Improvements

.github/actions/mend/action.yml

@@ -31,6 +31,9 @@ inputs:
     description: "Comma-separated list of file paths to exclude from SAST scan (e.g. 'dir1/**,dir2/file.txt')"
     required: false
     default: ""
+  upload_results:
+    description: "Whether to upload Mend scan results. Should be false for PR scans"
+    required: true
   source_ref:
     description: "Git ref to associate findings with (e.g. 'refs/pull/123/head'). Defaults to the workflow's ref"
     required: false
@@ -62,15 +65,17 @@ runs:
         TAGS: ${{ inputs.TAGS }}
         SCA_EXCLUDES: ${{ inputs.SCA_EXCLUDES }}
         SCA_EXCLUDE_CONFIGURATIONS: ${{ inputs.SCA_EXCLUDE_CONFIGURATIONS }}
+        UPLOAD_RESULTS: ${{ inputs.upload_results }}
       run: |
-        REACHABILITY_SCAN=$([[ "$SCA_REACHABILITY" == "true" ]] && echo "-r" || echo "")
+        REACHABILITY_ARG=(); [[ "$SCA_REACHABILITY" == "true" ]] && REACHABILITY_ARG=(-r)
         MEND_SCOPE="${MEND_ORGNAME}//${MEND_PRODUCTNAME}//${PROJECT_NAME}"
-        TAGS_ARG=()
-        [[ -n "$TAGS" ]] && TAGS_ARG=(--tags "$TAGS")
+        TAGS_ARG=(${TAGS:+--tags "$TAGS"})
+        UPLOAD_ARG=(); [[ "$UPLOAD_RESULTS" == "true" ]] && UPLOAD_ARG=(-u)
+
         export MEND_SCA_PATH_EXCLUSIONS="$SCA_EXCLUDES"
         export MEND_SCA_EXCLUDE_DEP_CLASS="$SCA_EXCLUDE_CONFIGURATIONS"
 
-        mend dep -u $REACHABILITY_SCAN --fail-policy --export-results sca-results.txt --non-interactive --scope "$MEND_SCOPE" "${TAGS_ARG[@]}" || SCAN_EXIT=$?
+        mend dep "${UPLOAD_ARG[@]}" "${REACHABILITY_ARG[@]}" --fail-policy --export-results sca-results.txt --non-interactive --scope "$MEND_SCOPE" "${TAGS_ARG[@]}" || SCAN_EXIT=$?
         SCAN_EXIT=${SCAN_EXIT:-0}
 
         mkdir -p ~/.mend/logs
@@ -86,13 +91,15 @@ runs:
         PROJECT_NAME: ${{ inputs.PROJECT_NAME }}
         TAGS: ${{ inputs.TAGS }}
         SAST_EXCLUDES: ${{ inputs.SAST_EXCLUDES }}
+        UPLOAD_RESULTS: ${{ inputs.upload_results }}
       run: |
         MEND_SCOPE="${MEND_ORGNAME}//${MEND_PRODUCTNAME}//${PROJECT_NAME}"
-        TAGS_ARG=()
-        [[ -n "$TAGS" ]] && TAGS_ARG=(--tags "$TAGS")
+        TAGS_ARG=(${TAGS:+--tags "$TAGS"})
+        OFFLINE_ARG=(); [[ "$UPLOAD_RESULTS" == "false" ]] && OFFLINE_ARG=(--offline)
+
         export MEND_SAST_PATH_EXCLUSIONS="$SAST_EXCLUDES"
 
-        mend code -r --formats sarif --filename sast-results --non-interactive --scope "$MEND_SCOPE" "${TAGS_ARG[@]}" || SCAN_EXIT=$?
+        mend code "${OFFLINE_ARG[@]}" -r --formats sarif --filename sast-results --non-interactive --scope "$MEND_SCOPE" "${TAGS_ARG[@]}" || SCAN_EXIT=$?
         SCAN_EXIT=${SCAN_EXIT:-0}
 
         mkdir -p ~/.mend/logs

.github/workflows/gradle-release.yml

@@ -22,6 +22,12 @@ on:
         type: string
         default: 'release'
 
+      server_id:
+        description: 'The server ID to use for Maven Central. Default: central-publisher'
+        required: false
+        type: string
+        default: 'central-publisher'
+
       additional_release_args:
         description: 'Extra Gradle arguments appended to the release command, e.g. -Prelease=true'
         required: false
@@ -84,7 +90,7 @@ jobs:
           distribution: 'temurin'
           cache: gradle
           # Some Gradle projects read ~/.m2/settings.xml for Central credentials
-          server-id: central-publisher
+          server-id: '${{ inputs.server_id }}'
           server-username: MAVEN_USERNAME
           server-password: MAVEN_PASSWORD
           gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}

.github/workflows/gradle-snapshot.yml

@@ -17,6 +17,11 @@ on:
         required: false
         type: boolean
         default: false
+      server_id:
+        description: 'The server ID to use for Maven Central. Default: central-publisher'
+        required: false
+        type: string
+        default: 'central-publisher'
       snapshot_deploy_args:
         description: "The snapshot args for gradle tool. Default: build publishToCentral -x test -x funcTest"
         required: false
@@ -50,7 +55,7 @@ jobs:
           java-version: "${{ inputs.java_version }}"
           distribution: "temurin"
           cache: gradle
-          server-id: central-publisher # we use this in our pom.xml
+          server-id: '${{ inputs.server_id }}'
           server-username: MAVEN_USERNAME # env var name for username
           server-password: MAVEN_PASSWORD # env var name for password
 

.github/workflows/maven-release.yml

@@ -26,6 +26,11 @@ on:
         #              and instead uses https://github.com + github token.
         #              We'll manually push it later
         default: 'mvn -B -V release:prepare release:perform -DlocalCheckout=true -DpushChanges=false -DcompletionGoals="spotless:apply"'
+      server_id:
+        description: 'The server ID to use for Maven Central. Default: central-publisher'
+        required: false
+        type: string
+        default: 'central-publisher'
 
       fetch_all_commits:
         description: 'Whether to fetch all commits. Default: false'
@@ -97,7 +102,7 @@ jobs:
         java-version: '${{ inputs.java_version }}'
         distribution: 'temurin'
         cache: maven
-        server-id: central-publisher    # Matches the ID in your pom's distributionManagement
+        server-id: '${{ inputs.server_id }}' # matches the ID in the pom's distributionManagement
         server-username: MAVEN_USERNAME # Env variable name
         server-password: MAVEN_PASSWORD # env var secret
         gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}

.github/workflows/maven-snapshot.yml

@@ -18,6 +18,11 @@ on:
         required: false
         type: string
         default: 'mvn -B -V deploy'
+      server_id:
+        description: 'The server ID to use for Maven Central. Default: central-publisher'
+        required: false
+        type: string
+        default: 'central-publisher'
       fetch_all_commits:
         description: 'Whether to fetch all commits. Default: false'
         required: false
@@ -73,8 +78,8 @@ jobs:
       with:
         java-version: '${{ inputs.java_version }}'  # java version to use
         distribution: 'temurin'
-        cache: maven                      # use cache for speed
-        server-id: central-publisher      # we use this in our pom.xml
+        cache: maven                         # use cache for speed
+        server-id: '${{ inputs.server_id }}' # as used in the pom.xml
         server-username: MAVEN_USERNAME   # env var name for username
         server-password:  MAVEN_PASSWORD  # env var name for password
 

README.md

@@ -240,6 +240,7 @@ Workflow for performing a release to Maven Central (Sonatype). This can be manua
   * ref_to_release (default: `''`)
   * java_version (default: `21`)
   * release_command (default `mvn -B -V release:prepare release:perform -DlocalCheckout=true -DpushChanges=false`)
+  * server_id (default: `central-publisher`)
   * fetch_all_commits (default: `false`)
   * jboss_parent_override: This is used to override variables from the jboss-parent (default `-Dcentral.serverId=central-publisher -Dcentral.autoPublish=false -DreleaseProfile=central-release -DsignTag=false`)
 - **Permissions**: `contents: write`
@@ -255,6 +256,7 @@ Workflow for deploying snapshot versions to Maven Central. Gated to the upstream
   * project_name :  **Must** be set by the caller (format: <organisation>/<project_name>).
   * java_version (default: `21`)
   * snapshot_deploy_command (default `mvn -B -V deploy`)
+  * server_id (default: `central-publisher`)
   * fetch_all_commits (default: `false`)
   * quarkus_jib_image ( default: `false`)
   * jboss_parent_override: This is used to override variables from the jboss-parent (default `-Dcentral.serverId=central-publisher -Dcentral.sonatype.url=https://central.sonatype.com/repository/maven-snapshots -Pcentral-release -Dgpg.skip`)