Skip to content

Commit 0a022d4

Browse files
micronaut-buildmicronaut-build
authored
Sonatype Scan Gradle Plugin (#678)
1 parent a7a97dd commit 0a022d4

11 files changed

+73
-39
lines changed

‎.github/renovate.json

+15-7
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,32 @@
11
{
22
"extends": [
3-
"config:base"
3+
"config:recommended"
4+
],
5+
"addLabels": [
6+
"type: dependency-upgrade"
47
],
5-
"addLabels": ["type: dependency-upgrade"],
68
"schedule": [
7-
"after 10pm every day"
9+
"after 10pm"
810
],
911
"prHourlyLimit": 1,
1012
"prConcurrentLimit": 20,
1113
"timezone": "Europe/Prague",
1214
"packageRules": [
1315
{
14-
"matchPackagePatterns": ["actions.*"],
1516
"dependencyDashboardApproval": true,
16-
"matchUpdateTypes": ["patch"],
17+
"matchUpdateTypes": [
18+
"patch"
19+
],
1720
"matchCurrentVersion": "!/^0/",
18-
"automerge": true
21+
"automerge": true,
22+
"matchPackageNames": [
23+
"/actions.*/"
24+
]
1925
},
2026
{
21-
"matchUpdateTypes": ["patch"],
27+
"matchUpdateTypes": [
28+
"patch"
29+
],
2230
"matchCurrentVersion": "!/^0/",
2331
"automerge": true
2432
}

‎.github/workflows/central-sync.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,9 @@ jobs:
3131
GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
3232
GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}
3333
GPG_FILE: ${{ secrets.GPG_FILE }}
34-
GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
35-
GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USERNAME }}
36-
GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
34+
DEVELOCITY_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
35+
DEVELOCITY_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USERNAME }}
36+
DEVELOCITY_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
3737
run: |
3838
echo $GPG_FILE | base64 -d > secring.gpg
3939
./gradlew publishToSonatype closeAndReleaseSonatypeStagingRepository

‎.github/workflows/graalvm-dev.yml

+6-6
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,9 @@ jobs:
1212
if: github.repository != 'micronaut-projects/micronaut-project-template'
1313
runs-on: ubuntu-latest
1414
env:
15-
GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
16-
GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USERNAME }}
17-
GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
15+
DEVELOCITY_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
16+
DEVELOCITY_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USERNAME }}
17+
DEVELOCITY_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
1818
outputs:
1919
matrix: ${{ steps.build-matrix.outputs.matrix }}
2020
steps:
@@ -38,9 +38,9 @@ jobs:
3838
- java: 'latest-ea'
3939
distribution: 'graalvm-community'
4040
env:
41-
GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
42-
GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USERNAME }}
43-
GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
41+
DEVELOCITY_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
42+
DEVELOCITY_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USERNAME }}
43+
DEVELOCITY_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
4444
steps:
4545
- uses: actions/checkout@v4
4646
- name: Pre-Build Steps

‎.github/workflows/graalvm-latest.yml

+6-6
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,9 @@ jobs:
1818
if: github.repository != 'micronaut-projects/micronaut-project-template'
1919
runs-on: ubuntu-latest
2020
env:
21-
GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
22-
GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USERNAME }}
23-
GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
21+
DEVELOCITY_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
22+
DEVELOCITY_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USERNAME }}
23+
DEVELOCITY_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
2424
outputs:
2525
matrix: ${{ steps.build-matrix.outputs.matrix }}
2626
steps:
@@ -38,9 +38,9 @@ jobs:
3838
java: ['17', '21']
3939
native_test_task: ${{ fromJson(needs.build_matrix.outputs.matrix).native_test_task }}
4040
env:
41-
GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
42-
GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USERNAME }}
43-
GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
41+
DEVELOCITY_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
42+
DEVELOCITY_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USERNAME }}
43+
DEVELOCITY_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
4444
steps:
4545
- uses: actions/checkout@v4
4646
- name: Pre-Build Steps

‎.github/workflows/gradle.yml

+10-3
Original file line numberDiff line numberDiff line change
@@ -21,15 +21,17 @@ jobs:
2121
matrix:
2222
java: ['17', '21']
2323
env:
24-
GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
25-
GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USERNAME }}
26-
GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
24+
DEVELOCITY_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
25+
DEVELOCITY_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USERNAME }}
26+
DEVELOCITY_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
2727
GH_TOKEN_PUBLIC_REPOS_READONLY: ${{ secrets.GH_TOKEN_PUBLIC_REPOS_READONLY }}
2828
GH_USERNAME: ${{ secrets.GH_USERNAME }}
2929
TESTCONTAINERS_RYUK_DISABLED: true
3030
PREDICTIVE_TEST_SELECTION: "${{ github.event_name == 'pull_request' && 'true' || 'false' }}"
3131
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
3232
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
33+
OSS_INDEX_USERNAME: ${{ secrets.OSS_INDEX_USERNAME }}
34+
OSS_INDEX_PASSWORD: ${{ secrets.OSS_INDEX_PASSWORD }}
3335
steps:
3436
# https://github.com/actions/virtual-environments/issues/709
3537
- name: "🗑 Free disk space"
@@ -58,6 +60,11 @@ jobs:
5860
run: |
5961
[ -f ./setup.sh ] && ./setup.sh || [ ! -f ./setup.sh ]
6062
63+
- name: "🚔 Sonatype Scan"
64+
id: sonatypescan
65+
run: |
66+
./gradlew ossIndexAudit --no-parallel --info
67+
6168
- name: "🛠 Build with Gradle"
6269
id: gradle
6370
run: |

‎.github/workflows/publish-snapshot.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727
env:
2828
SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
2929
SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
30-
GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
31-
GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USERNAME }}
32-
GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
30+
DEVELOCITY_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
31+
DEVELOCITY_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USERNAME }}
32+
DEVELOCITY_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
3333
run: ./gradlew publishToSonatype --no-daemon

‎.github/workflows/release.yml

+9-9
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,9 @@ jobs:
4040
GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
4141
GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}
4242
GPG_FILE: ${{ secrets.GPG_FILE }}
43-
GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
44-
GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USERNAME }}
45-
GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
43+
DEVELOCITY_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
44+
DEVELOCITY_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USERNAME }}
45+
DEVELOCITY_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
4646
run: |
4747
echo $GPG_FILE | base64 -d > secring.gpg
4848
# Publish both locally and to Sonatype.
@@ -80,9 +80,9 @@ jobs:
8080
- name: Generate docs
8181
run: ./gradlew docs
8282
env:
83-
GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
84-
GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USERNAME }}
85-
GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
83+
DEVELOCITY_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
84+
DEVELOCITY_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USERNAME }}
85+
DEVELOCITY_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
8686
GH_TOKEN_PUBLIC_REPOS_READONLY: ${{ secrets.GH_TOKEN_PUBLIC_REPOS_READONLY }}
8787
GH_USERNAME: ${{ secrets.GH_USERNAME }}
8888
- name: Export Gradle Properties
@@ -97,9 +97,9 @@ jobs:
9797
FOLDER: build/docs
9898
VERSION: ${{ steps.release_version.outputs.release_version }}
9999
TARGET_REPOSITORY: ${{ github.repository == 'micronaut-projects/micronaut-core' && env.docsRepository || github.repository }}
100-
GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
101-
GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USERNAME }}
102-
GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
100+
DEVELOCITY_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
101+
DEVELOCITY_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USERNAME }}
102+
DEVELOCITY_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
103103
- name: Run post-release
104104
if: success()
105105
uses: micronaut-projects/github-actions/post-release@master

‎buildSrc/build.gradle

+1
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,5 @@ dependencies {
1111
implementation (libs.gradle.micronaut)
1212
implementation (libs.kotlin.gradle.plugin)
1313
implementation (libs.kotlin.gradle.allopen)
14+
implementation(libs.sonatype.scan)
1415
}

‎buildSrc/src/main/groovy/io.micronaut.build.internal.kotlin-module.gradle

+17
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,23 @@ plugins {
22
id "io.micronaut.build.internal.kotlin-base"
33
id "io.micronaut.build.internal.module"
44
id("org.jetbrains.dokka")
5+
id("org.sonatype.gradle.plugins.scan")
6+
}
7+
String ossIndexUsername = System.getenv("OSS_INDEX_USERNAME") ?: project.properties["ossIndexUsername"]
8+
String ossIndexPassword = System.getenv("OSS_INDEX_PASSWORD") ?: project.properties["ossIndexPassword"]
9+
boolean sonatypePluginConfigured = ossIndexUsername != null && ossIndexPassword != null
10+
if (sonatypePluginConfigured) {
11+
ossIndexAudit {
12+
username = ossIndexUsername
13+
password = ossIndexPassword
14+
excludeCoordinates = [ // Ktor 2.x vulnerable versions
15+
"org.apache.tomcat:tomcat-catalina:9.0.89",
16+
"org.apache.tomcat:tomcat-coyote:9.0.89",
17+
"org.eclipse.jetty:jetty-server:9.4.54.v20240208",
18+
"org.eclipse.jetty:jetty-http:9.4.54.v20240208",
19+
"org.eclipse.jetty:jetty-servlets:9.4.54.v20240208",
20+
]
21+
}
522
}
623

724
dokkaHtmlPartial {

‎gradle/libs.versions.toml

+2
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ managed-ktor = "2.3.13"
1010
mockito-kotlin = "2.2.0"
1111
typesafe-config = "1.4.3"
1212
micronaut-gradle-plugin = "4.4.4"
13+
sonatype-scan = "3.0.0"
1314

1415
# Micronaut BOMs
1516
micronaut-reactor = "3.6.0"
@@ -39,6 +40,7 @@ micronaut-serde = { module = "io.micronaut.serde:micronaut-serde-bom", version.r
3940
gradle-micronaut = { module = "io.micronaut.gradle:micronaut-gradle-plugin", version.ref = "micronaut-gradle-plugin" }
4041
kotlin-gradle-plugin = { module = 'org.jetbrains.kotlin:kotlin-gradle-plugin', version.ref = 'kotlin' }
4142
kotlin-gradle-allopen = { module = 'org.jetbrains.kotlin:kotlin-allopen', version.ref = 'kotlin' }
43+
sonatype-scan = { module = "org.sonatype.gradle.plugins:scan-gradle-plugin", version.ref = "sonatype-scan" }
4244

4345
[plugins]
4446
dokka = { id = "org.jetbrains.dokka", version.ref = "dokka" }

‎gradlew

+1-2
Original file line numberDiff line numberDiff line change
@@ -86,8 +86,7 @@ done
8686
# shellcheck disable=SC2034
8787
APP_BASE_NAME=${0##*/}
8888
# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
89-
APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s
90-
' "$PWD" ) || exit
89+
APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
9190

9291
# Use the maximum available, or set MAX_FD != -1 to use that value.
9392
MAX_FD=maximum

0 commit comments

Comments
 (0)