diff --git a/README.md b/README.md index 55924e88..ba15a4ae 100644 --- a/README.md +++ b/README.md @@ -182,17 +182,20 @@ By default, Maven caches `~/.m2/repository`. You can customize this behavior: #### Required Vault Permissions - `public-reader` or `private-reader`: Artifactory role for reading dependencies. +- `development/kv/data/develocity`: Develocity access token (only when `use-develocity: true`). #### Other Dependencies The Maven tool must be pre-installed. Use of `mise` is recommended. +Dependencies are resolved from the self-hosted Artifactory instance at `https://repox-internal.dev.sonar.build/artifactory` (not configurable). + ### Usage ```yaml permissions: id-token: write - contents: write + contents: read steps: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - uses: SonarSource/ci-github-actions/config-maven@v1 @@ -216,7 +219,6 @@ steps: | `working-directory` | Relative path under github.workspace to execute the build in | `.` | | `artifactory-reader-role` | Suffix for the Artifactory reader role in Vault | `private-reader` for private repos, `public-reader` for public repos | | `common-mvn-flags` | Maven flags for all subsequent mvn calls | `--batch-mode --no-transfer-progress --errors --fail-at-end --show-version -Dmaven.test.redirectTestOutputToFile=false` | -| `repox-url` | URL for Repox | `https://repox.jfrog.io` | | `use-develocity` | Whether to use Develocity for build tracking | `false` | | `develocity-url` | URL for Develocity | `https://develocity.sonar.build/` | | `cache-paths` | Custom cache paths (multiline). | (optional) | @@ -238,13 +240,13 @@ steps: | `ARTIFACTORY_ACCESS_USERNAME` | Deprecated alias for `ARTIFACTORY_USERNAME` | | `ARTIFACTORY_USERNAME` | Username for Artifactory authentication | | `ARTIFACTORY_PASSWORD` | Deprecated alias for `ARTIFACTORY_ACCESS_TOKEN` | -| `ARTIFACTORY_URL` | Artifactory (Repox) URL. E.x.: `https://repox.jfrog.io/artifactory` | +| `ARTIFACTORY_URL` | Artifactory API base URL. E.g. `https://repox-internal.dev.sonar.build/artifactory` | | `BASH_ENV` | Path to the bash profile with mvn function for adding common flags to Maven calls | | `CURRENT_VERSION` | The original project version from pom.xml | | `DEVELOCITY_ACCESS_KEY` | The Develocity access key when `use-develocity` is true | | `MAVEN_OPTS` | JVM options for Maven execution. | | `PROJECT_VERSION` | The project version with build number (after replacement) | -| `SONARSOURCE_REPOSITORY_URL` | URL for SonarSource Artifactory root virtual repository (i.e.: [`sonarsource`](https://repox.jfrog.io/artifactory/sonarsource) for release builds or [`sonarsource-qa`](https://repox.jfrog.io/artifactory/sonarsource-qa) for QA builds) | +| `SONARSOURCE_REPOSITORY_URL` | URL for SonarSource Artifactory root virtual repository (i.e.: [`sonarsource`](https://repox-internal.dev.sonar.build/artifactory/sonarsource) for release builds or [`sonarsource-qa`](https://repox-internal.dev.sonar.build/artifactory/sonarsource-qa) for QA builds) | | `CONFIG_MAVEN_COMPLETED` | For internal use. If set, the action is skipped | | `MAVEN_CONFIG` | Path to m2 root `$HOME/.m2` | @@ -321,7 +323,6 @@ See also [`config-maven`](#config-maven) input environment variables. | `deploy-pull-request` | Whether to also deploy for pull requests. If deploy is false, this has no effect. | `false` | | `maven-args` | Additional arguments to pass to Maven | (optional) | | `scanner-java-opts` | Additional Java options for the Sonar scanner (`SONAR_SCANNER_JAVA_OPTS`) | `-Xmx512m` | -| `repox-url` | URL for Repox | `https://repox.jfrog.io` | | `use-develocity` | Whether to use Develocity for build tracking | `false` | | `develocity-url` | URL for Develocity | `https://develocity.sonar.build/` | | `sonar-platform` | SonarQube primary platform - 'next', 'sqc-eu', 'sqc-us', or 'none'. Use 'none' to skip sonar scans | `next` | @@ -1415,7 +1416,6 @@ promote: | Input | Description | Default | |---------------------------|---------------------------------------------------------------------------------------------------------------------------|--------------------------| -| `repox-url` | URL for Repox | `https://repox.jfrog.io` | | `promote-pull-request` | Whether to promote pull request artifacts. Requires `deploy-pull-request` input to be set to `true` in the build action | `false` | | `multi-repo` | If true, promotes to public and private repositories. For projects with both public and private artifacts | (optional) | | `artifactory-deploy-repo` | Repository to deploy to. If not set, it will be retrieved from the build info | (optional) | diff --git a/build-maven/action.yml b/build-maven/action.yml index 9c8db9f7..d8745567 100644 --- a/build-maven/action.yml +++ b/build-maven/action.yml @@ -48,9 +48,6 @@ inputs: common-mvn-flags: description: Maven flags for all subsequent mvn calls default: --batch-mode --no-transfer-progress --errors --fail-at-end --show-version -Dmaven.test.redirectTestOutputToFile=false - repox-url: - description: URL for Repox - default: https://repox.jfrog.io use-develocity: description: Whether to use Develocity for build tracking. default: 'false' @@ -113,7 +110,6 @@ runs: working-directory: ${{ inputs.working-directory }} artifactory-reader-role: ${{ inputs.artifactory-reader-role }} common-mvn-flags: ${{ inputs.common-mvn-flags }} - repox-url: ${{ inputs.repox-url }} use-develocity: ${{ inputs.use-develocity }} develocity-url: ${{ inputs.develocity-url }} cache-paths: ${{ inputs.cache-paths }} @@ -151,16 +147,17 @@ runs: if: inputs.deploy != 'false' id: artifactory with: - url: ${{ contains(inputs.repox-url, 'dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }} + url: https://vault.sonar.build # yamllint disable rule:line-length secrets: | ${{ inputs.deploy != 'false' && inputs.run-shadow-scans != 'true' && steps.params.outputs.ARTIFACTORY_DEPLOY_USERNAME_VAULT || '' }} ${{ inputs.deploy != 'false' && inputs.run-shadow-scans != 'true' && steps.params.outputs.ARTIFACTORY_DEPLOY_ACCESS_TOKEN_VAULT || '' }} ${{ inputs.deploy != 'false' && inputs.mixed-privacy == 'true' && steps.params.outputs.ARTIFACTORY_PRIVATE_DEPLOY_ACCESS_TOKEN_VAULT || '' }} - # yamllint enable rule:line-length + - uses: SonarSource/vault-action-wrapper@881045d830534a70ec3c7c275fa3714412c8ff6e # 3.6.1 id: secrets with: + url: https://vault.sonar.build # yamllint disable rule:line-length secrets: | ${{ (inputs.sonar-platform != 'none' || inputs.run-shadow-scans == 'true') && 'development/kv/data/next url | NEXT_URL;' || '' }} diff --git a/config-maven/action.yml b/config-maven/action.yml index 2738ea18..2b02c72b 100644 --- a/config-maven/action.yml +++ b/config-maven/action.yml @@ -12,9 +12,6 @@ inputs: common-mvn-flags: description: Maven flags for all subsequent mvn calls default: --batch-mode --no-transfer-progress --errors --fail-at-end --show-version -Dmaven.test.redirectTestOutputToFile=false - repox-url: - description: URL for Repox - default: https://repox.jfrog.io use-develocity: description: Whether to use Develocity for build tracking. default: 'false' @@ -93,7 +90,7 @@ runs: if: steps.config-maven-completed.outputs.skip != 'true' id: artifactory with: - url: ${{ contains(inputs.repox-url, 'dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }} + url: https://vault.sonar.build secrets: | development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME; development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN; @@ -101,6 +98,7 @@ runs: if: steps.config-maven-completed.outputs.skip != 'true' && inputs.use-develocity == 'true' id: secrets with: + url: https://vault.sonar.build secrets: | development/kv/data/develocity token | DEVELOCITY_TOKEN; @@ -116,7 +114,7 @@ runs: if: steps.config-maven-completed.outputs.skip != 'true' shell: bash env: - ARTIFACTORY_URL: ${{ format('{0}/artifactory', inputs.repox-url) }} + ARTIFACTORY_URL: https://repox-internal.dev.sonar.build/artifactory # yamllint disable rule:line-length ARTIFACTORY_USERNAME: ${{ steps.artifactory.outputs.vault && fromJSON(steps.artifactory.outputs.vault).ARTIFACTORY_USERNAME || '' }} ARTIFACTORY_ACCESS_TOKEN: ${{ steps.artifactory.outputs.vault && fromJSON(steps.artifactory.outputs.vault).ARTIFACTORY_ACCESS_TOKEN || '' }} @@ -128,9 +126,14 @@ runs: echo "::warning title=Found invalid DEVELOCITY_ACCESS_KEY::DEVELOCITY_ACCESS_KEY should not be set manually" \ "in the environment." >&2 echo "[WARNING] DEVELOCITY_ACCESS_KEY is set in the environment with an empty token. This is a deprecated configuration." \ - "The Develocity token is configured by config-maven. Please remove external configuration of DEVELOCITY_ACCESS_KEY." + "The Develocity token is configured by config-maven. Please remove external configuration of DEVELOCITY_ACCESS_KEY." fi + # Vault may return mixed-case usernames (e.g. vault-SonarSource-...), but JFrog Access + # token subjects are lowercase. Basic auth is case-sensitive on a federated edge node + # (DENIED LOGIN for vault-SonarSource-... while Bearer works as vault-sonarsource-...). + ARTIFACTORY_USERNAME="${ARTIFACTORY_USERNAME,,}" + echo "ARTIFACTORY_URL=$ARTIFACTORY_URL" >> "$GITHUB_ENV" echo "ARTIFACTORY_USERNAME=$ARTIFACTORY_USERNAME" >> "$GITHUB_ENV" echo "ARTIFACTORY_ACCESS_USERNAME=$ARTIFACTORY_USERNAME" >> "$GITHUB_ENV" # deprecated, backward compliance diff --git a/config-maven/resources/settings.xml b/config-maven/resources/settings.xml index 6b724928..c885c054 100644 --- a/config-maven/resources/settings.xml +++ b/config-maven/resources/settings.xml @@ -62,7 +62,7 @@ true - interval:60 + always fail diff --git a/promote/action.yml b/promote/action.yml index 5b37419b..d91625a4 100644 --- a/promote/action.yml +++ b/promote/action.yml @@ -2,9 +2,6 @@ name: Promote description: GitHub Action to promote a project inputs: - repox-url: - description: URL for Repox - default: https://repox.jfrog.io promote-pull-request: description: Whether to promote pull request artifacts. Requires `deploy-pull-request` input to be set to `true` in the build action. default: 'false' @@ -48,26 +45,21 @@ runs: - uses: ./.actions/get-build-number with: host-actions-root: ${{ steps.set-path.outputs.host_actions_root }} - - uses: SonarSource/vault-action-wrapper@881045d830534a70ec3c7c275fa3714412c8ff6e # 3.6.1 - id: artifactory - with: - url: ${{ contains(inputs.repox-url, 'dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }} - secrets: | - development/artifactory/token/{REPO_OWNER_NAME_DASH}-promoter access_token | ARTIFACTORY_PROMOTE_ACCESS_TOKEN; - uses: SonarSource/vault-action-wrapper@881045d830534a70ec3c7c275fa3714412c8ff6e # 3.6.1 id: secrets with: + url: https://vault.sonar.build secrets: | - development/github/token/{REPO_OWNER_NAME_DASH}-promotion token | GITHUB_TOKEN; - - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0 + development/artifactory/token/{REPO_OWNER_NAME_DASH}-promoter access_token | ARTIFACTORY_PROMOTE_ACCESS_TOKEN; + - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1 with: version: 2026.6.14 - name: Promote artifacts shell: bash env: - ARTIFACTORY_URL: ${{ format('{0}/artifactory', inputs.repox-url) }} - ARTIFACTORY_PROMOTE_ACCESS_TOKEN: ${{ fromJSON(steps.artifactory.outputs.vault).ARTIFACTORY_PROMOTE_ACCESS_TOKEN }} - GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).GITHUB_TOKEN }} + ARTIFACTORY_URL: https://repox-internal.dev.sonar.build/artifactory + ARTIFACTORY_PROMOTE_ACCESS_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_PROMOTE_ACCESS_TOKEN }} + GITHUB_TOKEN: ${{ github.token }} DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} MULTI_REPO_PROMOTE: ${{ inputs.multi-repo }} ARTIFACTORY_DEPLOY_REPO: ${{ inputs.artifactory-deploy-repo }}