps-only" in sys.argv:
+    sys.exit(0)
+
+exe = ".exe" if os_name == "windows" else ""
+rc = subprocess.call(f"go build -o dist/cf-cli-java-plugin-{os_name}-{arch}{exe}", shell=True)
+sys.exit(rc)

.github/workflows/pr-validation.yml

@@ -10,8 +10,8 @@ permissions:
   contents: read
 
 jobs:
-  validate-pr:
-    name: Validate Pull Request
+  validate:
+    name: Lint & Test
     runs-on: ubuntu-latest
 
     steps:
@@ -38,6 +38,9 @@ jobs:
           mkdir -p dist
           curl -fsSL -o dist/jstall-minimal.jar https://github.com/parttimenerd/jstall/releases/latest/download/jstall-minimal.jar
 
+      - name: Download hprof-redact binaries for go:embed
+        run: python3 .github/workflows/build.py --deps-only
+
       - name: Install Go dependencies
         run: go mod tidy -e || true
 
@@ -49,9 +52,6 @@ jobs:
       - name: Run govulncheck
         run: |
           go install golang.org/x/vuln/cmd/govulncheck@latest
-          # Run in JSON mode and emit GitHub Actions warning annotations for each finding.
-          # govulncheck outputs multi-line JSON objects (not line-delimited), so we use
-          # raw_decode to parse successive top-level objects from the output stream.
           govulncheck -json . 2>/dev/null | python3 -c "
           import sys, json
           decoder = json.JSONDecoder()
@@ -87,15 +87,16 @@ jobs:
       - name: Lint Go code
         run: ./scripts/lint-go.sh ci
 
+      - name: Run Go tests
+        run: go test -v -race ./...
+
       - name: Check Python test suite
         id: check-python
         run: |
           if [ -f "test/requirements.txt" ] && [ -f "test/setup.sh" ]; then
             echo "python_tests_exist=true" >> $GITHUB_OUTPUT
-            echo "✅ Python test suite found"
           else
             echo "python_tests_exist=false" >> $GITHUB_OUTPUT
-            echo "⚠️  Python test suite not found - skipping Python validation"
           fi
 
       - name: Setup Python environment
@@ -114,48 +115,86 @@ jobs:
       - name: Lint Markdown files
         run: ./scripts/lint-markdown.sh ci
 
-      # TODO: Re-enable Python tests when ready
-      # - name: Run Python tests
-      #   if: steps.check-python.outputs.python_tests_exist == 'true'
-      #   run: |
-      #     cd test
-      #     source venv/bin/activate
-      #     echo "🧪 Running Python tests..."
-      #     if ! pytest -v --tb=short; then
-      #       echo "❌ Python tests failed."
-      #       exit 1
-      #     fi
-      #     echo "✅ Python tests passed!"
-      #   env:
-      #     CF_API: ${{ secrets.CF_API }}
-      #     CF_USERNAME: ${{ secrets.CF_USERNAME }}
-      #     CF_PASSWORD: ${{ secrets.CF_PASSWORD }}
-      #     CF_ORG: ${{ secrets.CF_ORG }}
-      #     CF_SPACE: ${{ secrets.CF_SPACE }}
+  build:
+    name: Build (${{ matrix.os }})
+    needs: validate
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ">=1.23.5"
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Download JStall minimal JAR for go:embed
+        shell: bash
+        run: |
+          mkdir -p dist
+          curl -fsSL -o dist/jstall-minimal.jar https://github.com/parttimenerd/jstall/releases/latest/download/jstall-minimal.jar
+
+      - name: Download hprof-redact binaries for go:embed
+        shell: bash
+        run: python3 .github/workflows/build.py --deps-only
+
+      - name: Install Go dependencies
+        run: go mod tidy -e || true
+
+      - name: Run Go tests
+        shell: bash
+        run: go test -race ./...
 
       - name: Build plugin
+        shell: bash
+        run: python3 .github/workflows/build.py
+
+      - name: Install CF CLI (Windows only)
+        if: runner.os == 'Windows'
+        shell: bash
         run: |
-          echo "🔨 Building plugin..."
-          if ! python3 .github/workflows/build.py; then
-            echo "❌ Build failed."
+          choco install cloudfoundry-cli -y --no-progress
+          cf version
+
+      - name: Smoke-test jstall on Windows
+        if: runner.os == 'Windows'
+        shell: bash
+        run: |
+          plugin_bin=$(ls dist/cf-cli-java-plugin-windows-* | head -1)
+          # The binary must have a .exe extension; cf install-plugin rejects files without it.
+          if [[ "$plugin_bin" != *.exe ]]; then
+            echo "FAIL: Windows plugin binary missing .exe extension: $plugin_bin"
             exit 1
           fi
-          echo "✅ Build successful!"
+          cf install-plugin "$plugin_bin" -f
 
-      - name: Validation Summary
-        run: |
-          echo ""
-          echo "🎉 Pull Request Validation Summary"
-          echo "=================================="
-          echo "✅ Go code formatting and linting"
-          echo "✅ Go tests"
-          echo "✅ Markdown formatting and linting"
-          if [ "${{ steps.check-python.outputs.python_tests_exist }}" == "true" ]; then
-            echo "✅ Python code quality checks"
-            echo "✅ Python tests"
-          else
-            echo "⚠️  Python tests skipped (not found)"
+          # Run cf java status — not logged in so CF will respond with an auth
+          # error. That means jstall successfully invoked cf.exe via ProcessBuilder.
+          # Any Windows invocation bug (sh not found, unknown flag, etc.) would
+          # produce a different error and fail this check.
+          output=$(cf java status fake-app 2>&1 || true)
+          echo "Output: $output"
+
+          if ! echo "$output" | grep -qiE "not logged in|login|token|authenticate"; then
+            echo "FAIL: expected CF auth error, got: $output"
+            exit 1
           fi
-          echo "✅ Plugin build"
-          echo ""
-          echo "🚀 Ready for merge!"
+          echo "OK: jstall reached CF as expected"
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v7
+        with:
+          name: cf-cli-java-plugin-${{ matrix.os }}
+          path: |
+            dist/*
+            !dist/jstall-minimal.jar
+            !dist/hprof-redact-*

.github/workflows/release.yml

@@ -64,7 +64,7 @@ jobs:
         run: python3 .github/workflows/build.py
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: binaries-${{ matrix.os }}
           path: dist/
@@ -130,7 +130,7 @@ jobs:
           git push origin "$VERSION"
 
       - name: Download all build artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts/
 

.gitignore

@@ -26,13 +26,16 @@ _testmain.go
 # Tools
 counterfeiter
 
-# Built binaries
+# Build output directories
 build/
 pkg/
 
 # built project binary (go build)
 cf-java-plugin
+cf-cli-java-plugin
 
+# Local tool binaries (downloaded during development, e.g. gofumpt, gopls)
+bin/
 # Testing directory - sensitive config and test results
 test/test_config.yml
 test/*.hprof
@@ -49,8 +52,55 @@ test/snapshots/
 # Heap dump files
 *.hprof
 
-# Build artifacts
+# Embedded/downloaded build artifacts
 dist
 
-# go
-pkg
+# Local project binaries
+requires
+
+# OS/editor/local tooling
+.DS_Store
+.claude/
+.playwright-mcp/
+.test_success_cache.json
+*.log
+*.tmp
+*.bak
+*~
+
+# Python local caches / coverage
+.coverage
+htmlcov/
+.mypy_cache/
+.ruff_cache/
+venv/
+
+# Local investigation / scratch artifacts
+BUG*.md
+FIX*.md
+*_REPORT.md
+*analysis*.py
+append_*.py
+discover*.py
+investigate*.py
+*_test_output.txt
+*_results.txt
+*.out
+out.zip
+
+# Local runtime artifacts
+sapmachine21-status/
+sapmachine21-status.zip
+sapmachine21-heapdump-*.hprof.gz
+sapmachine21-heapdump-*-redacted.hprof.gz
+
+# Local ad-hoc test helpers/artifacts
+test/doc_bugs_finder.py
+test/sapmachine21-status.zip
+test/test_bugs.py
+test_bugs.sh
+test_edge_cases.py
+test_fixes.py
+
+# Internal planning docs (superpowers skill artifacts)
+docs/superpowers/