Merge branch 'main' into ahemani/event_instrumentation_iceberg_rest

Author: adnanhemani

.github/actions/ci-incr-build-cache-prepare/action.yml

@@ -45,7 +45,7 @@ runs:
         fi
 
     - name: Gradle / Setup
-      uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4
+      uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4
       with:
         cache-read-only: ${{ inputs.cache-read-only }}
         validate-wrappers: false

.github/workflows/gradle.yml

@@ -46,16 +46,13 @@ jobs:
         with:
           java-version: '21'
           distribution: 'temurin'
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4
-        with:
-          validate-wrappers: false
       - name: Prepare Gradle build cache
         uses: ./.github/actions/ci-incr-build-cache-prepare
       - name: Run unit tests
         env:
           # publishToMavenLocal causes a GH API requests, use the token for those requests
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
         run: |
           ./gradlew check sourceTarball distTar distZip publishToMavenLocal \
             -x :polaris-runtime-service:test \
@@ -87,13 +84,11 @@ jobs:
         with:
           java-version: '21'
           distribution: 'temurin'
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4
-        with:
-          validate-wrappers: false
       - name: Prepare Gradle build cache
         uses: ./.github/actions/ci-incr-build-cache-prepare
       - name: Run Quarkus tests
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
         run: |
           ./gradlew \
             :polaris-runtime-service:test \
@@ -125,14 +120,12 @@ jobs:
         with:
           java-version: '21'
           distribution: 'temurin'
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4
-        with:
-          validate-wrappers: false
       - name: Prepare Gradle build cache
         uses: ./.github/actions/ci-incr-build-cache-prepare
       - name: Run integration tests
         run: ./gradlew intTest --continue
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
       - name: Save partial Gradle build cache
         uses: ./.github/actions/ci-incr-build-cache-save
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
@@ -163,14 +156,13 @@ jobs:
         with:
           java-version: '21'
           distribution: 'temurin'
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4
-        with:
-          validate-wrappers: false
       - name: Collect partial Gradle build caches
         uses: ./.github/actions/ci-incr-build-cache-prepare
         with:
           cache-read-only: false
       - name: Trigger Gradle home cleanup
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
         run: ./gradlew --no-daemon :showVersion
+
       # Note: the "Post Gradle invocation" archives the updated build cache.

.github/workflows/helm.yml

@@ -83,6 +83,8 @@ jobs:
           minikube docker-env
 
       - name: Image build
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
         run: |
           eval $(minikube -p minikube docker-env)
           ./gradlew \

.github/workflows/nightly.yml

@@ -52,14 +52,14 @@ jobs:
         with:
           java-version: '21'
           distribution: 'temurin'
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4
-        with:
-          validate-wrappers: false
+
+      - name: Prepare Gradle build cache
+        uses: ./.github/actions/ci-incr-build-cache-prepare
       - name: Publish SNAPSHOTs to Apache Nexus Repository
         run: ./gradlew publishToApache
         env:
           # publishToApache causes a GH API requests, use the token for those requests
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           ORG_GRADLE_PROJECT_apacheUsername: ${{ secrets.NEXUS_USER }}
-          ORG_GRADLE_PROJECT_apachePassword: ${{ secrets.NEXUS_PW }} 
+          ORG_GRADLE_PROJECT_apachePassword: ${{ secrets.NEXUS_PW }}
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}

.github/workflows/python-client.yml

@@ -38,7 +38,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.9", "3.10", "3.11"]
+        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
 
     steps:
       - name: Checkout Polaris project
@@ -59,11 +59,17 @@ jobs:
         run: |
           make client-lint
 
+      - name: License Compliance Check
+        run: |
+          make client-license-check
+
       - name: Generated Client Tests
         run: |
           make client-unit-test
 
       - name: Image build
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
         run: |
           ./gradlew \
             :polaris-server:assemble \
@@ -74,6 +80,6 @@ jobs:
         run: |
           make client-integration-test
 
-      - name: Run Polaris Client help maual
+      - name: Run Polaris Client help manual
         run: |
           ./polaris --help

.github/workflows/regtest.yml

@@ -40,18 +40,15 @@ jobs:
           java-version: '21'
           distribution: 'temurin'
 
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4
-        with:
-          validate-wrappers: false
-
       - name: Prepare Gradle build cache
         uses: ./.github/actions/ci-incr-build-cache-prepare
 
       - name: Fix permissions
         run: mkdir -p regtests/output && chmod 777 regtests/output && chmod 777 regtests/t_*/ref/*
 
       - name: Image build
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
         run: |
           ./gradlew \
               :polaris-server:assemble \

.github/workflows/spark_client_regtests.yml

@@ -40,11 +40,6 @@ jobs:
           java-version: '21'
           distribution: 'temurin'
 
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4
-        with:
-          validate-wrappers: false
-
       - name: Prepare Gradle build cache
         uses: ./.github/actions/ci-incr-build-cache-prepare
 
@@ -55,9 +50,12 @@ jobs:
         env:
           # publishToMavenLocal causes a GH API requests, use the token for those requests
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
         run: ./gradlew assemble publishToMavenLocal
 
       - name: Image build
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
         run: |
           ./gradlew \
               :polaris-server:assemble \

CHANGELOG.md

@@ -41,9 +41,9 @@ request adding CHANGELOG notes for breaking (!) changes and possibly other secti
 
 - **MinIO**: Added MinIO integration support with comprehensive getting started documentation.
 
-### Upgrade notes
+### Upgrade Notes
 
-### Breaking changes
+### Breaking Changes
 
 - Helm chart: the default value of the `authentication.tokenBroker.secret.symmetricKey.secretKey` property has changed
   from `symmetric.pem` to `symmetric.key`.
@@ -105,9 +105,45 @@ refresh-credentials flag for the desired storage provider.
 
 ### Commits
 
-## [1.0.0-incubating]
+## [1.0.1-incubating]
+Apache Polaris 1.0.1-incubating was released on August 16th, 2025. It’s a maintenance release on the 1.0.0 release fixing a couple of issues on the Helm Chart:
+- remove db-kind in Helm Chart
+- add relational-jdbc to helm
+
 
-- TODO: backfill 1.0.0 release notes
+## [1.0.0-incubating]
+Apache Polaris 1.0.0-incubating was released on July 9th, 2025.
+
+- **Highlights**
+  - First release ready for real-world workloads after the public beta 0.9.0 
+  - **Binary distribution** – first release with single downloadable .tgz or .zip artifact. 
+  - **Helm Chart** – debut of an official Helm chart for seamless Kubernetes deployment 
+- **New features & enhancements**
+  - **Policy Store** — persistence with schema evolution, built‑in TMS policies (Data compaction, Snapshot expiry, etc) and REST CRUD endpoints 
+  - **Postgres JDBC persistence** — native JDBC backend with robust support for concurrent changes. 
+  - **Rollback Compaction on Conflicts** - makes Polaris smarter, to revert the compaction commits in case of crunch to let the writers who are actually adding or removing the data to the table succeed. In a sense treating compaction as always a lower priority process. 
+  - **Enhanced runtime** — new runtime powered by Quarkus delivers out‑of‑the‑box Kubernetes readiness, quick startup, OIDC integration, and many other benefits. Polaris server and admin tool are now using Quarkus as a runtime framework. 
+  - **HTTP caching via ETag** — the loadTable endpoint supports ETag, reducing bandwidth and improving perceived latency 
+  - **Support for external identity providers (IdP)** — Polaris can now be its own IdP, delegate to an external IdP, or both 
+  - **Snapshot filtering** – clients can choose to load only referenced snapshots 
+  - **Catalog Federation (experimental)** – federate requests to an external Iceberg REST or Hadoop Catalog 
+  - **Generic Tables (experimental)** — serve multiple table formats besides Iceberg tables; initial Spark 3.5 plugin supports Delta Lake 
+  - **Event Listener framework (experimental)** — subscribe to catalog events (AfterTableCommitedEvent, BeforeViewCommitedEvent, etc)
+- **Notable bug fixes**
+  - **CLI and Python Client improvements** – Support for new features, CLI repair, changes to the update subcommand, and various fixes 
+  - **Safe configurations** – Catalog-level Polaris configurations follow a strict naming convention to avoid name clashes with user-provided configuration entries. Legacy Polaris configuration names are still supported in 1.0 to allow existing deployments to migrate without rush. 
+  - **TableOperations optimizations** – Changes to BasePolarisTableOperations result in less traffic to object storage during commits 
+  - **Bounded entity cache** – The entity cache is now more memory-aware and less likely to lead to OOMs 
+  - **Bootstrapping fixes** – Users can more easily bootstrap a new realm. Root credentials can be provided by the user or generated by Polaris (and returned to the user). 
+- **Breaking changes**
+  - **Server Configuration** – The format used to configure the Polaris service in 0.9 has changed with the migration to Quarkus and changes to configurations 
+  - **Bootstrap Flow** – The bootstrap flow used in 0.9 has changed with the migration to Quarkus and the new admin tool
+
+
+## [0.9.0-incubating]
+Apache Polaris 0.9.0 was released on March 11, 2025 as the first Polaris release. Only the source distribution is available for this release.
 
 [Unreleased]: https://github.com/apache/polaris/commits
+[1.0.1-incubating]: https://github.com/apache/polaris/releases/tag/apache-polaris-1.0.1-incubating
 [1.0.0-incubating]: https://github.com/apache/polaris/releases/tag/apache-polaris-1.0.0-incubating-rc2
+[0.9.0-incubating]: https://github.com/apache/polaris/releases/tag/apache-polaris-0.9.0-incubating

Makefile

@@ -162,10 +162,16 @@ client-integration-test: client-setup-env ## Run client integration tests
 	@echo "Tearing down Docker Compose services..."
 	@$(DOCKER) compose -f $(PYTHON_CLIENT_DIR)/docker-compose.yml down || true # Ensure teardown even if tests fail
 
+.PHONY: client-license-check
+client-license-check: client-setup-env ## Run license compliance check
+	@echo "--- Starting license compliance check ---"
+	@$(ACTIVATE_AND_CD) && pip-licenses
+	@echo "--- License compliance check complete ---"
+
 .PHONY: client-build
 client-build: client-setup-env ## Build client distribution
 	@echo "--- Building client distribution ---"
-	@$(ACTIVATE_AND_CD) && poetry build -f wheel
+	@$(ACTIVATE_AND_CD) && poetry build
 	@echo "--- Client distribution build complete ---"
 
 .PHONY: client-cleanup

README.md

@@ -22,7 +22,7 @@
 Apache Polaris™ is an open-source, fully-featured catalog for Apache Iceberg™. It implements Iceberg's 
 [REST API](https://github.com/apache/iceberg/blob/main/open-api/rest-catalog-open-api.yaml),
 enabling seamless multi-engine interoperability across a wide range of platforms, including Apache Doris™, Apache Flink®,
-Apache Spark™, StarRocks, and Trino. 
+Apache Spark™, Dremio® OSS, StarRocks, and Trino. 
 
 Documentation is available at https://polaris.apache.org. The REST OpenAPI specifications are available here:
 [Polaris management API doc](https://editor-next.swagger.io/?url=https://raw.githubusercontent.com/apache/polaris/refs/heads/main/spec/polaris-management-service.yml)
@@ -42,11 +42,11 @@ Click [here](https://polaris.apache.org/in-dev/unreleased/) for a quick overview
 ## Quickstart
 Click [here](https://polaris.apache.org/in-dev/unreleased/getting-started/install-dependencies/) for the quickstart experience, which will help you set up a Polaris instance locally or on any supported cloud provider.
 
-## Building and Running 
+## Project Structure
 
 Apache Polaris is organized into the following modules:
 
-- `polaris-core` - The main Polaris entity definitions and core business logic
+- [`polaris-core`](./polaris-core/README.md) - The main Polaris entity definitions and core business logic
 - API modules (implementing the Iceberg REST API and Polaris management API):
   - `polaris-api-management-model` - The Polaris management model
   - `polaris-api-management-service` - The Polaris management service
@@ -59,13 +59,15 @@ Apache Polaris is organized into the following modules:
 - Persistence modules:
   - `polaris-eclipselink` - The Eclipselink implementation of the MetaStoreManager interface
   - `polaris-relational-jdbc` - The JDBC implementation of BasePersistence to be used via AtomicMetaStoreManager
- 
+
+## Building and Running
+
 Apache Polaris is built using Gradle with Java 21+ and Docker 27+.
 
 - `./gradlew build` - To build and run tests. Make sure Docker is running, as the integration tests depend on it.
 - `./gradlew assemble` - To skip tests.
 - `./gradlew check` - To run all checks, including unit tests and integration tests.
-- `./gradlew run` - To run the Polaris server locally; the server is reachable at localhost:8181. This is also suitable for running regression tests, or for connecting with Spark. Set your own credentials by specifying system property `./gradlew run -Dpolaris.bootstrap.credentials=POLARIS,root,s3cr3t` where:
+- `./gradlew run` - To run the Polaris server locally; the server is reachable at localhost:8181. This is also suitable for running regression tests, or for connecting with Spark. Set your own credentials by specifying system property `./gradlew run -Dpolaris.bootstrap.credentials=POLARIS,root,secret` where:
   - `POLARIS` is the realm
   - `root` is the CLIENT_ID
   - `secret` is the CLIENT_SECRET
@@ -136,6 +138,19 @@ Default configuration values can be found in `runtime/defaults/src/main/resource
   ```
 - See [README in `site/`](site/README.md) for more information.
 
+#### Publishing Build Scans to develocity.apache.org
+
+All authenticated builds of Apache Polaris will automatically publish build scans to the ASF Develocity instance at 
+[develocity.apache.org](https://develocity.apache.org/scans?search.rootProjectNames=polaris). 
+
+CI builds originating from the `apache/polaris` repository will have access to the Apache organization-level secret 
+`DEVELOCITY_ACCESS_KEY` and publish build scans using the secret. CI builds originating from pull requests from forks 
+will not have access to the secret and will silently skip build scan publication.
+
+Apache committers can publish build scans from their local machine by 
+[provisioning an access key](https://docs.gradle.com/develocity/gradle-plugin/current/#automated_access_key_provisioning) 
+using ASF LDAP credentials. Builds by anonymous, unauthenticated contributors will silently skip build scan publication.
+
 ## License
 
 Apache Polaris is under the Apache License Version 2.0. See the [LICENSE](LICENSE).