feat: obs-sdk 实现 #2061（spec 契约 + Go/Python/Java/Node SDK + UT）

[TangJia025]

resolve https://github.com/opensourceways/backlog/issues/2061

背景

opensourceways/backlog#1938 微服务可观测建设 · 子任务 A opensourceways/backlog#2061：obs-sdk 单仓建设。

按 #2061 验收：spec 契约层 + Go / Python / Java / Node 4 语言 SDK package + UT（试点服务接入与 robot-framework-lib 切换属下游各仓改动，不在此 PR）。

交付内容

目录	内容
spec/	契约单一事实来源：log JSON schema（log-format）、通用字段 service/env/instance/community/request_id/trace_id（common-fields，统一 OBS_* 环境变量）、指标命名/label（metrics-format）、community 取值（community-values）
go/	log（encoding/json 单行 JSON → stdout）、metrics（client_golang 薄封装）、sdkctx（context 请求字段）、middleware(net/http) + ginmw；go vet + go test 通过
python/	log（root JSON handler）、metrics（prometheus-client）、_context、FastAPI/Flask/Django 适配；14 pytest 通过
node/	log（JSON stream）、metrics（prom-client）、context（AsyncLocalStorage）、middleware；9 node --test 通过
java/	RequestContext（ThreadLocal）、ObsLogging（logback MDC + logstash JSON）、ObsMetrics（Micrometer + Prometheus registry）、ObsFilter（Servlet，可选）；JUnit 已写，本机无 JDK/Maven 未跑 mvn test，由 CI 编译验证
.github/workflows/ci.yml	Go / Python / Node / Java 四语言 CI job

关键设计对齐点

• community 双层注入：service/env/instance 部署级 const；community 普通可变 label/字段 —— 请求级在服务可信判定点（路由前缀/认证主体/白名单）解析后写请求上下文，未覆盖回退部署默认（OBS_COMMUNITY）。（Go context / Python contextvars / Node AsyncLocalStorage / Java ThreadLocal）
• trace_id 预留：字段可写可透传，首期不落 span，二期经上下文平滑接入。
• 服务端指标：Go/Python/Node 由 SDK 中间件记 obs_http_server_*；Java 走 Actuator + Micrometer 官方 server instrumentation，不重复埋点（starter 对齐）。
• 各语言自管版本与 Git tag 前缀（go-v1.0.0 等）。

测试结果（本机）

• cd go && go vet ./... && go test ./... → 全过
• cd python && ./.venv/bin/python -m pytest -q → 14 passed
• cd node && npm test → 9 passed
• Java：本地无 JDK/Maven（无 passwordless sudo），PR 已带 CI java job 在 Actions 上跑 mvn test；若 CI 暴露问题以其输出为准修复。

---

🤖 Generated with Claude Code

AI 使用声明

当前 PR 是否有 AI 参与：

• 否
• 是
  1. AI Agent 平台：Claude Code
  2. AI 模型：deepseek-v4-flash
  3. Prompt 上下文：obs-sdk #2061 实现（spec + 四语言 SDK + UT + CI）

[opensourceways-bot]

Welcome To opensourceways Community

Hey @TangJia025 , thanks for your contribution to the community.

Bot Usage Manual

I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands.

[opensourceways-bot]

CLA Signature Pass

TangJia025, thanks for your pull request. All authors of the commits have signed the CLA. 👍

[opensourceways-bot]

Linking Issue Notice

@TangJia025 , the pull request must be linked to at least one issue.
If an issue has already been linked, but the needs-issue label remains, you can remove the label by commenting /check-issue .

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	maven/​ch.qos.logback/​logback-classic@​1.5.12
	maven/​net.logstash.logback/​logstash-logback-encoder@​7.4
	maven/​org.slf4j/​slf4j-api@​2.0.13
	npm/​prom-client@​15.1.3
	maven/​jakarta.servlet/​jakarta.servlet-api@​6.0.0
	maven/​org.junit.jupiter/​junit-jupiter@​5.10.2
	pypi/​setuptools@​84.0.0
	golang/​github.com/​gin-gonic/​gin@​v1.10.0
	golang/​github.com/​prometheus/​client_golang@​v1.20.5
	pypi/​django@​6.1.1
	maven/​io.micrometer/​micrometer-core@​1.13.6
	pypi/​pytest@​9.1.1
	maven/​io.micrometer/​micrometer-registry-prometheus@​1.13.6
	golang/​github.com/​stretchr/​testify@​v1.9.0
	pypi/​flask@​3.1.3
	pypi/​prometheus-client@​0.26.0
	pypi/​wheel@​0.48.0
	pypi/​fastapi@​0.141.1
	pypi/​httpx2@​2.12.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Critical CVE: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang golang.org/x/crypto CVE: GHSA-v778-237x-gjrc Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (CRITICAL) Affected versions: < 0.31.0 Patched version: 0.31.0 From: go/go.mod → golang/github.com/gin-gonic/gin@v1.10.0 → golang/github.com/prometheus/client_golang@v1.20.5 → golang/golang.org/x/crypto@v0.24.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.24.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: golang golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses CVE: GHSA-vgwf-h737-ff37 golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: go/go.mod → golang/github.com/gin-gonic/gin@v1.10.0 → golang/github.com/prometheus/client_golang@v1.20.5 → golang/golang.org/x/crypto@v0.24.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.24.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: golang golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement CVE: GHSA-x527-x647-q7gg golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: go/go.mod → golang/github.com/gin-gonic/gin@v1.10.0 → golang/github.com/prometheus/client_golang@v1.20.5 → golang/golang.org/x/crypto@v0.24.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.24.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: golang golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed CVE: GHSA-89gr-r52h-f8rx golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: go/go.mod → golang/github.com/gin-gonic/gin@v1.10.0 → golang/github.com/prometheus/client_golang@v1.20.5 → golang/golang.org/x/crypto@v0.24.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.24.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: golang golang.org/x/crypto vulnerable to infinite loop on large channel writes CVE: GHSA-rm3j-f69w-wqmq golang.org/x/crypto vulnerable to infinite loop on large channel writes (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: go/go.mod → golang/github.com/gin-gonic/gin@v1.10.0 → golang/github.com/prometheus/client_golang@v1.20.5 → golang/golang.org/x/crypto@v0.24.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.24.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: golang golang.org/x/crypto vulnerable to auth bypass via unenforced @Revoked status CVE: GHSA-5cgq-3rg8-m6cv golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: go/go.mod → golang/github.com/gin-gonic/gin@v1.10.0 → golang/github.com/prometheus/client_golang@v1.20.5 → golang/golang.org/x/crypto@v0.24.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.24.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: golang golang.org/x/crypto doesn't enforce invoking key constraints CVE: GHSA-jppx-rxg9-jmrx golang.org/x/crypto doesn't enforce invoking key constraints (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: go/go.mod → golang/github.com/gin-gonic/gin@v1.10.0 → golang/github.com/prometheus/client_golang@v1.20.5 → golang/golang.org/x/crypto@v0.24.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.24.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: golang golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys CVE: GHSA-f5wc-c3c7-36mc golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys (CRITICAL) Affected versions: < 0.52.0 Patched version: 0.52.0 From: go/go.mod → golang/github.com/gin-gonic/gin@v1.10.0 → golang/github.com/prometheus/client_golang@v1.20.5 → golang/golang.org/x/crypto@v0.24.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/crypto@v0.24.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: golang github.com/modern-go/reflect2 is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: go/go.mod → golang/github.com/gin-gonic/gin@v1.10.0 → golang/github.com/prometheus/client_golang@v1.20.5 → golang/github.com/modern-go/reflect2@v1.0.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/modern-go/reflect2@v1.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven ch.qos.logback:logback-classic is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: java/pom.xml → maven/ch.qos.logback/logback-classic@1.5.12 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/ch.qos.logback/logback-classic@1.5.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven ch.qos.logback:logback-core is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: java/pom.xml → maven/ch.qos.logback/logback-classic@1.5.12 → maven/ch.qos.logback/logback-core@1.5.12 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/ch.qos.logback/logback-core@1.5.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven ch.qos.logback:logback-core is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: java/pom.xml → maven/ch.qos.logback/logback-classic@1.5.12 → maven/ch.qos.logback/logback-core@1.5.12 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/ch.qos.logback/logback-core@1.5.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven com.fasterxml.jackson.core:jackson-core is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: java/pom.xml → maven/net.logstash.logback/logstash-logback-encoder@7.4 → maven/com.fasterxml.jackson.core/jackson-core@2.15.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/com.fasterxml.jackson.core/jackson-core@2.15.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven com.fasterxml.jackson.core:jackson-databind is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: java/pom.xml → maven/net.logstash.logback/logstash-logback-encoder@7.4 → maven/com.fasterxml.jackson.core/jackson-databind@2.15.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/com.fasterxml.jackson.core/jackson-databind@2.15.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven com.fasterxml.jackson.core:jackson-databind is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: java/pom.xml → maven/net.logstash.logback/logstash-logback-encoder@7.4 → maven/com.fasterxml.jackson.core/jackson-databind@2.15.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/com.fasterxml.jackson.core/jackson-databind@2.15.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven org.junit.jupiter:junit-jupiter-engine is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: java/pom.xml → maven/org.junit.jupiter/junit-jupiter@5.10.2 → maven/org.junit.jupiter/junit-jupiter-engine@5.10.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.junit.jupiter/junit-jupiter-engine@5.10.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: maven org.junit.platform:junit-platform-engine is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: java/pom.xml → maven/org.junit.jupiter/junit-jupiter@5.10.2 → maven/org.junit.platform/junit-platform-engine@1.10.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.junit.platform/junit-platform-engine@1.10.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[opensourceways-bot]

CLA Signature Pass

TangJia025, thanks for your pull request. All authors of the commits have signed the CLA. 👍