medizininformatik-initiative/aether v1.0.0

on GitHub

This is the first stable release of aether. The pipeline now verifies its two input files — the CRTDL and the flatten-lookup file — at pipeline start, so a defective file stops the job with a full list of findings before the first step runs. All three service clients (torch, dimp, send) now accept the same nested auth block with Basic Auth, OAuth2 client credentials, or an API key. CRTDL enrichment no longer drops linkedGroups references silently. The bundled TORCH image moves to its own stable v1.0.0.

What's Changed

Breaking Changes

• fix: keep linkedGroups references that enrichment cannot resolve — ResolveLinkedGroups deleted a linkedGroups entry whose profile URL matched no attribute group. The link disappeared, the pipeline continued, and DIMP got incomplete input with no error. Enrichment now resolves all entries against the complete document, and an entry that does not resolve stops the pipeline with a message that names the group, the attribute, and the URL. A CRTDL whose entries all resolve gives the same result as before. (closes #715) #718
• fix: apply the aether CRTDL rules in the startup verifier — the aether-specific rules (unique attributeGroup names, non-empty ids and references) ran only when CRTDL preprocessing parsed the file. With preprocessing disabled, a defective CRTDL stopped the pipeline late, at the flattening step. VerifyCRTDLBytes now runs the library schema checks and the aether rules together, and one run reports all violations. ValidateCRTDL is removed. A CRTDL that broke these rules but ran with preprocessing disabled now fails at pipeline start. (closes #719) #732

Features

• feat: verify the CRTDL file at pipeline start — a vendored internal/lib/crtdl package validates the document against the embedded CRTDL and CCDL JSON Schemas from dataportal-backend, plus cross-reference checks (unresolved linkedGroups, duplicate group ids, reversed date filters), with no network access. pipeline start runs the check before the connectivity check, and PrepareCRTDL verifies the enriched document before it writes enriched-crtdl.json. (closes #709) #711
• feat: verify the flatten-lookup file at pipeline start — the flatten-lookup validator is vendored as internal/lib/flattenlookup (JSON Schema plus child resolution, parent uniqueness, cycle, and naming checks). pipeline start and pipeline continue verify the file before the first step when the flattening step is enabled. Error findings stop the job; warning findings go to the log. (closes #708) #710
• feat: add authentication to the dimp step — the dimp service config gets an auth block with Basic Auth, OAuth2 client credentials, or an API key, through the same ApplyAuth path as torch and send. (closes #720) #722
• feat: add an auth block to the TORCH service configuration — the five flat authentication fields of the torch service move into the same nested auth block that dimp and send use, and TORCH auth now gets the shared validation (no mix of Basic Auth and OAuth2, no incomplete field set). The flat keys and their environment variables keep working; a file that sets both shapes is refused. A later major version removes the flat keys. (closes #721) #742

Internal & CI

• ci: run the full test suite in the merge queue — the merge_group event gives the docs-only path filter no base ref, so the queue always runs the full suite; pull requests keep the filter. (refs #726) #727
• ci: run go mod tidy after Renovate updates — Renovate left go.sum without the full hashes for tool dependencies, which broke the govulncheck job. (closes #730) #731
• chore: increase the Renovate limit of parallel pull requests to 5 — the merge queue rebases and retests each entry, so the serial limit is no longer necessary. (closes #737) #738
• refactor: use santhosh-tekuri/jsonschema/v6 in the bundle chunk test — removes the second JSON Schema library (xeipuuv/gojsonschema) from the module. (closes #716) #717

Dependency Updates

• Go modules: stretchr/testify v1.12.0 #741; aws-sdk-go-v2 monorepo #707 #734; golang.org/x/text v0.41.0 #714; golang.org/x/vuln v1.7.0 #728; Go toolchain 1.26.6 #724
• Docker images: TORCH v1.0.0 #712; chrislusf/seaweedfs v4.42 #740; postgres 18.6 #725 #735; nginx-unprivileged:1.31-alpine digest #736
• GitHub Actions: step-security/harden-runner v2.21.0 #739; github/codeql-action digest #723
• Tools and docs: esbuild v0.28.2 #713

Full Changelog