Baf 1717/cmake migration

[martinburian-ba]

Summary

Migrates transparent-module (v1.0.5) off cmlib onto plain CMake +
FetchContent, following the same pattern established in external-server-cpp
(BAF-1706).

• Replaces FIND_PACKAGE(CMLIB ...) / CMDEF_ADD_LIBRARY / CMDEF_INSTALL
  usage with a cmake/FindCMLIB.cmake compatibility shim, so the rest of
  CMakeLists.txt is unchanged.
• Adds FindBA*.cmake modules that resolve each dependency via a system/
  config package first, falling back to FetchContent (nlohmann_json,
  fleet-protocol-interface, fleet-protocol-cxx-helpers-static,
  async-function-execution-shared, aeron, fleet-http-client-shared, Boost,
  ZLIB, cpprestsdk).

Fixes on top of the original migration commit

Found while verifying the migration builds:

1. Configure failed immediately — the migration dropped
   FIND_PACKAGE(CMLIB COMPONENTS CMDEF CMUTIL STORAGE REQUIRED) from
   CMakeLists.txt, so cmake/FindCMLIB.cmake (which defines
   CMDEF_ADD_LIBRARY/CMDEF_INSTALL) was never loaded. Restored the call.
2. Wrong package version — the CMDEF_PACKAGE shim was a no-op and
   silently dropped its VERSION argument, so cpack always produced
   0.1.1 instead of the real module version. Shim now sets
   CPACK_PACKAGE_VERSION from the passed version.

Verification

• Native x86_64 build (module-gateway variant,
  -DFLEET_PROTOCOL_BUILD_EXTERNAL_SERVER=OFF): configure, build, and
  cpack all pass — transparent_module-1.0.5-Linux.zip.
• Native x86_64 package build (both variants,
  -DBRINGAUTO_PACKAGE=ON, matching what the real deploy pipeline runs):
  passes.
• Ran the real fleet-os-deploy pipeline end to end against a temp tag on
  this branch (temp/baf-1717-deploy-verify) — steps 1-7 and the aarch64
  dependency-sysroot assembly all pass. The run is currently blocked only
  by the fleet-os-3 cross-compile Docker image not being available in any
  reachable registry — an infra gap unrelated to this change (it fails
  before even reaching this module, on module-gateway).

Note: this module was previously missing from fleet-os-deploy's
deployment.json entirely — added an entry for it (module-num 3) as part of
today's verification so it could be exercised through the pipeline at all.

Closes BAF-1717.

[coderabbitai]

Warning

Review limit reached

@martinburian-ba, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 58 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 1696715c-c9b9-4301-a51e-407736711233

📥 Commits

Reviewing files that changed from the base of the PR and between 9f224e3 and 17c490a.

📒 Files selected for processing (18)

• CMLibStorage.cmake
• CMakeLists.txt
• cmake/Dependencies.cmake
• cmake/FindBAAeron.cmake
• cmake/FindBAAsyncFunctionExecution.cmake
• cmake/FindBABoost.cmake
• cmake/FindBACppRestSdk.cmake
• cmake/FindBAFleetHttpClient.cmake
• cmake/FindBAFleetProtocolCpp.cmake
• cmake/FindBAFleetProtocolInterface.cmake
• cmake/FindBANlohmannJson.cmake
• cmake/FindBAProtobuf.cmake
• cmake/FindBAZlib.cmake
• cmake/FindCMLIB.cmake
• cmake/Findasync-function-execution-shared.cmake
• cmake/Findfleet-http-client-shared.cmake
• cmake/Findfleet-protocol-cxx-helpers-static.cmake
• cmake/Findfleet-protocol-interface.cmake

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch BAF-1717/cmake-migration

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jiriskuta]

Review — CMake migration (cmlib → plain CMake + FetchContent)

Version-pin audit: all 10 dependency pins are preserved on the FetchContent branch, and the removed BRINGAUTO_* options cause no demonstrable build break. Nice clean migration. Three non-blocking findings:

1. MEDIUM — version floor is dropped on the system/config fast-path

The system/config fast-paths in the FindBA* shims call find_package(... QUIET CONFIG) without a version constraint, and cmake/Findfleet-protocol-interface.cmake sets _FOUND TRUE but never sets _VERSION. As a result FIND_PACKAGE(fleet-protocol-interface 2.1.0 REQUIRED) performs no version check when a system/config package is present — a stale/mismatched package is silently accepted. Same weakening in FindBAAeron, FindBAAsyncFunctionExecution, FindBAFleetProtocolCpp, FindBACppRestSdk, FindBAFleetHttpClient (FindBANlohmannJson correctly keeps its floor).
Fix: pass the pinned version into the config-mode find_package calls and have the forwarding shims propagate <pkg>_VERSION so the top-level FIND_PACKAGE(... <ver> REQUIRED) actually validates.

2. MEDIUM — unrestored BUILD_SHARED_LIBS ... CACHE ... FORCE global mutation

FindBAAsyncFunctionExecution.cmake and FindBACppRestSdk.cmake do set(BUILD_SHARED_LIBS OFF CACHE BOOL "" FORCE) and never restore it, so it leaks into every dependency fetched afterward. Inconsistent with FindBABoost.cmake, which uses a plain non-cache set(BUILD_SHARED_LIBS OFF).
Fix: prefer the non-cache form, or save/restore the previous value around FetchContent_MakeAvailable. Avoid FORCE on a global toggle.

3. LOW — CMDEF_COMPILE_DEFINITIONS shim ignores its scope argument

The shim (cmake/FindCMLIB.cmake) accepts a scope arg (ALL/PUBLIC/PRIVATE) but discards it and calls directory-global add_compile_definitions(), leaking definitions project-wide rather than to the intended target.
Fix: forward to target_compile_definitions(<target> <scope> ...), or document that the shim is intentionally directory-wide.

---

🤖 Review generated with Claude Code