Merge origin/main into grails7-upgrade, resolving conflicts

Author: Copilot

.github/copilot-instructions.md

@@ -0,0 +1,30 @@
+<!-- AUTO-GENERATED from rundeck-plugins/.github/templates/copilot-instructions.shared.md -- DO NOT EDIT. Run scripts/sync-copilot-instructions.sh to update. -->
+
+# GitHub Copilot Instructions
+
+This repository is part of the `rundeck-plugins` organization and follows the org-wide engineering guide.
+
+- Canonical guide: https://github.com/rundeck-plugins/.github/blob/main/CLAUDE.md
+- Plugin overview: https://github.com/rundeck-plugins/.github/blob/main/PLUGINS_OVERVIEW.md
+
+Read the canonical guide for the full context. The essentials below apply to work in this repo.
+
+## Working agreements
+- Optimize for customer impact first; connect technical choices to customer/business impact.
+- Strive for backwards compatibility. Announce deprecations; don't remove until the next major version.
+- Do not push to GitHub or create commits unless explicitly asked.
+- Never add `Co-authored-by` / agent / Cursor trailers or email author flags to commits. Plain messages describing the change only.
+- Commit messages and PR descriptions explain the "why" and the customer impact, not just the "what."
+- Avoid emojis unless explicitly requested.
+- Write full build logs to a `temp/` dir at the repo root using `YYYYMMDD-HHMMSS-<desc>.log` names; re-read logs instead of re-running builds repeatedly.
+
+## Build and release conventions
+- Baseline: Rundeck 6.0 (Grails 7 / Spring Boot 3). JAR plugins build on Java 17.
+- Maven coordinates: group `com.rundeck.plugins`, published to PackageCloud (`PKGCLD_READ_TOKEN`).
+- Versioning: Axion from git tags with `prefix = ''` (tags like `1.2.3`, no `v`).
+- ZIP (script) plugins: package with Gradle `type: Jar` (archiveExtension `zip`), publish with `extension = 'jar'` and `pom.packaging = 'jar'`, and process `plugin.yaml` with `ReplaceTokens` (never `expand`).
+- Groovy-based JAR plugins need the `groovy` Gradle plugin and `groovy-all` dependency or the jar ships with no compiled classes.
+
+## Branch and CI conventions
+- Default branch is `main`. Target CI triggers at `main`.
+- Security scanning is centralized: `.github/workflows/snyk-scan.yml` calls the org reusable Snyk workflow (push/PR to `main`, weekly Monday 06:00 UTC, and manual dispatch).

.github/workflows/gradle.yml

@@ -8,14 +8,14 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - name: Get Fetch Tags
         run: git -c protocol.version=2 fetch --tags --progress --no-recurse-submodules origin
         if: "!contains(github.ref, 'refs/tags')"
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           java-version: 17
           distribution: 'zulu'
@@ -58,7 +58,7 @@ jobs:
         id: get_version
         run: VERSION=$(./gradlew currentVersion -q -Prelease.quiet) && echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
       - name: Upload plugin jar
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           # Artifact name
           name: Grails-Plugin-${{ steps.get_version.outputs.VERSION }}

.github/workflows/release.yml

@@ -1,22 +1,21 @@
 on:
   push:
-    # Sequence of patterns matched against refs/tags
     tags:
-      - '*' # Push events to matching v*, i.e. v1.0, v20.15.10
+      - '*.*.*'
 
-name: Upload Release Asset
+name: Publish Release
 
 jobs:
   build:
-    name: Upload Release Asset
+    name: Publish Release
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           java-version: '17'
           distribution: 'zulu'
@@ -25,8 +24,7 @@ jobs:
       - name: Get Release Version
         id: get_version
         run: VERSION=$(./gradlew currentVersion -q -Prelease.quiet) && echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
-      - name: Create Release and Upload Asset
-        id: create_release
+      - name: Create Release
         run: |
           gh release create \
             --generate-notes \
@@ -35,3 +33,10 @@ jobs:
             build/libs/ansible-plugin-${{ steps.get_version.outputs.VERSION }}.jar
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Publish to Maven Central
+        run: ./gradlew -PsigningKey=${SIGNING_KEY_B64} -PsigningPassword=${SIGNING_PASSWORD} -PsonatypeUsername=${SONATYPE_USERNAME} -PsonatypePassword=${SONATYPE_PASSWORD} publishToSonatype closeAndReleaseSonatypeStagingRepository
+        env:
+          SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
+          SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
+          SIGNING_KEY_B64: ${{ secrets.SIGNING_KEY_B64 }}
+          SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}

.github/workflows/snyk-scan.yml

@@ -5,6 +5,9 @@ on:
     branches: [ main, master ]
   pull_request:
     branches: [ main, master ]
+  schedule:
+    # Weekly on Monday 06:00 UTC (GitHub Actions cron is UTC-only)
+    - cron: '0 6 * * 1'
   workflow_dispatch:
 
 jobs:

build.gradle

@@ -1,9 +1,15 @@
 plugins {
-  id 'pl.allegro.tech.build.axion-release' version '1.17.2'
-  id 'maven-publish'
+  id 'pl.allegro.tech.build.axion-release' version '1.21.2'
+  id 'io.github.gradle-nexus.publish-plugin' version '2.0.0'
 }
 
-group = 'com.rundeck.plugins'
+group = 'org.rundeck.plugins'
+
+ext.publishName = "Ansible Integration ${project.version}"
+ext.githubSlug = 'rundeck-plugins/ansible-plugin'
+ext.developers = [
+        [id: 'rundeck', name: 'Rundeck Engineering', email: 'product@rundeck.com']
+]
 
 ext.rundeckPluginVersion = '1.2'
 ext.pluginClassNames = [
@@ -21,15 +27,28 @@ ext.pluginClassNames = [
 
 apply plugin: 'java'
 apply plugin: 'groovy'
-sourceCompatibility = 17
-targetCompatibility = 17
+
+// Maven Central (Sonatype) requires -sources.jar and -javadoc.jar on close; same as attribute-match java.gradle
+java {
+  sourceCompatibility = JavaVersion.VERSION_17
+  targetCompatibility = JavaVersion.VERSION_17
+  withSourcesJar()
+  withJavadocJar()
+}
+
+// Lombok @Builder inner types break strict javadoc; Central still requires a -javadoc.jar artifact
+tasks.withType(Javadoc).configureEach {
+  failOnError = false
+  options.encoding = 'UTF-8'
+}
 
 scmVersion {
     ignoreUncommittedChanges = false
     tag {
         prefix = ''           // NO "v" prefix - see PLUGIN_TAGGING_ARCHITECTURE.md
         versionSeparator = ''
     }
+    versionCreator 'simple'  // Use simple version creator (just tag name); tolerates legacy v* tags
 }
 
 version = scmVersion.version  // Dynamic version from git tag
@@ -58,12 +77,12 @@ repositories {
 configurations {
   pluginLibs
 
-  // Security: Force resolution of vulnerable dependencies
+  // Security: Force resolution of vulnerable dependencies (versions: gradle/libs.versions.toml)
   all {
     resolutionStrategy {
-      force 'org.apache.commons:commons-lang3:3.20.0'
-      force 'org.apache.commons:commons-compress:1.28.0'
-      force 'org.jetbrains.kotlin:kotlin-stdlib:2.1.0'
+      force libs.commons.lang3.get()
+      force libs.commons.compress.get()
+      force libs.kotlin.stdlib.get()
       // Exclude old commons-lang to prevent conflicts
       exclude group: 'commons-lang', module: 'commons-lang'
     }
@@ -76,7 +95,9 @@ configurations {
 
 dependencies {
   pluginLibs libs.gson
-  implementation libs.rundeck.core
+  // rundeck-core: compileOnly so SNAPSHOT is not in published POM; testImplementation for tests
+  compileOnly libs.rundeck.core
+  testImplementation libs.rundeck.core
   implementation libs.groovy.all
   pluginLibs libs.jackson.core
   pluginLibs libs.jackson.dataformat.yaml
@@ -123,7 +144,7 @@ jar {
     def libList = configurations.pluginLibs.collect{'lib/' + it.name}.join(' ')
     attributes 'Rundeck-Plugin-Name' : 'Ansible Integration'
     attributes 'Rundeck-Plugin-Description' : 'This plugin brings basic Ansible support to Rundeck. It imports hosts from Ansible\'s inventory, including a bunch of facts, and can run modules and playbooks. There is also a node executor and file copier for your project.'
-    attributes 'Rundeck-Plugin-Rundeck-Compatibility-Version': '3.0.1+'
+    attributes 'Rundeck-Plugin-Rundeck-Compatibility-Version': '6.0.0+'
     attributes 'Rundeck-Plugin-Tags': 'java,node executor,resource model,workflow step,ansible'
     attributes 'Rundeck-Plugin-License': 'MIT'
     attributes 'Rundeck-Plugin-Source-Link': 'https://github.com/rundeck-plugins/ansible-plugin'
@@ -139,27 +160,14 @@ jar {
   dependsOn(copyToLib)
 }
 
-publishing {
-  publications {
-    maven(MavenPublication) {
-      groupId = 'com.rundeck.plugins'
-      artifactId = 'ansible-plugin'
-      version = project.version
-      from components.java
-    }
-  }
-  
+nexusPublishing {
+  packageGroup = 'org.rundeck.plugins'
   repositories {
-    maven {
-      name = "PackageCloudTest"
-      url = uri("https://packagecloud.io/pagerduty/rundeckpro-test/maven2")
-      authentication {
-        header(HttpHeaderAuthentication)
-      }
-      credentials(HttpHeaderCredentials) {
-        name = "Authorization"
-        value = "Bearer " + (System.getenv("PKGCLD_WRITE_TOKEN") ?: project.findProperty("pkgcldWriteToken"))
-      }
+    sonatype {
+      nexusUrl.set(uri("https://ossrh-staging-api.central.sonatype.com/service/local/"))
+      snapshotRepositoryUrl.set(uri("https://central.sonatype.com/repository/maven-snapshots/"))
     }
   }
 }
+
+apply from: "${rootDir}/gradle/publishing.gradle"

functional-test/build.gradle

@@ -11,11 +11,11 @@ repositories {
 group = 'com.github.rundeck-plugins'
 
 configurations {
-    // Security: Force resolution of vulnerable dependencies
+    // Security: Force resolution (versions: root gradle/libs.versions.toml)
     all {
         resolutionStrategy {
-            force 'org.apache.commons:commons-compress:1.28.0'
-            force 'org.jetbrains.kotlin:kotlin-stdlib:2.1.0'
+            force libs.commons.compress.get()
+            force libs.kotlin.stdlib.get()
         }
     }
 }

gradle/libs.versions.toml

@@ -1,18 +1,18 @@
 [versions]
 # Security-fixed versions
-commons-lang3 = "3.17.0"
+commons-lang3 = "3.20.0"
 commons-compress = "1.28.0"
 kotlin-stdlib = "2.1.0"
 
 # Current dependency versions (maintained for compatibility)
 gson = "2.10.1"
-jackson = "2.21.2"
+jackson = "2.22.0"
 snakeyaml = "2.2"
 groovy = "4.0.29"
 lombok = "1.18.30"
 spock = "2.4-groovy-4.0"
 testcontainers = "1.19.0"
-rd-api-client = "2.0.9"
+rd-api-client = "2.1.2"
 jsch = "0.1.55"
 bytebuddy = "1.14.11"
 objenesis = "3.4"

gradle/publishing.gradle

@@ -0,0 +1,86 @@
+/**
+ * Define project extension values in the project gradle file before including this file:
+ *
+ * publishName = 'Name of Package'
+ * publishDescription = 'description' (optional)
+ * githubSlug = Github slug e.g. 'rundeck/rundeck-cli'
+ * developers = [ [id:'id', name:'name', email: 'email' ] ] list of developers
+ *
+ * Define project properties to sign and publish when invoking publish task:
+ *
+ *     ./gradlew \
+ *     -PsigningKey="base64 encoded gpg key" \
+ *     -PsigningPassword="password for key" \
+ *     -PsonatypeUsername="sonatype token user" \
+ *     -PsonatypePassword="sonatype token password" \
+ *     publishToSonatype closeAndReleaseSonatypeStagingRepository
+ */
+apply plugin: 'maven-publish'
+apply plugin: 'signing'
+
+publishing {
+    publications {
+        "${project.name}"(MavenPublication) { publication ->
+            from components.java
+
+            pom {
+                name = publishName
+                description = project.ext.hasProperty('publishDescription') ? project.ext.publishDescription :
+                        project.description ?: publishName
+                url = "https://github.com/${githubSlug}"
+                licenses {
+                    license {
+                        name = 'The Apache Software License, Version 2.0'
+                        url = 'http://www.apache.org/licenses/LICENSE-2.0.txt'
+                        distribution = 'repo'
+                    }
+                }
+                scm {
+                    url = "https://github.com/${githubSlug}"
+                    connection = "scm:git:git@github.com/${githubSlug}.git"
+                    developerConnection = "scm:git:git@github.com:${githubSlug}.git"
+                }
+                if (project.ext.developers) {
+                    developers {
+                        project.ext.developers.each { dev ->
+                            developer {
+                                id = dev.id
+                                name = dev.name
+                                email = dev.email
+                            }
+                        }
+                    }
+                }
+            }
+
+        }
+    }
+    repositories {
+        def pkgcldWriteToken = System.getenv("PKGCLD_WRITE_TOKEN") ?: project.findProperty("pkgcldWriteToken")
+        if (pkgcldWriteToken) {
+            maven {
+                name = "PackageCloudTest"
+                url = uri("https://packagecloud.io/pagerduty/rundeckpro-test/maven2")
+                authentication {
+                    header(HttpHeaderAuthentication)
+                }
+                credentials(HttpHeaderCredentials) {
+                    name = "Authorization"
+                    value = "Bearer " + pkgcldWriteToken
+                }
+            }
+        }
+    }
+}
+def base64Decode = { String prop ->
+    project.findProperty(prop) ?
+            new String(Base64.getDecoder().decode(project.findProperty(prop).toString())).trim() :
+            null
+}
+
+if (project.hasProperty('signingKey') && project.hasProperty('signingPassword')) {
+    signing {
+        useInMemoryPgpKeys(base64Decode("signingKey"), project.signingPassword)
+        sign(publishing.publications)
+    }
+}