From 891473b4bc3a139c92ded331ddc25151f63c1daa Mon Sep 17 00:00:00 2001 From: Mary Georgiou Date: Tue, 21 Jul 2026 09:24:50 +0200 Subject: [PATCH 1/3] Fix build-maven: normalize Windows backslash paths in installed-artifacts On Windows runners, Maven's install plugin logs local-repo paths with backslashes (C:\...\.m2\repository\...), but the sed extracting the relative artifact path only matched a forward-slash .m2/repository/ prefix. The unmodified line was then passed to deploy-artifacts.sh, where unquoted word-splitting broke it into unrecognized tokens and every artifact silently failed org/* vs com/* classification, so nothing was deployed under mixed-privacy on Windows. --- build-maven/build.sh | 4 +++- spec/build-maven_spec.sh | 34 ++++++++++++++++++++++++++++++++++ 2 files changed, 37 insertions(+), 1 deletion(-) diff --git a/build-maven/build.sh b/build-maven/build.sh index bac4e1b2..1f7fbb12 100755 --- a/build-maven/build.sh +++ b/build-maven/build.sh @@ -206,7 +206,9 @@ build_maven() { export_built_artifacts() { local installed_artifacts deployed build_dir artifacts - installed_artifacts=$(grep Installing "$mvn_output" | sed 's,.*\.m2/repository/,,' || true) + # Strip the local repo prefix (Linux uses '/', Windows uses '\') and normalize + # remaining separators to '/' so downstream org/* vs com/* matching is consistent. + installed_artifacts=$(grep Installing "$mvn_output" | sed -e 's,.*\.m2[/\\]repository[/\\],,' -e 's,\\,/,g' || true) { echo "installed-artifacts<> "$GITHUB_OUTPUT" + + Mock mvn + case "$*" in + *"help:evaluate -Dexpression=maven.deploy.skip -q -DforceStdout"*) echo "false" ;; + *"help:evaluate -Dexpression=project.build.directory -q -DforceStdout"*) echo "target" ;; + *) echo "mvn $*" ;; + esac + End + mvn_output=$(mktemp) + { + printf '[INFO] Installing C:\\a\\work\\test-repo\\pom.xml to C:\\Users\\runneradmin\\.m2\\repository\\org\\sonarsource\\app\\1.0\\app-1.0.pom\n' + printf '[INFO] Installing C:\\a\\work\\test-repo\\target\\app-1.0.jar to C:\\Users\\runneradmin\\.m2\\repository\\org\\sonarsource\\app\\1.0\\app-1.0.jar\n' + } > "$mvn_output" + mkdir -p target + touch target/app-1.0.jar + + When call export_built_artifacts + The status should be success + The lines of stdout should equal 5 + The line 1 should equal "::group::Capturing built artifacts for attestation" + The line 2 should equal "Scanning for artifacts in: */target/*" + The line 3 should equal "Found artifacts for attestation:" + The line 4 should equal "./target/app-1.0.jar" + The line 5 should equal "::endgroup::" + The line 3 of contents of file "$GITHUB_OUTPUT" should equal "org/sonarsource/app/1.0/app-1.0.pom" + The line 4 of contents of file "$GITHUB_OUTPUT" should equal "org/sonarsource/app/1.0/app-1.0.jar" + + rm -rf target "$GITHUB_OUTPUT" + End + It 'reports no artifacts found when build directory is empty' GITHUB_OUTPUT=$(mktemp) export GITHUB_OUTPUT From 55a87f4cdf5fad15e30e61775cb8ee17ad4efa70 Mon Sep 17 00:00:00 2001 From: Mary Georgiou Date: Tue, 21 Jul 2026 10:04:56 +0200 Subject: [PATCH 2/3] add jfrog cli --- build-maven/action.yml | 14 ++++++++++++++ build-maven/deploy-artifacts.sh | 5 ++++- spec/build-maven_deploy-artifacts_spec.sh | 2 +- 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/build-maven/action.yml b/build-maven/action.yml index 9c8db9f7..50829a8b 100644 --- a/build-maven/action.yml +++ b/build-maven/action.yml @@ -208,6 +208,20 @@ runs: working-directory: ${{ inputs.working-directory }} run: $ACTION_PATH_BUILD_MAVEN/build.sh + - name: Setup JFrog CLI for artifact upload + uses: jfrog/setup-jfrog-cli@1641575d87647fb969c0545f0b6a76873e328b7c # v5.0.0 + if: | + inputs.mixed-privacy == 'true' && steps.build.outputs.deployed == 'true' && + (github.event_name != 'pull_request' || inputs.deploy-pull-request == 'true') + with: + # This step only installs the jf binary for deploy-artifacts.sh; build-maven generates + # its own summary later via generate-jfrog-summary.sh, so disable this action's own + # post-job automation (which otherwise fails trying to summarize without a configured + # server URL, since auth happens later inside deploy-artifacts.sh). + disable-auto-build-publish: true + disable-auto-evidence-collection: true + disable-job-summary: true + - name: Artifacts upload shell: bash if: | diff --git a/build-maven/deploy-artifacts.sh b/build-maven/deploy-artifacts.sh index c39de774..f1ade7aa 100755 --- a/build-maven/deploy-artifacts.sh +++ b/build-maven/deploy-artifacts.sh @@ -46,7 +46,10 @@ echo "::endgroup::" echo "::group::Deploy private artifacts" echo "Deploying private artifacts..." -jf config edit deploy --artifactory-url "$ARTIFACTORY_URL" --access-token "$ARTIFACTORY_PRIVATE_DEPLOY_ACCESS_TOKEN" +# jf config edit runs non-interactively in CI ($CI=true) and silently clears any field not +# re-passed here (https://github.com/jfrog/jfrog-cli/issues/2478), so --url must be repeated. +jf config edit deploy --url "${ARTIFACTORY_URL%/artifactory*}" --artifactory-url "$ARTIFACTORY_URL" \ + --access-token "$ARTIFACTORY_PRIVATE_DEPLOY_ACCESS_TOKEN" for artifact in "${private_artifacts[@]}"; do jf rt u --build-name "$build_name" --build-number "$BUILD_NUMBER" "$artifact" "${ARTIFACTORY_PRIVATE_DEPLOY_REPO}" done diff --git a/spec/build-maven_deploy-artifacts_spec.sh b/spec/build-maven_deploy-artifacts_spec.sh index 1a6a1d92..687d4d5f 100755 --- a/spec/build-maven_deploy-artifacts_spec.sh +++ b/spec/build-maven_deploy-artifacts_spec.sh @@ -38,7 +38,7 @@ com/sonarsource/private/app/1.0/app-1.0.jar" The line 10 of output should equal "::endgroup::" The line 11 of output should equal "::group::Deploy private artifacts" The line 12 of output should equal "Deploying private artifacts..." - The line 13 of output should equal "jf config edit deploy --artifactory-url https://dummy.repox --access-token private-token" + The line 13 of output should equal "jf config edit deploy --url https://dummy.repox --artifactory-url https://dummy.repox --access-token private-token" The line 14 of output should include "com/sonarsource/private/app/1.0/app-1.0.pom private-repo-qa" The line 15 of output should include "com/sonarsource/private/app/1.0/app-1.0.jar private-repo-qa" The line 16 of output should equal "::endgroup::" From f05359b2180e602b5552b8088bf3dced683c4c22 Mon Sep 17 00:00:00 2001 From: Mary Georgiou Date: Tue, 21 Jul 2026 13:09:43 +0200 Subject: [PATCH 3/3] Remove explicit JFrog CLI setup from build-maven The runner image now bundles the jf CLI, so this action no longer needs to install it itself before deploy-artifacts.sh runs. --- build-maven/action.yml | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/build-maven/action.yml b/build-maven/action.yml index 50829a8b..9c8db9f7 100644 --- a/build-maven/action.yml +++ b/build-maven/action.yml @@ -208,20 +208,6 @@ runs: working-directory: ${{ inputs.working-directory }} run: $ACTION_PATH_BUILD_MAVEN/build.sh - - name: Setup JFrog CLI for artifact upload - uses: jfrog/setup-jfrog-cli@1641575d87647fb969c0545f0b6a76873e328b7c # v5.0.0 - if: | - inputs.mixed-privacy == 'true' && steps.build.outputs.deployed == 'true' && - (github.event_name != 'pull_request' || inputs.deploy-pull-request == 'true') - with: - # This step only installs the jf binary for deploy-artifacts.sh; build-maven generates - # its own summary later via generate-jfrog-summary.sh, so disable this action's own - # post-job automation (which otherwise fails trying to summarize without a configured - # server URL, since auth happens later inside deploy-artifacts.sh). - disable-auto-build-publish: true - disable-auto-evidence-collection: true - disable-job-summary: true - - name: Artifacts upload shell: bash if: |