Switch sandbox deps to analytics-api (JDK 21 surface)

[bowenlan-amzn]

Summary

sql depends on two interfaces from analytics-engine: QueryPlanExecutor and OpenSearchSchemaBuilder. Previously these were vendored as local JARs. This PR:

1. Replaces vendored JARs with analytics-api — a new JDK-21-targeted Maven module that exposes only those two interfaces. Depends on Extract analytics-api module for JDK 21 downstream consumers OpenSearch#21574.
2. Removes analytics-engine from standard test clusters — it was never needed for sql's own integration tests. Standard integTest runs without it.
3. Adds analyticsEngineCompatIT — a dedicated smoke test that boots sql alongside analytics-engine + arrow-flight-rpc to verify the three plugins load together without classloader errors.

Root cause of the original JDK mismatch

analytics-framework and analytics-engine target JDK 25 (they use java.lang.foreign). sql targets JDK 21. Consuming their JARs directly caused class file has wrong version 69.0, should be 65.0 on the JDK-21 CI matrix. The fix is analytics-api: a thin module containing only the interfaces sql needs, compiled at JDK 21.

Why analytics-api is implementation (not compileOnly) in plugin

OpenSearch scans plugin classes at startup by calling getMethods(). sql's handler classes reference QueryPlanExecutor in their method signatures. Without analytics-api bundled in the plugin zip, OpenSearch throws NoClassDefFoundError: QueryPlanExecutor at startup even when no analytics-engine code path runs. When analytics-engine IS installed, its classloader provides the class via extendedPlugins parent-first delegation — the bundled copy is unused but harmless.

Verification

Tested locally with analytics-api published to mavenLocal from the OpenSearch PR branch:

• ./gradlew :core:compileJava — BUILD SUCCESSFUL
• ./gradlew :opensearch-sql-plugin:bundlePlugin — BUILD SUCCESSFUL
• ./gradlew :integ-test:analyticsEngineCompatIT — BUILD SUCCESSFUL (cluster boots, all three plugins load)
• CI will turn green once OpenSearch#21574 merges and analytics-api-3.7.0-SNAPSHOT is published to the snapshot Maven repo.

Depends on

• Extract analytics-api module for JDK 21 downstream consumers OpenSearch#21574 — Extract analytics-api module targeting JDK 21
• Resolve analytics-engine/framework from remote, drop vendored libs/ #5425 — Switch analytics-engine/framework resolution from vendored libs to remote Maven

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit de41ce1.

Path	Line	Severity	Description
core/build.gradle	67	high	Dependency change: local JAR files replaced by external Maven artifact 'org.opensearch.sandbox:analytics-api:3.7.0-SNAPSHOT'. The 'sandbox' namespace is less controlled than the primary 'org.opensearch' namespace and artifact authenticity cannot be verified without reviewing the registry configuration. Mandatory flag for supply chain review.
plugin/build.gradle	163	high	Dependency change: local JARs replaced by external Maven artifact 'org.opensearch.sandbox:analytics-api:${opensearch_version}'. Uses a dynamic version variable rather than a pinned version string, making the resolved artifact non-deterministic. Mandatory flag for supply chain review.
integ-test/build.gradle	279	high	New Download tasks fetch binary plugin ZIPs from an external CI URL containing '/latest/' in the path (https://ci.opensearch.org/ci/dbc/feature-build-opensearch/feature-datafusion/latest/...). No checksum or integrity verification is performed. The 'latest' segment means content changes silently over time, allowing a compromised upstream build to inject malicious binaries into test clusters.
.github/workflows/analytics-engine-compat.yml	17	high	External reusable workflow referenced at @main (not a pinned SHA): 'opensearch-project/opensearch-build/.github/workflows/get-ci-image-tag.yml@main'. Outputs from this workflow (ci-image-version-linux, ci-image-start-options, ci-image-start-command) are injected directly into the container image selector and a run: step (line 31), meaning a compromise of that external repo's main branch could execute arbitrary commands in CI.

The table above displays the top 10 most important findings.

Total: 4 | Critical: 0 | High: 4 | Medium: 0 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.