Fix build/publish workflow; add force publish parameter

.github/workflows/build.yaml

@@ -5,13 +5,22 @@ on:
     branches:
       - main
   pull_request:
+  workflow_dispatch: # Allow manual trigger
+    inputs:
+      forcePublish:
+        description: 'Force publish snapshots of libraries to Artifactory even if not main branch'
+        type: boolean
+        default: 'false' # boolean values are actually strings
+        required: false
 
 env:
   ARTIFACTORY_URL: ${{ secrets.ARTIFACTORY_URL }}
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
+    env:
+      AWS_REGION: ${{ vars.AWS_REGION }}
 
     steps:
       - name: Checkout Code
@@ -24,60 +33,48 @@ jobs:
           distribution: 'corretto'
 
       - name: Set up Gradle
-        uses: gradle/gradle-build-action@v2
+        uses: gradle/actions/setup-gradle@v4
         with:
-          gradle-version: '8.10'
-
-      - name: Build Libraries
-        env:
-          ARTIFACTORY_USER: ${{ secrets.ARTIFACTORY_USER }}
-          ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
-        run: gradle -b build.gradle
-
-      - name: Test Libraries
-        env:
-          ARTIFACTORY_USER: ${{ secrets.ARTIFACTORY_USER }}
-          ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
+          gradle-version: '7.2'
+
+      - name: Set env vars from AWS params
+        uses: cmsgov/ab2d-bcda-dpc-platform/actions/aws-params-env-action@main
+        with:
+          params: |
+            ARTIFACTORY_URL=/artifactory/url
+            ARTIFACTORY_USER=/artifactory/user
+            ARTIFACTORY_PASSWORD=/artifactory/password
+            SONAR_HOST_URL=/sonarqube/url
+            SONAR_TOKEN=/sonarqube/token
+
+      - name: Build and test libraries
         run: gradle clean test --info -b build.gradle
 
-      - name: Build Jars
-        env:
-          ARTIFACTORY_USER: ${{ secrets.ARTIFACTORY_USER }}
-          ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
+      - name: Build JARs
         run: gradle jar --info -b build.gradle
 
       - name: SonarQube Analysis
-        env:
-          ARTIFACTORY_USER: ${{ secrets.ARTIFACTORY_USER }}
-          ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
         run: |
           gradle sonarqube \
             -Dsonar.projectKey=ab2d-lib-project \
-            -Dsonar.host.url=https://sonarqube.cloud.cms.gov \
-            -Dsonar.login=${{ secrets.SONAR_TOKEN }}
+            -Dsonar.host.url=$SONAR_HOST_URL \
+            -Dsonar.login=$SONAR_TOKEN
 
       - name: Quality Gate
-        id: quality-gate
-        uses: sonarsource/sonarcloud-github-action@v2
+        id: sonarqube-quality-gate-check
+        uses: sonarsource/sonarqube-quality-gate-action@master
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          scanMetadataReportFile: build/sonar/report-task.txt
         timeout-minutes: 10
 
       - name: Generate SBOM
-        env:
-          ARTIFACTORY_USER: ${{ secrets.ARTIFACTORY_USER }}
-          ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
         run: gradle cyclonedxBom
 
-      - name: Publish Libraries
+      - name: Publish libraries from main branch
         if: github.ref == 'refs/heads/main'
-        env:
-          ARTIFACTORY_USER: ${{ secrets.ARTIFACTORY_USER }}
-          ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
         run: |
           # Check for artifacts to deploy
-          versionPublishedList=$(gradle -q lookForArtifacts)
+          versionPublishedList=$(SUPPRESS_LOGGING_BRANCH_CLASSIFIER=true gradle -q lookForArtifacts)
 
           deployScript=""
           for entry in $(echo "$versionPublishedList" | tr "'''" "\n"); do
@@ -95,3 +92,7 @@ jobs:
           else
             echo "No artifacts to publish."
           fi
+
+      - name: Force publish libraries
+        if: inputs.forcePublish == 'true'
+        run: gradle artifactoryPublish -b build.gradle

.github/workflows/gitleaks.yml

@@ -14,10 +14,11 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE}}
-      - name: Slack notification
-        if: failure()
-        env:
-          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
-        uses: Ilshidur/action-slack@master
-        with:
-          args: 'Potential Secrets found in: https://github.com/{{ GITHUB_REPOSITORY }}/commit/{{ GITHUB_SHA }} Link to build with full gitleaks output: https://github.com/{{ GITHUB_REPOSITORY }}/commit/{{ GITHUB_SHA }}/checks'
+      # TODO enable this
+#      - name: Slack notification
+#        if: failure()
+#        env:
+#          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
+#        uses: Ilshidur/action-slack@master
+#        with:
+#          args: 'Potential Secrets found in: https://github.com/{{ GITHUB_REPOSITORY }}/commit/{{ GITHUB_SHA }} Link to build with full gitleaks output: https://github.com/{{ GITHUB_REPOSITORY }}/commit/{{ GITHUB_SHA }}/checks'

build.gradle

@@ -24,7 +24,7 @@ ext {
     // AB2D libraries
     fhirVersion='2.1.0'
     bfdVersion='3.2.0'
-    aggregatorVersion='2.0.1'
+    aggregatorVersion='2.0.2' // should publish snapshot TODO remove
     filtersVersion='2.1.0'
     eventClientVersion='3.2.5'
     propertiesClientVersion='2.0.0'
@@ -112,9 +112,9 @@ allprojects {
                 username = project.artifactory_user
                 password = project.artifactory_password
             }
-            authentication {
-                basic(BasicAuthentication)
-            }
+//            authentication {
+//                basic(BasicAuthentication)
+//            }
         }
     }
 }
@@ -158,7 +158,10 @@ subprojects {
     jar {
         processResources.exclude('checkstyle.xml')
         classifier "main".equalsIgnoreCase(gitBranch()) || "main".equalsIgnoreCase(System.getenv('BRANCH_NAME')) ? "" : "SNAPSHOT"
-        out.println("**** building branch - " + gitBranch() + ", classifier - " + classifier + " - CI branch - " + System.getenv('BRANCH_NAME'))
+        // suppress the '*** building branch' logs
+        if (!'true'.equals(System.getenv("SUPPRESS_LOGGING_BRANCH_CLASSIFIER"))) {
+            out.println("**** building branch - " + gitBranch() + ", classifier - " + classifier + " - CI branch - " + System.getenv('BRANCH_NAME'))
+        }
     }
 
     test {