From 09b1bfe17b6808d5cdc79791e5141768bb813708 Mon Sep 17 00:00:00 2001 From: Romain Bioteau Date: Mon, 2 Dec 2024 20:30:53 +0100 Subject: [PATCH] fix(install): force system properties in build request --- .github/workflows/codeql-analysis.yml | 46 ++++++++++------ .github/workflows/workflow-PR.yml | 53 +++++++++++++------ .github/workflows/workflow-build.yml | 50 +++++++++++------ .../install/InstallProjectStoreMojo.java | 4 +- 4 files changed, 105 insertions(+), 48 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index d1d4e183..89a8984e 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -14,29 +14,40 @@ name: "CodeQL" on: push: - branches: [ master ] + branches: [ develop, support/* ] pull_request: # The branches below must be a subset of the branches above - branches: [ master ] + branches: [ develop, support/* ] schedule: - cron: '15 8 * * 4' jobs: analyze: name: Analyze - runs-on: ubuntu-latest + # Runner size impacts CodeQL analysis time. To learn more, please see: + # - https://gh.io/recommended-hardware-resources-for-running-codeql + # - https://gh.io/supported-runners-and-hardware-resources + # - https://gh.io/using-larger-runners + # Consider using larger runners for possible analysis time improvements. + runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} + timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }} + permissions: + actions: read + contents: read + security-events: write strategy: fail-fast: false matrix: language: [ 'java' ] - # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ] - # Learn more: - # https://docs.github.com/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed + # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'swift' ] + # Use only 'java' to analyze code written in Java, Kotlin or both + # Use only 'javascript' to analyze code written in JavaScript, TypeScript or both + # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v4 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL @@ -46,7 +57,9 @@ jobs: # If you wish to specify custom queries, you can do so here or in a config file. # By default, queries listed here will override any specified in a config file. # Prefix the list here with "+" to use these queries and those in the config file. - # queries: ./path/to/local/query, your-org/your-repo/queries@main + + # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs + # queries: security-extended,security-and-quality - name: Setup Java uses: actions/setup-java@v3 @@ -54,21 +67,22 @@ jobs: distribution: 'adopt' java-version: 11 - # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). + # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild uses: github/codeql-action/autobuild@v2 # ℹī¸ Command-line programs to run using the OS shell. - # 📚 https://git.io/JvXDl + # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun - # ✏ī¸ If the Autobuild fails above, remove it and uncomment the following three lines - # and modify them (or add more) to build your code if your project - # uses a compiled language + # If the Autobuild fails above, remove it and uncomment the following three lines. + # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. - #- run: | - # make bootstrap - # make release + # - run: | + # echo "Run, Build Application using script" + # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@v2 + with: + category: "/language:${{matrix.language}}" diff --git a/.github/workflows/workflow-PR.yml b/.github/workflows/workflow-PR.yml index 47065c97..2675d50b 100644 --- a/.github/workflows/workflow-PR.yml +++ b/.github/workflows/workflow-PR.yml @@ -2,36 +2,59 @@ name: workflow-pr on: pull_request: - branches: [ master, support/*] + branches: ["master", "support/*", "develop"] + paths-ignore: + - "**/README.md" + - "CONTRIBUTING.md" + - ".github/**" + - "!.github/workflows/workflow-PR.yml" -jobs: +permissions: + checks: write +jobs: build: - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 + - name: Cache SonarCloud packages - uses: actions/cache@v3 + uses: actions/cache@v4 with: path: ~/.sonar/cache key: ${{ runner.os }}-sonar restore-keys: ${{ runner.os }}-sonar + - name: Setup Java - uses: actions/setup-java@v3 + uses: actions/setup-java@v4 with: - distribution: 'temurin' - java-version: 11 - cache: 'maven' + distribution: "temurin" + java-version: 17 + cache: "maven" + + - uses: Keeper-Security/ksm-action@v1 + env: + KSM_CONFIG: ${{ secrets.KSM_CONFIG }} + if: ${{ env.KSM_CONFIG != '' }} + with: + keeper-secret-config: ${{ secrets.KSM_CONFIG }} + secrets: | + ${{ vars.KEEPER_SONARCLOUD_RECORD_ID }}/field/password > env:SONAR_TOKEN + - name: Build with Sonarcloud env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any - SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any if: ${{ env.SONAR_TOKEN != '' }} - run: ./mvnw -B -ntp clean verify sonar:sonar -Dsonar.login=${{ secrets.SONAR_TOKEN }} + run: ./mvnw -B -ntp clean verify sonar:sonar + - name: Build env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any - SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any if: ${{ env.SONAR_TOKEN == '' }} run: ./mvnw -B -ntp clean verify - + + - name: Publish Test Report + uses: mikepenz/action-junit-report@v4 + if: always() # always run even if the previous step fails + with: + report_paths: "**/target/*-reports/TEST-*.xml" diff --git a/.github/workflows/workflow-build.yml b/.github/workflows/workflow-build.yml index 60696cb1..02c750c9 100644 --- a/.github/workflows/workflow-build.yml +++ b/.github/workflows/workflow-build.yml @@ -2,31 +2,49 @@ name: workflow-build on: push: - branches: [ master, support/* ] + branches: + - develop + - release/* + - support/* + paths-ignore: + - "**/README.md" + - "CONTRIBUTING.md" + - ".github/**" + - "!.github/workflows/workflow-build.yml" -jobs: + # Allows you to run this workflow manually from the Actions tab + workflow_dispatch: +jobs: build: - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 + + - uses: Keeper-Security/ksm-action@v1 + with: + keeper-secret-config: ${{ secrets.KSM_CONFIG }} + secrets: | + ${{ vars.KEEPER_SONARCLOUD_RECORD_ID }}/field/password > env:SONAR_TOKEN + ${{ vars.KEEPER_OSSRH_RECORD_ID }}/field/login > env:MAVEN_USERNAME + ${{ vars.KEEPER_OSSRH_RECORD_ID }}/field/password > env:MAVEN_PASSWORD + ${{ vars.KEEPER_GPG_ARTIFACT_SIGNING_RECORD_ID }}/field/login > env:GPG_KEYNAME + ${{ vars.KEEPER_GPG_ARTIFACT_SIGNING_RECORD_ID }}/custom_field/gpg-private-key > env:GPG_PRIVATE_KEY + ${{ vars.KEEPER_GPG_ARTIFACT_SIGNING_RECORD_ID }}/field/password > env:MAVEN_GPG_PASSPHRASE + - name: Setup Java - uses: actions/setup-java@v3 + uses: actions/setup-java@v4 with: - distribution: 'temurin' - java-version: 11 - cache: 'maven' + distribution: "temurin" + java-version: 17 + cache: "maven" server-id: ossrh # Value of the distributionManagement/repository/id field of the pom.xml server-username: MAVEN_USERNAME # env variable for username in deploy - server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy - gpg-private-key: ${{ secrets.gpg_private_key }} # Value of the GPG private key to import + server-password: MAVEN_PASSWORD # env variable for token in deploy + gpg-private-key: ${{ env.GPG_PRIVATE_KEY }} # Value of the GPG private key to import gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase - name: Build and deploy env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any - SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - MAVEN_USERNAME: ${{ secrets.ossrh_username }} - MAVEN_CENTRAL_TOKEN: ${{ secrets.ossrh_password }} - MAVEN_GPG_PASSPHRASE: ${{ secrets.gpg_passphrase }} - run: ./mvnw -B -ntp clean deploy sonar:sonar -Dsonar.login=${{ secrets.SONAR_TOKEN }} + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any + run: ./mvnw -B -ntp clean deploy sonar:sonar diff --git a/plugin/src/main/java/org/bonitasoft/plugin/install/InstallProjectStoreMojo.java b/plugin/src/main/java/org/bonitasoft/plugin/install/InstallProjectStoreMojo.java index 2227a8e6..eda72bef 100644 --- a/plugin/src/main/java/org/bonitasoft/plugin/install/InstallProjectStoreMojo.java +++ b/plugin/src/main/java/org/bonitasoft/plugin/install/InstallProjectStoreMojo.java @@ -82,7 +82,7 @@ public class InstallProjectStoreMojo extends AbstractMojo { private static final String VERSION = "version"; private static final String ARTIFACT_ID = "artifactId"; - static final String DEFAULT_INSTALL_PLUGIN_VERSION = "3.1.1"; + static final String DEFAULT_INSTALL_PLUGIN_VERSION = "3.1.3"; static final String INITIAL_INSTALL_PLUGIN_VERSION = "2.4"; private static final String INSTALL_PLUGIN_GROUP_ID = "org.apache.maven.plugins"; private static final String INSTALL_PLUGIN_ARTIFACT_ID = "maven-install-plugin"; @@ -349,6 +349,7 @@ MavenExecutionRequest newInstallFileExecutionRequest(Artifact artifact, INSTALL_PLUGIN_ARTIFACT_ID, installPluginVersion))); executionRequest.setLocalRepository(localRepository); + executionRequest.setSystemProperties(System.getProperties()); Properties installFileProperties = new Properties(); installFileProperties.setProperty(GROUP_ID, artifact.getGroupId()); installFileProperties.setProperty(ARTIFACT_ID, artifact.getArtifactId()); @@ -383,6 +384,7 @@ private ProjectBuildingRequest newResolveArtifactProjectBuildingRequest() { ProjectBuildingRequest buildingRequest = new DefaultProjectBuildingRequest(session.getProjectBuildingRequest()); buildingRequest.setRemoteRepositories(remoteRepositories); + buildingRequest.setSystemProperties(System.getProperties()); return buildingRequest; }