Skip to content

Commit 70d7991

Browse files
author
Fabiana Severin
committed
ci(release): configure Maven CodeArtifact mirror
1 parent 1dcf590 commit 70d7991

3 files changed

Lines changed: 121 additions & 25 deletions

File tree

‎.github/actions/configure-maven-mirror/action.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: Configure Maven CodeArtifact mirror
2+
description: Configure Maven to resolve dependencies through the release CodeArtifact repository.
3+
4+
runs:
5+
using: composite
6+
steps:
7+
- shell: bash
8+
run: |
9+
CA_DOMAIN=aws-lambda
10+
CA_REPO=maven-central-store
11+
12+
# Uses the ambient region and caller account.
13+
TOKEN=$(aws codeartifact get-authorization-token \
14+
--domain "$CA_DOMAIN" --query authorizationToken --output text)
15+
echo "::add-mask::$TOKEN"
16+
17+
CA_URL=$(aws codeartifact get-repository-endpoint \
18+
--domain "$CA_DOMAIN" --repository "$CA_REPO" --format maven \
19+
--query repositoryEndpoint --output text)
20+
21+
# <mirrorOf>*</mirrorOf> routes all resolution through the mirror;
22+
# deployment uses distributionManagement and is unaffected.
23+
mkdir -p "$HOME/.m2"
24+
cat > "$HOME/.m2/settings.xml" <<EOF
25+
<settings>
26+
<servers>
27+
<server>
28+
<id>codeartifact-mirror</id>
29+
<username>aws</username>
30+
<password>${TOKEN}</password>
31+
</server>
32+
</servers>
33+
<mirrors>
34+
<mirror>
35+
<id>codeartifact-mirror</id>
36+
<name>release CodeArtifact Maven Central proxy</name>
37+
<url>${CA_URL}</url>
38+
<mirrorOf>*</mirrorOf>
39+
</mirror>
40+
</mirrors>
41+
</settings>
42+
EOF

‎.github/workflows/release-runtime-interface-client.yml‎

Lines changed: 46 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -69,12 +69,22 @@ jobs:
6969
7070
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
7171

72-
- name: Set up JDK 8
73-
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
74-
with:
75-
java-version: 8
76-
distribution: corretto
77-
cache: maven
72+
# Use the CodeBuild image's preinstalled Corretto 8. The image ships it at
73+
# $JAVA_8_HOME but defaults JAVA_HOME to Java 25, so point JAVA_HOME/PATH at
74+
# 8. Avoids actions/setup-java, which fetches from corretto.github.io +
75+
# corretto.aws, both blocked by the runner egress lock. $JAVA_8_HOME
76+
# resolves per-arch (x86_64/aarch64).
77+
- name: Use the runner image's preinstalled Corretto 8
78+
run: |
79+
echo "JAVA_HOME=$JAVA_8_HOME" >> "$GITHUB_ENV"
80+
echo "$JAVA_8_HOME/bin" >> "$GITHUB_PATH"
81+
"$JAVA_8_HOME/bin/java" -version
82+
83+
# Route all mvn resolution through the CodeArtifact mirror. Must precede
84+
# resolve-release-version, which invokes `mvn help:evaluate`. Ambient
85+
# CodeBuild runner-role creds supply the token; no OIDC step in this job.
86+
- name: Configure Maven CodeArtifact mirror
87+
uses: ./.github/actions/configure-maven-mirror
7888

7989
- name: Resolve and validate release version
8090
uses: ./.github/actions/resolve-release-version
@@ -112,6 +122,12 @@ jobs:
112122
${{ env.MODULE }}/target/*-linux*.jar
113123
${{ env.MODULE }}/target/classes/jni/*.so
114124
125+
# Remove the user settings holding the CodeArtifact mirror token once the
126+
# build is done. Ephemeral runner, so defence-in-depth, not load-bearing.
127+
- name: Scrub Maven settings
128+
if: always()
129+
run: rm -f "$HOME/.m2/settings.xml"
130+
115131
# Assemble all native builds and publish.
116132
release:
117133
needs: build-natives
@@ -123,12 +139,23 @@ jobs:
123139
with:
124140
fetch-depth: 0 # full history for tagging/pushing
125141

126-
- name: Set up JDK 8
127-
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
128-
with:
129-
java-version: 8
130-
distribution: corretto
131-
cache: maven
142+
# Use the CodeBuild image's preinstalled Corretto 8. The image ships it at
143+
# $JAVA_8_HOME but defaults JAVA_HOME to Java 25, so point JAVA_HOME/PATH at
144+
# 8. Avoids actions/setup-java, which fetches from corretto.github.io +
145+
# corretto.aws, both blocked by the runner egress lock. $JAVA_8_HOME
146+
# resolves per-arch (x86_64/aarch64).
147+
- name: Use the runner image's preinstalled Corretto 8
148+
run: |
149+
echo "JAVA_HOME=$JAVA_8_HOME" >> "$GITHUB_ENV"
150+
echo "$JAVA_8_HOME/bin" >> "$GITHUB_PATH"
151+
"$JAVA_8_HOME/bin/java" -version
152+
153+
# Route all mvn resolution through the CodeArtifact mirror. Must precede
154+
# resolve-release-version (which invokes `mvn help:evaluate`) and the OIDC
155+
# step (which would shadow the runner-role creds this needs). Runs on every
156+
# path, since dependency resolution happens on dry-runs too.
157+
- name: Configure Maven CodeArtifact mirror
158+
uses: ./.github/actions/configure-maven-mirror
132159

133160
- name: Resolve and validate release version
134161
uses: ./.github/actions/resolve-release-version
@@ -234,7 +261,11 @@ jobs:
234261
gpg --batch --import <<< "$GPG_PRIVATE_KEY"
235262
GPG_KEYNAME=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/ {print $5; exit}')
236263
237-
# settings.xml with the Sonatype token (server id "central").
264+
# Global settings holding only the Sonatype "central" server for upload.
265+
# Passed to Maven as -gs (global) so it MERGES with the CodeArtifact
266+
# mirror in ~/.m2/settings.xml (user) that the mirror step wrote: deps
267+
# resolve through the mirror, upload goes to central, and the mirror
268+
# token stays in that user file instead of being re-passed here.
238269
{
239270
echo '<settings><servers><server>'
240271
echo "<id>central</id>"
@@ -243,9 +274,9 @@ jobs:
243274
echo '</server></servers></settings>'
244275
} > "$MAVEN_SETTINGS"
245276
246-
# --- Publish ---
277+
# --- Publish --- (-gs: merge Sonatype creds with the ~/.m2 mirror)
247278
mvn deploy -Prelease -DskipTests -DmultiArch=false \
248-
-s "$MAVEN_SETTINGS" \
279+
-gs "$MAVEN_SETTINGS" \
249280
-Dgpg.keyname="$GPG_KEYNAME" -Dgpg.passphrase="$GPG_PASSPHRASE" \
250281
--file "$MODULE/pom.xml"
251282

‎.github/workflows/release.yml‎

Lines changed: 33 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -85,13 +85,22 @@ jobs:
8585
with:
8686
fetch-depth: 0 # full history for tagging/pushing
8787

88-
# Pinned JDK 8: building on a newer JDK can silently break the artifact.
89-
- name: Set up JDK 8
90-
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
91-
with:
92-
java-version: 8
93-
distribution: corretto
94-
cache: maven
88+
# Use the CodeBuild image's preinstalled Corretto 8. The image ships it at
89+
# $JAVA_8_HOME but defaults JAVA_HOME to Java 25, so point JAVA_HOME/PATH at
90+
# 8. Avoids actions/setup-java, which fetches from corretto.github.io +
91+
# corretto.aws, both blocked by the runner egress lock. $JAVA_8_HOME
92+
# resolves per-arch (x86_64/aarch64).
93+
- name: Use the runner image's preinstalled Corretto 8
94+
run: |
95+
echo "JAVA_HOME=$JAVA_8_HOME" >> "$GITHUB_ENV"
96+
echo "$JAVA_8_HOME/bin" >> "$GITHUB_PATH"
97+
"$JAVA_8_HOME/bin/java" -version
98+
99+
# Route all mvn resolution through the CodeArtifact mirror. Runs before the
100+
# OIDC step (which would shadow the runner-role creds this needs) and on
101+
# every path, since dependency resolution happens on dry-runs too.
102+
- name: Configure Maven CodeArtifact mirror
103+
uses: ./.github/actions/configure-maven-mirror
95104

96105
- name: Resolve and validate release version
97106
uses: ./.github/actions/resolve-release-version
@@ -201,7 +210,11 @@ jobs:
201210
gpg --batch --import <<< "$GPG_PRIVATE_KEY"
202211
GPG_KEYNAME=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/ {print $5; exit}')
203212
204-
# settings.xml with the Sonatype token (server id "central").
213+
# Global settings holding only the Sonatype "central" server for upload.
214+
# Passed to Maven as -gs (global) so it MERGES with the CodeArtifact
215+
# mirror in ~/.m2/settings.xml (user) that the mirror step wrote: deps
216+
# resolve through the mirror, upload goes to central, and the mirror
217+
# token stays in that user file instead of being re-passed here.
205218
{
206219
echo '<settings><servers><server>'
207220
echo "<id>central</id>"
@@ -220,9 +233,11 @@ jobs:
220233
# Prepare locally (no push): release commits + tag.
221234
mvn release:prepare -DpushChanges=false "${RELEASE_ARGS[@]}" --file "$MODULE/pom.xml"
222235
223-
# perform forks a fresh build, so pass settings/gpg via -Darguments.
236+
# perform forks a fresh build. Pass the Sonatype creds as GLOBAL
237+
# settings (-gs) so the fork still auto-reads ~/.m2/settings.xml (the
238+
# mirror) and merges the two.
224239
mvn release:perform -DlocalCheckout=true \
225-
-Darguments="-s $MAVEN_SETTINGS -Prelease -Dgpg.keyname=$GPG_KEYNAME -Dgpg.passphrase=$GPG_PASSPHRASE" \
240+
-Darguments="-gs $MAVEN_SETTINGS -Prelease -Dgpg.keyname=$GPG_KEYNAME -Dgpg.passphrase=$GPG_PASSPHRASE" \
226241
--file "$MODULE/pom.xml"
227242
228243
# Push commits + tag atomically, only after publish succeeded.
@@ -261,3 +276,11 @@ jobs:
261276
echo "| Version | \`$EFFECTIVE_RELEASE_VERSION\` |" >> $GITHUB_STEP_SUMMARY
262277
echo "| Tag | \`$TAG_NAME\` |" >> $GITHUB_STEP_SUMMARY
263278
echo "| Maven Central | [com.amazonaws:$MODULE:$EFFECTIVE_RELEASE_VERSION](https://central.sonatype.com/artifact/com.amazonaws/$MODULE/$EFFECTIVE_RELEASE_VERSION) |" >> $GITHUB_STEP_SUMMARY
279+
280+
# Symmetry with the publish step's in-shell scrub: remove the user settings
281+
# holding the CodeArtifact mirror token. Last step, after the mvn-using
282+
# rollback path, so nothing still needs it. The runner is ephemeral, so
283+
# this is defence-in-depth, not load-bearing.
284+
- name: Scrub Maven settings
285+
if: always()
286+
run: rm -f "$HOME/.m2/settings.xml"

0 commit comments

Comments
 (0)