diff --git a/.github/actions/mend/action.yml b/.github/actions/mend/action.yml index e627439..6fff84f 100644 --- a/.github/actions/mend/action.yml +++ b/.github/actions/mend/action.yml @@ -31,6 +31,9 @@ inputs: description: "Comma-separated list of file paths to exclude from SAST scan (e.g. 'dir1/**,dir2/file.txt')" required: false default: "" + upload_results: + description: "Whether to upload Mend scan results. Should be false for PR scans" + required: true source_ref: description: "Git ref to associate findings with (e.g. 'refs/pull/123/head'). Defaults to the workflow's ref" required: false @@ -62,15 +65,17 @@ runs: TAGS: ${{ inputs.TAGS }} SCA_EXCLUDES: ${{ inputs.SCA_EXCLUDES }} SCA_EXCLUDE_CONFIGURATIONS: ${{ inputs.SCA_EXCLUDE_CONFIGURATIONS }} + UPLOAD_RESULTS: ${{ inputs.upload_results }} run: | - REACHABILITY_SCAN=$([[ "$SCA_REACHABILITY" == "true" ]] && echo "-r" || echo "") + REACHABILITY_ARG=(); [[ "$SCA_REACHABILITY" == "true" ]] && REACHABILITY_ARG=(-r) MEND_SCOPE="${MEND_ORGNAME}//${MEND_PRODUCTNAME}//${PROJECT_NAME}" - TAGS_ARG=() - [[ -n "$TAGS" ]] && TAGS_ARG=(--tags "$TAGS") + TAGS_ARG=(${TAGS:+--tags "$TAGS"}) + UPLOAD_ARG=(); [[ "$UPLOAD_RESULTS" == "true" ]] && UPLOAD_ARG=(-u) + export MEND_SCA_PATH_EXCLUSIONS="$SCA_EXCLUDES" export MEND_SCA_EXCLUDE_DEP_CLASS="$SCA_EXCLUDE_CONFIGURATIONS" - mend dep -u $REACHABILITY_SCAN --fail-policy --export-results sca-results.txt --non-interactive --scope "$MEND_SCOPE" "${TAGS_ARG[@]}" || SCAN_EXIT=$? + mend dep "${UPLOAD_ARG[@]}" "${REACHABILITY_ARG[@]}" --fail-policy --export-results sca-results.txt --non-interactive --scope "$MEND_SCOPE" "${TAGS_ARG[@]}" || SCAN_EXIT=$? SCAN_EXIT=${SCAN_EXIT:-0} mkdir -p ~/.mend/logs @@ -86,13 +91,15 @@ runs: PROJECT_NAME: ${{ inputs.PROJECT_NAME }} TAGS: ${{ inputs.TAGS }} SAST_EXCLUDES: ${{ inputs.SAST_EXCLUDES }} + UPLOAD_RESULTS: ${{ inputs.upload_results }} run: | MEND_SCOPE="${MEND_ORGNAME}//${MEND_PRODUCTNAME}//${PROJECT_NAME}" - TAGS_ARG=() - [[ -n "$TAGS" ]] && TAGS_ARG=(--tags "$TAGS") + TAGS_ARG=(${TAGS:+--tags "$TAGS"}) + OFFLINE_ARG=(); [[ "$UPLOAD_RESULTS" == "false" ]] && OFFLINE_ARG=(--offline) + export MEND_SAST_PATH_EXCLUSIONS="$SAST_EXCLUDES" - mend code -r --formats sarif --filename sast-results --non-interactive --scope "$MEND_SCOPE" "${TAGS_ARG[@]}" || SCAN_EXIT=$? + mend code "${OFFLINE_ARG[@]}" -r --formats sarif --filename sast-results --non-interactive --scope "$MEND_SCOPE" "${TAGS_ARG[@]}" || SCAN_EXIT=$? SCAN_EXIT=${SCAN_EXIT:-0} mkdir -p ~/.mend/logs diff --git a/.github/workflows/gradle-release.yml b/.github/workflows/gradle-release.yml index 4547e70..dd4a314 100644 --- a/.github/workflows/gradle-release.yml +++ b/.github/workflows/gradle-release.yml @@ -22,6 +22,12 @@ on: type: string default: 'release' + server_id: + description: 'The server ID to use for Maven Central. Default: central-publisher' + required: false + type: string + default: 'central-publisher' + additional_release_args: description: 'Extra Gradle arguments appended to the release command, e.g. -Prelease=true' required: false @@ -84,7 +90,7 @@ jobs: distribution: 'temurin' cache: gradle # Some Gradle projects read ~/.m2/settings.xml for Central credentials - server-id: central-publisher + server-id: '${{ inputs.server_id }}' server-username: MAVEN_USERNAME server-password: MAVEN_PASSWORD gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }} diff --git a/.github/workflows/gradle-snapshot.yml b/.github/workflows/gradle-snapshot.yml index 75a138b..7ae851a 100644 --- a/.github/workflows/gradle-snapshot.yml +++ b/.github/workflows/gradle-snapshot.yml @@ -17,6 +17,11 @@ on: required: false type: boolean default: false + server_id: + description: 'The server ID to use for Maven Central. Default: central-publisher' + required: false + type: string + default: 'central-publisher' snapshot_deploy_args: description: "The snapshot args for gradle tool. Default: build publishToCentral -x test -x funcTest" required: false @@ -50,7 +55,7 @@ jobs: java-version: "${{ inputs.java_version }}" distribution: "temurin" cache: gradle - server-id: central-publisher # we use this in our pom.xml + server-id: '${{ inputs.server_id }}' server-username: MAVEN_USERNAME # env var name for username server-password: MAVEN_PASSWORD # env var name for password diff --git a/.github/workflows/maven-release.yml b/.github/workflows/maven-release.yml index b1016eb..bf98fca 100644 --- a/.github/workflows/maven-release.yml +++ b/.github/workflows/maven-release.yml @@ -26,6 +26,11 @@ on: # and instead uses https://github.com + github token. # We'll manually push it later default: 'mvn -B -V release:prepare release:perform -DlocalCheckout=true -DpushChanges=false -DcompletionGoals="spotless:apply"' + server_id: + description: 'The server ID to use for Maven Central. Default: central-publisher' + required: false + type: string + default: 'central-publisher' fetch_all_commits: description: 'Whether to fetch all commits. Default: false' @@ -97,7 +102,7 @@ jobs: java-version: '${{ inputs.java_version }}' distribution: 'temurin' cache: maven - server-id: central-publisher # Matches the ID in your pom's distributionManagement + server-id: '${{ inputs.server_id }}' # matches the ID in the pom's distributionManagement server-username: MAVEN_USERNAME # Env variable name server-password: MAVEN_PASSWORD # env var secret gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }} diff --git a/.github/workflows/maven-snapshot.yml b/.github/workflows/maven-snapshot.yml index 7423689..8530e2d 100644 --- a/.github/workflows/maven-snapshot.yml +++ b/.github/workflows/maven-snapshot.yml @@ -18,6 +18,11 @@ on: required: false type: string default: 'mvn -B -V deploy' + server_id: + description: 'The server ID to use for Maven Central. Default: central-publisher' + required: false + type: string + default: 'central-publisher' fetch_all_commits: description: 'Whether to fetch all commits. Default: false' required: false @@ -73,8 +78,8 @@ jobs: with: java-version: '${{ inputs.java_version }}' # java version to use distribution: 'temurin' - cache: maven # use cache for speed - server-id: central-publisher # we use this in our pom.xml + cache: maven # use cache for speed + server-id: '${{ inputs.server_id }}' # as used in the pom.xml server-username: MAVEN_USERNAME # env var name for username server-password: MAVEN_PASSWORD # env var name for password diff --git a/README.md b/README.md index ea4453d..0297c2b 100644 --- a/README.md +++ b/README.md @@ -240,6 +240,7 @@ Workflow for performing a release to Maven Central (Sonatype). This can be manua * ref_to_release (default: `''`) * java_version (default: `21`) * release_command (default `mvn -B -V release:prepare release:perform -DlocalCheckout=true -DpushChanges=false`) + * server_id (default: `central-publisher`) * fetch_all_commits (default: `false`) * jboss_parent_override: This is used to override variables from the jboss-parent (default `-Dcentral.serverId=central-publisher -Dcentral.autoPublish=false -DreleaseProfile=central-release -DsignTag=false`) - **Permissions**: `contents: write` @@ -255,6 +256,7 @@ Workflow for deploying snapshot versions to Maven Central. Gated to the upstream * project_name : **Must** be set by the caller (format: /). * java_version (default: `21`) * snapshot_deploy_command (default `mvn -B -V deploy`) + * server_id (default: `central-publisher`) * fetch_all_commits (default: `false`) * quarkus_jib_image ( default: `false`) * jboss_parent_override: This is used to override variables from the jboss-parent (default `-Dcentral.serverId=central-publisher -Dcentral.sonatype.url=https://central.sonatype.com/repository/maven-snapshots -Pcentral-release -Dgpg.skip`)