Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: Add Maven BYOB publisher (#2242)
Adds a publisher for the Maven builder. It is missing a few bits here and there, but I am keeping it open as a draft to track progress. The main things to fix are: 1. ~~Keep the built artifacts without modifying the delegator.~~ Done 2. ~~Use the safe downloaders and uploaders.~~ Done We have made a Maven plugin to replace `collect_release_artifacts.sh`. This plugin currently exist in the test projects source tree but should ideally exist in Maven Central. Example usage: https://github.com/AdamKorcz/test-java-project/blob/main/.github/workflows/byob.yml Example action: https://github.com/AdamKorcz/test-java-project/actions/runs/5380001938 Sample release: Browse v0.1.17 here: https://central.sonatype.com/artifact/io.github.adamkorcz/test-java-project/0.1.17/versions --------- Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> Signed-off-by: AdamKorcz <adam@adalogics.com>
- Loading branch information
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,127 @@ | ||
| # Copyright 2023 SLSA Authors | ||
This comment has been minimized.
Sorry, something went wrong. |
||
| # | ||
| # Licensed under the Apache License, Version 2.0 (the "License"); | ||
| # you may not use this file except in compliance with the License. | ||
| # You may obtain a copy of the License at | ||
| # | ||
| # http://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # Unless required by applicable law or agreed to in writing, software | ||
| # distributed under the License is distributed on an "AS IS" BASIS, | ||
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| # See the License for the specific language governing permissions and | ||
| # limitations under the License. | ||
|
|
||
| on: | ||
| workflow_call: | ||
| inputs: | ||
| provenance-download-name: | ||
| description: "The artifact name for the package provenance." | ||
| required: true | ||
| type: string | ||
| provenance-download-sha256: | ||
| description: "The sha256 of the package provenance artifact." | ||
| required: false | ||
| type: string | ||
| target-download-sha256: | ||
| description: "The sha256 of the target directory." | ||
| required: true | ||
| type: string | ||
| secrets: | ||
| maven-username: | ||
| description: "Maven username" | ||
| required: false | ||
| maven-password: | ||
| description: "Maven password" | ||
| required: false | ||
| gpg-key-pass: | ||
| description: "gpg-key-pass" | ||
| required: false | ||
| gpg-private-key: | ||
| description: "gpg-key-pass" | ||
| required: false | ||
|
|
||
This comment has been minimized.
Sorry, something went wrong. |
||
| jobs: | ||
| setup-java: | ||
This comment has been minimized.
Sorry, something went wrong. |
||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout the project repository | ||
| uses: slsa-framework/slsa-github-generator/.github/actions/secure-project-checkout@main | ||
| - name: Set up Java for publishing to Maven Central Repository | ||
| uses: actions/setup-java@v3 | ||
| env: | ||
| MAVEN_USERNAME: ${{ secrets.maven-username }} | ||
| MAVEN_PASSWORD: ${{ secrets.maven-password }} | ||
| GPG_KEY_PASS: ${{ secrets.gpg-key-pass }} | ||
| with: | ||
| java-version: '11' | ||
| distribution: 'temurin' | ||
| server-id: ossrh | ||
| server-username: MAVEN_USERNAME | ||
| server-password: MAVEN_PASSWORD | ||
| gpg-private-key: ${{ secrets.gpg-private-key }} | ||
| gpg-passphrase: GPG_KEY_PASS | ||
|
|
||
| - name: Download the slsa attestation | ||
| uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@main | ||
| with: | ||
| name: "${{ inputs.provenance-download-name }}" | ||
| path: slsa-attestations | ||
| sha256: "${{ inputs.provenance-download-sha256 }}" | ||
|
|
||
| - name: Download the target dir | ||
| uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@main | ||
| with: | ||
| name: target | ||
| path: ./ | ||
| sha256: "${{ inputs.target-download-sha256 }}" | ||
|
|
||
| - name: Publish to the Maven Central Repository | ||
| shell: bash | ||
| env: | ||
| MAVEN_USERNAME: "${{ secrets.maven-username }}" | ||
| MAVEN_PASSWORD: "${{ secrets.maven-password }}" | ||
| GPG_KEY_PASS: "${{ secrets.gpg-key-pass }}" | ||
| SLSA_DIR: "${{ inputs.provenance-download-name }}" | ||
| PROVENANCE_FILES: "${{ inputs.provenance-download-name }}" | ||
| run: | | ||
| # Build and run custom plugin | ||
| cd plugin && mvn clean install && cd .. | ||
| # Re-indexing the secondary jar files for deploy | ||
| mvn javadoc:jar source:jar | ||
| echo "find javadoc" | ||
| find . -name "*javadoc*" | ||
| echo "end find javadoc" | ||
| # Retrieve project version | ||
| VERSION=$(mvn org.apache.maven.plugins:maven-help-plugin:3.2.0:evaluate -Dexpression=project.version -q -DforceStdout) | ||
This comment has been minimized.
Sorry, something went wrong. 
ianlewis
Member
|
||
| ARTIFACTID=$(mvn org.apache.maven.plugins:maven-help-plugin:3.2.0:evaluate -Dexpression=project.artifactId -q -DforceStdout) | ||
| # Reset the environment variables add in the base provenance | ||
| FILES="slsa-attestations/${PROVENANCE_FILES}/${ARTIFACTID}-${VERSION}.jar.intoto.build.slsa" | ||
| TYPES=slsa | ||
| CLASSIFIERS=jar.intoto.build | ||
| # Find all necessary built jar files and attach them to the environment variable deploy | ||
| # shellcheck disable=SC2044 # We don't spawn a new sub shell since we are appending to global env vars | ||
| for name in $(find ./ -name "$ARTIFACTID-$VERSION-*.jar") | ||
| do | ||
| # shellcheck disable=SC1001 # shellcheck complains over \- but the line does what it should. | ||
| TARGET=$(echo "${name}" | rev | cut -d\- -f1 | rev) | ||
| FILES=$FILES,$name | ||
| TYPES=$TYPES,${TARGET##*.} | ||
| CLASSIFIERS=$CLASSIFIERS,${TARGET%.*} | ||
| echo "FILESSS: ${FILES}" | ||
| done | ||
| echo "find ./ -name {ARTIFACTID}-{VERSION}-*.jar" | ||
| find ./ -name "${ARTIFACTID}-${VERSION}-*.jar" | ||
| # Find all generated provenance files and attach them the the environment variable for deploy | ||
| # shellcheck disable=SC2044 # We don't spawn a new sub shell since we are appending to global env vars | ||
| for name in $(find ./ -name "$ARTIFACTID-$VERSION-*.jar.intoto.build.slsa") | ||
This comment has been minimized.
Sorry, something went wrong.
ianlewis
Member
|
||
| do | ||
| # shellcheck disable=SC1001 # shellcheck complains over \- but the line does what it should. | ||
| TARGET=$(echo "${name}" | rev | cut -d\- -f1 | rev) | ||
This comment has been minimized.
Sorry, something went wrong. |
||
| FILES=$FILES,$name | ||
| TYPES=$TYPES",slsa" | ||
| CLASSIFIERS=$CLASSIFIERS,${TARGET::-9} | ||
| done | ||
| # Sign and deploy the files to the ossrh remote repository | ||
| mvn validate jar:jar -Dfile=target/"${ARTIFACTID}"-"${VERSION}".jar -Durl=https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/ -DrepositoryId=ossrh -Dfiles="${FILES}" -Dtypes="${TYPES}" -Dclassifiers="${CLASSIFIERS}" -DpomFile=pom.xml gpg:sign-and-deploy-file | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
IIUC this was an example workflow. Maybe we can consider putting this file somewhere else? like in an examples/ directory?