feat(audit-logging): phase 2 - US.2 - System & Integration Activity Logging (#6383)

[damgouj (damgouj)]

Proposed changes

• Manage audit logging for XTM composer, delete unnecessary logs for integrations

Testing Instructions

1. Delete, update, create, deploy,... connectors from the catalog
2. Check each action has 1 log
3. Check same logs aren't repeated during the tests

Related issues

• feat(audit-logging): Phase 2 - US.2 - System & Integration Activity Logging #6383

Checklist

• I consider the submitted work as finished
• I tested the code for its functionality
• I wrote test cases for the relevant uses case
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality
• For bug fix -> I implemented a test that covers the bug

[github-actions]

📖 Documentation check — ✅ Passed

8 functional file(s), 0 doc file(s) changed.

No documentation gaps detected.

[github-actions]

📖 Documentation check — ✅ Passed

8 functional file(s), 0 doc file(s) changed.

No documentation gaps detected.

[Copilot]

Pull request overview

This PR continues the audit-logging rollout (issue #6383) by reducing audit noise from integration “heartbeat” traffic (XTM Composer callbacks, connector health checks, and repeated registration pings) while keeping meaningful integration lifecycle changes auditable.

Changes:

• Introduces “significant state” capture on several connector-related entities to decide when audit logging should be suppressed for non-meaningful updates.
• Adds audit suppression logic in connector registration/healthcheck code paths to avoid repeated/duplicated audit events.
• Explicitly disables audit logging for selected XTM Composer endpoints that are deemed too noisy (connectivity refresh, connector log ingestion).

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
openaev-model/src/main/java/io/openaev/database/model/Injector.java	Marks injector as audit-state capturable; ignores timestamp/securityPlatform fields for significance checks.
openaev-model/src/main/java/io/openaev/database/model/Executor.java	Marks executor as audit-state capturable; ignores timestamps for significance checks.
openaev-model/src/main/java/io/openaev/database/model/ConnectorInstancePersisted.java	Marks connector instance as audit-state capturable; ignores startedAt and logs for significance checks.
openaev-model/src/main/java/io/openaev/database/model/Collector.java	Marks collector as audit-state capturable; ignores timestamps/securityPlatform for significance checks.
openaev-api/src/main/java/io/openaev/service/InjectorService.java	Captures before/after significant state on external injector upsert; suppresses audit when unchanged.
openaev-api/src/main/java/io/openaev/service/connector_instances/ConnectorInstanceService.java	Captures before/after state on healthcheck patch; suppresses audit when unchanged.
openaev-api/src/main/java/io/openaev/rest/collector/service/CollectorService.java	Captures before/after significant state on collector upsert; suppresses audit when unchanged.
openaev-api/src/main/java/io/openaev/api/xtm_composer/XtmComposerApi.java	Disables audit logging for noisy XTM Composer endpoints.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

⚠️ Container vulnerability scan — 8 findings

Core CI reports these findings in advisory mode. Review the JSON reports before merging.

Image	Critical	High	Total	Status
Standard	0	8	8	⚠️ Findings
UBI9	0	0	0	✅ Clear

View workflow run · Standard JSON report · UBI9 JSON report

_{Updated from CI run attempt 1.}

[Gael Leblan (Dimfacion)]

Silence, at last ;)
Tested ok, looks good to me, I'm just waiting for an answer on one of my comments and we'll be good to go