Merge remote-tracking branch 'origin/main' into cve-fixes

Author: fdevans

.github/copilot-instructions.md

@@ -0,0 +1,30 @@
+<!-- AUTO-GENERATED from rundeck-plugins/.github/templates/copilot-instructions.shared.md -- DO NOT EDIT. Run scripts/sync-copilot-instructions.sh to update. -->
+
+# GitHub Copilot Instructions
+
+This repository is part of the `rundeck-plugins` organization and follows the org-wide engineering guide.
+
+- Canonical guide: https://github.com/rundeck-plugins/.github/blob/main/CLAUDE.md
+- Plugin overview: https://github.com/rundeck-plugins/.github/blob/main/PLUGINS_OVERVIEW.md
+
+Read the canonical guide for the full context. The essentials below apply to work in this repo.
+
+## Working agreements
+- Optimize for customer impact first; connect technical choices to customer/business impact.
+- Strive for backwards compatibility. Announce deprecations; don't remove until the next major version.
+- Do not push to GitHub or create commits unless explicitly asked.
+- Never add `Co-authored-by` / agent / Cursor trailers or email author flags to commits. Plain messages describing the change only.
+- Commit messages and PR descriptions explain the "why" and the customer impact, not just the "what."
+- Avoid emojis unless explicitly requested.
+- Write full build logs to a `temp/` dir at the repo root using `YYYYMMDD-HHMMSS-<desc>.log` names; re-read logs instead of re-running builds repeatedly.
+
+## Build and release conventions
+- Baseline: Rundeck 6.0 (Grails 7 / Spring Boot 3). JAR plugins build on Java 17.
+- Maven coordinates: group `com.rundeck.plugins`, published to PackageCloud (`PKGCLD_READ_TOKEN`).
+- Versioning: Axion from git tags with `prefix = ''` (tags like `1.2.3`, no `v`).
+- ZIP (script) plugins: package with Gradle `type: Jar` (archiveExtension `zip`), publish with `extension = 'jar'` and `pom.packaging = 'jar'`, and process `plugin.yaml` with `ReplaceTokens` (never `expand`).
+- Groovy-based JAR plugins need the `groovy` Gradle plugin and `groovy-all` dependency or the jar ships with no compiled classes.
+
+## Branch and CI conventions
+- Default branch is `main`. Target CI triggers at `main`.
+- Security scanning is centralized: `.github/workflows/snyk-scan.yml` calls the org reusable Snyk workflow (push/PR to `main`, weekly Monday 06:00 UTC, and manual dispatch).

.github/workflows/gradle.yml

@@ -8,14 +8,14 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - name: Get Fetch Tags
         run: git -c protocol.version=2 fetch --tags --progress --no-recurse-submodules origin
         if: "!contains(github.ref, 'refs/tags')"
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           java-version: 17
           distribution: 'zulu'
@@ -33,7 +33,7 @@ jobs:
         id: get_version
         run: VERSION=$(./gradlew currentVersion -q -Prelease.quiet) && echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
       - name: Upload plugin jar
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           # Artifact name
           name: Grails-Plugin-${{ steps.get_version.outputs.VERSION }}

.github/workflows/release.yml

@@ -11,11 +11,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           java-version: '17'
           distribution: 'zulu'

.github/workflows/snyk-scan.yml

@@ -5,6 +5,9 @@ on:
     branches: [ main, master ]
   pull_request:
     branches: [ main, master ]
+  schedule:
+    # Weekly on Monday 06:00 UTC (GitHub Actions cron is UTC-only)
+    - cron: '0 6 * * 1'
   workflow_dispatch:
 
 jobs:

build.gradle

@@ -1,5 +1,5 @@
 plugins {
-  id 'pl.allegro.tech.build.axion-release' version '1.17.2'
+  id 'pl.allegro.tech.build.axion-release' version '1.21.2'
   id 'io.github.gradle-nexus.publish-plugin' version '2.0.0'
 }
 
@@ -48,6 +48,7 @@ scmVersion {
         prefix = ''           // NO "v" prefix - see PLUGIN_TAGGING_ARCHITECTURE.md
         versionSeparator = ''
     }
+    versionCreator 'simple'  // Use simple version creator (just tag name); tolerates legacy v* tags
 }
 
 version = scmVersion.version  // Dynamic version from git tag

gradle/libs.versions.toml

@@ -6,19 +6,19 @@ kotlin-stdlib = "2.1.0"
 
 # Current dependency versions (maintained for compatibility)
 gson = "2.10.1"
-jackson = "2.21.2"
+jackson = "2.22.0"
 snakeyaml = "2.2"
 groovy = "4.0.29"
 lombok = "1.18.30"
 spock = "2.4-groovy-4.0"
 testcontainers = "1.19.0"
-rd-api-client = "2.0.10"
+rd-api-client = "2.1.2"
 jsch = "0.1.55"
 bytebuddy = "1.14.11"
 objenesis = "3.4"
 
 # Rundeck version
-rundeck-core = "6.0.0-alpha1-20260407"
+rundeck-core = "6.1.0-SNAPSHOT"
 
 [libraries]
 # Security overrides

src/main/groovy/com/rundeck/plugins/ansible/ansible/AnsibleRunnerContextBuilder.java

@@ -42,6 +42,12 @@ public class AnsibleRunnerContextBuilder {
     private final Map<String, Object> jobConf;
     private final Collection<INodeEntry> nodes;
     private final Collection<File> tempFiles;
+    /**
+     * Per-builder working directory (e.g. {@code ansible-exec-<executionId>-builder-<rand>/})
+     * created atomically with
+     * {@link Files#createTempDirectory(java.nio.file.Path, String, java.nio.file.attribute.FileAttribute[])}.
+     * EXCLUSIVELY owned by this builder; safe to delete recursively.
+     */
     private File executionSpecificDir;
 
     private AnsiblePluginGroup pluginGroup;
@@ -827,20 +833,25 @@ public void cleanupTempFiles() {
         }
         tempFiles.clear();
 
-        // Clean up execution-specific directory (including group_vars when inventory was generated/inline)
-        // Note: group_vars created alongside user-provided inventory files is cleaned up by AnsibleRunner
+        // Clean up the builder-specific working directory (including group_vars when inventory
+        // was generated/inline). Note: group_vars created alongside user-provided inventory files
+        // is cleaned up by AnsibleRunner.
+        // executionSpecificDir is an EXCLUSIVE per-builder directory (ansible-exec-<execId>-builder-<rand>/),
+        // so recursive deletion is always safe — no sibling builder shares files with it.
         if (executionSpecificDir != null && executionSpecificDir.exists()) {
             if (!getDebug()) {
-                log.debug("Cleaning up execution-specific directory: {}", executionSpecificDir.getAbsolutePath());
+                log.debug("Cleaning up builder-specific directory: {}", executionSpecificDir.getAbsolutePath());
                 if (!deleteDirectoryRecursively(executionSpecificDir)) {
-                    log.warn("Failed to completely delete execution-specific directory: {}", executionSpecificDir.getAbsolutePath());
+                    log.warn("Failed to completely delete builder-specific directory: {}", executionSpecificDir.getAbsolutePath());
                 } else {
-                    log.debug("Successfully deleted execution-specific directory: {}", executionSpecificDir.getAbsolutePath());
+                    log.debug("Successfully deleted builder-specific directory: {}", executionSpecificDir.getAbsolutePath());
                 }
             } else {
-                // In debug mode, the execution-specific directory is intentionally preserved for troubleshooting.
-                // Note: These directories will accumulate over time and may require periodic manual cleanup.
-                log.debug("Debug mode enabled; not cleaning up execution-specific directory: {}", executionSpecificDir.getAbsolutePath());
+                // In debug mode the per-builder directory is intentionally preserved for troubleshooting.
+                // Sibling directories of the same Rundeck execution share the ansible-exec-<execId>-* prefix
+                // for easy filtering. These directories will accumulate over time and may require periodic
+                // manual cleanup.
+                log.debug("Debug mode enabled; not cleaning up builder-specific directory: {}", executionSpecificDir.getAbsolutePath());
             }
         }
     }
@@ -1145,16 +1156,25 @@ public Boolean generateInventoryNodesAuth() {
     }
 
     /**
-     * Creates and returns an execution-specific temporary directory path.
-     * This ensures that each execution has its own isolated directory for inventory and group_vars,
-     * preventing conflicts when multiple workflow step executions run in parallel.
+     * Creates and returns a builder-specific temporary directory path.
+     *
+     * <p>Each builder receives a unique flat directory directly under the configured base tmp
+     * dir, named {@code ansible-exec-<executionId>-builder-<rand>/}. The directory is created
+     * atomically with {@link Files#createTempDirectory(java.nio.file.Path, String, java.nio.file.attribute.FileAttribute[])},
+     * which guarantees uniqueness without any coordination between sibling threads sharing the
+     * same Rundeck executionId.</p>
+     *
+     * <p>The {@code ansible-exec-<executionId>} prefix preserves the ability to filter all
+     * directories belonging to a given Rundeck execution (useful in debug mode), while keeping
+     * each directory exclusively owned by a single builder. Recursive cleanup of one builder's
+     * directory cannot affect siblings.</p>
      *
-     * @return The path to the execution-specific directory
+     * @return The absolute path to the builder-specific directory
      */
     String getExecutionSpecificTmpDir() {
         // Return cached directory if already created
         if (executionSpecificDir != null) {
-            log.debug("Using cached execution-specific directory: {}", executionSpecificDir.getAbsolutePath());
+            log.debug("Using cached builder-specific directory: {}", executionSpecificDir.getAbsolutePath());
             return executionSpecificDir.getAbsolutePath();
         }
 
@@ -1169,18 +1189,17 @@ String getExecutionSpecificTmpDir() {
         // Get base tmp directory
         String baseTmpDir = AnsibleUtil.getCustomTmpPathDir(framework);
 
-        // Create execution-specific directory
         if (executionId != null && !executionId.isEmpty()) {
-            executionSpecificDir = new File(baseTmpDir, "ansible-exec-" + executionId);
-            log.debug("Creating execution-specific directory: {}", executionSpecificDir.getAbsolutePath());
+            // Atomic + unique by construction. No coordination needed between sibling threads
+            // sharing the same Rundeck executionId. The executionId prefix lets operators filter
+            // all directories belonging to a given Rundeck execution with a single glob.
             try {
-                // Use Files.createDirectories() which is idempotent (safe to call if directory exists)
-                // and handles race conditions properly. Unlike mkdirs(), it doesn't return false
-                // when the directory already exists - it only throws IOException on actual failure.
-                Files.createDirectories(executionSpecificDir.toPath());
-                log.debug("Successfully ensured execution-specific directory exists: {}", executionSpecificDir.getAbsolutePath());
+                executionSpecificDir = Files
+                        .createTempDirectory(Paths.get(baseTmpDir), "ansible-exec-" + executionId + "-builder-")
+                        .toFile();
+                log.debug("Created builder-specific directory: {}", executionSpecificDir.getAbsolutePath());
             } catch (IOException e) {
-                String errorMsg = "Failed to create execution-specific directory: " + executionSpecificDir.getAbsolutePath();
+                String errorMsg = "Failed to create builder-specific directory under: " + baseTmpDir;
                 log.error(errorMsg, e);
                 throw new IllegalStateException(errorMsg, e);
             }

src/main/groovy/com/rundeck/plugins/ansible/plugin/AnsibleFileCopier.java

@@ -56,6 +56,8 @@ public class AnsibleFileCopier implements FileCopier, AnsibleDescribable, ProxyR
         builder.property(VAULT_KEY_FILE_PROP);
         builder.property(VAULT_KEY_STORAGE_PROP);
 
+        builder.mapping(ANSIBLE_BINARIES_DIR_PATH,PROJ_PROP_PREFIX + ANSIBLE_BINARIES_DIR_PATH);
+        builder.frameworkMapping(ANSIBLE_BINARIES_DIR_PATH,FWK_PROP_PREFIX + ANSIBLE_BINARIES_DIR_PATH);
         builder.mapping(ANSIBLE_CONFIG_FILE_PATH,PROJ_PROP_PREFIX + ANSIBLE_CONFIG_FILE_PATH);
         builder.frameworkMapping(ANSIBLE_CONFIG_FILE_PATH,FWK_PROP_PREFIX + ANSIBLE_CONFIG_FILE_PATH);
         builder.mapping(ANSIBLE_VAULT_PATH,PROJ_PROP_PREFIX + ANSIBLE_VAULT_PATH);