diff --git a/.gitattributes b/.gitattributes index 6a7b667b3..f3f6bec5a 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1,11 +1,2 @@ -# .* eol=crlf -# *.html eol=crlf -# *.java eol=crlf -# *.txt eol=crlf -# *.css eol=crlf -# *.xml eol=crlf -# *.js eol=crlf -# *.properties eol=crlf -# Shell scripts require LF *.sh text eol=lf -Dockerfile text eol=lf \ No newline at end of file +Dockerfile text eol=lf diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f308e8b58..1ea9b22f4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,9 +17,6 @@ on: env: JAVA_VERSION: "21" - GIT_USERNAME: ${{ secrets.BOT_GITHUB_USERNAME }} - GIT_EMAIL: ${{ secrets.BOT_GITHUB_EMAIL }} - GIT_PASSWORD: ${{ secrets.BOT_GITHUB_TOKEN }} DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }} DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }} GITHUB_ACTIONS_DEPLOY_TIMEOUT: 60 @@ -37,7 +34,7 @@ jobs: if: > !contains(github.event.head_commit.message, '[skip tests]') steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@ac0009fd55b474dbf50864caa4f9da36a41e5ffe # v18.21.2 - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@ac0009fd55b474dbf50864caa4f9da36a41e5ffe # v18.21.2 - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@ac0009fd55b474dbf50864caa4f9da36a41e5ffe # v18.21.2 @@ -90,13 +87,25 @@ jobs: profiles: all-tas-tests compose-file: docker-compose-minimal.yml steps: - - uses: actions/checkout@v4 + - name: "Generate GitHub App token" + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }} + private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }} + owner: Alfresco + repositories: alfresco-community-repo,alfresco-community-share,acs-community-packaging + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + token: ${{ steps.app-token.outputs.token }} - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@ac0009fd55b474dbf50864caa4f9da36a41e5ffe # v18.21.2 - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@ac0009fd55b474dbf50864caa4f9da36a41e5ffe # v18.21.2 with: java-version: ${{ env.JAVA_VERSION }} - name: "Init" timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }} + env: + AUTH: x-access-token:${{ steps.app-token.outputs.token }}@ run: | bash ./scripts/ci/init.sh bash ./scripts/ci/build.sh @@ -153,15 +162,25 @@ jobs: search-engine-type: opensearch db-type: postgresql steps: - - uses: actions/checkout@v4 + - name: "Generate GitHub App token" + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - persist-credentials: false + client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }} + private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }} + owner: Alfresco + repositories: alfresco-community-repo,alfresco-community-share,acs-community-packaging + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + token: ${{ steps.app-token.outputs.token }} - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@ac0009fd55b474dbf50864caa4f9da36a41e5ffe # v18.21.2 - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@ac0009fd55b474dbf50864caa4f9da36a41e5ffe # v18.21.2 with: java-version: ${{ env.JAVA_VERSION }} - name: "Build" timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }} + env: + AUTH: x-access-token:${{ steps.app-token.outputs.token }}@ run: | bash ./scripts/ci/init.sh bash ./scripts/ci/build.sh @@ -188,13 +207,25 @@ jobs: runs-on: ubuntu-latest if: "!contains(github.event.head_commit.message, '[skip tests]')" steps: - - uses: actions/checkout@v4 + - name: "Generate GitHub App token" + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }} + private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }} + owner: Alfresco + repositories: alfresco-community-repo,alfresco-community-share,acs-community-packaging + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + token: ${{ steps.app-token.outputs.token }} - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@ac0009fd55b474dbf50864caa4f9da36a41e5ffe # v18.21.2 - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@ac0009fd55b474dbf50864caa4f9da36a41e5ffe # v18.21.2 with: java-version: ${{ env.JAVA_VERSION }} - name: "Init" timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }} + env: + AUTH: x-access-token:${{ steps.app-token.outputs.token }}@ run: | bash ./scripts/ci/init.sh bash ./scripts/ci/build.sh @@ -212,9 +243,17 @@ jobs: if: > !contains(github.event.head_commit.message, '[skip tests]') steps: - - uses: actions/checkout@v4 + - name: "Generate GitHub App token" + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - persist-credentials: false + client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }} + private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }} + owner: Alfresco + repositories: alfresco-community-repo,alfresco-community-share,acs-community-packaging + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + token: ${{ steps.app-token.outputs.token }} - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@ac0009fd55b474dbf50864caa4f9da36a41e5ffe # v18.21.2 - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@ac0009fd55b474dbf50864caa4f9da36a41e5ffe # v18.21.2 - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@ac0009fd55b474dbf50864caa4f9da36a41e5ffe # v18.21.2 @@ -222,6 +261,8 @@ jobs: java-version: ${{ env.JAVA_VERSION }} - name: "Build" timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }} + env: + AUTH: x-access-token:${{ steps.app-token.outputs.token }}@ run: | bash ./scripts/ci/init.sh bash ./scripts/ci/build.sh @@ -254,16 +295,28 @@ jobs: ports: - 5000:5000 steps: - - uses: actions/checkout@v4 + - name: "Generate GitHub App token" + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }} + private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }} + owner: Alfresco + repositories: alfresco-community-repo,alfresco-community-share,acs-community-packaging + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + token: ${{ steps.app-token.outputs.token }} - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@ac0009fd55b474dbf50864caa4f9da36a41e5ffe # v18.21.2 - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@ac0009fd55b474dbf50864caa4f9da36a41e5ffe # v18.21.2 - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@ac0009fd55b474dbf50864caa4f9da36a41e5ffe # v18.21.2 with: java-version: ${{ env.JAVA_VERSION }} - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - name: "Init" timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }} + env: + AUTH: x-access-token:${{ steps.app-token.outputs.token }}@ run: | bash ./scripts/ci/init.sh bash ./scripts/ci/build.sh -m @@ -288,9 +341,20 @@ jobs: ports: - 5000:5000 steps: - - uses: actions/checkout@v4 + - name: "Generate GitHub App token" + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - persist-credentials: false + client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }} + private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }} + owner: Alfresco + repositories: alfresco-community-repo,alfresco-community-share,acs-community-packaging + permission-contents: write + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + token: ${{ steps.app-token.outputs.token }} + - name: "Create local release branch" + run: git checkout -B "${{ github.ref_name }}" - uses: Alfresco/alfresco-build-tools/.github/actions/env-load-from-yaml@ac0009fd55b474dbf50864caa4f9da36a41e5ffe # v18.21.2 with: yml_path: .github/release-versions.yml @@ -300,22 +364,31 @@ jobs: with: java-version: ${{ env.JAVA_VERSION }} - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - name: "Init" timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }} + env: + AUTH: x-access-token:${{ steps.app-token.outputs.token }}@ run: | bash ./scripts/ci/init.sh bash ./scripts/ci/build.sh -m + - name: "Verify release version" + run: bash scripts/ci/verify_release_tag.sh - name: "Release" timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }} - run: | - bash scripts/ci/verify_release_tag.sh - bash scripts/ci/maven_release.sh - source scripts/ci/prepare_staging_deploy.sh + uses: Alfresco/alfresco-build-tools/.github/actions/maven-release-slim@30c1953fd4ad6e52062d7eba444298fe1701d1df # v18.22.0 + with: + token: ${{ steps.app-token.outputs.token }} + release-version: ${{ env.RELEASE_VERSION }} + development-version: ${{ env.DEVELOPMENT_VERSION }} + release-profile: "release,all-tas-tests,ags" + maven-args: "-Darguments=-Prelease,all-tas-tests -Pags -DskipTests -Dbuild-number=${{ env.BUILD_NUMBER }}" + - name: "Prepare staging artifacts" + run: bash scripts/ci/prepare_staging_deploy.sh - name: "Clean Maven cache" run: bash ./scripts/ci/cleanup_cache.sh - name: "Configure AWS credentials" - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 with: aws-access-key-id: ${{ secrets.AWS_S3_STAGING_ACCESS_KEY }} aws-secret-access-key: ${{ secrets.AWS_S3_STAGING_SECRET_KEY }} @@ -336,13 +409,13 @@ jobs: (github.ref_name == 'master' || startsWith(github.ref_name, 'release/')) && github.event_name != 'pull_request' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: Alfresco/alfresco-build-tools/.github/actions/env-load-from-yaml@ac0009fd55b474dbf50864caa4f9da36a41e5ffe # v18.21.2 with: yml_path: .github/release-versions.yml - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@ac0009fd55b474dbf50864caa4f9da36a41e5ffe # v18.21.2 - name: "Configure AWS credentials" - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 with: aws-access-key-id: ${{ secrets.AWS_S3_RELEASE_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_S3_RELEASE_SECRET_ACCESS_KEY }} diff --git a/scripts/ci/build_functions.sh b/scripts/ci/build_functions.sh index 60f4c5f50..da14d7a47 100755 --- a/scripts/ci/build_functions.sh +++ b/scripts/ci/build_functions.sh @@ -20,7 +20,7 @@ function cloneRepo() { rm -rf "$(basename "${REPO%.git}")" - git clone -b "${TAG_OR_BRANCH}" --depth=1 "https://${GIT_USERNAME}:${GIT_PASSWORD}@${REPO}" + git clone -b "${TAG_OR_BRANCH}" --depth=1 "https://${AUTH}${REPO}" popd >/dev/null } @@ -76,7 +76,9 @@ function remoteBranchExists() { local REMOTE_REPO="${1}" local BRANCH="${2}" - git ls-remote --exit-code --heads "https://${GIT_USERNAME}:${GIT_PASSWORD}@${REMOTE_REPO}" "${BRANCH}" &>/dev/null + git ls-remote --exit-code --heads "https://${AUTH}${REMOTE_REPO}" "${BRANCH}" &>/dev/null + + return "${RESULT}" } function identifyUpstreamSourceBranch() { @@ -175,7 +177,7 @@ function retieveLatestTag() { local LOCAL_PATH="/tmp/$(basename "${REPO%.git}")" - git clone -q -b "${BRANCH}" "https://${GIT_USERNAME}:${GIT_PASSWORD}@${REPO}" "${LOCAL_PATH}" + git clone -q -b "${BRANCH}" "https://${AUTH}${REPO}" "${LOCAL_PATH}" pushd "${LOCAL_PATH}" >/dev/null git describe --abbrev=0 --tags diff --git a/scripts/ci/maven_release.sh b/scripts/ci/maven_release.sh deleted file mode 100755 index 0472394e4..000000000 --- a/scripts/ci/maven_release.sh +++ /dev/null @@ -1,34 +0,0 @@ -#!/usr/bin/env bash -echo "=========================== Starting Release Script ===========================" -PS4="\[\e[35m\]+ \[\e[m\]" -set -vex -pushd "$(dirname "${BASH_SOURCE[0]}")/../../" - - -if [ -z "${RELEASE_VERSION}" ] || [ -z "${DEVELOPMENT_VERSION}" ]; then - echo "Please provide a Release and Development version in the format - (e.g. 7.2.0-A2)" - exit 1 -fi - -# Use full history for release -git checkout -B "${BRANCH_NAME}" -# Define git identity for commits -git config user.email "${GIT_EMAIL}" -git config user.name "${GIT_USERNAME}" - -mvn -B \ - -ntp \ - -Prelease,all-tas-tests -Pags \ - -DreleaseVersion="${RELEASE_VERSION}" \ - -DdevelopmentVersion="${DEVELOPMENT_VERSION}" \ - "-Darguments=-Prelease,all-tas-tests -Pags -DskipTests -Dbuild-number=${BUILD_NUMBER}" \ - release:clean release:prepare release:perform \ - -DscmCommentPrefix="[maven-release-plugin][skip ci] " \ - -Dusername="${GIT_USERNAME}" \ - -Dpassword="${GIT_PASSWORD}" - - -popd -set +vex -echo "=========================== Finishing Release Script ==========================" -