Use published SDK version instead of local replace directives

[renuka-fernando]

Summary

Fix #1066

• Replace local SDK replace directives with published version v0.3.9 in gateway go.mod files
• Add separate CI workflow (sdk-integration-test.yml) to validate SDK changes against gateway integration tests

Problem

Gateway components used replace github.com/wso2/api-platform/sdk => ../../sdk to always build against local SDK source. Since the SDK is a user-facing published module with external consumers (policy authors), this caused non-reproducible builds and masked potential interface drift between the gateway runtime and published SDK versions.

Changes

go.mod (3 files):

• gateway/gateway-runtime/policy-engine/go.mod — removed SDK replace directive
• gateway/gateway-builder/go.mod — removed SDK replace, updated v0.0.0 → v0.3.9
• gateway/gateway-controller/go.mod — removed SDK replace, updated v0.0.0 → v0.3.9
• common module replace directives kept as-is (internal, unpublished module)

CI (1 new file):

• .github/workflows/sdk-integration-test.yml — triggers on sdk/** changes, injects go mod edit -replace to test local SDK against gateway integration tests

No changes to Dockerfiles or Makefiles — SDK source continues to be copied into Docker builds via --build-context sdk. During normal builds Go downloads the published version from module proxy; during SDK CI testing the injected replace directive makes Go use the local copy.

Summary by CodeRabbit

• Chores
  • Expanded GitHub Actions workflow triggers to include common module changes for improved test coverage
  • Introduced comprehensive SDK integration test workflow with Go setup, Docker configuration, and automated test execution with diagnostic logging
  • Updated SDK dependencies in gateway modules to v0.3.9 and removed local development replacements

[coderabbitai]

Walkthrough

The changes update GitHub Actions workflows to add SDK integration testing capabilities and update Go module dependencies across gateway components to use SDK v0.3.9 instead of local path replacements, removing local module overrides.

Changes

Cohort / File(s)	Summary
CI/CD Workflow Configuration .github/workflows/gateway-integration-test.yml, .github/workflows/sdk-integration-test.yml	Adds common/** path filter to existing gateway integration test trigger; introduces new SDK integration test workflow that sets up Go 1.25, Docker Buildx, injects local SDK via go mod replacements, builds gateway and mock server images, and runs integration tests with diagnostic logging on failure.
Go Module Dependencies gateway/gateway-builder/go.mod, gateway/gateway-controller/go.mod, gateway/gateway-runtime/policy-engine/go.mod	Updates github.com/wso2/api-platform/sdk from v0.0.0 to v0.3.9 and removes local module path replacements across modules; adds transitive dependencies golang.org/x/crypto and golang.org/x/sys.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐰 The SDK springs forth at v0.3.9,
Local paths fade like stars at sunrise,
Workflows now dance with Docker's delight,
Go modules stack perfectly aligned,
Integration tests bloom in the night,
Our gateway grows stronger, shining bright! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: switching from local SDK replace directives to using the published v0.3.9 version in gateway go.mod files.
Description check	✅ Passed	The description includes Purpose (links to issue), Goals, Approach, and explains the changes clearly; however, it lacks Documentation, Security checks, and Test environment sections from the template.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In @.github/workflows/sdk-integration-test.yml:
- Around line 27-36: The workflow step that injects the local SDK via go mod
edit -replace into the modules (gateway/gateway-runtime/policy-engine,
gateway-builder, gateway-controller) is missing go mod tidy, which can leave
go.sum inconsistent; after each go mod edit -replace invocation run go mod tidy
in the same module to update go.sum and pull correct transitive deps, and make
the step more robust by using absolute paths based on $GITHUB_WORKSPACE instead
of chained cd commands so each module (policy-engine, gateway-builder,
gateway-controller) is edited and tidied reliably.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Missing go mod tidy after injecting replace directives.

After go mod edit -replace, the go.sum files won't reflect the local SDK's transitive dependencies. If the local SDK differs from v0.3.9 in its dependency graph, subsequent go build or go test may fail or fetch unexpected versions. Run go mod tidy in each module after editing.

Also, the chained cd navigation is fragile — consider using absolute paths from $GITHUB_WORKSPACE for clarity.

Proposed fix

       - name: Inject local SDK into gateway modules
         run: |
-          cd gateway/gateway-runtime/policy-engine
-          go mod edit -replace github.com/wso2/api-platform/sdk=../../../sdk
+          cd $GITHUB_WORKSPACE/gateway/gateway-runtime/policy-engine
+          go mod edit -replace github.com/wso2/api-platform/sdk=../../../sdk
+          go mod tidy
 
-          cd ../../gateway-builder
-          go mod edit -replace github.com/wso2/api-platform/sdk=../../sdk
+          cd $GITHUB_WORKSPACE/gateway/gateway-builder
+          go mod edit -replace github.com/wso2/api-platform/sdk=../../sdk
+          go mod tidy
 
-          cd ../gateway-controller
-          go mod edit -replace github.com/wso2/api-platform/sdk=../../sdk
+          cd $GITHUB_WORKSPACE/gateway/gateway-controller
+          go mod edit -replace github.com/wso2/api-platform/sdk=../../sdk
+          go mod tidy

🤖 Prompt for AI Agents

In @.github/workflows/sdk-integration-test.yml around lines 27 - 36, The
workflow step that injects the local SDK via go mod edit -replace into the
modules (gateway/gateway-runtime/policy-engine, gateway-builder,
gateway-controller) is missing go mod tidy, which can leave go.sum inconsistent;
after each go mod edit -replace invocation run go mod tidy in the same module to
update go.sum and pull correct transitive deps, and make the step more robust by
using absolute paths based on $GITHUB_WORKSPACE instead of chained cd commands
so each module (policy-engine, gateway-builder, gateway-controller) is edited
and tidied reliably.