mirror of
https://github.com/Alfresco/alfresco-transform-core.git
synced 2026-09-16 18:12:54 +00:00
ACS-12080: Migrate ATS release to verified commits and GitHub App tokens (maven-release-slim) (#1321)
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: gionn <71768+gionn@users.noreply.github.com>
This commit is contained in:
co-authored by
copilot-swe-agent[bot]
gionn
parent
7e4eb8a5cb
commit
b23826a338
@@ -0,0 +1,72 @@
|
|||||||
|
# Copilot / AI assistant instructions — Alfresco Transform Core
|
||||||
|
|
||||||
|
Guidance for AI coding agents working in this repository. Keep changes minimal,
|
||||||
|
consistent with existing conventions, and always buildable.
|
||||||
|
|
||||||
|
## What this project is
|
||||||
|
|
||||||
|
Alfresco Transform Core contains the common transformer ("T-Engine") code plus a set of
|
||||||
|
concrete T-Engine implementations. Each T-Engine is a Spring Boot application that is also
|
||||||
|
packaged as a Docker image. Client, T-Engine and T-Router exchange JSON described by the
|
||||||
|
shared `model` library.
|
||||||
|
|
||||||
|
## Tech stack
|
||||||
|
|
||||||
|
- **Java 17** (`java.version` in the root `pom.xml`); some artifacts also target Java 11
|
||||||
|
(`acs-compatible.java.version`) for ACS compatibility.
|
||||||
|
- **Spring Boot** (inherited from `spring-boot-starter-parent`).
|
||||||
|
- **Maven** multi-module build. **Docker** images per engine.
|
||||||
|
- Code style enforced via **Spotless** and license-header checks; hooks run through
|
||||||
|
**pre-commit**.
|
||||||
|
|
||||||
|
## Repository layout
|
||||||
|
|
||||||
|
- `model/` — JSON data model + transform-selection logic, packaged as a jar.
|
||||||
|
- `engines/base/` — code common to all T-Engines (the current base).
|
||||||
|
- `engines/<name>/` — individual T-Engines (`imagemagick`, `libreoffice`, `misc`,
|
||||||
|
`pdfrenderer`, `tika`, `example`) plus `aio` (All-In-One). Each builds a Spring Boot jar
|
||||||
|
and a Docker image.
|
||||||
|
- `deprecated/alfresco-transformer-base/` — the original base; retained but superseded by
|
||||||
|
`engines/base`.
|
||||||
|
- `_ci/` — CI helper scripts (`build.sh`, `test.sh`, `cache_artifacts.sh`).
|
||||||
|
- `docs/` — additional documentation (transform config, probes, scaling, release, …).
|
||||||
|
- `scripts/hooks/` — local pre-commit hook scripts (formatting + license headers).
|
||||||
|
|
||||||
|
Maven profiles select which modules build: `full-build` (default, everything), `base`,
|
||||||
|
and one per engine (e.g. `imagemagick`, `libreoffice`, `misc`, `pdf-renderer`, `tika`).
|
||||||
|
|
||||||
|
## Build & test
|
||||||
|
|
||||||
|
- Full local build with per-engine Docker images and integration setup:
|
||||||
|
```bash
|
||||||
|
mvn clean install -Plocal,docker-it-setup
|
||||||
|
```
|
||||||
|
- Base libraries only: `mvn clean install -Pbase`.
|
||||||
|
- A single engine locally, mirroring CI: `bash _ci/build.sh <buildProfile>` then
|
||||||
|
`bash _ci/test.sh <testProfile>` (see the matrix in `.github/workflows/ci.yml`).
|
||||||
|
- Integration tests are `*IT.java` and require the `docker-it-setup` profile.
|
||||||
|
|
||||||
|
## Running a T-Engine
|
||||||
|
|
||||||
|
A T-Engine is a Spring Boot app (`org.alfresco.transform.base.Application`):
|
||||||
|
|
||||||
|
- `mvn spring-boot:run`, or `java -jar target/<engine>-{version}.jar`.
|
||||||
|
- Serves on port `8090`; test page at `http://localhost:8090/`, config at
|
||||||
|
`http://localhost:8090/transform/config`.
|
||||||
|
|
||||||
|
## Conventions
|
||||||
|
|
||||||
|
- Keep formatting Spotless-clean and preserve license headers — the
|
||||||
|
`scripts/hooks/check-format-and-headers.sh` pre-commit hook fixes Java files.
|
||||||
|
- Pin dependency and plugin versions via `<properties>` in the root `pom.xml` rather than
|
||||||
|
inline in child modules.
|
||||||
|
- In GitHub Actions, third-party actions must be SHA-pinned with a version comment; only
|
||||||
|
`Alfresco/alfresco-build-tools/*` may use release tags. Never place secrets in a
|
||||||
|
workflow-level `env` block — scope them to the steps that need them.
|
||||||
|
|
||||||
|
## Where to look first
|
||||||
|
|
||||||
|
- Root `pom.xml` for versions, profiles and module wiring.
|
||||||
|
- `README.md` for a high-level overview and artifact/Docker details.
|
||||||
|
- `docs/` for transform config, transformer selection, probes and the release process.
|
||||||
|
|
||||||
+51
-59
@@ -1,3 +1,5 @@
|
|||||||
|
# Documentation for all configuration options:
|
||||||
|
# https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference
|
||||||
version: 2
|
version: 2
|
||||||
registries:
|
registries:
|
||||||
maven-alfresco-internal:
|
maven-alfresco-internal:
|
||||||
@@ -6,62 +8,52 @@ registries:
|
|||||||
username: ${{secrets.NEXUS_USERNAME}}
|
username: ${{secrets.NEXUS_USERNAME}}
|
||||||
password: ${{secrets.NEXUS_PASSWORD}}
|
password: ${{secrets.NEXUS_PASSWORD}}
|
||||||
updates:
|
updates:
|
||||||
- package-ecosystem: maven
|
- package-ecosystem: "github-actions"
|
||||||
directory: "/"
|
directories:
|
||||||
schedule:
|
- "/"
|
||||||
interval: daily
|
schedule:
|
||||||
time: "22:00"
|
interval: "weekly"
|
||||||
timezone: Europe/London
|
labels:
|
||||||
open-pull-requests-limit: 99
|
- "dependencies"
|
||||||
registries:
|
- "github_actions"
|
||||||
- maven-alfresco-internal
|
cooldown:
|
||||||
- package-ecosystem: docker
|
default-days: 7
|
||||||
directory: "engines/aio"
|
groups:
|
||||||
schedule:
|
github-actions:
|
||||||
interval: daily
|
patterns:
|
||||||
time: "22:00"
|
- "*"
|
||||||
timezone: Europe/London
|
|
||||||
open-pull-requests-limit: 99
|
- package-ecosystem: "maven"
|
||||||
- package-ecosystem: docker
|
directories:
|
||||||
directory: "engines/libreoffice"
|
- "/"
|
||||||
schedule:
|
schedule:
|
||||||
interval: daily
|
interval: "weekly"
|
||||||
time: "22:00"
|
open-pull-requests-limit: 99
|
||||||
timezone: Europe/London
|
registries:
|
||||||
open-pull-requests-limit: 99
|
- maven-alfresco-internal
|
||||||
- package-ecosystem: docker
|
labels:
|
||||||
directory: "engines/imagemagick"
|
- "dependencies"
|
||||||
schedule:
|
- "java"
|
||||||
interval: daily
|
cooldown:
|
||||||
time: "22:00"
|
default-days: 7
|
||||||
timezone: Europe/London
|
groups:
|
||||||
open-pull-requests-limit: 99
|
maven:
|
||||||
- package-ecosystem: docker
|
patterns:
|
||||||
directory: "engines/misc"
|
- "*"
|
||||||
schedule:
|
|
||||||
interval: daily
|
- package-ecosystem: "docker"
|
||||||
time: "22:00"
|
directories:
|
||||||
timezone: Europe/London
|
# Each T-Engine ships its own Dockerfile; the glob collapses the siblings.
|
||||||
open-pull-requests-limit: 99
|
- "engines/*"
|
||||||
- package-ecosystem: docker
|
schedule:
|
||||||
directory: "engines/tika"
|
interval: "weekly"
|
||||||
schedule:
|
open-pull-requests-limit: 99
|
||||||
interval: daily
|
labels:
|
||||||
time: "22:00"
|
- "dependencies"
|
||||||
timezone: Europe/London
|
- "docker"
|
||||||
open-pull-requests-limit: 99
|
cooldown:
|
||||||
- package-ecosystem: docker
|
default-days: 7
|
||||||
directory: "engines/pdfrenderer"
|
groups:
|
||||||
schedule:
|
docker:
|
||||||
interval: daily
|
patterns:
|
||||||
time: "22:00"
|
- "*"
|
||||||
timezone: Europe/London
|
|
||||||
open-pull-requests-limit: 99
|
|
||||||
- package-ecosystem: github-actions
|
|
||||||
directory: "/"
|
|
||||||
schedule:
|
|
||||||
interval: monthly
|
|
||||||
groups:
|
|
||||||
github-actions:
|
|
||||||
patterns:
|
|
||||||
- "*"
|
|
||||||
|
|||||||
+113
-45
@@ -22,17 +22,16 @@ on:
|
|||||||
- cron: '0 5 * * 1'
|
- cron: '0 5 * * 1'
|
||||||
workflow_dispatch:
|
workflow_dispatch:
|
||||||
|
|
||||||
|
# NOTE: Secrets are intentionally NOT declared at the workflow (top) level.
|
||||||
|
# A workflow-level `env` exposes secrets to every job/step (including third-party
|
||||||
|
# actions). Secrets are scoped to the individual steps that need them instead.
|
||||||
env:
|
env:
|
||||||
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
|
|
||||||
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
|
||||||
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
|
|
||||||
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
|
|
||||||
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
|
|
||||||
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
|
|
||||||
GIT_USERNAME: ${{ secrets.BOT_GITHUB_USERNAME }}
|
|
||||||
GIT_EMAIL: ${{ secrets.BOT_GITHUB_EMAIL }}
|
|
||||||
GIT_PASSWORD: ${{ secrets.BOT_GITHUB_TOKEN }}
|
|
||||||
GITHUB_ACTIONS_DEPLOY_TIMEOUT: 120
|
GITHUB_ACTIONS_DEPLOY_TIMEOUT: 120
|
||||||
|
# Both variables are required to be set before the release process starts.
|
||||||
|
# As the release is triggered by a commit message with "[release]" keyword on a release branch,
|
||||||
|
# setting these variables to new values can be done in the same commit and will indicate the release and the dev versions in it.
|
||||||
|
RELEASE_VERSION: "5.4.5-A.3" # The version of the release (tag).
|
||||||
|
DEVELOPMENT_VERSION: "5.4.5-A.4-SNAPSHOT" # The version that will be set in pom files after the release (next dev version)
|
||||||
|
|
||||||
permissions:
|
permissions:
|
||||||
contents: read
|
contents: read
|
||||||
@@ -41,7 +40,7 @@ jobs:
|
|||||||
pre_commit:
|
pre_commit:
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
steps:
|
steps:
|
||||||
- uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v9.3.1
|
- uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v18.21.2
|
||||||
|
|
||||||
test_run_check:
|
test_run_check:
|
||||||
name: "Test run check"
|
name: "Test run check"
|
||||||
@@ -66,10 +65,17 @@ jobs:
|
|||||||
- test_run_check
|
- test_run_check
|
||||||
if: needs.test_run_check.outputs.tests == 'true' && github.event_name == 'pull_request'
|
if: needs.test_run_check.outputs.tests == 'true' && github.event_name == 'pull_request'
|
||||||
steps:
|
steps:
|
||||||
- uses: actions/checkout@v4
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
||||||
- uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v9.3.1
|
- uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.21.2
|
||||||
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v9.3.1
|
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
|
||||||
- uses: Alfresco/ya-pmd-scan@v4.1.0
|
- uses: Alfresco/ya-pmd-scan@e817ecd9292844800451c42f07cdebdb14268cfa # v4.1.0
|
||||||
|
env:
|
||||||
|
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
|
||||||
|
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
|
||||||
|
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
|
||||||
|
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
|
||||||
|
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
||||||
|
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
|
||||||
with:
|
with:
|
||||||
classpath-build-command: "mvn -ntp package -DskipTests"
|
classpath-build-command: "mvn -ntp package -DskipTests"
|
||||||
|
|
||||||
@@ -81,16 +87,16 @@ jobs:
|
|||||||
- test_run_check
|
- test_run_check
|
||||||
if: needs.test_run_check.outputs.tests == 'true'
|
if: needs.test_run_check.outputs.tests == 'true'
|
||||||
steps:
|
steps:
|
||||||
- uses: actions/checkout@v4
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
||||||
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v9.3.1
|
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.2
|
||||||
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v9.3.1
|
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
|
||||||
- name: "Login to Docker Hub"
|
- name: "Login to Docker Hub"
|
||||||
uses: docker/login-action@v3
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
||||||
with:
|
with:
|
||||||
username: ${{ secrets.DOCKER_USERNAME }}
|
username: ${{ secrets.DOCKER_USERNAME }}
|
||||||
password: ${{ secrets.DOCKER_PASSWORD }}
|
password: ${{ secrets.DOCKER_PASSWORD }}
|
||||||
- name: "Login to Quay.io"
|
- name: "Login to Quay.io"
|
||||||
uses: docker/login-action@v3
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
||||||
with:
|
with:
|
||||||
registry: quay.io
|
registry: quay.io
|
||||||
username: ${{ secrets.QUAY_USERNAME }}
|
username: ${{ secrets.QUAY_USERNAME }}
|
||||||
@@ -100,14 +106,28 @@ jobs:
|
|||||||
echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
|
echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
|
||||||
sudo service docker restart
|
sudo service docker restart
|
||||||
- name: "Clean-up SNAPSHOT artifacts"
|
- name: "Clean-up SNAPSHOT artifacts"
|
||||||
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" | xargs -r -l rm -rf
|
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
|
||||||
- name: "Build"
|
- name: "Build"
|
||||||
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
|
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
|
||||||
|
env:
|
||||||
|
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
|
||||||
|
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
|
||||||
|
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
|
||||||
|
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
|
||||||
|
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
||||||
|
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
|
||||||
run: mvn -B -U -q clean install -DadditionalOption=-Xdoclint:none -DskipTests -Dmaven.javadoc.skip=true -Dmaven.wagon.http.pool=false -Pbase
|
run: mvn -B -U -q clean install -DadditionalOption=-Xdoclint:none -DskipTests -Dmaven.javadoc.skip=true -Dmaven.wagon.http.pool=false -Pbase
|
||||||
- name: "Cache LibreOffice"
|
- name: "Cache LibreOffice"
|
||||||
run: bash _ci/cache_artifacts.sh
|
run: bash _ci/cache_artifacts.sh
|
||||||
- name: "Run tests"
|
- name: "Run tests"
|
||||||
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
|
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
|
||||||
|
env:
|
||||||
|
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
|
||||||
|
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
|
||||||
|
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
|
||||||
|
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
|
||||||
|
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
||||||
|
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
|
||||||
run: mvn -B -U clean deploy -DadditionalOption=-Xdoclint:none -Dmaven.javadoc.skip=true -Dmaven.wagon.http.pool=false -Pbase
|
run: mvn -B -U clean deploy -DadditionalOption=-Xdoclint:none -Dmaven.javadoc.skip=true -Dmaven.wagon.http.pool=false -Pbase
|
||||||
|
|
||||||
all_tests_matrix:
|
all_tests_matrix:
|
||||||
@@ -140,16 +160,16 @@ jobs:
|
|||||||
buildProfile: full-build
|
buildProfile: full-build
|
||||||
testProfile: aio-test
|
testProfile: aio-test
|
||||||
steps:
|
steps:
|
||||||
- uses: actions/checkout@v4
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
||||||
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v9.3.1
|
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.2
|
||||||
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v9.3.1
|
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
|
||||||
- name: "Login to Docker Hub"
|
- name: "Login to Docker Hub"
|
||||||
uses: docker/login-action@v3
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
||||||
with:
|
with:
|
||||||
username: ${{ secrets.DOCKER_USERNAME }}
|
username: ${{ secrets.DOCKER_USERNAME }}
|
||||||
password: ${{ secrets.DOCKER_PASSWORD }}
|
password: ${{ secrets.DOCKER_PASSWORD }}
|
||||||
- name: "Login to Quay.io"
|
- name: "Login to Quay.io"
|
||||||
uses: docker/login-action@v3
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
||||||
with:
|
with:
|
||||||
registry: quay.io
|
registry: quay.io
|
||||||
username: ${{ secrets.QUAY_USERNAME }}
|
username: ${{ secrets.QUAY_USERNAME }}
|
||||||
@@ -159,14 +179,28 @@ jobs:
|
|||||||
echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
|
echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
|
||||||
sudo service docker restart
|
sudo service docker restart
|
||||||
- name: "Clean-up SNAPSHOT artifacts"
|
- name: "Clean-up SNAPSHOT artifacts"
|
||||||
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" | xargs -r -l rm -rf
|
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
|
||||||
- name: "Build local docker image"
|
- name: "Build local docker image"
|
||||||
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
|
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
|
||||||
|
env:
|
||||||
|
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
|
||||||
|
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
|
||||||
|
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
|
||||||
|
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
|
||||||
|
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
||||||
|
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
|
||||||
run: bash _ci/build.sh ${{ matrix.buildProfile }}
|
run: bash _ci/build.sh ${{ matrix.buildProfile }}
|
||||||
- name: "Cache LibreOffice"
|
- name: "Cache LibreOffice"
|
||||||
run: bash _ci/cache_artifacts.sh
|
run: bash _ci/cache_artifacts.sh
|
||||||
- name: "Run tests"
|
- name: "Run tests"
|
||||||
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
|
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
|
||||||
|
env:
|
||||||
|
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
|
||||||
|
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
|
||||||
|
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
|
||||||
|
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
|
||||||
|
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
||||||
|
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
|
||||||
run: bash _ci/test.sh ${{ matrix.testProfile }}
|
run: bash _ci/test.sh ${{ matrix.testProfile }}
|
||||||
|
|
||||||
e2e_javaruntime_tests:
|
e2e_javaruntime_tests:
|
||||||
@@ -181,16 +215,16 @@ jobs:
|
|||||||
matrix:
|
matrix:
|
||||||
java: [ '21', '25' ]
|
java: [ '21', '25' ]
|
||||||
steps:
|
steps:
|
||||||
- uses: actions/checkout@v4
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
||||||
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v9.3.1
|
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.2
|
||||||
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v9.3.1
|
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
|
||||||
- name: "Login to Docker Hub"
|
- name: "Login to Docker Hub"
|
||||||
uses: docker/login-action@v3
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
||||||
with:
|
with:
|
||||||
username: ${{ secrets.DOCKER_USERNAME }}
|
username: ${{ secrets.DOCKER_USERNAME }}
|
||||||
password: ${{ secrets.DOCKER_PASSWORD }}
|
password: ${{ secrets.DOCKER_PASSWORD }}
|
||||||
- name: "Login to Quay.io"
|
- name: "Login to Quay.io"
|
||||||
uses: docker/login-action@v3
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
||||||
with:
|
with:
|
||||||
registry: quay.io
|
registry: quay.io
|
||||||
username: ${{ secrets.QUAY_USERNAME }}
|
username: ${{ secrets.QUAY_USERNAME }}
|
||||||
@@ -200,9 +234,16 @@ jobs:
|
|||||||
echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
|
echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
|
||||||
sudo service docker restart
|
sudo service docker restart
|
||||||
- name: "Clean-up SNAPSHOT artifacts"
|
- name: "Clean-up SNAPSHOT artifacts"
|
||||||
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" | xargs -r -l rm -rf
|
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
|
||||||
- name: "Build local docker image"
|
- name: "Build local docker image"
|
||||||
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
|
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
|
||||||
|
env:
|
||||||
|
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
|
||||||
|
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
|
||||||
|
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
|
||||||
|
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
|
||||||
|
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
||||||
|
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
|
||||||
run: bash _ci/build.sh full-build
|
run: bash _ci/build.sh full-build
|
||||||
- name: "Cache LibreOffice"
|
- name: "Cache LibreOffice"
|
||||||
run: bash _ci/cache_artifacts.sh
|
run: bash _ci/cache_artifacts.sh
|
||||||
@@ -212,6 +253,12 @@ jobs:
|
|||||||
SMOKE_TESTS: true
|
SMOKE_TESTS: true
|
||||||
SKIP_DEPLOY: true
|
SKIP_DEPLOY: true
|
||||||
JAVA_RUNTIME_VERSION: ${{ matrix.java }}
|
JAVA_RUNTIME_VERSION: ${{ matrix.java }}
|
||||||
|
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
|
||||||
|
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
|
||||||
|
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
|
||||||
|
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
|
||||||
|
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
||||||
|
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
|
||||||
run: bash _ci/test.sh aio-test
|
run: bash _ci/test.sh aio-test
|
||||||
|
|
||||||
release:
|
release:
|
||||||
@@ -224,23 +271,32 @@ jobs:
|
|||||||
github.event_name != 'pull_request' &&
|
github.event_name != 'pull_request' &&
|
||||||
(github.ref_name == 'master' || startsWith(github.ref_name, 'SP/') || startsWith(github.ref_name, 'HF/'))
|
(github.ref_name == 'master' || startsWith(github.ref_name, 'SP/') || startsWith(github.ref_name, 'HF/'))
|
||||||
steps:
|
steps:
|
||||||
- uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v9.3.1
|
- name: Generate app token
|
||||||
- uses: actions/checkout@v4
|
id: app-token
|
||||||
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
||||||
with:
|
with:
|
||||||
persist-credentials: false
|
client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }}
|
||||||
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v9.3.1
|
private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }}
|
||||||
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v9.3.1
|
permission-contents: write
|
||||||
|
- uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.21.2
|
||||||
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
||||||
|
with:
|
||||||
|
token: ${{ steps.app-token.outputs.token }}
|
||||||
|
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.2
|
||||||
|
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
|
||||||
- name: Set up QEMU
|
- name: Set up QEMU
|
||||||
uses: docker/setup-qemu-action@v3
|
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
|
||||||
with:
|
with:
|
||||||
platforms: linux/amd64,linux/arm64
|
platforms: linux/amd64,linux/arm64
|
||||||
|
- name: Set up Docker Buildx
|
||||||
|
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
|
||||||
- name: "Login to Docker Hub"
|
- name: "Login to Docker Hub"
|
||||||
uses: docker/login-action@v3
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
||||||
with:
|
with:
|
||||||
username: ${{ secrets.DOCKER_USERNAME }}
|
username: ${{ secrets.DOCKER_USERNAME }}
|
||||||
password: ${{ secrets.DOCKER_PASSWORD }}
|
password: ${{ secrets.DOCKER_PASSWORD }}
|
||||||
- name: "Login to Quay.io"
|
- name: "Login to Quay.io"
|
||||||
uses: docker/login-action@v3
|
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
|
||||||
with:
|
with:
|
||||||
registry: quay.io
|
registry: quay.io
|
||||||
username: ${{ secrets.QUAY_USERNAME }}
|
username: ${{ secrets.QUAY_USERNAME }}
|
||||||
@@ -250,14 +306,26 @@ jobs:
|
|||||||
echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
|
echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
|
||||||
sudo service docker restart
|
sudo service docker restart
|
||||||
- name: "Clean-up SNAPSHOT artifacts"
|
- name: "Clean-up SNAPSHOT artifacts"
|
||||||
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" | xargs -r -l rm -rf
|
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
|
||||||
- uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@v9.3.1
|
- uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@v18.21.2
|
||||||
with:
|
with:
|
||||||
username: ${{ env.GIT_USERNAME }}
|
username: ${{ secrets.BOT_GITHUB_USERNAME }}
|
||||||
email: ${{ env.GIT_EMAIL }}
|
email: ${{ secrets.BOT_GITHUB_EMAIL }}
|
||||||
global: true
|
global: true
|
||||||
- name: "Cache LibreOffice"
|
- name: "Cache LibreOffice"
|
||||||
run: bash _ci/cache_artifacts.sh
|
run: bash _ci/cache_artifacts.sh
|
||||||
- name: "Release"
|
- name: "Release"
|
||||||
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
|
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
|
||||||
run: bash _ci/release.sh
|
uses: Alfresco/alfresco-build-tools/.github/actions/maven-release-slim@v18.21.2
|
||||||
|
env:
|
||||||
|
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
|
||||||
|
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
|
||||||
|
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
|
||||||
|
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
|
||||||
|
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
|
||||||
|
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
|
||||||
|
with:
|
||||||
|
token: ${{ steps.app-token.outputs.token }}
|
||||||
|
release-version: ${{ env.RELEASE_VERSION }}
|
||||||
|
development-version: ${{ env.DEVELOPMENT_VERSION }}
|
||||||
|
maven-args: "-DskipTests -Dmaven.javadoc.skip=true -DadditionalOption=-Xdoclint:none -Dmaven.wagon.http.pool=false"
|
||||||
|
|||||||
@@ -16,22 +16,6 @@ jobs:
|
|||||||
contents: write
|
contents: write
|
||||||
if: contains(github.event.head_commit.message, '[reformat code]')
|
if: contains(github.event.head_commit.message, '[reformat code]')
|
||||||
steps:
|
steps:
|
||||||
- uses: actions/checkout@v4
|
- uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v18.21.2
|
||||||
- name: Set up Python ${{ inputs.python-version }}
|
|
||||||
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
|
|
||||||
with:
|
with:
|
||||||
python-version: "3.9"
|
auto-commit: "true"
|
||||||
- uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
|
|
||||||
continue-on-error: true
|
|
||||||
with:
|
|
||||||
extra_args: --all-files
|
|
||||||
- name: Update secrets baseline
|
|
||||||
run: pip install detect-secrets && detect-secrets scan --baseline .secrets.baseline
|
|
||||||
- uses: Alfresco/alfresco-build-tools/.github/actions/git-commit-changes@v8.26.0
|
|
||||||
with:
|
|
||||||
username: ${{ secrets.BOT_GITHUB_USERNAME }}
|
|
||||||
add-options: -u
|
|
||||||
commit-message: "Apply Pre-Commit code formatting"
|
|
||||||
skip-if-no-changes: true
|
|
||||||
- name: Push changes
|
|
||||||
run: git push
|
|
||||||
|
|||||||
@@ -41,3 +41,6 @@ alf_data
|
|||||||
/src/main/resources/alfresco/extension/custom-log4j.properties
|
/src/main/resources/alfresco/extension/custom-log4j.properties
|
||||||
|
|
||||||
libreoffice-dist-*-linux.gz
|
libreoffice-dist-*-linux.gz
|
||||||
|
|
||||||
|
# Claude Code local artifacts
|
||||||
|
.claude
|
||||||
|
|||||||
+43
-4
@@ -1,9 +1,48 @@
|
|||||||
repos:
|
repos:
|
||||||
- repo: https://github.com/Yelp/detect-secrets
|
- repo: https://github.com/pre-commit/pre-commit-hooks
|
||||||
rev: v1.5.0
|
rev: v6.0.0
|
||||||
hooks:
|
hooks:
|
||||||
- id: detect-secrets
|
- id: check-yaml
|
||||||
args: ["--baseline", ".secrets.baseline"]
|
args: [--allow-multiple-documents]
|
||||||
|
# Spring Boot configs use Maven resource-filtering tokens (e.g. @project.version@);
|
||||||
|
# '@' is a reserved YAML indicator, so strict PyYAML parsing cannot read them.
|
||||||
|
exclude: '^engines/(aio/src/main/resources/application-default|base/src/main/resources/application)\.yaml$'
|
||||||
|
- id: check-json
|
||||||
|
- id: check-xml
|
||||||
|
- id: check-merge-conflict
|
||||||
|
# The mutating whitespace hooks (end-of-file-fixer, trailing-whitespace,
|
||||||
|
# mixed-line-ending, fix-byte-order-marker) are intentionally deferred:
|
||||||
|
# enabling them requires a one-off normalization of ~200 existing files.
|
||||||
|
# Add them in a dedicated cleanup change so this config stays green:
|
||||||
|
# - id: fix-byte-order-marker
|
||||||
|
# - id: mixed-line-ending
|
||||||
|
# args: ['--fix=lf']
|
||||||
|
# - id: end-of-file-fixer
|
||||||
|
# - id: trailing-whitespace
|
||||||
|
|
||||||
|
- repo: https://github.com/sirosen/check-jsonschema
|
||||||
|
rev: 0.37.1
|
||||||
|
hooks:
|
||||||
|
- id: check-dependabot
|
||||||
|
- id: check-github-actions
|
||||||
|
- id: check-github-workflows
|
||||||
|
|
||||||
|
# markdownlint is intentionally omitted for now: the existing docs violate ~20
|
||||||
|
# default rules (line length, heading spacing, etc.). Enable it in a dedicated
|
||||||
|
# docs-normalization change (add a .markdownlint config + fix the docs) so the
|
||||||
|
# pre-commit CI gate stays green.
|
||||||
|
|
||||||
|
- repo: https://github.com/rhysd/actionlint
|
||||||
|
rev: v1.7.12
|
||||||
|
hooks:
|
||||||
|
- id: actionlint
|
||||||
|
|
||||||
|
- repo: https://github.com/hyland/github-actions-ensure-sha-pinned-actions
|
||||||
|
rev: v1.2.0
|
||||||
|
hooks:
|
||||||
|
- id: gha-sha-convert
|
||||||
|
args: [--allowlist, 'Alfresco/alfresco-build-tools/*']
|
||||||
|
|
||||||
- repo: local
|
- repo: local
|
||||||
hooks:
|
hooks:
|
||||||
- id: check-format-and-headers
|
- id: check-format-and-headers
|
||||||
|
|||||||
@@ -1,159 +0,0 @@
|
|||||||
{
|
|
||||||
"version": "1.5.0",
|
|
||||||
"plugins_used": [
|
|
||||||
{
|
|
||||||
"name": "ArtifactoryDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "AWSKeyDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "AzureStorageKeyDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "Base64HighEntropyString",
|
|
||||||
"limit": 4.5
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "BasicAuthDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "CloudantDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "DiscordBotTokenDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "GitHubTokenDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "GitLabTokenDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "HexHighEntropyString",
|
|
||||||
"limit": 3.0
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "IbmCloudIamDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "IbmCosHmacDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "IPPublicDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "JwtTokenDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "KeywordDetector",
|
|
||||||
"keyword_exclude": ""
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "MailchimpDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "NpmDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "OpenAIDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "PrivateKeyDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "PypiTokenDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "SendGridDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "SlackDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "SoftlayerDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "SquareOAuthDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "StripeDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "TelegramBotTokenDetector"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"name": "TwilioKeyDetector"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"filters_used": [
|
|
||||||
{
|
|
||||||
"path": "detect_secrets.filters.allowlist.is_line_allowlisted"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"path": "detect_secrets.filters.common.is_baseline_file",
|
|
||||||
"filename": ".secrets.baseline"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
|
|
||||||
"min_level": 2
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"path": "detect_secrets.filters.heuristic.is_indirect_reference"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"path": "detect_secrets.filters.heuristic.is_likely_id_string"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"path": "detect_secrets.filters.heuristic.is_lock_file"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"path": "detect_secrets.filters.heuristic.is_potential_uuid"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"path": "detect_secrets.filters.heuristic.is_sequential_string"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"path": "detect_secrets.filters.heuristic.is_swagger_file"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"path": "detect_secrets.filters.heuristic.is_templated_secret"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"results": {
|
|
||||||
"deprecated/alfresco-transformer-base/src/main/resources/application.yaml": [
|
|
||||||
{
|
|
||||||
"type": "Secret Keyword",
|
|
||||||
"filename": "deprecated/alfresco-transformer-base/src/main/resources/application.yaml",
|
|
||||||
"hashed_secret": "8c1ab56bc026c89468942df91166c35a277455a7",
|
|
||||||
"is_verified": false,
|
|
||||||
"line_number": 10
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"engines/base/src/main/resources/application.yaml": [
|
|
||||||
{
|
|
||||||
"type": "Secret Keyword",
|
|
||||||
"filename": "engines/base/src/main/resources/application.yaml",
|
|
||||||
"hashed_secret": "8c1ab56bc026c89468942df91166c35a277455a7",
|
|
||||||
"is_verified": false,
|
|
||||||
"line_number": 10
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"engines/libreoffice/src/test/resources/quick.vdx": [
|
|
||||||
{
|
|
||||||
"type": "Hex High Entropy String",
|
|
||||||
"filename": "engines/libreoffice/src/test/resources/quick.vdx",
|
|
||||||
"hashed_secret": "37c332070388a4797ccf1fa64f7029a193ce0371",
|
|
||||||
"is_verified": false,
|
|
||||||
"line_number": 2
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"generated_at": "2025-07-18T08:03:08Z"
|
|
||||||
}
|
|
||||||
+1
-27
@@ -3,7 +3,7 @@ Thanks for your interest in contributing to this project!
|
|||||||
|
|
||||||
The following is a set of guidelines for contributing to this library. Most of them will make the life of the reviewer easier and therefore decrease the time required for the patch be included in the next version.
|
The following is a set of guidelines for contributing to this library. Most of them will make the life of the reviewer easier and therefore decrease the time required for the patch be included in the next version.
|
||||||
|
|
||||||
The project uses [pre-commit](https://pre-commit.com/) to format code (with [Spotless](https://github.com/diffplug/spotless)), validate license headers and check for secrets (with [detect-secrets](https://github.com/Yelp/detect-secrets)). To install the pre-commit hooks then first install pre-commit and then run:
|
The project uses [pre-commit](https://pre-commit.com/) to format code (with [Spotless](https://github.com/diffplug/spotless)) and validate license headers. To install the pre-commit hooks then first install pre-commit and then run:
|
||||||
```shell
|
```shell
|
||||||
pre-commit install
|
pre-commit install
|
||||||
```
|
```
|
||||||
@@ -23,29 +23,3 @@ To reformat files you can use:
|
|||||||
mvn spotless:apply
|
mvn spotless:apply
|
||||||
```
|
```
|
||||||
|
|
||||||
#### Secret Detection
|
|
||||||
|
|
||||||
We are using [detect-secrets](https://github.com/Yelp/detect-secrets) to try to avoid accidentally publishing secret keys.
|
|
||||||
If you have pre-commit installed then this should run automatically when making a commit. Usually there should be no issues,
|
|
||||||
but if it finds a potential issue (e.g. a high entropy string) then you will see the following:
|
|
||||||
|
|
||||||
```shell
|
|
||||||
Detect secrets...........................................................Failed
|
|
||||||
- hook id: detect-secrets
|
|
||||||
- exit code: 1
|
|
||||||
|
|
||||||
ERROR: Potential secrets about to be committed to git repo!
|
|
||||||
|
|
||||||
Secret Type: Secret Keyword
|
|
||||||
Location: test.txt:1
|
|
||||||
```
|
|
||||||
|
|
||||||
If this is a false positive and you actually want to commit the string then run these two commands:
|
|
||||||
|
|
||||||
```shell
|
|
||||||
detect-secrets scan --baseline .secrets.baseline
|
|
||||||
detect-secrets audit .secrets.baseline
|
|
||||||
```
|
|
||||||
|
|
||||||
This will update the baseline file to include your new code and then allow you to review the detected secret and mark it as a false positive.
|
|
||||||
Once you are finished then you can add `.secrets.baseline` to the staged changes and you should be able to create a commit.
|
|
||||||
|
|||||||
@@ -1,22 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
|
|
||||||
echo "=========================== Starting Release Script ==========================="
|
|
||||||
PS4="\[\e[35m\]+ \[\e[m\]"
|
|
||||||
set -vex
|
|
||||||
pushd "$(dirname "${BASH_SOURCE[0]}")/../"
|
|
||||||
|
|
||||||
# GitHub Actions CI runner work on DETACHED HEAD, so we need to checkout the release branch
|
|
||||||
git checkout -B "${BRANCH_NAME}"
|
|
||||||
|
|
||||||
# Run the release plugin - with "[skip ci]" in the release commit message
|
|
||||||
mvn -B -Dmaven.wagon.http.pool=false \
|
|
||||||
-Prelease \
|
|
||||||
"-Darguments=-Prelease -DskipTests -Dmaven.javadoc.skip -Dadditionalparam=-Xdoclint:none" \
|
|
||||||
release:clean release:prepare release:perform \
|
|
||||||
-DscmCommentPrefix="[maven-release-plugin][skip ci] " \
|
|
||||||
-Dusername=alfresco-build \
|
|
||||||
-Dpassword=${GIT_PASSWORD}
|
|
||||||
|
|
||||||
popd
|
|
||||||
set +vex
|
|
||||||
echo "=========================== Finishing Release Script =========================="
|
|
||||||
+1
-1
@@ -31,7 +31,7 @@ mvn -B -U -Dmaven.wagon.http.pool=false \
|
|||||||
"-P${PROFILE},docker-it-setup,${1}" \
|
"-P${PROFILE},docker-it-setup,${1}" \
|
||||||
${ADDITIONAL_MAVEN_OPTS}
|
${ADDITIONAL_MAVEN_OPTS}
|
||||||
|
|
||||||
docker ps -a -q | xargs -r -l docker stop ; docker ps -a -q | xargs -r -l docker rm
|
docker ps -a -q | xargs -r -l docker stop ; docker ps -a -q | xargs -r -l docker rm || true
|
||||||
|
|
||||||
popd
|
popd
|
||||||
set +vex
|
set +vex
|
||||||
|
|||||||
+31
-16
@@ -7,6 +7,13 @@ The `ci.yml` config file can be found in the `.github/workflows` directory of th
|
|||||||
1. **Build**: Java build with unit and integration tests.
|
1. **Build**: Java build with unit and integration tests.
|
||||||
2. **Release**: Release with artifact deployment to Nexus, DockerHub and Quay.io.
|
2. **Release**: Release with artifact deployment to Nexus, DockerHub and Quay.io.
|
||||||
|
|
||||||
|
> The _Release_ stage uses the
|
||||||
|
> [`maven-release-slim`](https://github.com/Alfresco/alfresco-build-tools/tree/master/.github/actions/maven-release-slim)
|
||||||
|
> action from `alfresco-build-tools`. It authenticates with a **GitHub App token**, produces
|
||||||
|
> **verified (signed) commits and tags**, and deploys artifacts with `mvn deploy` (no
|
||||||
|
> `maven-release-plugin`). The release and next development versions are provided explicitly
|
||||||
|
> (see the _Release process steps_ below), which avoids the SemVer auto-increment issue.
|
||||||
|
|
||||||
|
|
||||||
## Branches
|
## Branches
|
||||||
GitHub Actions CI builds differ by branch:
|
GitHub Actions CI builds differ by branch:
|
||||||
@@ -31,29 +38,37 @@ All other branches are ignored.
|
|||||||
## Release process steps & info
|
## Release process steps & info
|
||||||
Prerequisites:
|
Prerequisites:
|
||||||
- the `master` / `SP/*` / `HF/*` branch is green and it contains all the changes that should be
|
- the `master` / `SP/*` / `HF/*` branch is green and it contains all the changes that should be
|
||||||
included in the next release.
|
included in the next release.
|
||||||
|
- the repository has the GitHub App configured for verified releases: the
|
||||||
|
`GH_APP_ENGINEERING_CONTRIB_CLIENT_ID` variable and `GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY`
|
||||||
|
secret are available, and the App is installed with `contents: write` permission.
|
||||||
|
|
||||||
Steps:
|
Steps:
|
||||||
1. Create a new branch with the name `ATS-###_release_version` from the `master` / `SP/*`/ `HF/*`
|
1. Create a new branch with the name `ATS-###_release_version` from the `master` / `SP/*`/ `HF/*`
|
||||||
branch.
|
branch.
|
||||||
2. Update the project version if the current POM version is not the next desired release; use a
|
2. Set the release and next development versions in the `env` block of
|
||||||
maven command, i.e.
|
`.github/workflows/ci.yml`:
|
||||||
```bash
|
```yaml
|
||||||
mvn versions:set -DnewVersion=#.##.#-SNAPSHOT versions:commit
|
RELEASE_VERSION: "5.4.5-A.1" # the version of the release (git tag)
|
||||||
|
DEVELOPMENT_VERSION: "5.4.5-A.2-SNAPSHOT" # the version set in the POMs after the release
|
||||||
```
|
```
|
||||||
3. Update the project's dependencies (remove the `-SNAPSHOT` suffixes - only for dependencies, not
|
> The `maven-release-slim` action sets `RELEASE_VERSION` in every `pom.xml`, deploys the
|
||||||
for the local project version).
|
> artifacts, creates the verified tag, then sets `DEVELOPMENT_VERSION` for the next iteration
|
||||||
4. Create a new commit with the `[release]` tag in its message. If no local changes have
|
> - all as verified commits.
|
||||||
been generated by steps (2) and (3), then an empty commit should be created - e.g.
|
3. Create a new commit with the `[release]` tag in its message. The version changes from step (2)
|
||||||
|
can be included in this same commit - e.g.
|
||||||
```bash
|
```bash
|
||||||
git commit --allow-empty -m "ATS-###: Release T-Core (T-Engines) #.##.# [release]"
|
git commit -am "ATS-###: Release T-Core (T-Engines) 5.4.5-A.1 [release]"
|
||||||
```
|
```
|
||||||
|
|
||||||
> The location of the `[release]` tag in the commit message is irrelevant.
|
> The location of the `[release]` tag in the commit message is irrelevant.
|
||||||
|
|
||||||
5. Open a new Pull Request from the `ATS-###_release_version` branch into the original
|
4. Open a new Pull Request from the `ATS-###_release_version` branch into the original
|
||||||
`master` / `SP/*` / `HF/*` branch and wait for a green build.
|
`master` / `SP/*` / `HF/*` branch and wait for a green build.
|
||||||
6. Once it is approved, merge the PR, preferably through the **Rebase and merge** option. If the
|
5. Once it is approved, merge the PR, preferably through the **Rebase and merge** option. If the
|
||||||
**Create a merge commit** (_Merge pull request_) or **Squash and merge** options are used, you
|
**Create a merge commit** (_Merge pull request_) or **Squash and merge** options are used, you
|
||||||
need to ensure that the _commit message_ contains the `[release]` tag (sub-string).
|
need to ensure that the _commit message_ contains the `[release]` tag (sub-string).
|
||||||
|
6. After the _Release_ stage completes, verify in GitHub that the release commits and the new tag
|
||||||
|
are marked as **Verified**.
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
+1
-1
@@ -7,7 +7,7 @@
|
|||||||
<parent>
|
<parent>
|
||||||
<groupId>org.alfresco</groupId>
|
<groupId>org.alfresco</groupId>
|
||||||
<artifactId>alfresco-transform-core</artifactId>
|
<artifactId>alfresco-transform-core</artifactId>
|
||||||
<version>5.4.5-A.1-SNAPSHOT</version>
|
<version>5.4.5-A.4-SNAPSHOT</version>
|
||||||
<relativePath>../../pom.xml</relativePath>
|
<relativePath>../../pom.xml</relativePath>
|
||||||
</parent>
|
</parent>
|
||||||
|
|
||||||
|
|||||||
@@ -7,7 +7,7 @@
|
|||||||
<parent>
|
<parent>
|
||||||
<groupId>org.alfresco</groupId>
|
<groupId>org.alfresco</groupId>
|
||||||
<artifactId>alfresco-transform-core</artifactId>
|
<artifactId>alfresco-transform-core</artifactId>
|
||||||
<version>5.4.5-A.1-SNAPSHOT</version>
|
<version>5.4.5-A.4-SNAPSHOT</version>
|
||||||
<relativePath>../../pom.xml</relativePath>
|
<relativePath>../../pom.xml</relativePath>
|
||||||
</parent>
|
</parent>
|
||||||
|
|
||||||
|
|||||||
@@ -7,7 +7,7 @@
|
|||||||
<parent>
|
<parent>
|
||||||
<groupId>org.alfresco</groupId>
|
<groupId>org.alfresco</groupId>
|
||||||
<artifactId>alfresco-transform-core</artifactId>
|
<artifactId>alfresco-transform-core</artifactId>
|
||||||
<version>5.4.5-A.1-SNAPSHOT</version>
|
<version>5.4.5-A.4-SNAPSHOT</version>
|
||||||
<relativePath>../../pom.xml</relativePath>
|
<relativePath>../../pom.xml</relativePath>
|
||||||
</parent>
|
</parent>
|
||||||
|
|
||||||
|
|||||||
@@ -7,7 +7,7 @@
|
|||||||
<parent>
|
<parent>
|
||||||
<groupId>org.alfresco</groupId>
|
<groupId>org.alfresco</groupId>
|
||||||
<artifactId>alfresco-transform-core</artifactId>
|
<artifactId>alfresco-transform-core</artifactId>
|
||||||
<version>5.4.5-A.1-SNAPSHOT</version>
|
<version>5.4.5-A.4-SNAPSHOT</version>
|
||||||
<relativePath>../../pom.xml</relativePath>
|
<relativePath>../../pom.xml</relativePath>
|
||||||
</parent>
|
</parent>
|
||||||
|
|
||||||
|
|||||||
@@ -7,7 +7,7 @@
|
|||||||
<parent>
|
<parent>
|
||||||
<groupId>org.alfresco</groupId>
|
<groupId>org.alfresco</groupId>
|
||||||
<artifactId>alfresco-transform-core</artifactId>
|
<artifactId>alfresco-transform-core</artifactId>
|
||||||
<version>5.4.5-A.1-SNAPSHOT</version>
|
<version>5.4.5-A.4-SNAPSHOT</version>
|
||||||
<relativePath>../../pom.xml</relativePath>
|
<relativePath>../../pom.xml</relativePath>
|
||||||
</parent>
|
</parent>
|
||||||
|
|
||||||
|
|||||||
@@ -7,7 +7,7 @@
|
|||||||
<parent>
|
<parent>
|
||||||
<groupId>org.alfresco</groupId>
|
<groupId>org.alfresco</groupId>
|
||||||
<artifactId>alfresco-transform-core</artifactId>
|
<artifactId>alfresco-transform-core</artifactId>
|
||||||
<version>5.4.5-A.1-SNAPSHOT</version>
|
<version>5.4.5-A.4-SNAPSHOT</version>
|
||||||
<relativePath>../../pom.xml</relativePath>
|
<relativePath>../../pom.xml</relativePath>
|
||||||
</parent>
|
</parent>
|
||||||
|
|
||||||
|
|||||||
@@ -7,7 +7,7 @@
|
|||||||
<parent>
|
<parent>
|
||||||
<groupId>org.alfresco</groupId>
|
<groupId>org.alfresco</groupId>
|
||||||
<artifactId>alfresco-transform-core</artifactId>
|
<artifactId>alfresco-transform-core</artifactId>
|
||||||
<version>5.4.5-A.1-SNAPSHOT</version>
|
<version>5.4.5-A.4-SNAPSHOT</version>
|
||||||
<relativePath>../../pom.xml</relativePath>
|
<relativePath>../../pom.xml</relativePath>
|
||||||
</parent>
|
</parent>
|
||||||
|
|
||||||
|
|||||||
@@ -7,7 +7,7 @@
|
|||||||
<parent>
|
<parent>
|
||||||
<groupId>org.alfresco</groupId>
|
<groupId>org.alfresco</groupId>
|
||||||
<artifactId>alfresco-transform-core</artifactId>
|
<artifactId>alfresco-transform-core</artifactId>
|
||||||
<version>5.4.5-A.1-SNAPSHOT</version>
|
<version>5.4.5-A.4-SNAPSHOT</version>
|
||||||
<relativePath>../../pom.xml</relativePath>
|
<relativePath>../../pom.xml</relativePath>
|
||||||
</parent>
|
</parent>
|
||||||
|
|
||||||
|
|||||||
+1
-8
@@ -8,7 +8,7 @@
|
|||||||
<parent>
|
<parent>
|
||||||
<groupId>org.alfresco</groupId>
|
<groupId>org.alfresco</groupId>
|
||||||
<artifactId>alfresco-transform-core</artifactId>
|
<artifactId>alfresco-transform-core</artifactId>
|
||||||
<version>5.4.5-A.1-SNAPSHOT</version>
|
<version>5.4.5-A.4-SNAPSHOT</version>
|
||||||
</parent>
|
</parent>
|
||||||
|
|
||||||
<properties>
|
<properties>
|
||||||
@@ -84,13 +84,6 @@
|
|||||||
<build>
|
<build>
|
||||||
<pluginManagement>
|
<pluginManagement>
|
||||||
<plugins>
|
<plugins>
|
||||||
<plugin>
|
|
||||||
<artifactId>maven-release-plugin</artifactId>
|
|
||||||
<version>3.1.1</version>
|
|
||||||
<configuration>
|
|
||||||
<tagNameFormat>@{project.version}</tagNameFormat>
|
|
||||||
</configuration>
|
|
||||||
</plugin>
|
|
||||||
<plugin>
|
<plugin>
|
||||||
<groupId>org.apache.maven.plugins</groupId>
|
<groupId>org.apache.maven.plugins</groupId>
|
||||||
<artifactId>maven-surefire-plugin</artifactId>
|
<artifactId>maven-surefire-plugin</artifactId>
|
||||||
|
|||||||
@@ -3,7 +3,7 @@
|
|||||||
<modelVersion>4.0.0</modelVersion>
|
<modelVersion>4.0.0</modelVersion>
|
||||||
<groupId>org.alfresco</groupId>
|
<groupId>org.alfresco</groupId>
|
||||||
<artifactId>alfresco-transform-core</artifactId>
|
<artifactId>alfresco-transform-core</artifactId>
|
||||||
<version>5.4.5-A.1-SNAPSHOT</version>
|
<version>5.4.5-A.4-SNAPSHOT</version>
|
||||||
<name>Alfresco Transform Core</name>
|
<name>Alfresco Transform Core</name>
|
||||||
<packaging>pom</packaging>
|
<packaging>pom</packaging>
|
||||||
|
|
||||||
@@ -311,14 +311,6 @@
|
|||||||
|
|
||||||
<pluginManagement>
|
<pluginManagement>
|
||||||
<plugins>
|
<plugins>
|
||||||
<plugin>
|
|
||||||
<groupId>org.apache.maven.plugins</groupId>
|
|
||||||
<artifactId>maven-release-plugin</artifactId>
|
|
||||||
<version>3.1.1</version>
|
|
||||||
<configuration>
|
|
||||||
<tagNameFormat>@{project.version}</tagNameFormat>
|
|
||||||
</configuration>
|
|
||||||
</plugin>
|
|
||||||
<plugin>
|
<plugin>
|
||||||
<groupId>org.codehaus.mojo</groupId>
|
<groupId>org.codehaus.mojo</groupId>
|
||||||
<artifactId>license-maven-plugin</artifactId>
|
<artifactId>license-maven-plugin</artifactId>
|
||||||
|
|||||||
Reference in New Issue
Block a user