inteligr8/alfresco-transform-core
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-transform-core.git synced 2026-09-16 18:12:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

ACS-12080: Migrate ATS release to verified commits and GitHub App tokens (maven-release-slim) (#1321)

Browse Source 
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: gionn <71768+gionn@users.noreply.github.com>
This commit is contained in:
Dhaval Patel
2026-08-06 11:30:48 +05:30
committed by GitHub
co-authored by copilot-swe-agent[bot] gionn
parent 7e4eb8a5cb
commit b23826a338
22 changed files with 332 additions and 379 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/copilot-instructions.md
+72
View File
@@ -0,0 +1,72 @@
# Copilot / AI assistant instructions — Alfresco Transform Core
Guidance for AI coding agents working in this repository. Keep changes minimal,
consistent with existing conventions, and always buildable.
## What this project is
Alfresco Transform Core contains the common transformer ("T-Engine") code plus a set of
concrete T-Engine implementations. Each T-Engine is a Spring Boot application that is also
packaged as a Docker image. Client, T-Engine and T-Router exchange JSON described by the
shared `model` library.
## Tech stack
- **Java 17** (`java.version` in the root `pom.xml`); some artifacts also target Java 11
(`acs-compatible.java.version`) for ACS compatibility.
- **Spring Boot** (inherited from `spring-boot-starter-parent`).
- **Maven** multi-module build. **Docker** images per engine.
- Code style enforced via **Spotless** and license-header checks; hooks run through
**pre-commit**.
## Repository layout
- `model/` — JSON data model + transform-selection logic, packaged as a jar.
- `engines/base/` — code common to all T-Engines (the current base).
- `engines/<name>/` — individual T-Engines (`imagemagick`, `libreoffice`, `misc`,
`pdfrenderer`, `tika`, `example`) plus `aio` (All-In-One). Each builds a Spring Boot jar
and a Docker image.
- `deprecated/alfresco-transformer-base/` — the original base; retained but superseded by
`engines/base`.
- `_ci/` — CI helper scripts (`build.sh`, `test.sh`, `cache_artifacts.sh`).
- `docs/` — additional documentation (transform config, probes, scaling, release, …).
- `scripts/hooks/` — local pre-commit hook scripts (formatting + license headers).
Maven profiles select which modules build: `full-build` (default, everything), `base`,
and one per engine (e.g. `imagemagick`, `libreoffice`, `misc`, `pdf-renderer`, `tika`).
## Build & test
- Full local build with per-engine Docker images and integration setup:
```bash
mvn clean install -Plocal,docker-it-setup
```
- Base libraries only: `mvn clean install -Pbase`.
- A single engine locally, mirroring CI: `bash _ci/build.sh <buildProfile>` then
`bash _ci/test.sh <testProfile>` (see the matrix in `.github/workflows/ci.yml`).
- Integration tests are `*IT.java` and require the `docker-it-setup` profile.
## Running a T-Engine
A T-Engine is a Spring Boot app (`org.alfresco.transform.base.Application`):
- `mvn spring-boot:run`, or `java -jar target/<engine>-{version}.jar`.
- Serves on port `8090`; test page at `http://localhost:8090/`, config at
`http://localhost:8090/transform/config`.
## Conventions
- Keep formatting Spotless-clean and preserve license headers — the
`scripts/hooks/check-format-and-headers.sh` pre-commit hook fixes Java files.
- Pin dependency and plugin versions via `<properties>` in the root `pom.xml` rather than
inline in child modules.
- In GitHub Actions, third-party actions must be SHA-pinned with a version comment; only
`Alfresco/alfresco-build-tools/*` may use release tags. Never place secrets in a
workflow-level `env` block — scope them to the steps that need them.
## Where to look first
- Root `pom.xml` for versions, profiles and module wiring.
- `README.md` for a high-level overview and artifact/Docker details.
- `docs/` for transform config, transformer selection, probes and the release process.
.github/dependabot.yml
+51 -59
View File
@@ -1,3 +1,5 @@
# Documentation for all configuration options:
# https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference
version: 2
registries:
maven-alfresco-internal:
@@ -6,62 +8,52 @@ registries:
username: ${{secrets.NEXUS_USERNAME}}
password: ${{secrets.NEXUS_PASSWORD}}
updates:
- package-ecosystem: maven
directory: "/"
schedule:
interval: daily
time: "22:00"
timezone: Europe/London
open-pull-requests-limit: 99
registries:
- maven-alfresco-internal
- package-ecosystem: docker
directory: "engines/aio"
schedule:
interval: daily
time: "22:00"
timezone: Europe/London
open-pull-requests-limit: 99
- package-ecosystem: docker
directory: "engines/libreoffice"
schedule:
interval: daily
time: "22:00"
timezone: Europe/London
open-pull-requests-limit: 99
- package-ecosystem: docker
directory: "engines/imagemagick"
schedule:
interval: daily
time: "22:00"
timezone: Europe/London
open-pull-requests-limit: 99
- package-ecosystem: docker
directory: "engines/misc"
schedule:
interval: daily
time: "22:00"
timezone: Europe/London
open-pull-requests-limit: 99
- package-ecosystem: docker
directory: "engines/tika"
schedule:
interval: daily
time: "22:00"
timezone: Europe/London
open-pull-requests-limit: 99
- package-ecosystem: docker
directory: "engines/pdfrenderer"
schedule:
interval: daily
time: "22:00"
timezone: Europe/London
open-pull-requests-limit: 99
- package-ecosystem: github-actions
directory: "/"
schedule:
interval: monthly
groups:
github-actions:
patterns:
- "*"
- package-ecosystem: "github-actions"
directories:
- "/"
schedule:
interval: "weekly"
labels:
- "dependencies"
- "github_actions"
cooldown:
default-days: 7
groups:
github-actions:
patterns:
- "*"
- package-ecosystem: "maven"
directories:
- "/"
schedule:
interval: "weekly"
open-pull-requests-limit: 99
registries:
- maven-alfresco-internal
labels:
- "dependencies"
- "java"
cooldown:
default-days: 7
groups:
maven:
patterns:
- "*"
- package-ecosystem: "docker"
directories:
# Each T-Engine ships its own Dockerfile; the glob collapses the siblings.
- "engines/*"
schedule:
interval: "weekly"
open-pull-requests-limit: 99
labels:
- "dependencies"
- "docker"
cooldown:
default-days: 7
groups:
docker:
patterns:
- "*"
.github/workflows/ci.yml
+113 -45
View File
@@ -22,17 +22,16 @@ on:
- cron: '0 5 * * 1'
workflow_dispatch:
# NOTE: Secrets are intentionally NOT declared at the workflow (top) level.
# A workflow-level `env` exposes secrets to every job/step (including third-party
# actions). Secrets are scoped to the individual steps that need them instead.
env:
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
GIT_USERNAME: ${{ secrets.BOT_GITHUB_USERNAME }}
GIT_EMAIL: ${{ secrets.BOT_GITHUB_EMAIL }}
GIT_PASSWORD: ${{ secrets.BOT_GITHUB_TOKEN }}
GITHUB_ACTIONS_DEPLOY_TIMEOUT: 120
# Both variables are required to be set before the release process starts.
# As the release is triggered by a commit message with "[release]" keyword on a release branch,
# setting these variables to new values can be done in the same commit and will indicate the release and the dev versions in it.
RELEASE_VERSION: "5.4.5-A.3" # The version of the release (tag).
DEVELOPMENT_VERSION: "5.4.5-A.4-SNAPSHOT" # The version that will be set in pom files after the release (next dev version)
permissions:
contents: read
@@ -41,7 +40,7 @@ jobs:
pre_commit:
runs-on: ubuntu-latest
steps:
- uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v9.3.1
- uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v18.21.2
test_run_check:
name: "Test run check"
@@ -66,10 +65,17 @@ jobs:
- test_run_check
if: needs.test_run_check.outputs.tests == 'true' && github.event_name == 'pull_request'
steps:
- uses: actions/checkout@v4
- uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v9.3.1
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v9.3.1
- uses: Alfresco/ya-pmd-scan@v4.1.0
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.21.2
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
- uses: Alfresco/ya-pmd-scan@e817ecd9292844800451c42f07cdebdb14268cfa # v4.1.0
env:
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
with:
classpath-build-command: "mvn -ntp package -DskipTests"
@@ -81,16 +87,16 @@ jobs:
- test_run_check
if: needs.test_run_check.outputs.tests == 'true'
steps:
- uses: actions/checkout@v4
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v9.3.1
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v9.3.1
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.2
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
- name: "Login to Docker Hub"
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: "Login to Quay.io"
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
registry: quay.io
username: ${{ secrets.QUAY_USERNAME }}
@@ -100,14 +106,28 @@ jobs:
echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
sudo service docker restart
- name: "Clean-up SNAPSHOT artifacts"
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" | xargs -r -l rm -rf
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
- name: "Build"
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
env:
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
run: mvn -B -U -q clean install -DadditionalOption=-Xdoclint:none -DskipTests -Dmaven.javadoc.skip=true -Dmaven.wagon.http.pool=false -Pbase
- name: "Cache LibreOffice"
run: bash _ci/cache_artifacts.sh
- name: "Run tests"
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
env:
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
run: mvn -B -U clean deploy -DadditionalOption=-Xdoclint:none -Dmaven.javadoc.skip=true -Dmaven.wagon.http.pool=false -Pbase
all_tests_matrix:
@@ -140,16 +160,16 @@ jobs:
buildProfile: full-build
testProfile: aio-test
steps:
- uses: actions/checkout@v4
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v9.3.1
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v9.3.1
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.2
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
- name: "Login to Docker Hub"
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: "Login to Quay.io"
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
registry: quay.io
username: ${{ secrets.QUAY_USERNAME }}
@@ -159,14 +179,28 @@ jobs:
echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
sudo service docker restart
- name: "Clean-up SNAPSHOT artifacts"
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" | xargs -r -l rm -rf
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
- name: "Build local docker image"
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
env:
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
run: bash _ci/build.sh ${{ matrix.buildProfile }}
- name: "Cache LibreOffice"
run: bash _ci/cache_artifacts.sh
- name: "Run tests"
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
env:
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
run: bash _ci/test.sh ${{ matrix.testProfile }}
e2e_javaruntime_tests:
@@ -181,16 +215,16 @@ jobs:
matrix:
java: [ '21', '25' ]
steps:
- uses: actions/checkout@v4
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v9.3.1
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v9.3.1
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.2
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
- name: "Login to Docker Hub"
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: "Login to Quay.io"
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
registry: quay.io
username: ${{ secrets.QUAY_USERNAME }}
@@ -200,9 +234,16 @@ jobs:
echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
sudo service docker restart
- name: "Clean-up SNAPSHOT artifacts"
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" | xargs -r -l rm -rf
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
- name: "Build local docker image"
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
env:
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
run: bash _ci/build.sh full-build
- name: "Cache LibreOffice"
run: bash _ci/cache_artifacts.sh
@@ -212,6 +253,12 @@ jobs:
SMOKE_TESTS: true
SKIP_DEPLOY: true
JAVA_RUNTIME_VERSION: ${{ matrix.java }}
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
run: bash _ci/test.sh aio-test
release:
@@ -224,23 +271,32 @@ jobs:
github.event_name != 'pull_request' &&
(github.ref_name == 'master' || startsWith(github.ref_name, 'SP/') || startsWith(github.ref_name, 'HF/'))
steps:
- uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v9.3.1
- uses: actions/checkout@v4
- name: Generate app token
id: app-token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
persist-credentials: false
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v9.3.1
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v9.3.1
client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }}
private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }}
permission-contents: write
- uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.21.2
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
token: ${{ steps.app-token.outputs.token }}
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.2
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
with:
platforms: linux/amd64,linux/arm64
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
- name: "Login to Docker Hub"
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: "Login to Quay.io"
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
registry: quay.io
username: ${{ secrets.QUAY_USERNAME }}
@@ -250,14 +306,26 @@ jobs:
echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
sudo service docker restart
- name: "Clean-up SNAPSHOT artifacts"
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" | xargs -r -l rm -rf
- uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@v9.3.1
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
- uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@v18.21.2
with:
username: ${{ env.GIT_USERNAME }}
email: ${{ env.GIT_EMAIL }}
username: ${{ secrets.BOT_GITHUB_USERNAME }}
email: ${{ secrets.BOT_GITHUB_EMAIL }}
global: true
- name: "Cache LibreOffice"
run: bash _ci/cache_artifacts.sh
- name: "Release"
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
run: bash _ci/release.sh
uses: Alfresco/alfresco-build-tools/.github/actions/maven-release-slim@v18.21.2
env:
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
with:
token: ${{ steps.app-token.outputs.token }}
release-version: ${{ env.RELEASE_VERSION }}
development-version: ${{ env.DEVELOPMENT_VERSION }}
maven-args: "-DskipTests -Dmaven.javadoc.skip=true -DadditionalOption=-Xdoclint:none -Dmaven.wagon.http.pool=false"
.github/workflows/precommit_formatter.yml
+2 -18
View File
@@ -16,22 +16,6 @@ jobs:
contents: write
if: contains(github.event.head_commit.message, '[reformat code]')
steps:
- uses: actions/checkout@v4
- name: Set up Python ${{ inputs.python-version }}
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
- uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v18.21.2
with:
python-version: "3.9"
- uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
continue-on-error: true
with:
extra_args: --all-files
- name: Update secrets baseline
run: pip install detect-secrets && detect-secrets scan --baseline .secrets.baseline
- uses: Alfresco/alfresco-build-tools/.github/actions/git-commit-changes@v8.26.0
with:
username: ${{ secrets.BOT_GITHUB_USERNAME }}
add-options: -u
commit-message: "Apply Pre-Commit code formatting"
skip-if-no-changes: true
- name: Push changes
run: git push
auto-commit: "true"
.gitignore
+3
View File
@@ -41,3 +41,6 @@ alf_data
/src/main/resources/alfresco/extension/custom-log4j.properties
libreoffice-dist-*-linux.gz
# Claude Code local artifacts
.claude
.pre-commit-config.yaml
+43 -4
View File
@@ -1,9 +1,48 @@
repos:
- repo: https://github.com/Yelp/detect-secrets
rev: v1.5.0
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v6.0.0
hooks:
- id: detect-secrets
args: ["--baseline", ".secrets.baseline"]
- id: check-yaml
args: [--allow-multiple-documents]
# Spring Boot configs use Maven resource-filtering tokens (e.g. @project.version@);
# '@' is a reserved YAML indicator, so strict PyYAML parsing cannot read them.
exclude: '^engines/(aio/src/main/resources/application-default|base/src/main/resources/application)\.yaml$'
- id: check-json
- id: check-xml
- id: check-merge-conflict
# The mutating whitespace hooks (end-of-file-fixer, trailing-whitespace,
# mixed-line-ending, fix-byte-order-marker) are intentionally deferred:
# enabling them requires a one-off normalization of ~200 existing files.
# Add them in a dedicated cleanup change so this config stays green:
# - id: fix-byte-order-marker
# - id: mixed-line-ending
# args: ['--fix=lf']
# - id: end-of-file-fixer
# - id: trailing-whitespace
- repo: https://github.com/sirosen/check-jsonschema
rev: 0.37.1
hooks:
- id: check-dependabot
- id: check-github-actions
- id: check-github-workflows
# markdownlint is intentionally omitted for now: the existing docs violate ~20
# default rules (line length, heading spacing, etc.). Enable it in a dedicated
# docs-normalization change (add a .markdownlint config + fix the docs) so the
# pre-commit CI gate stays green.
- repo: https://github.com/rhysd/actionlint
rev: v1.7.12
hooks:
- id: actionlint
- repo: https://github.com/hyland/github-actions-ensure-sha-pinned-actions
rev: v1.2.0
hooks:
- id: gha-sha-convert
args: [--allowlist, 'Alfresco/alfresco-build-tools/*']
- repo: local
hooks:
- id: check-format-and-headers
.secrets.baseline
-159
View File
@@ -1,159 +0,0 @@
{
"version": "1.5.0",
"plugins_used": [
{
"name": "ArtifactoryDetector"
},
{
"name": "AWSKeyDetector"
},
{
"name": "AzureStorageKeyDetector"
},
{
"name": "Base64HighEntropyString",
"limit": 4.5
},
{
"name": "BasicAuthDetector"
},
{
"name": "CloudantDetector"
},
{
"name": "DiscordBotTokenDetector"
},
{
"name": "GitHubTokenDetector"
},
{
"name": "GitLabTokenDetector"
},
{
"name": "HexHighEntropyString",
"limit": 3.0
},
{
"name": "IbmCloudIamDetector"
},
{
"name": "IbmCosHmacDetector"
},
{
"name": "IPPublicDetector"
},
{
"name": "JwtTokenDetector"
},
{
"name": "KeywordDetector",
"keyword_exclude": ""
},
{
"name": "MailchimpDetector"
},
{
"name": "NpmDetector"
},
{
"name": "OpenAIDetector"
},
{
"name": "PrivateKeyDetector"
},
{
"name": "PypiTokenDetector"
},
{
"name": "SendGridDetector"
},
{
"name": "SlackDetector"
},
{
"name": "SoftlayerDetector"
},
{
"name": "SquareOAuthDetector"
},
{
"name": "StripeDetector"
},
{
"name": "TelegramBotTokenDetector"
},
{
"name": "TwilioKeyDetector"
}
],
"filters_used": [
{
"path": "detect_secrets.filters.allowlist.is_line_allowlisted"
},
{
"path": "detect_secrets.filters.common.is_baseline_file",
"filename": ".secrets.baseline"
},
{
"path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
"min_level": 2
},
{
"path": "detect_secrets.filters.heuristic.is_indirect_reference"
},
{
"path": "detect_secrets.filters.heuristic.is_likely_id_string"
},
{
"path": "detect_secrets.filters.heuristic.is_lock_file"
},
{
"path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string"
},
{
"path": "detect_secrets.filters.heuristic.is_potential_uuid"
},
{
"path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign"
},
{
"path": "detect_secrets.filters.heuristic.is_sequential_string"
},
{
"path": "detect_secrets.filters.heuristic.is_swagger_file"
},
{
"path": "detect_secrets.filters.heuristic.is_templated_secret"
}
],
"results": {
"deprecated/alfresco-transformer-base/src/main/resources/application.yaml": [
{
"type": "Secret Keyword",
"filename": "deprecated/alfresco-transformer-base/src/main/resources/application.yaml",
"hashed_secret": "8c1ab56bc026c89468942df91166c35a277455a7",
"is_verified": false,
"line_number": 10
}
],
"engines/base/src/main/resources/application.yaml": [
{
"type": "Secret Keyword",
"filename": "engines/base/src/main/resources/application.yaml",
"hashed_secret": "8c1ab56bc026c89468942df91166c35a277455a7",
"is_verified": false,
"line_number": 10
}
],
"engines/libreoffice/src/test/resources/quick.vdx": [
{
"type": "Hex High Entropy String",
"filename": "engines/libreoffice/src/test/resources/quick.vdx",
"hashed_secret": "37c332070388a4797ccf1fa64f7029a193ce0371",
"is_verified": false,
"line_number": 2
}
]
},
"generated_at": "2025-07-18T08:03:08Z"
}
CLAUDE.md
+2
View File
@@ -0,0 +1,2 @@
@.github/copilot-instructions.md
CONTRIBUTING.md
+1 -27
View File
@@ -3,7 +3,7 @@ Thanks for your interest in contributing to this project!
The following is a set of guidelines for contributing to this library. Most of them will make the life of the reviewer easier and therefore decrease the time required for the patch be included in the next version.
The project uses [pre-commit](https://pre-commit.com/) to format code (with [Spotless](https://github.com/diffplug/spotless)), validate license headers and check for secrets (with [detect-secrets](https://github.com/Yelp/detect-secrets)). To install the pre-commit hooks then first install pre-commit and then run:
The project uses [pre-commit](https://pre-commit.com/) to format code (with [Spotless](https://github.com/diffplug/spotless)) and validate license headers. To install the pre-commit hooks then first install pre-commit and then run:
```shell
pre-commit install
```
@@ -23,29 +23,3 @@ To reformat files you can use:
mvn spotless:apply
```
#### Secret Detection
We are using [detect-secrets](https://github.com/Yelp/detect-secrets) to try to avoid accidentally publishing secret keys.
If you have pre-commit installed then this should run automatically when making a commit. Usually there should be no issues,
but if it finds a potential issue (e.g. a high entropy string) then you will see the following:
```shell
Detect secrets...........................................................Failed
- hook id: detect-secrets
- exit code: 1
ERROR: Potential secrets about to be committed to git repo!
Secret Type: Secret Keyword
Location: test.txt:1
```
If this is a false positive and you actually want to commit the string then run these two commands:
```shell
detect-secrets scan --baseline .secrets.baseline
detect-secrets audit .secrets.baseline
```
This will update the baseline file to include your new code and then allow you to review the detected secret and mark it as a false positive.
Once you are finished then you can add `.secrets.baseline` to the staged changes and you should be able to create a commit.
_ci/release.sh
-22
View File
@@ -1,22 +0,0 @@
#!/usr/bin/env bash
echo "=========================== Starting Release Script ==========================="
PS4="\[\e[35m\]+ \[\e[m\]"
set -vex
pushd "$(dirname "${BASH_SOURCE[0]}")/../"
# GitHub Actions CI runner work on DETACHED HEAD, so we need to checkout the release branch
git checkout -B "${BRANCH_NAME}"
# Run the release plugin - with "[skip ci]" in the release commit message
mvn -B -Dmaven.wagon.http.pool=false \
-Prelease \
"-Darguments=-Prelease -DskipTests -Dmaven.javadoc.skip -Dadditionalparam=-Xdoclint:none" \
release:clean release:prepare release:perform \
-DscmCommentPrefix="[maven-release-plugin][skip ci] " \
-Dusername=alfresco-build \
-Dpassword=${GIT_PASSWORD}
popd
set +vex
echo "=========================== Finishing Release Script =========================="
_ci/test.sh
+1 -1
View File
@@ -31,7 +31,7 @@ mvn -B -U -Dmaven.wagon.http.pool=false \
"-P${PROFILE},docker-it-setup,${1}" \
${ADDITIONAL_MAVEN_OPTS}
docker ps -a -q | xargs -r -l docker stop ; docker ps -a -q | xargs -r -l docker rm
docker ps -a -q | xargs -r -l docker stop ; docker ps -a -q | xargs -r -l docker rm || true
popd
set +vex
docs/build-and-release.md
+31 -16
View File
@@ -7,6 +7,13 @@ The `ci.yml` config file can be found in the `.github/workflows` directory of th
1. **Build**: Java build with unit and integration tests.
2. **Release**: Release with artifact deployment to Nexus, DockerHub and Quay.io.
> The _Release_ stage uses the
> [`maven-release-slim`](https://github.com/Alfresco/alfresco-build-tools/tree/master/.github/actions/maven-release-slim)
> action from `alfresco-build-tools`. It authenticates with a **GitHub App token**, produces
> **verified (signed) commits and tags**, and deploys artifacts with `mvn deploy` (no
> `maven-release-plugin`). The release and next development versions are provided explicitly
> (see the _Release process steps_ below), which avoids the SemVer auto-increment issue.
## Branches
GitHub Actions CI builds differ by branch:
@@ -31,29 +38,37 @@ All other branches are ignored.
## Release process steps & info
Prerequisites:
- the `master` / `SP/*` / `HF/*` branch is green and it contains all the changes that should be
included in the next release.
included in the next release.
- the repository has the GitHub App configured for verified releases: the
`GH_APP_ENGINEERING_CONTRIB_CLIENT_ID` variable and `GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY`
secret are available, and the App is installed with `contents: write` permission.
Steps:
1. Create a new branch with the name `ATS-###_release_version` from the `master` / `SP/*`/ `HF/*`
branch.
2. Update the project version if the current POM version is not the next desired release; use a
maven command, i.e.
```bash
mvn versions:set -DnewVersion=#.##.#-SNAPSHOT versions:commit
branch.
2. Set the release and next development versions in the `env` block of
`.github/workflows/ci.yml`:
```yaml
RELEASE_VERSION: "5.4.5-A.1" # the version of the release (git tag)
DEVELOPMENT_VERSION: "5.4.5-A.2-SNAPSHOT" # the version set in the POMs after the release
```
3. Update the project's dependencies (remove the `-SNAPSHOT` suffixes - only for dependencies, not
for the local project version).
4. Create a new commit with the `[release]` tag in its message. If no local changes have
been generated by steps (2) and (3), then an empty commit should be created - e.g.
> The `maven-release-slim` action sets `RELEASE_VERSION` in every `pom.xml`, deploys the
> artifacts, creates the verified tag, then sets `DEVELOPMENT_VERSION` for the next iteration
> - all as verified commits.
3. Create a new commit with the `[release]` tag in its message. The version changes from step (2)
can be included in this same commit - e.g.
```bash
git commit --allow-empty -m "ATS-###: Release T-Core (T-Engines) #.##.# [release]"
git commit -am "ATS-###: Release T-Core (T-Engines) 5.4.5-A.1 [release]"
```
> The location of the `[release]` tag in the commit message is irrelevant.
5. Open a new Pull Request from the `ATS-###_release_version` branch into the original
`master` / `SP/*` / `HF/*` branch and wait for a green build.
6. Once it is approved, merge the PR, preferably through the **Rebase and merge** option. If the
**Create a merge commit** (_Merge pull request_) or **Squash and merge** options are used, you
need to ensure that the _commit message_ contains the `[release]` tag (sub-string).
4. Open a new Pull Request from the `ATS-###_release_version` branch into the original
`master` / `SP/*` / `HF/*` branch and wait for a green build.
5. Once it is approved, merge the PR, preferably through the **Rebase and merge** option. If the
**Create a merge commit** (_Merge pull request_) or **Squash and merge** options are used, you
need to ensure that the _commit message_ contains the `[release]` tag (sub-string).
6. After the _Release_ stage completes, verify in GitHub that the release commits and the new tag
are marked as **Verified**.
engines/aio/pom.xml
+1 -1
View File
@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-transform-core</artifactId>
<version>5.4.5-A.1-SNAPSHOT</version>
<version>5.4.5-A.4-SNAPSHOT</version>
<relativePath>../../pom.xml</relativePath>
</parent>
engines/base/pom.xml
+1 -1
View File
@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-transform-core</artifactId>
<version>5.4.5-A.1-SNAPSHOT</version>
<version>5.4.5-A.4-SNAPSHOT</version>
<relativePath>../../pom.xml</relativePath>
</parent>
engines/example/pom.xml
+1 -1
View File
@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-transform-core</artifactId>
<version>5.4.5-A.1-SNAPSHOT</version>
<version>5.4.5-A.4-SNAPSHOT</version>
<relativePath>../../pom.xml</relativePath>
</parent>
engines/imagemagick/pom.xml
+1 -1
View File
@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-transform-core</artifactId>
<version>5.4.5-A.1-SNAPSHOT</version>
<version>5.4.5-A.4-SNAPSHOT</version>
<relativePath>../../pom.xml</relativePath>
</parent>
engines/libreoffice/pom.xml
+1 -1
View File
@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-transform-core</artifactId>
<version>5.4.5-A.1-SNAPSHOT</version>
<version>5.4.5-A.4-SNAPSHOT</version>
<relativePath>../../pom.xml</relativePath>
</parent>
engines/misc/pom.xml
+1 -1
View File
@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-transform-core</artifactId>
<version>5.4.5-A.1-SNAPSHOT</version>
<version>5.4.5-A.4-SNAPSHOT</version>
<relativePath>../../pom.xml</relativePath>
</parent>
engines/pdfrenderer/pom.xml
+1 -1
View File
@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-transform-core</artifactId>
<version>5.4.5-A.1-SNAPSHOT</version>
<version>5.4.5-A.4-SNAPSHOT</version>
<relativePath>../../pom.xml</relativePath>
</parent>
engines/tika/pom.xml
+1 -1
View File
@@ -7,7 +7,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-transform-core</artifactId>
<version>5.4.5-A.1-SNAPSHOT</version>
<version>5.4.5-A.4-SNAPSHOT</version>
<relativePath>../../pom.xml</relativePath>
</parent>
model/pom.xml
+1 -8
View File
@@ -8,7 +8,7 @@
<parent>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-transform-core</artifactId>
<version>5.4.5-A.1-SNAPSHOT</version>
<version>5.4.5-A.4-SNAPSHOT</version>
</parent>
<properties>
@@ -84,13 +84,6 @@
<build>
<pluginManagement>
<plugins>
<plugin>
<artifactId>maven-release-plugin</artifactId>
<version>3.1.1</version>
<configuration>
<tagNameFormat>@{project.version}</tagNameFormat>
</configuration>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
pom.xml
+1 -9
View File
@@ -3,7 +3,7 @@
<modelVersion>4.0.0</modelVersion>
<groupId>org.alfresco</groupId>
<artifactId>alfresco-transform-core</artifactId>
<version>5.4.5-A.1-SNAPSHOT</version>
<version>5.4.5-A.4-SNAPSHOT</version>
<name>Alfresco Transform Core</name>
<packaging>pom</packaging>
@@ -311,14 +311,6 @@
<pluginManagement>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-release-plugin</artifactId>
<version>3.1.1</version>
<configuration>
<tagNameFormat>@{project.version}</tagNameFormat>
</configuration>
</plugin>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>license-maven-plugin</artifactId>