diff --git a/.github/workflows/assemble.yml b/.github/workflows/assemble.yml index 9209f92d43b39..709273bd03786 100644 --- a/.github/workflows/assemble.yml +++ b/.github/workflows/assemble.yml @@ -10,9 +10,9 @@ jobs: java: [ 11 ] os: [ubuntu-latest, windows-latest, macos-13] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Set up JDK ${{ matrix.java }} - uses: actions/setup-java@v4 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 with: java-version: ${{ matrix.java }} distribution: temurin diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml index b8d3912c5864a..45d77cdcf74eb 100644 --- a/.github/workflows/auto-release.yml +++ b/.github/workflows/auto-release.yml @@ -14,16 +14,16 @@ jobs: steps: - name: GitHub App token id: github_app_token - uses: tibdex/github-app-token@v1.5.0 + uses: tibdex/github-app-token@0af3325639c0a60612b2eeaf010f0f88e468e800 # v2.1.0 with: app_id: ${{ secrets.APP_ID }} private_key: ${{ secrets.APP_PRIVATE_KEY }} installation_id: 22958780 - name: Get tag id: tag - uses: dawidd6/action-get-tag@v1 - - uses: actions/checkout@v2 - - uses: ncipollo/release-action@v1 + uses: dawidd6/action-get-tag@727a6f0a561be04e09013531e73a3983a65e3479 # v1 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1 with: github_token: ${{ steps.github_app_token.outputs.token }} bodyFile: release-notes/opensearch.release-notes-${{steps.tag.outputs.tag}}.md diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml deleted file mode 100644 index 2a95177174e9b..0000000000000 --- a/.github/workflows/backport.yml +++ /dev/null @@ -1,40 +0,0 @@ -name: Backport -on: - pull_request_target: - types: - - closed - - labeled - -jobs: - backport: - name: Backport - runs-on: ubuntu-latest - # Only react to merged PRs for security reasons. - # See https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target. - if: > - github.event.pull_request.merged - && ( - github.event.action == 'closed' - || ( - github.event.action == 'labeled' - && contains(github.event.label.name, 'backport') - ) - ) - permissions: - contents: write - pull-requests: write - steps: - - name: GitHub App token - id: github_app_token - uses: tibdex/github-app-token@v2.1.0 - with: - app_id: ${{ secrets.APP_ID }} - private_key: ${{ secrets.APP_PRIVATE_KEY }} - installation_id: 22958780 - - - name: Backport - uses: VachaShah/backport@v2.2.0 - with: - github_token: ${{ steps.github_app_token.outputs.token }} - head_template: backport/backport-<%= number %>-to-<%= base %> - failure_labels: backport-failed diff --git a/.github/workflows/copy-linked-issue-labels.yml b/.github/workflows/copy-linked-issue-labels.yml index 33b5e92dc10da..0d1bf46b27eb0 100644 --- a/.github/workflows/copy-linked-issue-labels.yml +++ b/.github/workflows/copy-linked-issue-labels.yml @@ -13,7 +13,7 @@ jobs: pull-requests: write steps: - name: copy-issue-labels - uses: michalvankodev/copy-issue-labels@v1.3.0 + uses: michalvankodev/copy-issue-labels@c4df96ee53d2cdf639ba169a26c43b04d5085cb3 # v2.0.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} labels-to-exclude: | diff --git a/.github/workflows/delete_backport_branch.yml b/.github/workflows/delete_backport_branch.yml deleted file mode 100644 index d654df6b40257..0000000000000 --- a/.github/workflows/delete_backport_branch.yml +++ /dev/null @@ -1,15 +0,0 @@ -name: Delete merged branch of the backport PRs -on: - pull_request: - types: - - closed - -jobs: - delete-branch: - runs-on: ubuntu-latest - if: startsWith(github.event.pull_request.head.ref,'backport/') - steps: - - name: Delete merged branch - uses: SvanBoxel/delete-merged-branch@main - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file diff --git a/.github/workflows/dependabot_pr.yml b/.github/workflows/dependabot_pr.yml deleted file mode 100644 index 6fedf541a64b6..0000000000000 --- a/.github/workflows/dependabot_pr.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Dependabot PR actions -on: pull_request - -jobs: - dependabot: - runs-on: ubuntu-latest - permissions: - pull-requests: write - contents: write - if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }} - steps: - - name: GitHub App token - id: github_app_token - uses: tibdex/github-app-token@v2.1.0 - with: - app_id: ${{ secrets.APP_ID }} - private_key: ${{ secrets.APP_PRIVATE_KEY }} - installation_id: 22958780 - - - name: Check out code - uses: actions/checkout@v4 - with: - token: ${{ steps.github_app_token.outputs.token }} - - - name: Update Gradle SHAs - run: | - ./gradlew updateSHAs - - - name: Commit the changes - uses: stefanzweifel/git-auto-commit-action@v5 - with: - commit_message: Updating SHAs - branch: ${{ github.head_ref }} - commit_user_name: dependabot[bot] - commit_user_email: support@github.com - commit_options: '--signoff' - - - name: Run spotless - run: | - ./gradlew spotlessApply - - - name: Commit the changes - uses: stefanzweifel/git-auto-commit-action@v5 - with: - commit_message: Spotless formatting - branch: ${{ github.head_ref }} - commit_user_name: dependabot[bot] - commit_user_email: support@github.com - commit_options: '--signoff' - - - name: Update the changelog - uses: dangoslen/dependabot-changelog-helper@v3 - with: - version: 'Unreleased' - - - name: Commit the changes - uses: stefanzweifel/git-auto-commit-action@v5 - with: - commit_message: "Update changelog" - branch: ${{ github.head_ref }} - commit_user_name: dependabot[bot] - commit_user_email: support@github.com - commit_options: '--signoff' diff --git a/.github/workflows/gradle-check.yml b/.github/workflows/gradle-check.yml index 1ae2280310ba6..e946253b98696 100644 --- a/.github/workflows/gradle-check.yml +++ b/.github/workflows/gradle-check.yml @@ -17,10 +17,10 @@ jobs: outputs: RUN_GRADLE_CHECK: ${{ steps.changed-files-specific.outputs.any_changed }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Get changed files id: changed-files-specific - uses: tj-actions/changed-files@v44 + uses: tj-actions/changed-files@2f7c5bfce28377bc069a65ba478de0a74aa0ca32 # v46.0.1 with: files_ignore: | release-notes/*.md @@ -38,7 +38,7 @@ jobs: timeout-minutes: 130 steps: - name: Checkout OpenSearch repo - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: ref: ${{ github.event.pull_request.head.sha }} @@ -57,7 +57,7 @@ jobs: echo "post_merge_action=false" >> $GITHUB_ENV # to get the PR data that can be used for post merge actions - - uses: actions/github-script@v7 + - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 if: github.event_name == 'push' id: get_pr_data with: @@ -89,7 +89,7 @@ jobs: echo "post_merge_action=true" >> $GITHUB_ENV - name: Checkout opensearch-build repo - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: repository: opensearch-project/opensearch-build ref: main @@ -111,13 +111,13 @@ jobs: - name: Upload Coverage Report if: success() - uses: codecov/codecov-action@v4 + uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6 with: files: ./codeCoverage.xml - name: Create Comment Success if: ${{ github.event_name == 'pull_request_target' && success() && env.result == 'SUCCESS' }} - uses: peter-evans/create-or-update-comment@v4 + uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5 with: issue-number: ${{ env.pr_number }} body: | @@ -140,7 +140,7 @@ jobs: - name: Create Comment Flaky if: ${{ github.event_name == 'pull_request_target' && success() && env.result != 'SUCCESS' }} - uses: peter-evans/create-or-update-comment@v4 + uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5 with: issue-number: ${{ env.pr_number }} body: | @@ -150,7 +150,7 @@ jobs: - name: Create Comment Failure if: ${{ github.event_name == 'pull_request_target' && failure() }} - uses: peter-evans/create-or-update-comment@v4 + uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5 with: issue-number: ${{ env.pr_number }} body: | diff --git a/.github/workflows/maintainer-approval.yml b/.github/workflows/maintainer-approval.yml index fdc2bf16937b4..44a11226fd2bc 100644 --- a/.github/workflows/maintainer-approval.yml +++ b/.github/workflows/maintainer-approval.yml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest steps: - id: find-maintainers - uses: actions/github-script@v7.0.1 + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 with: github-token: ${{ secrets.GITHUB_TOKEN }} result-encoding: string diff --git a/.github/workflows/precommit.yml b/.github/workflows/precommit.yml index 70b3fb1a734e8..2863898315394 100644 --- a/.github/workflows/precommit.yml +++ b/.github/workflows/precommit.yml @@ -10,9 +10,9 @@ jobs: java: [ 11 ] os: [ubuntu-latest, windows-latest, macos-13] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Set up JDK ${{ matrix.java }} - uses: actions/setup-java@v4 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 with: java-version: ${{ matrix.java }} distribution: temurin diff --git a/.github/workflows/publish-maven-snapshots.yml b/.github/workflows/publish-maven-snapshots.yml index 7289455d1f3f1..4890880abd7ed 100644 --- a/.github/workflows/publish-maven-snapshots.yml +++ b/.github/workflows/publish-maven-snapshots.yml @@ -17,15 +17,15 @@ jobs: contents: write steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Set up JDK 11 - uses: actions/setup-java@v3 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 with: distribution: adopt java-version: 11 - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v1 + uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6 with: role-to-assume: ${{ secrets.PUBLISH_SNAPSHOTS_ROLE }} aws-region: us-east-1 diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml index fce328cb5bc35..7a8755fb319d4 100644 --- a/.github/workflows/version.yml +++ b/.github/workflows/version.yml @@ -11,13 +11,13 @@ jobs: steps: - name: GitHub App token id: github_app_token - uses: tibdex/github-app-token@v1.5.0 + uses: tibdex/github-app-token@0af3325639c0a60612b2eeaf010f0f88e468e800 # v2.1.0 with: app_id: ${{ secrets.APP_ID }} private_key: ${{ secrets.APP_PRIVATE_KEY }} installation_id: 22958780 - - uses: actions/checkout@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Fetch Tag and Version Information run: | TAG=$(echo "${GITHUB_REF#refs/*/}") @@ -42,7 +42,7 @@ jobs: echo "NEXT_VERSION=$NEXT_VERSION" >> $GITHUB_ENV echo "NEXT_VERSION_UNDERSCORE=$NEXT_VERSION_UNDERSCORE" >> $GITHUB_ENV echo "NEXT_VERSION_ID=$NEXT_VERSION_ID" >> $GITHUB_ENV - - uses: actions/checkout@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: ref: ${{ env.BASE }} token: ${{ steps.github_app_token.outputs.token }} @@ -57,7 +57,7 @@ jobs: sed -i "s/CURRENT = $CURRENT_VERSION_UNDERSCORE;/CURRENT = $NEXT_VERSION_UNDERSCORE;/g" server/src/main/java/org/opensearch/Version.java - name: Create Pull Request - uses: peter-evans/create-pull-request@v6 + uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7 with: token: ${{ steps.github_app_token.outputs.token }} base: ${{ env.BASE }} @@ -71,7 +71,7 @@ jobs: body: | I've noticed that a new tag ${{ env.TAG }} was pushed, and incremented the version from ${{ env.CURRENT_VERSION }} to ${{ env.NEXT_VERSION }}. - - uses: actions/checkout@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: ref: ${{ env.BASE_X }} token: ${{ steps.github_app_token.outputs.token }} @@ -84,7 +84,7 @@ jobs: sed -i "s/public static final Version $CURRENT_VERSION_UNDERSCORE = new Version(\([[:digit:]]\+\)\(.*\));/\0\n public static final Version $NEXT_VERSION_UNDERSCORE = new Version($NEXT_VERSION_ID\2);/g" server/src/main/java/org/opensearch/Version.java - name: Create Pull Request - uses: peter-evans/create-pull-request@v6 + uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7 with: token: ${{ steps.github_app_token.outputs.token }} base: ${{ env.BASE_X }} @@ -98,7 +98,7 @@ jobs: body: | I've noticed that a new tag ${{ env.TAG }} was pushed, and added a bwc version ${{ env.NEXT_VERSION }}. - - uses: actions/checkout@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: ref: main token: ${{ steps.github_app_token.outputs.token }} @@ -111,7 +111,7 @@ jobs: sed -i "s/public static final Version $CURRENT_VERSION_UNDERSCORE = new Version(\([[:digit:]]\+\)\(.*\));/\0\n public static final Version $NEXT_VERSION_UNDERSCORE = new Version($NEXT_VERSION_ID\2);/g" server/src/main/java/org/opensearch/Version.java - name: Create Pull Request - uses: peter-evans/create-pull-request@v6 + uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7 with: token: ${{ steps.github_app_token.outputs.token }} base: main diff --git a/.github/workflows/wrapper.yml b/.github/workflows/wrapper.yml index fc41d0b5e414b..348418604cdc7 100644 --- a/.github/workflows/wrapper.yml +++ b/.github/workflows/wrapper.yml @@ -6,5 +6,5 @@ jobs: name: Validate runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: gradle/wrapper-validation-action@v3 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: gradle/actions/wrapper-validation@0b6dd653ba04f4f93bf581ec31e66cbd7dcb644d # v4 diff --git a/build.gradle b/build.gradle index 050043ce14387..dae336f82b4f1 100644 --- a/build.gradle +++ b/build.gradle @@ -168,7 +168,7 @@ tasks.register("verifyVersions") { // Fetch the metadata and parse the xml into Version instances because it's more straight forward here // rather than bwcVersion ( VersionCollection ). //TODO OpenSearch - Update the maven repo URL for OpenSearch when available. - new URL('https://repo1.maven.org/maven2/org/elasticsearch/elasticsearch/maven-metadata.xml').openStream().withStream { s -> + new URL('https://ci.opensearch.org/maven2/org/elasticsearch/elasticsearch/maven-metadata.xml').openStream().withStream { s -> BuildParams.bwcVersions.compareToAuthoritative( new XmlParser().parse(s) .versioning.versions.version diff --git a/buildSrc/build.gradle b/buildSrc/build.gradle index 39ee079b5b6e6..957150b67a421 100644 --- a/buildSrc/build.gradle +++ b/buildSrc/build.gradle @@ -94,8 +94,22 @@ tasks.withType(JavaCompile).configureEach { *****************************************************************************/ repositories { - mavenCentral() - gradlePluginPortal() + maven { + url = uri("https://ci.opensearch.org/maven2/") + content { + excludeGroupByRegex "adoptium.*|adoptopenjdk.*|openjdk.*" + } + } + mavenCentral { + content { + excludeGroupByRegex "adoptium.*|adoptopenjdk.*|openjdk.*" + } + } + gradlePluginPortal { + content { + excludeGroupByRegex "adoptium.*|adoptopenjdk.*|openjdk.*" + } + } } dependencies { diff --git a/buildSrc/src/integTest/groovy/org/opensearch/gradle/OpenSearchTestBasePluginFuncTest.groovy b/buildSrc/src/integTest/groovy/org/opensearch/gradle/OpenSearchTestBasePluginFuncTest.groovy index fb61bbded5e09..250c3c7e38907 100644 --- a/buildSrc/src/integTest/groovy/org/opensearch/gradle/OpenSearchTestBasePluginFuncTest.groovy +++ b/buildSrc/src/integTest/groovy/org/opensearch/gradle/OpenSearchTestBasePluginFuncTest.groovy @@ -53,6 +53,7 @@ class OpenSearchTestBasePluginFuncTest extends AbstractGradleFuncTest { } repositories { + maven { url = uri("https://ci.opensearch.org/maven2/") } mavenCentral() } diff --git a/buildSrc/src/main/java/org/opensearch/gradle/RepositoriesSetupPlugin.java b/buildSrc/src/main/java/org/opensearch/gradle/RepositoriesSetupPlugin.java index 30847f0648c5c..78da55be827a3 100644 --- a/buildSrc/src/main/java/org/opensearch/gradle/RepositoriesSetupPlugin.java +++ b/buildSrc/src/main/java/org/opensearch/gradle/RepositoriesSetupPlugin.java @@ -82,7 +82,12 @@ public static void configureRepositories(Project project) { // such that we don't have to pass hardcoded files to gradle repos.mavenLocal(); } - repos.mavenCentral(); + repos.maven(repo -> { + repo.setName("Maven Cache"); + repo.setUrl("https://ci.opensearch.org/maven2/"); + repo.content(descriptor -> descriptor.excludeGroupByRegex("adoptium.*|adoptopenjdk.*|openjdk.*")); + }); + repos.mavenCentral(repo -> { repo.content(descriptor -> descriptor.excludeGroupByRegex("adoptium.*|adoptopenjdk.*|openjdk.*")); }); String luceneVersion = VersionProperties.getLucene(); if (luceneVersion.contains("-snapshot")) { diff --git a/buildSrc/src/testKit/opensearch.build/build.gradle b/buildSrc/src/testKit/opensearch.build/build.gradle index a0093eb1d2cd1..4a37e9d2cbdd8 100644 --- a/buildSrc/src/testKit/opensearch.build/build.gradle +++ b/buildSrc/src/testKit/opensearch.build/build.gradle @@ -39,6 +39,7 @@ repositories { artifact() } } + maven { url = uri("https://ci.opensearch.org/maven2/") } mavenCentral() } @@ -53,6 +54,7 @@ repositories { artifact() } } + maven { url = uri("https://ci.opensearch.org/maven2/") } mavenCentral() } diff --git a/buildSrc/src/testKit/testingConventions/build.gradle b/buildSrc/src/testKit/testingConventions/build.gradle index 418e833e8cb14..374bcb78603ab 100644 --- a/buildSrc/src/testKit/testingConventions/build.gradle +++ b/buildSrc/src/testKit/testingConventions/build.gradle @@ -18,6 +18,7 @@ allprojects { apply plugin: 'opensearch.build' repositories { + maven { url = uri("https://ci.opensearch.org/maven2/") } mavenCentral() } dependencies { diff --git a/buildSrc/src/testKit/thirdPartyAudit/build.gradle b/buildSrc/src/testKit/thirdPartyAudit/build.gradle index 41e699db94dcf..e63136441b737 100644 --- a/buildSrc/src/testKit/thirdPartyAudit/build.gradle +++ b/buildSrc/src/testKit/thirdPartyAudit/build.gradle @@ -36,6 +36,7 @@ repositories { artifact() } } + maven { url = uri("https://ci.opensearch.org/maven2/") } mavenCentral() } diff --git a/buildSrc/src/testKit/thirdPartyAudit/sample_jars/build.gradle b/buildSrc/src/testKit/thirdPartyAudit/sample_jars/build.gradle index c8c89fb5e4273..b26284c21376d 100644 --- a/buildSrc/src/testKit/thirdPartyAudit/sample_jars/build.gradle +++ b/buildSrc/src/testKit/thirdPartyAudit/sample_jars/build.gradle @@ -13,6 +13,7 @@ plugins { id 'java' } repositories { + maven { url = uri("https://ci.opensearch.org/maven2/") } mavenCentral() } dependencies { diff --git a/gradle/code-coverage.gradle b/gradle/code-coverage.gradle index 34fdf5d99ed84..5b70092d9cad8 100644 --- a/gradle/code-coverage.gradle +++ b/gradle/code-coverage.gradle @@ -9,7 +9,17 @@ apply plugin: 'jacoco' repositories { - mavenCentral() + maven { + url = "https://ci.opensearch.org/maven2/" + content { + excludeGroupByRegex "adoptium.*|adoptopenjdk.*|openjdk.*" + } + } + mavenCentral { + content { + excludeGroupByRegex "adoptium.*|adoptopenjdk.*|openjdk.*" + } + } } allprojects { diff --git a/gradle/ide.gradle b/gradle/ide.gradle index bc442a081adf0..be51f7825be67 100644 --- a/gradle/ide.gradle +++ b/gradle/ide.gradle @@ -15,6 +15,9 @@ import org.jetbrains.gradle.ext.JUnit buildscript { repositories { + maven { + url = "https://ci.opensearch.org/maven2/" + } maven { url "https://plugins.gradle.org/m2/" } diff --git a/settings.gradle b/settings.gradle index 5bfacfdbffc0d..643fddeb072f9 100644 --- a/settings.gradle +++ b/settings.gradle @@ -11,8 +11,22 @@ pluginManagement { repositories { - mavenCentral() - gradlePluginPortal() + maven { + url = uri("https://ci.opensearch.org/maven2/") + content { + excludeGroupByRegex "adoptium.*|adoptopenjdk.*|openjdk.*" + } + } + gradlePluginPortal { + content { + excludeGroupByRegex "adoptium.*|adoptopenjdk.*|openjdk.*" + } + } + mavenCentral { + content { + excludeGroupByRegex "adoptium.*|adoptopenjdk.*|openjdk.*" + } + } } }