From 4e3f058813e372399bd4b6410a5dc81844f4a9c2 Mon Sep 17 00:00:00 2001 From: marko-bekhta Date: Wed, 30 Oct 2024 10:15:54 +0100 Subject: [PATCH 1/7] HV-2059 Use different report directories for multiple executions of surefire plugin --- engine/pom.xml | 5 +++++ pom.xml | 2 ++ 2 files changed, 7 insertions(+) diff --git a/engine/pom.xml b/engine/pom.xml index 8ebdc5a9c..5ec99186e 100644 --- a/engine/pom.xml +++ b/engine/pom.xml @@ -25,6 +25,10 @@ .. -Duser.language=en -Duser.country=US ${hibernate-validator.module-name} + + ${project.build.directory}/surefire-reports/default + ${project.build.directory}/surefire-reports/bytebuddy + default ${surefire.environment} + ${project.build.directory}/surefire-reports @@ -980,6 +981,7 @@ use the test Java home, not the Maven Java home --> ${java-version.test.launcher.java_home} + ${surefire.default.reportsDirectory} + + + #{{'0.0.0.0'}} + + + true + + + #{env['CI'] == null} + + + + #{properties['no-build-cache'] == null} + + + #{properties['no-build-cache'] == null} + + #{env['CI'] != null and (env['CHANGE_ID']?:'').isBlank() and (env['GITHUB_BASE_REF']?:'').isBlank() and !(env['DEVELOCITY_ACCESS_KEY']?:'').isBlank()} + + + + diff --git a/.mvn/extensions.xml b/.mvn/extensions.xml new file mode 100644 index 000000000..aed8230ad --- /dev/null +++ b/.mvn/extensions.xml @@ -0,0 +1,17 @@ + + + com.gradle + develocity-maven-extension + 1.22.2 + + + com.gradle + common-custom-user-data-maven-extension + 2.0.1 + + + org.hibernate.infra.develocity + hibernate-develocity-maven-extension + 3.0.0.Final + + From 18a1b62c8f77fb4a701e6f0210d610da251f64b6 Mon Sep 17 00:00:00 2001 From: marko-bekhta Date: Wed, 30 Oct 2024 10:25:35 +0100 Subject: [PATCH 4/7] HV-2059 Disable build scans where they are unnecessary --- Jenkinsfile | 1 + jenkins/nightly/Jenkinsfile | 6 ++++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/Jenkinsfile b/Jenkinsfile index 1e47f2b10..370accf26 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -313,6 +313,7 @@ stage('Non-default environments') { -Denforcer.skip=true \ -DskipTests=true -Dcheckstyle.skip=true \ -DdisableDistributionBuild=true -DdisableDocumentationBuild=true \ + -Dscan=false -Dno-build-cache \ """ } } diff --git a/jenkins/nightly/Jenkinsfile b/jenkins/nightly/Jenkinsfile index 3364ed5bf..c674dabbd 100644 --- a/jenkins/nightly/Jenkinsfile +++ b/jenkins/nightly/Jenkinsfile @@ -53,7 +53,8 @@ pipeline { sh """mvn clean verify \ artifact:compare -Dreference.repo=hibernate-maven-central \ -Preproducibility-check \ - --fail-at-end + --fail-at-end \ + -Dscan=false -Dno-build-cache """ } } @@ -82,7 +83,8 @@ pipeline { echo "Run a build with strict JAXP configuration." sh """mvn clean install \ -Dsurefire.jvm.args.jaxp.strict-args="-Djava.xml.config.file=$jaxpStrictProperties" \ - -Djava-version.test.release=23 + -Djava-version.test.release=23 \ + -Dscan=false -Dno-build-cache """ }) } From af675cf5254b08fd7d5d97dea2de65d961ecf783 Mon Sep 17 00:00:00 2001 From: marko-bekhta Date: Wed, 30 Oct 2024 10:44:28 +0100 Subject: [PATCH 5/7] HV-2059 Add build scan publishing --- Jenkinsfile | 67 ++++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 58 insertions(+), 9 deletions(-) diff --git a/Jenkinsfile b/Jenkinsfile index 370accf26..1f84f2658 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -246,9 +246,9 @@ stage('Default build') { return } runBuildOnNode { - helper.withMavenWorkspace(mavenSettingsConfig: deploySnapshot ? helper.configuration.file.deployment.maven.settingsId : null) { - sh """ \ - mvn clean \ + withMavenWorkspace(mavenSettingsConfig: deploySnapshot ? helper.configuration.file.deployment.maven.settingsId : null) { + mvn """ \ + clean \ --fail-at-end \ ${deploySnapshot ? "\ deploy -DdeployAtEnd=true \ @@ -277,7 +277,7 @@ stage('Non-default environments') { environments.content.jdk.enabled.each { JdkBuildEnvironment buildEnv -> parameters.put(buildEnv.tag, { runBuildOnNode { - helper.withMavenWorkspace { + withMavenWorkspace { mavenNonDefaultBuild buildEnv, """ \ clean install \ """ @@ -290,7 +290,7 @@ stage('Non-default environments') { environments.content.wildflyTck.enabled.each { WildFlyTckBuildEnvironment buildEnv -> parameters.put(buildEnv.tag, { runBuildOnNode { - helper.withMavenWorkspace { + withMavenWorkspace { mavenNonDefaultBuild buildEnv, """ \ clean install \ -pl tck-runner \ @@ -305,7 +305,7 @@ stage('Non-default environments') { environments.content.sigtest.enabled.each { SigTestBuildEnvironment buildEnv -> parameters.put(buildEnv.tag, { runBuildOnNode { - helper.withMavenWorkspace(jdk: buildEnv.jdkTool) { + withMavenWorkspace(jdk: buildEnv.jdkTool) { mavenNonDefaultBuild buildEnv, """ \ clean install \ -pl tck-runner \ @@ -334,7 +334,7 @@ stage('Sonar analysis') { def sonarCredentialsId = helper.configuration.file?.sonar?.credentials if (sonarCredentialsId) { runBuildOnNode { - helper.withMavenWorkspace { + withMavenWorkspace { if (enableDefaultBuild && enableDefaultBuildIT) { unstash name: "default-build-jacoco-reports" } @@ -537,8 +537,8 @@ void mavenNonDefaultBuild(BuildEnvironment buildEnv, String args, String project def testSuffix = buildEnv.tag.replaceAll('[^a-zA-Z0-9_\\-+]+', '_') dir(projectPath) { - sh """ \ - mvn -Dsurefire.environment=$testSuffix \ + mvn """ \ + -Dsurefire.environment=$testSuffix \ ${toTestJdkArg(buildEnv)} \ --fail-at-end \ $args \ @@ -578,3 +578,52 @@ String toTestJdkArg(BuildEnvironment buildEnv) { return args } + +void withMavenWorkspace(Closure body) { + withMavenWorkspace([:], body) +} + +void withMavenWorkspace(Map args, Closure body) { + args.put("options", [ + // Artifacts are not needed and take up disk space + artifactsPublisher(disabled: true), + // stdout/stderr for successful tests is not needed and takes up disk space + // we archive test results and stdout/stderr as part of the build scan anyway, + // see https://ge.hibernate.org/scans?search.rootProjectNames=Hibernate%20Validator + junitPublisher(disabled: true) + ]) + helper.withMavenWorkspace(args, body) +} + +void mvn(String args) { + def develocityMainCredentialsId = helper.configuration.file?.develocity?.credentials?.main + def develocityPrCredentialsId = helper.configuration.file?.develocity?.credentials?.pr + if ( !helper.scmSource.pullRequest && develocityMainCredentialsId ) { + // Not a PR: we can pass credentials to the build, allowing it to populate the build cache + // and to publish build scans directly. + withCredentials([string(credentialsId: develocityMainCredentialsId, + variable: 'DEVELOCITY_ACCESS_KEY')]) { + withGradle { // withDevelocity, actually: https://plugins.jenkins.io/gradle/#plugin-content-capturing-build-scans-from-jenkins-pipeline + sh "mvn $args" + } + } + } + else if ( helper.scmSource.pullRequest && develocityPrCredentialsId ) { + // Pull request: we can't pass credentials to the build, since we'd be exposing secrets to e.g. tests. + // We do the build first, then publish the build scan separately. + tryFinally({ + sh "mvn $args" + }, { // Finally + withCredentials([string(credentialsId: develocityPrCredentialsId, + variable: 'DEVELOCITY_ACCESS_KEY')]) { + withGradle { // withDevelocity, actually: https://plugins.jenkins.io/gradle/#plugin-content-capturing-build-scans-from-jenkins-pipeline + sh 'mvn develocity:build-scan-publish-previous || true' + } + } + }) + } + else { + // No Develocity credentials. + sh "mvn $args" + } +} From dc1814ce08fbb17794c77a3edae97c57f6e59103 Mon Sep 17 00:00:00 2001 From: marko-bekhta Date: Tue, 5 Nov 2024 13:34:41 +0100 Subject: [PATCH 6/7] HV-2059 Update GH actions build to upload/publish build scans --- .github/workflows/ci-report.yml | 71 +++++++++++++++++++++++++++++++++ .github/workflows/ci.yml | 38 +++++++++--------- 2 files changed, 91 insertions(+), 18 deletions(-) create mode 100644 .github/workflows/ci-report.yml diff --git a/.github/workflows/ci-report.yml b/.github/workflows/ci-report.yml new file mode 100644 index 000000000..9e7c2ffaa --- /dev/null +++ b/.github/workflows/ci-report.yml @@ -0,0 +1,71 @@ +# SPDX-License-Identifier: Apache-2.0 +# Copyright Red Hat Inc. and Hibernate Authors + +name: GH Actions CI reporting + +on: + workflow_run: + workflows: [ "GH Actions CI" ] + types: [ completed ] + +defaults: + run: + shell: bash + +env: + MAVEN_ARGS: "-e -B --settings .github/mvn-settings.xml --fail-at-end -Pci-build --no-transfer-progress" + +jobs: + publish-build-scans: + name: Publish Develocity build scans + if: github.repository == 'hibernate/hibernate-validator' && github.event.workflow_run.conclusion != 'cancelled' + runs-on: ubuntu-latest + steps: + # Checkout target branch which has trusted code + - name: Check out target branch + uses: actions/checkout@v4 + with: + persist-credentials: false + ref: ${{ github.ref }} + - name: Set up Java 21 + uses: actions/setup-java@v4 + with: + java-version: 21 + distribution: temurin + # https://github.com/actions/cache/blob/main/examples.md#java---maven + - name: Cache local Maven repository + uses: actions/cache@v4 + with: + path: ~/.m2/repository + # use a different key than workflows running untrusted code + key: trusted-${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + trusted-${{ runner.os }}-maven- + - name: Set up Maven + run: ./mvnw -v + - name: Download GitHub Actions artifacts for the Develocity build scans + id: downloadBuildScan + uses: actions/download-artifact@v4 + with: + pattern: build-scan-data-* + github-token: ${{ github.token }} + repository: ${{ github.repository }} + run-id: ${{ github.event.workflow_run.id }} + path: /tmp/downloaded-build-scan-data/ + # Don't fail the build if there are no matching artifacts + continue-on-error: true + - name: Publish Develocity build scans for previous builds + if: ${{ steps.downloadBuildScan.outcome != 'failure'}} + run: | + shopt -s nullglob # Don't run the loop below if there are no artifacts + status=0 + mkdir -p ~/.m2/.develocity/ + for build_scan_data_directory in /tmp/downloaded-build-scan-data/* + do + rm -rf ~/.m2/.develocity/build-scan-data + mv "$build_scan_data_directory" ~/.m2/.develocity/build-scan-data \ + && ./mvnw $MAVEN_ARGS develocity:build-scan-publish-previous || status=1 + done + exit $status + env: + DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY_PR }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 72d8436c2..8a46aa5cf 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -103,35 +103,37 @@ jobs: - name: Set up Maven run: ./mvnw -v - - name: Build code and run tests and basic checks + - name: Build code and run tests and basic checks (Standalone) run: | ./mvnw $MAVEN_ARGS ${{ matrix.os.maven.args }} clean install \ -Pjqassistant -Pdist -Prelocation + env: + DEVELOCITY_ACCESS_KEY: "${{ secrets.DEVELOCITY_ACCESS_KEY || '' }}" + # For jobs running on 'pull_request', upload build scan data. + # The actual publishing must be done in a separate job (see ci-report.yml). + # We don't write to the remote cache as that would be unsafe. + - name: Upload GitHub Actions artifact for the Develocity build scan + uses: actions/upload-artifact@v4 + if: "${{ github.event_name == 'pull_request' && !cancelled() }}" + with: + name: build-scan-data-standalone-${{ matrix.os.name }} + path: ~/.m2/.develocity/build-scan-data - - name: Build code and run tests in container mode + - name: Run TCK tests in container mode run: | ./mvnw $MAVEN_ARGS ${{ matrix.os.maven.args }} clean verify \ -Pjqassistant -Pskip-checks \ -am -pl :hibernate-validator-tck-runner \ -Dincontainer -Dincontainer-prepared - # Workaround for https://github.com/actions/upload-artifact/issues/240 - - name: List build reports to upload (if build failed) - if: ${{ failure() || cancelled() }} - # The weird syntax is because we're setting a multiline environment variable - # See https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#example-of-a-multiline-string - run: | - { - echo 'buildReportPaths<> "$GITHUB_ENV" - - name: Upload build reports (if build failed) + env: + DEVELOCITY_ACCESS_KEY: "${{ secrets.DEVELOCITY_ACCESS_KEY || '' }}" + + - name: Upload GitHub Actions artifact for the Develocity build scan uses: actions/upload-artifact@v4 - if: ${{ failure() || cancelled() }} + if: "${{ github.event_name == 'pull_request' && !cancelled() }}" with: - name: ${{ format('build-reports-{0}', matrix.os.name ) }} - path: ${{ env.buildReportPaths }} - retention-days: 7 + name: build-scan-data-incontainer-${{ matrix.os.name }} + path: ~/.m2/.develocity/build-scan-data - name: Omit produced artifacts from build cache run: rm -r ~/.m2/repository/org/hibernate/validator From e1f95df1f71f0772cb2e025241cd2f1a18e0931e Mon Sep 17 00:00:00 2001 From: marko-bekhta Date: Tue, 5 Nov 2024 15:57:13 +0100 Subject: [PATCH 7/7] HV-2059 Adjust build scan GH bot reporting --- .github/hibernate-github-bot.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/.github/hibernate-github-bot.yml b/.github/hibernate-github-bot.yml index ca1db5851..5b7c84882 100644 --- a/.github/hibernate-github-bot.yml +++ b/.github/hibernate-github-bot.yml @@ -27,3 +27,23 @@ jira: - "README.md" - "MAINTAINERS.md" - "CONTRIBUTING.md" +develocity: + buildScan: + addCheck: true + tags: + - column: "OS" + pattern: "Linux" + - column: "OS" + pattern: "Windows.*" + replacement: "Windows" + - column: "Java" + pattern: "jdk-(.*)" + replacement: "$1" + - column: "TCK mode" + pattern: "(.+)-TCK" + replacement: "$1" + - column: "TCK Version" + pattern: "Validation-TCK-(.+)" + replacement: "$1" + - pattern: "org.hibernate.validator|Hibernate Validator|main|HEAD|\\d+.\\d+|PR-\\d+" + replacement: "" # Just remove these tags