fix(cdc): remove MySQL scaffold from production discovery

[seonghobae]

Purpose

Advance issue #153 one connector at a time by removing the nonfunctional MySQL Debezium scaffold from automatic Spring production discovery until a real maintained MySQL CDC implementation exists.

Exact current identity

• protected/live base: develop@622e5e6c3d534f230c390f10e3832efadfc01825;
• branch: fix/remove-mysql-cdc-scaffold-discovery;
• fail-first head: 2c886bdccee80513136098004fd76f6c8930a364;
• exact current source head: 3b501f823fa0d3d93a5a95c714efdd79242a8a58;
• current synthetic merge: 6f0669cc1c3b36f14296ab839154991c298a7eec;
• Draft: true;
• GitHub mergeability: true at the latest refetch.

Every check, review, approval, or synthetic merge from an older head is stale and does not transfer.

RCA / product boundary

Protected MysqlDebeziumCdcSource was a Spring @Component while extending AbstractScaffoldCdcSource, whose runtime start path refuses operation. Spring component discovery therefore advertised a source that could not start. Production support would additionally require a maintained Debezium MySQL connector dependency, validated binlog prerequisites, lifecycle, offsets/schema-history persistence, retries/recovery, credential boundaries, operational documentation, and realistic integration evidence.

The smallest safe remediation is not to invent those missing properties. This PR keeps the reference scaffold instantiable for explicit design/tests but removes it from Spring production discovery. Current CdcSourceFactory continues to register only the live PostgreSQL source; there is no separate production MySQL config/alias surface to retire in this slice.

TDD record

RED contract

Commit 2c886bdccee80513136098004fd76f6c8930a364 changes CdcSourceRegistryTest first. mysqlScaffoldIsNotAutoDiscoveredAsAProductionSource requires MysqlDebeziumCdcSource to have no Spring @Component annotation while the protected production class still carried that annotation. The explicit-construction test remains to preserve the reference scaffold as deliberate non-production material.

The PR-triggered workflows on this transient RED head were cancelled after the branch advanced, so they are not claimed as hosted RED acceptance evidence.

Production repair

• 9f64725bf20379d583a53149f2724a9513973994 removes @Component from MysqlDebeziumCdcSource and documents why production discovery must remain disabled;
• exact current head 3b501f823fa0d3d93a5a95c714efdd79242a8a58 aligns docs/cdc/any-to-any-cdc.md: MySQL is not registered, configured use resolves as an unknown source type, and the class is a reference scaffold only.

SQL Server remains a separate scaffold and is intentionally outside this slice. No MySQL connector JAR, credential, endpoint, or false support claim is introduced.

Exact-head workflow state and Security RCA

For exact source head 3b501f823fa0d3d93a5a95c714efdd79242a8a58:

• CI 31312834400: success;
• Dependency Review 31312834406: success;
• CycloneDX SBOM 31312834436: success;
• SAST Semgrep 31312834437: success;
• Security Scan 31312834418: failure;
• CodeRabbit exact-source commit status: success;
• unresolved review threads: zero;
• qualifying independent non-author formal APPROVED review: absent.

The Security Scan failure is not caused by the MySQL diff. Trivy job 93243221587 successfully scanned synthetic merge 6f0669cc1c3b36f14296ab839154991c298a7eec and its hard findings gate reported three inherited MEDIUM jackson-databind findings from the shared protected dependency baseline: CVE-2026-54515, CVE-2026-59889, and GHSA-mhm7-754m-9p8w.

Repeating this unchanged scan against the same base cannot change that root cause. Shared direct-develop Draft PR #160 is the bounded remediation: it imports the fixed Jackson 2.21.5 LTS BOM before Spring Boot dependency management, with fail-first dependency-baseline tests and security doctoring. #158 must remain fail-closed until that shared dependency change integrates and this unchanged MySQL head is re-evaluated against the new protected base. No #160 checks/reviews/approvals transfer to #158.

The currently protected PR workflows also predate #121's literal-source hard scanner controls. Even after the inherited CVEs are removed, a synthetic-merge Trivy result remains merge-preview evidence rather than accepted literal-source scanner proof under mightyETL governance.

Scope / merge boundary

Keep this PR Draft. Do not suppress the inherited Jackson advisories, patch them locally on this feature branch, or blindly rerun the unchanged failing Security Scan. Do not combine SQL Server, Qlik, Databricks, Snowflake, or a real MySQL implementation into this PR. Merge only after the shared security baseline is fixed, the unchanged source is revalidated against the resulting live base, every required accepted quality/security/dependency/SBOM/review gate passes, zero valid unresolved findings remain, qualifying independent non-author approval exists where required, and branch protection permits expected-head merge without bypass.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2d352361-e875-416a-953f-efd4ffadf355

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}