From 38525dbb8542b5d812558b95490016c4251f8a43 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Fri, 30 Jan 2026 17:32:14 +0200 Subject: [PATCH 01/39] fix(SD-4274): gha migration --- .github/.release-please-manifest.json | 3 + .github/dependabot.yml | 18 -- .github/release-please-config.json | 66 +++++++ .github/workflows/build-test-publish.yaml | 216 ++++++++++++++++++++++ .github/workflows/release-please.yaml | 24 +++ .github/workflows/security-scan-sast.yaml | 17 ++ .mvn/maven.config | 2 + .mvn/settings.xml | 23 +++ install_graalvm.sh | 15 ++ 9 files changed, 366 insertions(+), 18 deletions(-) create mode 100644 .github/.release-please-manifest.json delete mode 100644 .github/dependabot.yml create mode 100644 .github/release-please-config.json create mode 100644 .github/workflows/build-test-publish.yaml create mode 100644 .github/workflows/release-please.yaml create mode 100644 .github/workflows/security-scan-sast.yaml create mode 100644 .mvn/maven.config create mode 100644 .mvn/settings.xml create mode 100755 install_graalvm.sh diff --git a/.github/.release-please-manifest.json b/.github/.release-please-manifest.json new file mode 100644 index 000000000..2557a1077 --- /dev/null +++ b/.github/.release-please-manifest.json @@ -0,0 +1,3 @@ +{ + ".": "0.15.2" +} \ No newline at end of file diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index fbf5ead74..000000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,18 +0,0 @@ -# To get started with Dependabot version updates, you'll need to specify which -# package ecosystems to update and where the package manifests are located. -# Please see the documentation for all configuration options: -# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates - -version: 2 - -updates: - - package-ecosystem: "maven" - directory: "/" - schedule: - interval: "daily" - rebase-strategy: "disabled" - open-pull-requests-limit: 200 - - package-ecosystem: "docker" - directory: "/" - schedule: - interval: "daily" diff --git a/.github/release-please-config.json b/.github/release-please-config.json new file mode 100644 index 000000000..c4cf00ff2 --- /dev/null +++ b/.github/release-please-config.json @@ -0,0 +1,66 @@ +{ + "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json", + "packages": { + "." : { + "release-type": "simple" + } + }, + "changelog-sections": [ + { + "type": "feat", + "section": "Features" + }, + { + "type": "feature", + "section": "Features" + }, + { + "type": "fix", + "section": "Bug Fixes" + }, + { + "type": "perf", + "section": "Performance Improvements" + }, + { + "type": "revert", + "section": "Reverts" + }, + { + "type": "docs", + "section": "Documentation", + "hidden": false + }, + { + "type": "style", + "section": "Styles", + "hidden": false + }, + { + "type": "chore", + "section": "Miscellaneous Chores", + "hidden": false + }, + { + "type": "refactor", + "section": "Code Refactoring", + "hidden": false + }, + { + "type": "test", + "section": "Tests", + "hidden": false + }, + { + "type": "build", + "section": "Build System", + "hidden": false + }, + { + "type": "ci", + "section": "Continuous Integration", + "hidden": false + } + ], + "draft": false +} \ No newline at end of file diff --git a/.github/workflows/build-test-publish.yaml b/.github/workflows/build-test-publish.yaml new file mode 100644 index 000000000..c9f99e422 --- /dev/null +++ b/.github/workflows/build-test-publish.yaml @@ -0,0 +1,216 @@ +--- +## This workflow implements the following jobs +## - detect on PR which libs are updated +## - build libs +## - for libs: it uses the shared ci lib workflow +## - package the jar with unit tests +## - run integrations tests +## - publish the jar with github tag if event is push.tag + +name: build test and publish + +on: + push: + tags: + - "**" + pull_request: + +permissions: + contents: read + pull-requests: read + id-token: write + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +env: + HOST_M2_REPO: ./root-m2 + GRAALVM_HOME: ./.graalvm + +jobs: + build: + name: Build + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6 + + - name: Cache GraalVM Home + uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5 + id: cache-graalvm + with: + path: | + ${{ env.GRAALVM_HOME }} + key: ${{ runner.os }}-graalvm-${{ hashFiles('**/install_graalvm.sh') }} + restore-keys: | + ${{ runner.os }}-graalvm- + + - name: Cache M2 Repository + uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5 + with: + path: | + ${{ env.HOST_M2_REPO }} + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- + + - name: Download GraalVM + run: | + ./install_graalvm.sh + + - name: Package jars with tests + run: | + # we create the cache folder for the 1st run when action/cache won't restore it + mkdir -p "$HOST_M2_REPO" + make test_and_package + env: + GITHUB_TOKEN: ${{ secrets.VERYGOODBOT_CIAPPBUILDER_PAT }} + + - name: Upload target directory + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 + with: + name: maven-target + path: "**/target/" + retention-days: 1 + overwrite: "true" + + - name: Publish Test Report + uses: mikepenz/action-junit-report@a294a61c909bd8a4b563024a2faa28897fd53ebc # v6.1.0 + if: ${{ ! cancelled() }} + with: + report_paths: '**/target/surefire-reports/*.xml' + detailed_summary: true + group_suite: true + fail_on_failure: true + truncate_stack_traces: false + annotate_only: true + + + + + + + + + + + + + + + +# build-test-op-service: +# name: Build test-op-service +# uses: verygood-ops/cicd-shared/.github/workflows/maven-lib-ci.yaml@maven-lib-ci-v1.1.5 +# with: +# path: "./test-op-service" +# secrets: inherit +# +# build-fco-devtool: +# name: Build fco-devtool +# runs-on: ubuntu-latest +# steps: +# - name: Checkout +# uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6 +# +# - name: AWS ECR Login +# id: ecr-login +# uses: verygood-ops/cicd-shared/.github/actions/aws-ecr-login@bac4eacd02fa06a45355a857f573029fc2198092 # aws-ecr-login-action-v1.0.1 +# +# - name: Configure AWS Credentials +# uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1 +# with: +# aws-region: us-west-2 +# role-to-assume: arn:aws:iam::190066226418:role/CiAppBuilderRole +# +# - name: Run tests +# run: | +# docker compose run tests +# env: +# GEMFURY_PYPI_DEPLOY_TOKEN: ${{ secrets.GEMFURY_PYPI_DEPLOY_TOKEN }} +# +# checkstyle: +# name: Checkstyle +# runs-on: ubuntu-latest +# steps: +# - name: Checkout +# uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6 +# +# - name: Cache +# uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5 +# with: +# path: | +# ${{ env.HOST_M2_REPO }} +# key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} +# restore-keys: | +# ${{ runner.os }}-maven- +# +# - name: Checkstyle +# run: | +# make checkstyle +# env: +# GITHUB_TOKEN: ${{ secrets.VERYGOODBOT_CIAPPBUILDER_PAT }} +# +# publish-fco-devtool: +# name: Publish Image - fco-devtool +# needs: build-fco-devtool +# uses: verygood-ops/cicd-shared/.github/workflows/docker-build.yaml@docker-build-workflow-v1.2.0 +# with: +# name: vault/fco-devtool +# team: 'team-secure-data' +# title: fco-devtool +# +# publish-test-op-service: +# name: Publish Image - test-op-service +# needs: build-test-op-service +# uses: verygood-ops/cicd-shared/.github/workflows/docker-build.yaml@docker-build-workflow-v1.2.0 +# with: +# name: vault/test-op-service +# team: 'team-secure-data' +# title: test-op-service +# artifact-name: maven-target +# context: ./test-op-service +# file: ./test-op-service/Dockerfile +# +# publish-fco-tester: +# name: Publish Image - fco-tester +# needs: build-fco-devtool +# uses: verygood-ops/cicd-shared/.github/workflows/docker-build.yaml@docker-build-workflow-v1.2.0 +# with: +# name: vault/fco-tester +# team: 'team-secure-data' +# title: fco-tester +# context: . +# file: ./Dockerfile.fco.tester +# secrets: +# values: | +# gemfury=${{ secrets.GEMFURY_PYPI_DEPLOY_TOKEN }} +# +# publish-fco-validator: +# name: Publish Image - fco-validator +# needs: build-fco-devtool +# uses: verygood-ops/cicd-shared/.github/workflows/docker-build.yaml@docker-build-workflow-v1.2.0 +# with: +# name: vault/fco-validator +# team: 'team-secure-data' +# title: fco-validator +# context: . +# file: ./Dockerfile.fco.validator +# secrets: +# values: | +# gemfury=${{ secrets.GEMFURY_PYPI_DEPLOY_TOKEN }} +# +# orca: +# needs: [publish-fco-devtool, publish-test-op-service, publish-fco-tester, publish-fco-validator] +# uses: verygood-ops/cicd-shared/.github/workflows/security-scan-container.yaml@security-scan-container-v2.1.0 +# with: +# images: | +# [ +# "${{ fromJSON(needs.publish-fco-devtool.outputs.metadata)['image.name'] }}", +# "${{ fromJSON(needs.publish-test-op-service.outputs.metadata)['image.name'] }}", +# "${{ fromJSON(needs.publish-fco-tester.outputs.metadata)['image.name'] }}", +# "${{ fromJSON(needs.publish-fco-validator.outputs.metadata)['image.name'] }}" +# ] +# secrets: +# ORCA_SECURITY_API_TOKEN: ${{ secrets.ORCA_SECURITY_API_TOKEN }} \ No newline at end of file diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml new file mode 100644 index 000000000..f78cd63f0 --- /dev/null +++ b/.github/workflows/release-please.yaml @@ -0,0 +1,24 @@ +--- +name: release-please + +on: + push: + branches: + - master + +jobs: + release-please: + runs-on: ubuntu-latest + steps: + - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2 + id: app-token + with: + app-id: ${{ secrets.VGS_GITHUB_CI_BOT_APP_ID }} + private-key: ${{ secrets.VGS_GITHUB_CI_BOT_APP_PEM_FILE }} + + - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4 + with: + config-file: .github/release-please-config.json + manifest-file: .github/.release-please-manifest.json + include-component-in-tag: false + token: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/security-scan-sast.yaml b/.github/workflows/security-scan-sast.yaml new file mode 100644 index 000000000..d6a03afe7 --- /dev/null +++ b/.github/workflows/security-scan-sast.yaml @@ -0,0 +1,17 @@ +name: security-scan-sast + +on: + pull_request: + workflow_dispatch: + schedule: + - cron: '20 6 * * 4' + +jobs: + scan: + uses: verygood-ops/cicd-shared/.github/workflows/security-scan-sast.yaml@security-scan-sast-v2 + with: + uses_maven: false + secrets: + SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} + SAST_SLACK_WORKFLOW_WEBHOOK: ${{ secrets.SAST_SLACK_WORKFLOW_WEBHOOK }} + VERYGOODBOT_CIAPPBUILDER_PAT: ${{ secrets.VERYGOODBOT_CIAPPBUILDER_PAT }} diff --git a/.mvn/maven.config b/.mvn/maven.config new file mode 100644 index 000000000..4313f27a9 --- /dev/null +++ b/.mvn/maven.config @@ -0,0 +1,2 @@ +--settings +./.mvn/settings.xml \ No newline at end of file diff --git a/.mvn/settings.xml b/.mvn/settings.xml new file mode 100644 index 000000000..23e3c53ed --- /dev/null +++ b/.mvn/settings.xml @@ -0,0 +1,23 @@ + + + + repo1 + central + Maven Central + https://repo1.maven.org/maven2/ + + + repo2 + central + Maven Central 2 + https://repo2.maven.org/maven2/ + + + + + github + ${env.GITHUB_ACTOR} + ${env.GITHUB_TOKEN} + + + \ No newline at end of file diff --git a/install_graalvm.sh b/install_graalvm.sh new file mode 100755 index 000000000..ccf99e35c --- /dev/null +++ b/install_graalvm.sh @@ -0,0 +1,15 @@ +#!/usr/bin/env bash + +set -e + +cd "$(dirname "$0")" +GRAALVM_HOME=${GRAALVM_HOME:=./.graalvm} + +if [ ! -d "$GRAALVM_HOME" ]; then + echo "GraalVM exists in '$(pwd)'. Updating..." + curl https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-20.0.2/graalvm-community-jdk-20.0.2_linux-x64_bin.tar.gz -O -J -L + tar xfz graalvm-community-jdk-20.0.2_linux-x64_bin.tar.gz + mv graalvm-community-openjdk-20.0.2+9.1 .graalvm + rm graalvm-community-jdk-20.0.2_linux-x64_bin.tar.gz + $GRAALVM_HOME/bin/gu install native-image +fi \ No newline at end of file From d618d8f769bc8a157d463842a3f66f403f2fb330 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Fri, 30 Jan 2026 18:49:07 +0200 Subject: [PATCH 02/39] fix(SD-4274): gha migration --- Makefile | 29 +++++++++++++++++++++++++++++ compose.yaml | 33 +++++++++++++++++++++++++++++++++ docker-compose.yaml | 39 --------------------------------------- install_graalvm.sh | 32 +++++++++++++++++++++++++------- 4 files changed, 87 insertions(+), 46 deletions(-) create mode 100644 Makefile create mode 100644 compose.yaml delete mode 100644 docker-compose.yaml diff --git a/Makefile b/Makefile new file mode 100644 index 000000000..13aff509b --- /dev/null +++ b/Makefile @@ -0,0 +1,29 @@ +test_and_package: + @echo "Running tests and packaging" + docker compose run --rm maven /bin/sh -c "./install_graalvm.sh && mvn package -Pnative" + +unit_and_package: + @echo "Running unit tests and packaging" + docker compose run --rm maven /bin/sh -c "mvn package -DskipTests -DSTDOUT_TO_JSON=false" + +integration: + @echo "Running integration tests" + docker compose up -d --wait postgres + docker compose run --rm \ + -e STDOUT_TO_JSON=false \ + -e SPRING_DATASOURCE_URL="jdbc:postgresql://postgres:5432/vault_test?user=vault&password=vault" \ + -e AWS_DEFAULT_REGION \ + -e AWS_REGION \ + -e AWS_ACCESS_KEY_ID \ + -e AWS_SECRET_ACCESS_KEY \ + -e AWS_SESSION_TOKEN \ + maven /bin/sh -c "mvn package" + docker compose down postgres + +publish: + @echo "Deploying jar" + docker compose run --rm maven /bin/sh -c "mvn -B -e versions:set -DnewVersion=$(VERSION) && mvn deploy -DskipTests" + +checkstyle: + @echo "Running checkstyle" + docker compose run --rm maven /bin/sh -c "mvn checkstyle:check" diff --git a/compose.yaml b/compose.yaml new file mode 100644 index 000000000..1707c4ec6 --- /dev/null +++ b/compose.yaml @@ -0,0 +1,33 @@ +x-common: + image: &maven-jdk-image maven:3.8.5-openjdk-17 +services: + + maven: + image: *maven-jdk-image + platform: linux/amd64 + working_dir: /app + environment: + GITHUB_ACTOR: + GITHUB_TOKEN: + GRAALVM_HOME: ${GRAALVM_HOME:-/app/.graalvm} + MAVEN_OPTS: -Xmx6400m + volumes: + - .:/app/ + - ${HOST_M2_REPO:-~/.m2}:/root/.m2 + - /var/run/docker.sock:/var/run/docker.sock + + local: + build: + context: . + dockerfile: Dockerfile + environment: + VERSION: ${CIRCLE_TAG:-0.0.1} + TEST_RESULTS_PATH: /tmp/test-results/ + DIST_PATH: /tmp/dist/ + MAVEN_OPTS: -Xmx6400m + GRAALVM_HOME: /build/.graalvm + PYENV_ROOT: /root/.pyenv + volumes: + - ./:/src/ + - ./test-results:/tmp/test-results/ + - ~/.m2:/root/.m2 diff --git a/docker-compose.yaml b/docker-compose.yaml deleted file mode 100644 index f3cb0d466..000000000 --- a/docker-compose.yaml +++ /dev/null @@ -1,39 +0,0 @@ -x-common: - image: &maven-jdk-image maven:3.9-eclipse-temurin-17 -services: - - local: - build: - context: . - dockerfile: Dockerfile - environment: - VERSION: ${CIRCLE_TAG:-0.0.1} - TEST_RESULTS_PATH: /tmp/test-results/ - DIST_PATH: /tmp/dist/ - MAVEN_OPTS: -Xmx6400m - GRAALVM_HOME: /build/.graalvm - PYENV_ROOT: /root/.pyenv - volumes: - - ./:/src/ - - ./test-results:/tmp/test-results/ - - ~/.m2:/root/.m2 - - semgrep: - image: *maven-jdk-image - command: bash -c "mvn dependency:tree -DoutputFile=maven_dep_tree.txt && - apt-get update && - apt-get -y install python3 && - apt-get -y install python3-pip && - python3 -m pip install semgrep --break-system-packages && - git config --global --add safe.directory $$(pwd) && - semgrep ci --no-suppress-errors" - working_dir: /app - environment: - SEMGREP_REPO_NAME: $CIRCLE_PROJECT_USERNAME/$CIRCLE_PROJECT_REPONAME - SEMGREP_REPO_URL: ${SEMGREP_REPO_URL} - SEMGREP_BRANCH: ${SEMGREP_BRANCH} - SEMGREP_PR_ID: $CIRCLE_PR_NUMBER - SEMGREP_APP_TOKEN: ${SEMGREP_APP_TOKEN} - volumes: - - .:/app/ - - ~/.m2/:/root/.m2/ diff --git a/install_graalvm.sh b/install_graalvm.sh index ccf99e35c..071144839 100755 --- a/install_graalvm.sh +++ b/install_graalvm.sh @@ -3,13 +3,31 @@ set -e cd "$(dirname "$0")" -GRAALVM_HOME=${GRAALVM_HOME:=./.graalvm} +GRAALVM_DIR=${GRAALVM_DIR:=./.graalvm} -if [ ! -d "$GRAALVM_HOME" ]; then +OS_TYPE=${OS_TYPE:-$(uname)} +if [ "$OS_TYPE" == "Darwin" ]; then + # For local development. You can use it, but it's at your own risk. + echo "macOS detected." + GRAALVM_URL="https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-20.3.0/graalvm-ce-java11-darwin-amd64-20.3.0.tar.gz" + GRAALVM_PACKAGE="graalvm-ce-java11-20.3.0" + GRAALVM_BIN=${GRAALVM_DIR}/Contents/Home/bin +elif [ "$OS_TYPE" == "Linux" ]; then + # For CI/CD builds and MakeFile usage + echo "Linux detected." + GRAALVM_URL="https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-20.0.2/graalvm-community-jdk-20.0.2_linux-x64_bin.tar.gz" + GRAALVM_PACKAGE="graalvm-community-openjdk-20.0.2+9.1" + GRAALVM_BIN=${GRAALVM_DIR}/bin +else + echo "Unsupported OS: $OS_TYPE" + exit 1 +fi + +if [ ! -d "$GRAALVM_DIR" ]; then echo "GraalVM exists in '$(pwd)'. Updating..." - curl https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-20.0.2/graalvm-community-jdk-20.0.2_linux-x64_bin.tar.gz -O -J -L - tar xfz graalvm-community-jdk-20.0.2_linux-x64_bin.tar.gz - mv graalvm-community-openjdk-20.0.2+9.1 .graalvm - rm graalvm-community-jdk-20.0.2_linux-x64_bin.tar.gz - $GRAALVM_HOME/bin/gu install native-image + curl -o graalvm.tar.gz -J -L "$GRAALVM_URL" + tar xfz graalvm.tar.gz + mv $GRAALVM_PACKAGE .graalvm + rm graalvm.tar.gz + $GRAALVM_BIN/gu install native-image fi \ No newline at end of file From d288c5a23904de40f4002079f7249f6b09e3bec0 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Fri, 30 Jan 2026 18:56:48 +0200 Subject: [PATCH 03/39] fix(SD-4274): gha migration --- compose.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/compose.yaml b/compose.yaml index 1707c4ec6..338f1f625 100644 --- a/compose.yaml +++ b/compose.yaml @@ -9,7 +9,7 @@ services: environment: GITHUB_ACTOR: GITHUB_TOKEN: - GRAALVM_HOME: ${GRAALVM_HOME:-/app/.graalvm} + GRAALVM_HOME: /app/.graalvm MAVEN_OPTS: -Xmx6400m volumes: - .:/app/ From 070058382afeb8aa10c4caeb3b1df22ee076f3a4 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Fri, 30 Jan 2026 19:03:33 +0200 Subject: [PATCH 04/39] fix(SD-4274): gha migration --- .github/workflows/build-test-publish.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/build-test-publish.yaml b/.github/workflows/build-test-publish.yaml index c9f99e422..663ba0d39 100644 --- a/.github/workflows/build-test-publish.yaml +++ b/.github/workflows/build-test-publish.yaml @@ -26,7 +26,6 @@ concurrency: env: HOST_M2_REPO: ./root-m2 - GRAALVM_HOME: ./.graalvm jobs: build: @@ -41,7 +40,7 @@ jobs: id: cache-graalvm with: path: | - ${{ env.GRAALVM_HOME }} + ./.graalvm key: ${{ runner.os }}-graalvm-${{ hashFiles('**/install_graalvm.sh') }} restore-keys: | ${{ runner.os }}-graalvm- From 00074429521f647c65b5c988abfe618e6d7725a4 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Fri, 30 Jan 2026 19:21:34 +0200 Subject: [PATCH 05/39] fix(SD-4274): gha migration --- .mvn/Dockerfile | 12 ++++++++++++ compose.yaml | 3 ++- 2 files changed, 14 insertions(+), 1 deletion(-) create mode 100644 .mvn/Dockerfile diff --git a/.mvn/Dockerfile b/.mvn/Dockerfile new file mode 100644 index 000000000..3583356f0 --- /dev/null +++ b/.mvn/Dockerfile @@ -0,0 +1,12 @@ +FROM maven:3.8.5-openjdk-17 + +RUN microdnf install -y \ + gcc \ + gcc-c++ \ + make \ + glibc-devel \ + zlib-devel \ + libstdc++-static && \ + microdnf clean all + +WORKDIR /app \ No newline at end of file diff --git a/compose.yaml b/compose.yaml index 338f1f625..7b2674274 100644 --- a/compose.yaml +++ b/compose.yaml @@ -3,7 +3,8 @@ x-common: services: maven: - image: *maven-jdk-image + build: + context: ./.mvn platform: linux/amd64 working_dir: /app environment: From 828cc771b53f379ef27ee0340a53c5287a56a27c Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Fri, 30 Jan 2026 19:25:52 +0200 Subject: [PATCH 06/39] fix(SD-4274): gha migration --- .mvn/Dockerfile | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.mvn/Dockerfile b/.mvn/Dockerfile index 3583356f0..54dfd467a 100644 --- a/.mvn/Dockerfile +++ b/.mvn/Dockerfile @@ -5,8 +5,7 @@ RUN microdnf install -y \ gcc-c++ \ make \ glibc-devel \ - zlib-devel \ - libstdc++-static && \ + zlib-devel && \ microdnf clean all WORKDIR /app \ No newline at end of file From 42f7264f569ed784b0135dc72e2a2946ca805c1c Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Fri, 30 Jan 2026 19:51:49 +0200 Subject: [PATCH 07/39] fix(SD-4274): gha migration --- .github/workflows/build-test-publish.yaml | 4 ---- .mvn/Dockerfile | 3 +-- 2 files changed, 1 insertion(+), 6 deletions(-) diff --git a/.github/workflows/build-test-publish.yaml b/.github/workflows/build-test-publish.yaml index 663ba0d39..d326e7474 100644 --- a/.github/workflows/build-test-publish.yaml +++ b/.github/workflows/build-test-publish.yaml @@ -53,10 +53,6 @@ jobs: key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} restore-keys: | ${{ runner.os }}-maven- - - - name: Download GraalVM - run: | - ./install_graalvm.sh - name: Package jars with tests run: | diff --git a/.mvn/Dockerfile b/.mvn/Dockerfile index 54dfd467a..64d2a87b8 100644 --- a/.mvn/Dockerfile +++ b/.mvn/Dockerfile @@ -5,7 +5,6 @@ RUN microdnf install -y \ gcc-c++ \ make \ glibc-devel \ - zlib-devel && \ - microdnf clean all + zlib-devel WORKDIR /app \ No newline at end of file From d4db990aced828cdd43260e32150d3ba9c586bb0 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Fri, 30 Jan 2026 20:52:37 +0200 Subject: [PATCH 08/39] fix(SD-4274): gha migration --- install_graalvm.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/install_graalvm.sh b/install_graalvm.sh index 071144839..9240baa0a 100755 --- a/install_graalvm.sh +++ b/install_graalvm.sh @@ -7,10 +7,10 @@ GRAALVM_DIR=${GRAALVM_DIR:=./.graalvm} OS_TYPE=${OS_TYPE:-$(uname)} if [ "$OS_TYPE" == "Darwin" ]; then - # For local development. You can use it, but it's at your own risk. + # For local development. echo "macOS detected." - GRAALVM_URL="https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-20.3.0/graalvm-ce-java11-darwin-amd64-20.3.0.tar.gz" - GRAALVM_PACKAGE="graalvm-ce-java11-20.3.0" + GRAALVM_URL="https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-20.0.2/graalvm-community-jdk-20.0.2_macos-aarch64_bin.tar.gz" + GRAALVM_PACKAGE="graalvm-community-openjdk-20.0.2+9.1" GRAALVM_BIN=${GRAALVM_DIR}/Contents/Home/bin elif [ "$OS_TYPE" == "Linux" ]; then # For CI/CD builds and MakeFile usage From 2b8b18db66f91b1ebedca51d3d519d781addf932 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 14:03:43 +0200 Subject: [PATCH 09/39] fix(SD-4274): gha migration --- .github/workflows/build-test-publish.yaml | 46 +++++++++++++++++++++++ Dockerfile.python | 6 +++ Makefile | 26 ++----------- build-and-test-python.sh | 5 +-- compose.yaml | 16 +++++++- 5 files changed, 72 insertions(+), 27 deletions(-) create mode 100644 Dockerfile.python diff --git a/.github/workflows/build-test-publish.yaml b/.github/workflows/build-test-publish.yaml index d326e7474..f0b22b4bc 100644 --- a/.github/workflows/build-test-publish.yaml +++ b/.github/workflows/build-test-publish.yaml @@ -81,6 +81,52 @@ jobs: truncate_stack_traces: false annotate_only: true + build-py: + name: Build py + runs-on: ubuntu-latest + needs: build + steps: + - name: Checkout + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6 + + - name: Infos + id: infos + if: ${{ github.ref_type == 'tag' }} + run: | + if [[ ${EXTRACT_SEMVER} == 'true' ]]; then + VERSION=${TAG##*-v} # remove everything up to and including -v + VERSION=${VERSION#v} # remove initial v if it's just v1.2.3 + else + VERSION=${TAG} + fi + + echo "TAG=$TAG" >> $GITHUB_ENV + echo "VERSION=$VERSION" >> $GITHUB_ENV + env: + EXTRACT_SEMVER: ${{ github.ref_type == 'tag' }} + TAG: ${{ (github.ref_type == 'tag' && github.ref_name) || github.sha }} + + - name: Download target directory + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 + with: + name: maven-target + + - name: Run tests for pylarky + run: | + make py_test_and_package + + - name: Upload dist directory + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 + with: + name: python-target + path: "**/target/" + retention-days: 1 + overwrite: "true" + + + + + diff --git a/Dockerfile.python b/Dockerfile.python new file mode 100644 index 000000000..46540b362 --- /dev/null +++ b/Dockerfile.python @@ -0,0 +1,6 @@ +FROM python:3.10.5-slim-buster + +RUN pip install poetry + +WORKDIR /app + diff --git a/Makefile b/Makefile index 13aff509b..dbb6dff11 100644 --- a/Makefile +++ b/Makefile @@ -1,29 +1,11 @@ test_and_package: @echo "Running tests and packaging" - docker compose run --rm maven /bin/sh -c "./install_graalvm.sh && mvn package -Pnative" - -unit_and_package: - @echo "Running unit tests and packaging" - docker compose run --rm maven /bin/sh -c "mvn package -DskipTests -DSTDOUT_TO_JSON=false" - -integration: - @echo "Running integration tests" - docker compose up -d --wait postgres - docker compose run --rm \ - -e STDOUT_TO_JSON=false \ - -e SPRING_DATASOURCE_URL="jdbc:postgresql://postgres:5432/vault_test?user=vault&password=vault" \ - -e AWS_DEFAULT_REGION \ - -e AWS_REGION \ - -e AWS_ACCESS_KEY_ID \ - -e AWS_SECRET_ACCESS_KEY \ - -e AWS_SESSION_TOKEN \ - maven /bin/sh -c "mvn package" - docker compose down postgres + OS_TYPE=${OS_TYPE:-$(uname)} docker compose run --rm maven /bin/sh -c "./install_graalvm.sh && mvn package -Pnative" publish: @echo "Deploying jar" docker compose run --rm maven /bin/sh -c "mvn -B -e versions:set -DnewVersion=$(VERSION) && mvn deploy -DskipTests" -checkstyle: - @echo "Running checkstyle" - docker compose run --rm maven /bin/sh -c "mvn checkstyle:check" +py_test_and_package: + @echo "Running tests and packaging: pylarky" + docker compose run --rm python /bin/sh -c "./build-and-test-python.sh" \ No newline at end of file diff --git a/build-and-test-python.sh b/build-and-test-python.sh index 51bfb942d..60446112a 100755 --- a/build-and-test-python.sh +++ b/build-and-test-python.sh @@ -1,13 +1,12 @@ set -ex -pyenv local 3.10.5 -PATH=${PATH}:~/.local/bin +VERSION=${VERSION:-0.0.1} # You must run ./build-and-test-java.sh to build this cp ./runlarky/target/larky-runner ./pylarky # Run tests poetry version ${VERSION} -poetry install +poetry install > poetry_install.log poetry run pytest pylarky/tests poetry build \ No newline at end of file diff --git a/compose.yaml b/compose.yaml index 7b2674274..2b840c3ec 100644 --- a/compose.yaml +++ b/compose.yaml @@ -1,8 +1,7 @@ -x-common: - image: &maven-jdk-image maven:3.8.5-openjdk-17 services: maven: + image: maven-build:latest build: context: ./.mvn platform: linux/amd64 @@ -17,6 +16,19 @@ services: - ${HOST_M2_REPO:-~/.m2}:/root/.m2 - /var/run/docker.sock:/var/run/docker.sock + python: + image: python-build:latest + build: + context: . + dockerfile: Dockerfile.python + working_dir: /app + environment: + GITHUB_ACTOR: + GITHUB_TOKEN: + volumes: + - .:/app/ + - /var/run/docker.sock:/var/run/docker.sock + local: build: context: . From 0b01f3da103505af19f5b3b1f6f546fe61c034fb Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 15:30:28 +0200 Subject: [PATCH 10/39] fix(SD-4274): gha migration --- .github/workflows/release-please.yaml | 40 +++++++++++++++++++++++++++ Dockerfile.python | 5 ++-- Makefile | 2 +- build-and-test-java.sh | 11 ++++++-- build-and-test-python.sh | 8 +++++- 5 files changed, 58 insertions(+), 8 deletions(-) diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml index f78cd63f0..4a183b018 100644 --- a/.github/workflows/release-please.yaml +++ b/.github/workflows/release-please.yaml @@ -9,6 +9,9 @@ on: jobs: release-please: runs-on: ubuntu-latest + outputs: + release_created: ${{ steps.release.outputs.release_created }} + tag_name: ${{ steps.release.outputs.tag_name }} steps: - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2 id: app-token @@ -17,8 +20,45 @@ jobs: private-key: ${{ secrets.VGS_GITHUB_CI_BOT_APP_PEM_FILE }} - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4 + id: release with: config-file: .github/release-please-config.json manifest-file: .github/.release-please-manifest.json include-component-in-tag: false token: ${{ steps.app-token.outputs.token }} + + attach-assets: + needs: release-please + if: ${{ needs.release-please.outputs.release_created }} + runs-on: ubuntu-latest + steps: + - name: Wait for Build Workflow + run: | + echo "Waiting for builds on tag ${{ needs.release-please.outputs.tag_name }} to start..." + sleep 30 # Give the tag-triggered workflow a moment to initialize + + - name: Download Artifacts from Tag Run + run: | + # Use GH CLI to find the run ID triggered by the new tag + RUN_ID=$(gh run list --tag ${{ needs.release-please.outputs.tag_name }} --limit 1 --json databaseId -q '.[0].databaseId') + + # Wait until that run is completed (simplified polling) + gh run watch $RUN_ID + + # Download the specific artifacts you uploaded in build-test-publish + gh run download $RUN_ID -n maven-target -D java-assets + gh run download $RUN_ID -n python-target -D python-assets + env: + GITHUB_TOKEN: ${{ secrets.VERYGOODBOT_CIAPPBUILDER_PAT }} + + - name: Upload to Release + uses: softprops/action-gh-release@v2 + with: + tag_name: ${{ needs.release-please.outputs.tag_name }} + files: | + java-assets/runlarky/target/larky-*-linux + python-assets/dist/pylarky-*.whl + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + diff --git a/Dockerfile.python b/Dockerfile.python index 46540b362..af6e31cc9 100644 --- a/Dockerfile.python +++ b/Dockerfile.python @@ -1,6 +1,5 @@ FROM python:3.10.5-slim-buster -RUN pip install poetry - -WORKDIR /app +RUN pip install poetry twine +WORKDIR /app \ No newline at end of file diff --git a/Makefile b/Makefile index dbb6dff11..43881d166 100644 --- a/Makefile +++ b/Makefile @@ -1,6 +1,6 @@ test_and_package: @echo "Running tests and packaging" - OS_TYPE=${OS_TYPE:-$(uname)} docker compose run --rm maven /bin/sh -c "./install_graalvm.sh && mvn package -Pnative" + docker compose run --rm maven /bin/sh -c "./install_graalvm.sh && mvn package -Pnative" publish: @echo "Deploying jar" diff --git a/build-and-test-java.sh b/build-and-test-java.sh index c6dabbe8e..af996a494 100755 --- a/build-and-test-java.sh +++ b/build-and-test-java.sh @@ -1,3 +1,8 @@ +#!/usr/bin/env bash +cd "$(dirname "$0")" + +OS_TYPE=${OS_TYPE:-$(uname)} +OS_TYPE_LOWER=$(echo "$OS_TYPE" | tr '[:upper:]' '[:lower:]') TEST_RESULTS_PATH=${TEST_RESULTS_PATH:-/tmp/test-results} mkdir -p $TEST_RESULTS_PATH/junit/ @@ -9,6 +14,6 @@ find . -type f -regex ".*/target/site/.*" -exec cp --parents {} $TEST_RESULTS_PA # package it up to deliver mvn package -Pnative -DskipTests -mkdir ${DIST_PATH} -cp ./runlarky/target/larky-runner ${DIST_PATH}/larky-linux -# cp dist/*.whl ${DIST_PATH} + +# tag distribution +mv ./runlarky/target/larky-runner ./runlarky/target/larky-${OS_TYPE_LOWER} \ No newline at end of file diff --git a/build-and-test-python.sh b/build-and-test-python.sh index 60446112a..88e79c72b 100755 --- a/build-and-test-python.sh +++ b/build-and-test-python.sh @@ -1,9 +1,15 @@ +#!/usr/bin/env bash set -ex +cd "$(dirname "$0")" + +OS_TYPE=${OS_TYPE:-$(uname)} +OS_TYPE_LOWER=$(echo "$OS_TYPE" | tr '[:upper:]' '[:lower:]') VERSION=${VERSION:-0.0.1} # You must run ./build-and-test-java.sh to build this -cp ./runlarky/target/larky-runner ./pylarky +cp ./runlarky/target/larky-${OS_TYPE_LOWER} ./pylarky +chmod +x ./pylarky/larky-${OS_TYPE_LOWER} # Run tests poetry version ${VERSION} From c69c6163242602e560f0c89ac464ae9199cac410 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 15:37:52 +0200 Subject: [PATCH 11/39] fix(SD-4274): gha migration --- Makefile | 2 +- build-and-test-java.sh | 7 ++++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 43881d166..32df75df5 100644 --- a/Makefile +++ b/Makefile @@ -1,6 +1,6 @@ test_and_package: @echo "Running tests and packaging" - docker compose run --rm maven /bin/sh -c "./install_graalvm.sh && mvn package -Pnative" + docker compose run --rm maven /bin/sh -c "./install_graalvm.sh && ./build-and-test-java.sh" publish: @echo "Deploying jar" diff --git a/build-and-test-java.sh b/build-and-test-java.sh index af996a494..4f9d4c166 100755 --- a/build-and-test-java.sh +++ b/build-and-test-java.sh @@ -13,7 +13,12 @@ find . -type f -regex ".*/target/surefire-reports/.*-output.txt" -exec cp {} $TE find . -type f -regex ".*/target/site/.*" -exec cp --parents {} $TEST_RESULTS_PATH/coverage/ \; # package it up to deliver -mvn package -Pnative -DskipTests +mvn package -Pnative +# TODO remove: when CircleCI is disabled +DIST_PATH=${DIST_PATH:-./dist} +mkdir ${DIST_PATH} +cp ./runlarky/target/larky-runner ${DIST_PATH}/larky-linux +# cp dist/*.whl ${DIST_PATH} # tag distribution mv ./runlarky/target/larky-runner ./runlarky/target/larky-${OS_TYPE_LOWER} \ No newline at end of file From 286b7b6e39c9fcc2ccadc8fcc39d202ae7d47851 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 15:41:06 +0200 Subject: [PATCH 12/39] fix(SD-4274): gha migration --- build-and-test-java.sh | 15 +-------------- 1 file changed, 1 insertion(+), 14 deletions(-) diff --git a/build-and-test-java.sh b/build-and-test-java.sh index 4f9d4c166..663379384 100755 --- a/build-and-test-java.sh +++ b/build-and-test-java.sh @@ -3,22 +3,9 @@ cd "$(dirname "$0")" OS_TYPE=${OS_TYPE:-$(uname)} OS_TYPE_LOWER=$(echo "$OS_TYPE" | tr '[:upper:]' '[:lower:]') -TEST_RESULTS_PATH=${TEST_RESULTS_PATH:-/tmp/test-results} -mkdir -p $TEST_RESULTS_PATH/junit/ -mkdir -p $TEST_RESULTS_PATH/coverage/ -mvn clean install dependency:go-offline -T 2.0C -B -find . -type f -regex ".*/target/surefire-reports/.*xml" -exec cp {} $TEST_RESULTS_PATH/junit/ \; -find . -type f -regex ".*/target/surefire-reports/.*-output.txt" -exec cp {} $TEST_RESULTS_PATH/junit/ \; -find . -type f -regex ".*/target/site/.*" -exec cp --parents {} $TEST_RESULTS_PATH/coverage/ \; - -# package it up to deliver +# test and package mvn package -Pnative -# TODO remove: when CircleCI is disabled -DIST_PATH=${DIST_PATH:-./dist} -mkdir ${DIST_PATH} -cp ./runlarky/target/larky-runner ${DIST_PATH}/larky-linux -# cp dist/*.whl ${DIST_PATH} # tag distribution mv ./runlarky/target/larky-runner ./runlarky/target/larky-${OS_TYPE_LOWER} \ No newline at end of file From 3cd0036d1b036666a089c845878873bccdf360d3 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 15:50:29 +0200 Subject: [PATCH 13/39] fix(SD-4274): gha migration --- .github/workflows/build-test-publish.yaml | 2 +- .github/workflows/release-please.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-test-publish.yaml b/.github/workflows/build-test-publish.yaml index f0b22b4bc..c8df8f2f2 100644 --- a/.github/workflows/build-test-publish.yaml +++ b/.github/workflows/build-test-publish.yaml @@ -119,7 +119,7 @@ jobs: uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: python-target - path: "**/target/" + path: "**/dist/" retention-days: 1 overwrite: "true" diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml index 4a183b018..27b6a7124 100644 --- a/.github/workflows/release-please.yaml +++ b/.github/workflows/release-please.yaml @@ -56,8 +56,8 @@ jobs: with: tag_name: ${{ needs.release-please.outputs.tag_name }} files: | - java-assets/runlarky/target/larky-*-linux - python-assets/dist/pylarky-*.whl + runlarky/target/larky-linux + dist/pylarky-*.whl env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} From b298eabec40975283736951ac009f295093edb5b Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 15:52:15 +0200 Subject: [PATCH 14/39] fix(SD-4274): gha migration --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 32df75df5..1c0b09ad2 100644 --- a/Makefile +++ b/Makefile @@ -4,7 +4,7 @@ test_and_package: publish: @echo "Deploying jar" - docker compose run --rm maven /bin/sh -c "mvn -B -e versions:set -DnewVersion=$(VERSION) && mvn deploy -DskipTests" + docker compose run --rm maven /bin/sh -c "mvn -B -e versions:set -DnewVersion=$(VERSION) && mvn deploy -DskipTests -Pnative" py_test_and_package: @echo "Running tests and packaging: pylarky" From 50c25d725968341d28214b58b6a10ff24ac1d4da Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 15:52:24 +0200 Subject: [PATCH 15/39] fix(SD-4274): gha migration --- Makefile | 2 +- build-and-test-python.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 1c0b09ad2..32df75df5 100644 --- a/Makefile +++ b/Makefile @@ -4,7 +4,7 @@ test_and_package: publish: @echo "Deploying jar" - docker compose run --rm maven /bin/sh -c "mvn -B -e versions:set -DnewVersion=$(VERSION) && mvn deploy -DskipTests -Pnative" + docker compose run --rm maven /bin/sh -c "mvn -B -e versions:set -DnewVersion=$(VERSION) && mvn deploy -DskipTests" py_test_and_package: @echo "Running tests and packaging: pylarky" diff --git a/build-and-test-python.sh b/build-and-test-python.sh index 88e79c72b..6effb3b10 100755 --- a/build-and-test-python.sh +++ b/build-and-test-python.sh @@ -8,7 +8,7 @@ OS_TYPE_LOWER=$(echo "$OS_TYPE" | tr '[:upper:]' '[:lower:]') VERSION=${VERSION:-0.0.1} # You must run ./build-and-test-java.sh to build this -cp ./runlarky/target/larky-${OS_TYPE_LOWER} ./pylarky +cp ./runlarky/target/larky-${OS_TYPE_LOWER} ./pylarky/larky-runner chmod +x ./pylarky/larky-${OS_TYPE_LOWER} # Run tests From 5e4ac23a1b4e19cd2f1ee9ecf6c2fa6692818579 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 16:06:11 +0200 Subject: [PATCH 16/39] fix(SD-4274): gha migration --- README.md | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index 265d612c1..d5e836441 100644 --- a/README.md +++ b/README.md @@ -82,8 +82,8 @@ _Pylarky_ is pip lib-wrapper for runlarky to make larky calls conveniently from ```bash docker-compose build -docker-compose run local bash /src/build-and-test-java.sh -docker-compose run local bash /src/build-and-test-python.sh +docker compose run --rm maven /bin/sh -c "./install_graalvm.sh && ./build-and-test-java.sh" +docker compose run --rm python /bin/sh -c "./build-and-test-python.sh" ``` ### Run individual larky stdlib test @@ -122,10 +122,4 @@ In addition to having Maven installed, it must be configured to retrieve artifac ``` ## Deployment process - -To rollout a new verion of libstarlark/larky/larky-api create a new tag -``` -git tag x.x.x -git push origin x.x.x -``` -Than, after CircleCI build, publish the draft release +Release-please plugin manages creation of tag&release. \ No newline at end of file From 9960255244cec15d2e807269eb288f28ab6894a2 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 16:11:04 +0200 Subject: [PATCH 17/39] fix(SD-4274): gha migration --- build-and-test-python.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build-and-test-python.sh b/build-and-test-python.sh index 6effb3b10..daa9ae33b 100755 --- a/build-and-test-python.sh +++ b/build-and-test-python.sh @@ -9,7 +9,7 @@ VERSION=${VERSION:-0.0.1} # You must run ./build-and-test-java.sh to build this cp ./runlarky/target/larky-${OS_TYPE_LOWER} ./pylarky/larky-runner -chmod +x ./pylarky/larky-${OS_TYPE_LOWER} +chmod +x ./pylarky/larky-runner # Run tests poetry version ${VERSION} From 159ade51703a590210611dad27aa8aee76ea96b4 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 16:18:39 +0200 Subject: [PATCH 18/39] fix(SD-4274): gha migration --- Dockerfile | 33 --------------------------------- build-and-test-python.sh | 2 +- compose.yaml | 16 ---------------- 3 files changed, 1 insertion(+), 50 deletions(-) delete mode 100644 Dockerfile diff --git a/Dockerfile b/Dockerfile deleted file mode 100644 index b169044f1..000000000 --- a/Dockerfile +++ /dev/null @@ -1,33 +0,0 @@ -FROM ubuntu:lunar - -WORKDIR /build/ -ENV PYENV_ROOT="/root/.pyenv" -ENV PATH="/root/.poetry/bin:$PYENV_ROOT/shims:$PYENV_ROOT/bin:$PATH" - -# java -RUN apt-get update -qq \ - && JVM_ARCH=$([ `lscpu | grep -o "aarch64"` ] && echo "arm64" || echo "amd64") \ - && apt-get install -y curl openjdk-17-jdk maven \ - && update-alternatives --set java /usr/lib/jvm/java-17-openjdk-${JVM_ARCH}/bin/java \ - && update-alternatives --set javac /usr/lib/jvm/java-17-openjdk-${JVM_ARCH}/bin/javac - -# ghr -RUN apt-get install golang git -y \ - && go install github.com/tcnksm/ghr@latest - -# graalvm -RUN GRAALVM_ARCH=$([ `lscpu | grep -o "aarch64"` ] && echo "aarch64" || echo "x64") \ - && curl https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-17.0.9/graalvm-community-jdk-17.0.9_linux-${GRAALVM_ARCH}_bin.tar.gz -O -J -L \ - && tar xfz graalvm-community-jdk-17.0.9_linux-${GRAALVM_ARCH}_bin.tar.gz \ - && mv graalvm-community-openjdk-17.0.9+9.1 .graalvm \ - && rm graalvm-community-jdk-17.0.9_linux-${GRAALVM_ARCH}_bin.tar.gz \ - && /build/.graalvm/bin/gu install native-image - -# python -RUN git clone https://github.com/pyenv/pyenv.git ~/.pyenv \ - && apt-get install -y gcc libbz2-dev libsqlite3-dev libssl-dev make zlib1g-dev libffi-dev \ - && ~/.pyenv/bin/pyenv install 3.10.5 \ - && ~/.pyenv/bin/pyenv local 3.10.5 \ - && curl -sSL https://install.python-poetry.org | python3 - - -WORKDIR /src diff --git a/build-and-test-python.sh b/build-and-test-python.sh index daa9ae33b..8973880e3 100755 --- a/build-and-test-python.sh +++ b/build-and-test-python.sh @@ -13,6 +13,6 @@ chmod +x ./pylarky/larky-runner # Run tests poetry version ${VERSION} -poetry install > poetry_install.log +poetry install poetry run pytest pylarky/tests poetry build \ No newline at end of file diff --git a/compose.yaml b/compose.yaml index 2b840c3ec..39023b83e 100644 --- a/compose.yaml +++ b/compose.yaml @@ -28,19 +28,3 @@ services: volumes: - .:/app/ - /var/run/docker.sock:/var/run/docker.sock - - local: - build: - context: . - dockerfile: Dockerfile - environment: - VERSION: ${CIRCLE_TAG:-0.0.1} - TEST_RESULTS_PATH: /tmp/test-results/ - DIST_PATH: /tmp/dist/ - MAVEN_OPTS: -Xmx6400m - GRAALVM_HOME: /build/.graalvm - PYENV_ROOT: /root/.pyenv - volumes: - - ./:/src/ - - ./test-results:/tmp/test-results/ - - ~/.m2:/root/.m2 From 520d8f4e312306871e33effbc54f6239b877a279 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 16:20:01 +0200 Subject: [PATCH 19/39] fix(SD-4274): gha migration --- .github/workflows/build-test-publish.yaml | 135 +--------------------- 1 file changed, 1 insertion(+), 134 deletions(-) diff --git a/.github/workflows/build-test-publish.yaml b/.github/workflows/build-test-publish.yaml index c8df8f2f2..cb0512eac 100644 --- a/.github/workflows/build-test-publish.yaml +++ b/.github/workflows/build-test-publish.yaml @@ -119,139 +119,6 @@ jobs: uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 with: name: python-target - path: "**/dist/" + path: "**/dist/*.whl" retention-days: 1 overwrite: "true" - - - - - - - - - - - - - - - - - - - -# build-test-op-service: -# name: Build test-op-service -# uses: verygood-ops/cicd-shared/.github/workflows/maven-lib-ci.yaml@maven-lib-ci-v1.1.5 -# with: -# path: "./test-op-service" -# secrets: inherit -# -# build-fco-devtool: -# name: Build fco-devtool -# runs-on: ubuntu-latest -# steps: -# - name: Checkout -# uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6 -# -# - name: AWS ECR Login -# id: ecr-login -# uses: verygood-ops/cicd-shared/.github/actions/aws-ecr-login@bac4eacd02fa06a45355a857f573029fc2198092 # aws-ecr-login-action-v1.0.1 -# -# - name: Configure AWS Credentials -# uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1 -# with: -# aws-region: us-west-2 -# role-to-assume: arn:aws:iam::190066226418:role/CiAppBuilderRole -# -# - name: Run tests -# run: | -# docker compose run tests -# env: -# GEMFURY_PYPI_DEPLOY_TOKEN: ${{ secrets.GEMFURY_PYPI_DEPLOY_TOKEN }} -# -# checkstyle: -# name: Checkstyle -# runs-on: ubuntu-latest -# steps: -# - name: Checkout -# uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6 -# -# - name: Cache -# uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5 -# with: -# path: | -# ${{ env.HOST_M2_REPO }} -# key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} -# restore-keys: | -# ${{ runner.os }}-maven- -# -# - name: Checkstyle -# run: | -# make checkstyle -# env: -# GITHUB_TOKEN: ${{ secrets.VERYGOODBOT_CIAPPBUILDER_PAT }} -# -# publish-fco-devtool: -# name: Publish Image - fco-devtool -# needs: build-fco-devtool -# uses: verygood-ops/cicd-shared/.github/workflows/docker-build.yaml@docker-build-workflow-v1.2.0 -# with: -# name: vault/fco-devtool -# team: 'team-secure-data' -# title: fco-devtool -# -# publish-test-op-service: -# name: Publish Image - test-op-service -# needs: build-test-op-service -# uses: verygood-ops/cicd-shared/.github/workflows/docker-build.yaml@docker-build-workflow-v1.2.0 -# with: -# name: vault/test-op-service -# team: 'team-secure-data' -# title: test-op-service -# artifact-name: maven-target -# context: ./test-op-service -# file: ./test-op-service/Dockerfile -# -# publish-fco-tester: -# name: Publish Image - fco-tester -# needs: build-fco-devtool -# uses: verygood-ops/cicd-shared/.github/workflows/docker-build.yaml@docker-build-workflow-v1.2.0 -# with: -# name: vault/fco-tester -# team: 'team-secure-data' -# title: fco-tester -# context: . -# file: ./Dockerfile.fco.tester -# secrets: -# values: | -# gemfury=${{ secrets.GEMFURY_PYPI_DEPLOY_TOKEN }} -# -# publish-fco-validator: -# name: Publish Image - fco-validator -# needs: build-fco-devtool -# uses: verygood-ops/cicd-shared/.github/workflows/docker-build.yaml@docker-build-workflow-v1.2.0 -# with: -# name: vault/fco-validator -# team: 'team-secure-data' -# title: fco-validator -# context: . -# file: ./Dockerfile.fco.validator -# secrets: -# values: | -# gemfury=${{ secrets.GEMFURY_PYPI_DEPLOY_TOKEN }} -# -# orca: -# needs: [publish-fco-devtool, publish-test-op-service, publish-fco-tester, publish-fco-validator] -# uses: verygood-ops/cicd-shared/.github/workflows/security-scan-container.yaml@security-scan-container-v2.1.0 -# with: -# images: | -# [ -# "${{ fromJSON(needs.publish-fco-devtool.outputs.metadata)['image.name'] }}", -# "${{ fromJSON(needs.publish-test-op-service.outputs.metadata)['image.name'] }}", -# "${{ fromJSON(needs.publish-fco-tester.outputs.metadata)['image.name'] }}", -# "${{ fromJSON(needs.publish-fco-validator.outputs.metadata)['image.name'] }}" -# ] -# secrets: -# ORCA_SECURITY_API_TOKEN: ${{ secrets.ORCA_SECURITY_API_TOKEN }} \ No newline at end of file From 052296a9905c46be6e77436cec763370a4848d8b Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 16:24:52 +0200 Subject: [PATCH 20/39] fix(SD-4274): gha migration --- .github/workflows/security-scan-sast.yaml | 2 +- larky/pom.xml | 19 +++++++------------ libstarlark/pom.xml | 19 +++++++------------ 3 files changed, 15 insertions(+), 25 deletions(-) diff --git a/.github/workflows/security-scan-sast.yaml b/.github/workflows/security-scan-sast.yaml index d6a03afe7..cadb9ae2f 100644 --- a/.github/workflows/security-scan-sast.yaml +++ b/.github/workflows/security-scan-sast.yaml @@ -10,7 +10,7 @@ jobs: scan: uses: verygood-ops/cicd-shared/.github/workflows/security-scan-sast.yaml@security-scan-sast-v2 with: - uses_maven: false + uses_maven: true secrets: SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} SAST_SLACK_WORKFLOW_WEBHOOK: ${{ secrets.SAST_SLACK_WORKFLOW_WEBHOOK }} diff --git a/larky/pom.xml b/larky/pom.xml index ab3d82c3c..6c107d2de 100644 --- a/larky/pom.xml +++ b/larky/pom.xml @@ -11,6 +11,13 @@ jar + + + github + https://maven.pkg.github.com/verygoodsecurity/starlarky + + + maven @@ -310,16 +317,4 @@ - - - - github - - - github - https://maven.pkg.github.com/verygoodsecurity/starlarky - - - - diff --git a/libstarlark/pom.xml b/libstarlark/pom.xml index 779c70944..19d5ba269 100644 --- a/libstarlark/pom.xml +++ b/libstarlark/pom.xml @@ -11,6 +11,13 @@ jar + + + github + https://maven.pkg.github.com/verygoodsecurity/starlarky + + + 3.14.0 3.3.1 @@ -207,16 +214,4 @@ - - - - github - - - github - https://maven.pkg.github.com/verygoodsecurity/starlarky - - - - From 56ac5f98730c0a5137135ad6767d347dde84a231 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 16:29:10 +0200 Subject: [PATCH 21/39] fix(SD-4274): gha migration --- .circleci/config.yml | 372 ---------------------------- .mvn/Dockerfile => Dockerfile.maven | 0 compose.yaml | 3 +- 3 files changed, 2 insertions(+), 373 deletions(-) delete mode 100644 .circleci/config.yml rename .mvn/Dockerfile => Dockerfile.maven (100%) diff --git a/.circleci/config.yml b/.circleci/config.yml deleted file mode 100644 index 6fc810ae9..000000000 --- a/.circleci/config.yml +++ /dev/null @@ -1,372 +0,0 @@ -job-defaults: &job-defaults - working_directory: &working_directory - ~/starlarky - environment: - DIST_PATH: /tmp/dist - TEST_RESULTS_PATH: /tmp/test-results - MAVEN_OPTS: -Xmx6400m - GRAALVM_HOME: /home/circleci/starlarky/.graalvm - HOMEBREW_REQUIRED_RUBY_VERSION: 2.4.6 - LARKY_LIB_HOME: /home/circleci/.larky/lib - -machine-linux: &machine-linux - machine: - docker_layer_caching: false - image: ubuntu-2204:2023.10.1 - -install-java: &install-java - run: - name: Install OpenJDK17 and Maven - command: | - sudo apt-get update && sudo apt-get install openjdk-17-jdk maven - sudo update-alternatives --set java /usr/lib/jvm/java-17-openjdk-amd64/bin/java - sudo update-alternatives --set javac /usr/lib/jvm/java-17-openjdk-amd64/bin/javac - -install-gh: &install-gh - run: - name: Install Go and ghr - command: | - sudo apt-get update && sudo apt-get install golang -y - go get -u github.com/tcnksm/ghr - -install-graalvm: &install-graalvm - run: - name: Install GraalVM - command: | - [ ! -d $GRAALVM_HOME ] \ - && curl https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-20.0.2/graalvm-community-jdk-20.0.2_linux-x64_bin.tar.gz -O -J -L \ - && tar xfz graalvm-community-jdk-20.0.2_linux-x64_bin.tar.gz \ - && mv graalvm-community-openjdk-20.0.2+9.1 .graalvm \ - && rm graalvm-community-jdk-20.0.2_linux-x64_bin.tar.gz \ - && $GRAALVM_HOME/bin/gu install native-image - -build-quarkus-runnable: &build-quarkus-runnable - run: - name: Build binary for runlarky - command: | - if [ "${CIRCLE_TAG}" != "" ] ; - then - mvn versions:set-property -Dproperty=starlarky.version -DnewVersion=${CIRCLE_TAG} -pl runlarky - mvn versions:set -DnewVersion=${CIRCLE_TAG} -pl runlarky - fi - mvn package -Pnative -DskipTests - cp ./runlarky/target/larky-runner ./pylarky - no_output_timeout: 30m - -# Template to save Maven dependency cache to restore it in another jobs -save-maven-cache: &save-maven-cache - save_cache: - key: starlarky-{{ checksum "pom.xml" }}-{{ checksum "libstarlark/pom.xml" }}-{{ checksum "larky/pom.xml" }} - paths: - - ~/.m2 - -restore-maven-cache: &restore-maven-cache - restore_cache: - key: starlarky-{{ checksum "pom.xml" }}-{{ checksum "libstarlark/pom.xml" }}-{{ checksum "larky/pom.xml" }} - -save-graalvm-cache: &save-graalvm-cache - save_cache: - key: starlarky-{{ checksum ".circleci/config.yml" }} - paths: - - $GRAALVM_HOME - -restore-graalvm-cache: &restore-graalvm-cache - restore_cache: - key: starlarky-{{ checksum ".circleci/config.yml" }} - -setup-maven-distributions: &setup-maven-distributions - run: - name: Setup distrubution servers for larky - command: | - mkdir -p ~/.m2 - cat \< ~/.m2/settings.xml - - - - github - $GITHUB_USERNAME - $GITHUB_API_TOKEN - - - - EOF - -install_python: &install_python - run: - name: Install Python - command: | - git clone https://github.com/pyenv/pyenv.git ~/.pyenv - echo 'export PYENV_ROOT="$HOME/.pyenv"' >> $BASH_ENV - echo 'export PATH="$PYENV_ROOT/shims:$PYENV_ROOT/bin:$PATH"' >> $BASH_ENV - ~/.pyenv/bin/pyenv install 3.10.5 - ~/.pyenv/bin/pyenv local 3.10.5 - curl -sSL https://install.python-poetry.org | python - - echo 'export PATH="$HOME/.local/bin:$PATH"' >> $BASH_ENV - -build_test_pylarky: &build_test_pylarky - run: - name: Build and test pylarky - command: | - set -x - poetry version ${CIRCLE_TAG} - poetry install > poetry_install.log - poetry run pytest pylarky/tests - poetry build - -persist-dist: &persist-dist - persist_to_workspace: - root: /tmp/dist - paths: - - "*" - -attach-dist: &attach-dist - attach_workspace: - at: /tmp/dist - -parameters: - nightly-security-scan: - type: boolean - default: false - -# === JOBS === -version: 2.1 -jobs: - build-and-test: - <<: *job-defaults - <<: *machine-linux - steps: - - checkout - - <<: *install-java - - <<: *restore-maven-cache - - run: mkdir -p $TEST_RESULTS_PATH/junit/ - - run: mkdir -p $TEST_RESULTS_PATH/coverage/ - - run: - name: Maven Build/Test - command: | - mvn clean install dependency:go-offline -T 2.0C -B - - <<: *save-maven-cache - - run: find . -type f -regex ".*/target/surefire-reports/.*xml" -exec cp {} $TEST_RESULTS_PATH/junit/ \; - - run: find . -type f -regex ".*/target/surefire-reports/.*-output.txt" -exec cp {} $TEST_RESULTS_PATH/junit/ \; - - run: find . -type f -regex ".*/target/site/.*" -exec cp --parents {} $TEST_RESULTS_PATH/coverage/ \; - - store_artifacts: - path: /tmp/test-results - - store_test_results: - path: /tmp/test-results - - build-and-test-docker: - <<: *job-defaults - machine: true - steps: - - checkout - - <<: *restore-maven-cache - - run: mkdir -p $TEST_RESULTS_PATH/junit/ - - run: mkdir -p $TEST_RESULTS_PATH/coverage/ - - run: docker-compose build - - run: docker-compose run local bash /src/build-and-test-java.sh - - <<: *save-maven-cache - - run: find . -type f -regex ".*/target/surefire-reports/.*xml" -exec cp {} $TEST_RESULTS_PATH/junit/ \; - - run: find . -type f -regex ".*/target/surefire-reports/.*-output.txt" -exec cp {} $TEST_RESULTS_PATH/junit/ \; - - run: find . -type f -regex ".*/target/site/.*" -exec cp --parents {} $TEST_RESULTS_PATH/coverage/ \; - - run: docker-compose run local bash /src/build-and-test-python.sh - - store_artifacts: - path: /tmp/test-results - - store_test_results: - path: /tmp/test-results - - build-dist-maven: - <<: *job-defaults - <<: *machine-linux - steps: - - checkout - - <<: *install-java - - <<: *restore-maven-cache - - <<: *setup-maven-distributions - - run: - name: Build and deploy libstarlark - command: | - mvn versions:set -DnewVersion=${CIRCLE_TAG} -pl libstarlark - mvn clean dependency:go-offline package -pl libstarlark -U -Dmaven.test.skip.exec -T 2.0C -B - mvn deploy -DskipTests -pl libstarlark -Pgithub - - run: - name: Build and deploy larky - command: | - mvn versions:set-property -Dproperty=libstarlark.version -DnewVersion=${CIRCLE_TAG} - mvn versions:set -DnewVersion=${CIRCLE_TAG} -pl larky - mvn clean dependency:go-offline package -pl larky -U -Dmaven.test.skip.exec -T 2.0C -B - mvn deploy -DskipTests -pl larky -Pgithub - - <<: *save-maven-cache - - build-dist-linux: - <<: *job-defaults - <<: *machine-linux - steps: - - checkout - - <<: *install-java - - <<: *setup-maven-distributions - - <<: *restore-maven-cache - - <<: *restore-graalvm-cache - - <<: *install-graalvm - - <<: *save-graalvm-cache - - <<: *build-quarkus-runnable - - <<: *install_python - - <<: *build_test_pylarky - - run: - name: Copy dist files - command: | - mkdir ${DIST_PATH} - cp ./runlarky/target/larky-runner ${DIST_PATH}/larky-linux - cp dist/*.whl ${DIST_PATH} - - <<: *persist-dist - - build-dist-macos: - <<: *job-defaults - macos: - xcode: 10.2.1 - steps: - - checkout - - run: - name: Install dev - command: | - brew install openjdk@17 - brew install maven - - run: - name: Install GRAALVM - command: | - brew install --cask graalvm/tap/graalvm-ce-java17 - # Brew is designed to pull latest versions for the formula - xattr -r -d com.apple.quarantine /Library/Java/JavaVirtualMachines/graalvm-ce-java17-* - # We can use java_home exe to set GRAALVM_HOME - echo 'export GRAALVM_HOME="$(/usr/libexec/java_home)"' >> $BASH_ENV - source $BASH_ENV - # add gu to PATH - ln -s "$GRAALVM_HOME/bin/gu" /usr/local/bin - gu install native-image - - <<: *setup-maven-distributions - - <<: *build-quarkus-runnable - - <<: *install_python - - <<: *build_test_pylarky - - run: - name: Copy dist files - command: | - mkdir -p ${DIST_PATH} - cp ./runlarky/target/larky-runner ${DIST_PATH}/larky-macos - cp dist/*.whl ${DIST_PATH} - - <<: *persist-dist - - publish-to-gh: - <<: *job-defaults - docker: - - image: cibuilds/github:0.13 - steps: - - <<: *attach-dist - - run: - name: Create GH release - command: | - mv ${DIST_PATH}/larky-linux ${DIST_PATH}/larky-${CIRCLE_TAG}-linux - # mv ${DIST_PATH}/larky-macos ${DIST_PATH}/larky-${CIRCLE_TAG}-macos - ghr -draft -t ${GITHUB_API_TOKEN} -u ${CIRCLE_PROJECT_USERNAME} -r ${CIRCLE_PROJECT_REPONAME} -c ${CIRCLE_SHA1} -n ${CIRCLE_TAG} ${CIRCLE_TAG} ${DIST_PATH} - - publish-to-pypi: - <<: *job-defaults - docker: - - image: circleci/python - steps: - - <<: *attach-dist - - run: - name: Install twine - command: pip install twine - - run: - name: Upload packages - command: twine upload -u __token__ -p ${PYPI_TOKEN} ${DIST_PATH}/*.whl - scan-sast-pr: - <<: *machine-linux - <<: *job-defaults - environment: - SEMGREP_REPO_URL: << pipeline.project.git_url >> - SEMGREP_BRANCH: << pipeline.git.branch >> - SEMGREP_BASELINE_REF: master - SEMGREP_PR_ID: $CIRCLE_PR_NUMBER - steps: - - checkout - - <<: *restore-maven-cache - - run: - name: Semgrep PR Scan - command: docker-compose run --rm semgrep - scan-sast-full: - <<: *machine-linux - <<: *job-defaults - environment: - SEMGREP_REPO_URL: << pipeline.project.git_url >> - SEMGREP_BRANCH: << pipeline.git.branch >> - steps: - - checkout - - <<: *restore-maven-cache - - run: - name: Semgrep Full Scan - command: docker-compose run --rm semgrep - -workflows: - version: 2 - build_and_tests: - when: - not: << pipeline.parameters.nightly-security-scan >> - jobs: - - build-and-test - - build-dist-linux: - requires: - - build-and-test - - scan-sast-pr: - context: - - security-tools - - circleci - requires: - - build-and-test - filters: - tags: - ignore: /.*/ - - release: - when: - not: << pipeline.parameters.nightly-security-scan >> - jobs: - - build-dist-maven: - context: github - filters: - tags: - only: /^\d+\.\d+\.\d+(?:-[a-zA-Z0-9_.]+){0,1}$/ - branches: - ignore: /.*/ - - build-dist-linux: - context: github - filters: - tags: - only: /^\d+\.\d+\.\d+(?:-[a-zA-Z0-9_.]+){0,1}$/ - branches: - ignore: /.*/ - requires: - - build-dist-maven - - publish-to-gh: - context: github - filters: - tags: - only: /^\d+\.\d+\.\d+(?:-[a-zA-Z0-9_.]+){0,1}$/ - branches: - ignore: /.*/ - requires: - - build-dist-linux - - publish-to-pypi: - filters: - tags: - only: DEPRECATED - branches: - ignore: /.*/ - requires: - - build-dist-linux - scheduled-security-scan: - when: << pipeline.parameters.nightly-security-scan >> - jobs: - - scan-sast-full: - context: - - security-tools - - circleci - diff --git a/.mvn/Dockerfile b/Dockerfile.maven similarity index 100% rename from .mvn/Dockerfile rename to Dockerfile.maven diff --git a/compose.yaml b/compose.yaml index 39023b83e..bd6e0da14 100644 --- a/compose.yaml +++ b/compose.yaml @@ -3,7 +3,8 @@ services: maven: image: maven-build:latest build: - context: ./.mvn + context: . + dockerfile: Dockerfile.maven platform: linux/amd64 working_dir: /app environment: From 41ce2c223bbf8559614b284412cd00bdec476eaa Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 16:56:49 +0200 Subject: [PATCH 22/39] fix(SD-4274): gha migration --- .github/workflows/build-test-publish.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/build-test-publish.yaml b/.github/workflows/build-test-publish.yaml index cb0512eac..74863429d 100644 --- a/.github/workflows/build-test-publish.yaml +++ b/.github/workflows/build-test-publish.yaml @@ -91,7 +91,6 @@ jobs: - name: Infos id: infos - if: ${{ github.ref_type == 'tag' }} run: | if [[ ${EXTRACT_SEMVER} == 'true' ]]; then VERSION=${TAG##*-v} # remove everything up to and including -v From 66b22eaa5429f3d05cb26e1cfdf22c1fcb45c23c Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 16:59:53 +0200 Subject: [PATCH 23/39] fix(SD-4274): gha migration --- compose.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/compose.yaml b/compose.yaml index bd6e0da14..27db5989a 100644 --- a/compose.yaml +++ b/compose.yaml @@ -1,7 +1,6 @@ services: maven: - image: maven-build:latest build: context: . dockerfile: Dockerfile.maven @@ -18,7 +17,6 @@ services: - /var/run/docker.sock:/var/run/docker.sock python: - image: python-build:latest build: context: . dockerfile: Dockerfile.python From a8f7d69ad544027c8047a229fa3f12485f03eb0b Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 17:10:25 +0200 Subject: [PATCH 24/39] fix(SD-4274): gha migration --- .github/workflows/build-test-publish.yaml | 26 +++++++++++++++ .github/workflows/release-please.yaml | 39 ----------------------- 2 files changed, 26 insertions(+), 39 deletions(-) diff --git a/.github/workflows/build-test-publish.yaml b/.github/workflows/build-test-publish.yaml index 74863429d..c48047e47 100644 --- a/.github/workflows/build-test-publish.yaml +++ b/.github/workflows/build-test-publish.yaml @@ -121,3 +121,29 @@ jobs: path: "**/dist/*.whl" retention-days: 1 overwrite: "true" + + attach-assets: + needs: [build, build-py] + if: ${{ github.ref_type == 'tag' }} + runs-on: ubuntu-latest + steps: + - name: Download java target directory + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 + with: + name: maven-target + + - name: Download python target directory + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 + with: + name: python-target + + - name: Upload to Release + uses: softprops/action-gh-release@v2 + with: + tag_name: ${{ needs.release-please.outputs.tag_name }} + files: | + runlarky/target/larky-linux + dist/pylarky-*.whl + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG: ${{ github.ref_name }} diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml index 27b6a7124..c29597634 100644 --- a/.github/workflows/release-please.yaml +++ b/.github/workflows/release-please.yaml @@ -9,9 +9,6 @@ on: jobs: release-please: runs-on: ubuntu-latest - outputs: - release_created: ${{ steps.release.outputs.release_created }} - tag_name: ${{ steps.release.outputs.tag_name }} steps: - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2 id: app-token @@ -26,39 +23,3 @@ jobs: manifest-file: .github/.release-please-manifest.json include-component-in-tag: false token: ${{ steps.app-token.outputs.token }} - - attach-assets: - needs: release-please - if: ${{ needs.release-please.outputs.release_created }} - runs-on: ubuntu-latest - steps: - - name: Wait for Build Workflow - run: | - echo "Waiting for builds on tag ${{ needs.release-please.outputs.tag_name }} to start..." - sleep 30 # Give the tag-triggered workflow a moment to initialize - - - name: Download Artifacts from Tag Run - run: | - # Use GH CLI to find the run ID triggered by the new tag - RUN_ID=$(gh run list --tag ${{ needs.release-please.outputs.tag_name }} --limit 1 --json databaseId -q '.[0].databaseId') - - # Wait until that run is completed (simplified polling) - gh run watch $RUN_ID - - # Download the specific artifacts you uploaded in build-test-publish - gh run download $RUN_ID -n maven-target -D java-assets - gh run download $RUN_ID -n python-target -D python-assets - env: - GITHUB_TOKEN: ${{ secrets.VERYGOODBOT_CIAPPBUILDER_PAT }} - - - name: Upload to Release - uses: softprops/action-gh-release@v2 - with: - tag_name: ${{ needs.release-please.outputs.tag_name }} - files: | - runlarky/target/larky-linux - dist/pylarky-*.whl - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - From 8741d51a214ef3816311072fd0675f302d189d30 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 17:36:13 +0200 Subject: [PATCH 25/39] fix(SD-4274): gha migration --- .github/workflows/build-test-publish.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-test-publish.yaml b/.github/workflows/build-test-publish.yaml index c48047e47..2e83ab7f6 100644 --- a/.github/workflows/build-test-publish.yaml +++ b/.github/workflows/build-test-publish.yaml @@ -16,7 +16,7 @@ on: pull_request: permissions: - contents: read + contents: write pull-requests: read id-token: write From b1da0d47d17ccb1d5c694f3f92ba0fe5510ba831 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 17:59:03 +0200 Subject: [PATCH 26/39] fix(SD-4274): gha migration --- .github/workflows/build-test-publish.yaml | 6 +++++- Makefile | 4 +++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-test-publish.yaml b/.github/workflows/build-test-publish.yaml index 2e83ab7f6..658224d5c 100644 --- a/.github/workflows/build-test-publish.yaml +++ b/.github/workflows/build-test-publish.yaml @@ -137,12 +137,16 @@ jobs: with: name: python-target + - name: Add version to distribution + run: | + mv runlarky/target/larky-linux runlarky/target/larky-${VERSION}-linux + - name: Upload to Release uses: softprops/action-gh-release@v2 with: tag_name: ${{ needs.release-please.outputs.tag_name }} files: | - runlarky/target/larky-linux + runlarky/target/larky-*-linux dist/pylarky-*.whl env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/Makefile b/Makefile index 32df75df5..608758a03 100644 --- a/Makefile +++ b/Makefile @@ -8,4 +8,6 @@ publish: py_test_and_package: @echo "Running tests and packaging: pylarky" - docker compose run --rm python /bin/sh -c "./build-and-test-python.sh" \ No newline at end of file + docker compose run --rm \ + -e VERSION \ + python /bin/sh -c "./build-and-test-python.sh" \ No newline at end of file From 7667c1704cf3f61a38d65b21e57f59649f47dc32 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 18:10:40 +0200 Subject: [PATCH 27/39] fix(SD-4274): gha migration --- .github/workflows/build-test-publish.yaml | 3 +-- Makefile | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-test-publish.yaml b/.github/workflows/build-test-publish.yaml index 658224d5c..912cb8279 100644 --- a/.github/workflows/build-test-publish.yaml +++ b/.github/workflows/build-test-publish.yaml @@ -144,10 +144,9 @@ jobs: - name: Upload to Release uses: softprops/action-gh-release@v2 with: - tag_name: ${{ needs.release-please.outputs.tag_name }} + tag_name: ${{ github.ref_name }} files: | runlarky/target/larky-*-linux dist/pylarky-*.whl env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - TAG: ${{ github.ref_name }} diff --git a/Makefile b/Makefile index 608758a03..ea5ad9f04 100644 --- a/Makefile +++ b/Makefile @@ -9,5 +9,5 @@ publish: py_test_and_package: @echo "Running tests and packaging: pylarky" docker compose run --rm \ - -e VERSION \ +# -e VERSION \ python /bin/sh -c "./build-and-test-python.sh" \ No newline at end of file From a1a98180b3ead4e962f69a14e534d936ba349f17 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 18:23:46 +0200 Subject: [PATCH 28/39] fix(SD-4274): gha migration --- Makefile | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Makefile b/Makefile index ea5ad9f04..916b5c432 100644 --- a/Makefile +++ b/Makefile @@ -8,6 +8,5 @@ publish: py_test_and_package: @echo "Running tests and packaging: pylarky" - docker compose run --rm \ -# -e VERSION \ + docker compose run --rm python /bin/sh -c "./build-and-test-python.sh" \ No newline at end of file From 156c13dcad2ed6b463f95549a372c667c76b69d8 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 18:30:34 +0200 Subject: [PATCH 29/39] fix(SD-4274): gha migration --- Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 916b5c432..20d4238d5 100644 --- a/Makefile +++ b/Makefile @@ -8,5 +8,5 @@ publish: py_test_and_package: @echo "Running tests and packaging: pylarky" - docker compose run --rm - python /bin/sh -c "./build-and-test-python.sh" \ No newline at end of file + docker compose run --rm \ + python /bin/sh -c "./build-and-test-python.sh" \ No newline at end of file From 6b7bcab0517bb211e5efb9ece2f249759238f064 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 18:43:05 +0200 Subject: [PATCH 30/39] fix(SD-4274): gha migration --- .github/workflows/build-test-publish.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.github/workflows/build-test-publish.yaml b/.github/workflows/build-test-publish.yaml index 912cb8279..f3f6518b3 100644 --- a/.github/workflows/build-test-publish.yaml +++ b/.github/workflows/build-test-publish.yaml @@ -137,6 +137,21 @@ jobs: with: name: python-target + - name: Infos + id: infos + run: | + if [[ ${EXTRACT_SEMVER} == 'true' ]]; then + VERSION=${TAG##*-v} # remove everything up to and including -v + VERSION=${VERSION#v} # remove initial v if it's just v1.2.3 + else + VERSION=${TAG} + fi + + echo "VERSION=$VERSION" >> $GITHUB_ENV + env: + EXTRACT_SEMVER: ${{ github.ref_type == 'tag' }} + TAG: ${{ (github.ref_type == 'tag' && github.ref_name) || github.sha }} + - name: Add version to distribution run: | mv runlarky/target/larky-linux runlarky/target/larky-${VERSION}-linux From b468f0f5341d9df50ceb82058c6ec6bf9503549b Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 18:52:02 +0200 Subject: [PATCH 31/39] fix(SD-4274): gha migration --- Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/Makefile b/Makefile index 20d4238d5..6491c8518 100644 --- a/Makefile +++ b/Makefile @@ -9,4 +9,5 @@ publish: py_test_and_package: @echo "Running tests and packaging: pylarky" docker compose run --rm \ + -e VERSION \ python /bin/sh -c "./build-and-test-python.sh" \ No newline at end of file From 5f72a8e1e74910e9c10801130874f9a27d1348b2 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 18:57:46 +0200 Subject: [PATCH 32/39] fix(SD-4274): gha migration --- .github/workflows/build-test-publish.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/build-test-publish.yaml b/.github/workflows/build-test-publish.yaml index f3f6518b3..f893bdbb7 100644 --- a/.github/workflows/build-test-publish.yaml +++ b/.github/workflows/build-test-publish.yaml @@ -159,9 +159,8 @@ jobs: - name: Upload to Release uses: softprops/action-gh-release@v2 with: + token: ${{ secrets.GITHUB_TOKEN }} tag_name: ${{ github.ref_name }} files: | runlarky/target/larky-*-linux dist/pylarky-*.whl - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} From a2375ff52851f7912d8c8e6915945da45b7cdb60 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Mon, 2 Feb 2026 19:01:05 +0200 Subject: [PATCH 33/39] fix(SD-4274): gha migration --- .github/workflows/security-scan-sast.yaml | 17 ----------------- 1 file changed, 17 deletions(-) delete mode 100644 .github/workflows/security-scan-sast.yaml diff --git a/.github/workflows/security-scan-sast.yaml b/.github/workflows/security-scan-sast.yaml deleted file mode 100644 index cadb9ae2f..000000000 --- a/.github/workflows/security-scan-sast.yaml +++ /dev/null @@ -1,17 +0,0 @@ -name: security-scan-sast - -on: - pull_request: - workflow_dispatch: - schedule: - - cron: '20 6 * * 4' - -jobs: - scan: - uses: verygood-ops/cicd-shared/.github/workflows/security-scan-sast.yaml@security-scan-sast-v2 - with: - uses_maven: true - secrets: - SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} - SAST_SLACK_WORKFLOW_WEBHOOK: ${{ secrets.SAST_SLACK_WORKFLOW_WEBHOOK }} - VERYGOODBOT_CIAPPBUILDER_PAT: ${{ secrets.VERYGOODBOT_CIAPPBUILDER_PAT }} From a8e71bc71d6de5ff0f2456a1408e271acf83dd2a Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Tue, 3 Feb 2026 10:53:08 +0200 Subject: [PATCH 34/39] fix(SD-4274): gha migration --- .github/workflows/build-test-publish.yaml | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/.github/workflows/build-test-publish.yaml b/.github/workflows/build-test-publish.yaml index f893bdbb7..4e32ca8b0 100644 --- a/.github/workflows/build-test-publish.yaml +++ b/.github/workflows/build-test-publish.yaml @@ -157,10 +157,14 @@ jobs: mv runlarky/target/larky-linux runlarky/target/larky-${VERSION}-linux - name: Upload to Release - uses: softprops/action-gh-release@v2 - with: - token: ${{ secrets.GITHUB_TOKEN }} - tag_name: ${{ github.ref_name }} - files: | - runlarky/target/larky-*-linux - dist/pylarky-*.whl + run: | + # Check if a release exists for this tag + if gh release view ${{ github.ref_name }} &>/dev/null; then + echo "Release exists, uploading artifact..." + gh release upload ${{ github.ref_name }} dist/pylarky-*.whl --clobber + gh release upload ${{ github.ref_name }} runlarky/target/larky-*-linux --clobber + else + echo "No release found for tag ${{ github.ref_name }}" + fi + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} From 677cf7472de2bc6aa635511bba2025a0ac53560a Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Tue, 3 Feb 2026 11:02:29 +0200 Subject: [PATCH 35/39] fix(SD-4274): gha migration --- .github/workflows/build-test-publish.yaml | 12 +++--------- Makefile | 1 - 2 files changed, 3 insertions(+), 10 deletions(-) diff --git a/.github/workflows/build-test-publish.yaml b/.github/workflows/build-test-publish.yaml index 4e32ca8b0..102e8393b 100644 --- a/.github/workflows/build-test-publish.yaml +++ b/.github/workflows/build-test-publish.yaml @@ -140,17 +140,11 @@ jobs: - name: Infos id: infos run: | - if [[ ${EXTRACT_SEMVER} == 'true' ]]; then - VERSION=${TAG##*-v} # remove everything up to and including -v - VERSION=${VERSION#v} # remove initial v if it's just v1.2.3 - else - VERSION=${TAG} - fi - + VERSION=${TAG##*-v} # remove everything up to and including -v + VERSION=${VERSION#v} # remove initial v if it's just v1.2.3 echo "VERSION=$VERSION" >> $GITHUB_ENV env: - EXTRACT_SEMVER: ${{ github.ref_type == 'tag' }} - TAG: ${{ (github.ref_type == 'tag' && github.ref_name) || github.sha }} + TAG: ${{ github.ref_name }} - name: Add version to distribution run: | diff --git a/Makefile b/Makefile index 6491c8518..20d4238d5 100644 --- a/Makefile +++ b/Makefile @@ -9,5 +9,4 @@ publish: py_test_and_package: @echo "Running tests and packaging: pylarky" docker compose run --rm \ - -e VERSION \ python /bin/sh -c "./build-and-test-python.sh" \ No newline at end of file From 83a7da5e80725123d0ca075eca139c1346d68280 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Tue, 3 Feb 2026 11:19:11 +0200 Subject: [PATCH 36/39] fix(SD-4274): gha migration --- .github/workflows/build-test-publish.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/build-test-publish.yaml b/.github/workflows/build-test-publish.yaml index 102e8393b..25366a82e 100644 --- a/.github/workflows/build-test-publish.yaml +++ b/.github/workflows/build-test-publish.yaml @@ -127,6 +127,9 @@ jobs: if: ${{ github.ref_type == 'tag' }} runs-on: ubuntu-latest steps: + - name: Checkout + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6 + - name: Download java target directory uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 with: From b82f866e5ab265fbb4c159d07093122b9a0a05bb Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Tue, 3 Feb 2026 11:30:11 +0200 Subject: [PATCH 37/39] fix(SD-4274): gha migration --- Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/Makefile b/Makefile index 20d4238d5..6491c8518 100644 --- a/Makefile +++ b/Makefile @@ -9,4 +9,5 @@ publish: py_test_and_package: @echo "Running tests and packaging: pylarky" docker compose run --rm \ + -e VERSION \ python /bin/sh -c "./build-and-test-python.sh" \ No newline at end of file From 9b69466761186fe939a88c15e6ad90631cbc42c7 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Tue, 3 Feb 2026 11:41:48 +0200 Subject: [PATCH 38/39] fix(SD-4274): gha migration --- .github/workflows/build-test-publish.yaml | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/.github/workflows/build-test-publish.yaml b/.github/workflows/build-test-publish.yaml index 25366a82e..ef2863cdc 100644 --- a/.github/workflows/build-test-publish.yaml +++ b/.github/workflows/build-test-publish.yaml @@ -91,19 +91,14 @@ jobs: - name: Infos id: infos + if: ${{ github.ref_type == 'tag' }} run: | - if [[ ${EXTRACT_SEMVER} == 'true' ]]; then - VERSION=${TAG##*-v} # remove everything up to and including -v - VERSION=${VERSION#v} # remove initial v if it's just v1.2.3 - else - VERSION=${TAG} - fi - + VERSION=${TAG##*-v} # remove everything up to and including -v + VERSION=${VERSION#v} # remove initial v if it's just v1.2.3 echo "TAG=$TAG" >> $GITHUB_ENV echo "VERSION=$VERSION" >> $GITHUB_ENV env: - EXTRACT_SEMVER: ${{ github.ref_type == 'tag' }} - TAG: ${{ (github.ref_type == 'tag' && github.ref_name) || github.sha }} + TAG: ${{ github.ref_name }} - name: Download target directory uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 From 3ce00ba197294345e78a503754a79305c7b4d7e4 Mon Sep 17 00:00:00 2001 From: "viktor.kotziuba" Date: Tue, 3 Feb 2026 11:48:55 +0200 Subject: [PATCH 39/39] fix(SD-4274): gha migration --- .github/workflows/build-test-publish.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/build-test-publish.yaml b/.github/workflows/build-test-publish.yaml index ef2863cdc..4a9a03b2d 100644 --- a/.github/workflows/build-test-publish.yaml +++ b/.github/workflows/build-test-publish.yaml @@ -95,7 +95,6 @@ jobs: run: | VERSION=${TAG##*-v} # remove everything up to and including -v VERSION=${VERSION#v} # remove initial v if it's just v1.2.3 - echo "TAG=$TAG" >> $GITHUB_ENV echo "VERSION=$VERSION" >> $GITHUB_ENV env: TAG: ${{ github.ref_name }}