env:

CIRRUS_VAULT_URL: https://vault.sonar.build:8200

CIRRUS_VAULT_AUTH_PATH: jwt-cirrusci

CIRRUS_VAULT_ROLE: cirrusci-${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}

ARTIFACTORY_URL: VAULT[development/kv/data/repox data.url]

ARTIFACTORY_PRIVATE_USERNAME: vault-${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-private-reader

ARTIFACTORY_PRIVATE_PASSWORD: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-private-reader access_token]

ARTIFACTORY_DEPLOY_USERNAME: vault-${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-qa-deployer

ARTIFACTORY_DEPLOY_PASSWORD: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-qa-deployer access_token]

#Possible values for ARTIFACTORY_DEPLOY_REPO: sonarsource-private-qa, sonarsource-public-qa

ARTIFACTORY_DEPLOY_REPO: sonarsource-public-qa

ARTIFACTORY_ACCESS_TOKEN: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-private-reader access_token]

GITHUB_TOKEN: VAULT[development/github/token/licenses-ro token]

# burgr notification

BURGR_URL: VAULT[development/kv/data/burgr data.url]

BURGR_USERNAME: VAULT[development/kv/data/burgr data.cirrus_username]

BURGR_PASSWORD: VAULT[development/kv/data/burgr data.cirrus_password]

GRADLE_ENTERPRISE_USERNAME: VAULT[development/team/sonarqube/kv/data/gradle-enterprise data.username]

GRADLE_ENTERPRISE_PASSWORD: VAULT[development/team/sonarqube/kv/data/gradle-enterprise data.password]

GRADLE_ENTERPRISE_URL: VAULT[development/team/sonarqube/kv/data/gradle-enterprise data.url]

GRADLE_ENTERPRISE_KEY: VAULT[development/team/sonarqube/kv/data/gradle-enterprise data.access-key]

# Use bash (instead of sh on linux or cmd.exe on windows)

CIRRUS_SHELL: bash

# Allows to run builds for the 50 last commits in a branch:

CIRRUS_CLONE_DEPTH: 50

container_definition: &CONTAINER_DEFINITION

cluster_name: ${CIRRUS_CLUSTER_NAME}

region: eu-central-1

namespace: default

nodeSelectorTerms:

- matchExpressions:

- key: node.kubernetes.io/instance-type

operator: In

values:

- m6a.8xlarge # 3.6 GHz 3rd generation AMD EPYC processors (AMD EPYC 7R13), 18 vCPU, 64 GiB Memory

container_with_docker_definition: &CONTAINER_WITH_DOCKER_DEFINITION

<<: *CONTAINER_DEFINITION

dockerfile: .cirrus/Dockerfile.jdk17And21

builder_role: cirrus-builder

builder_image: docker-builder-v*

builder_instance_type: t3.small

builder_subnet_id: ${CIRRUS_AWS_SUBNET}

win_vm_definition: &WINDOWS_VM_DEFINITION

experimental: true # see https://github.com/cirruslabs/cirrus-ci-docs/issues/1051

platform: windows

region: eu-central-1

type: c5.4xlarge # 3.6 GHz (3.9GHz single core) Intel Xeon Scalable Processor, 16 vCPU, 32 GiB Memory

subnet_id: ${CIRRUS_AWS_SUBNET}

only_sonarsource_qa: &ONLY_SONARSOURCE_QA

only_if: $CIRRUS_USER_COLLABORATOR == 'true' && $CIRRUS_TAG == "" && ($CIRRUS_PR != "" || $CIRRUS_BRANCH == "master" || $CIRRUS_BRANCH =~ "branch-.*" || $CIRRUS_BRANCH =~ "dogfood-on-.*")

common_build_definition: &COMMON_BUILD_DEFINITION

eks_container:

<<: *CONTAINER_DEFINITION

image: ${CIRRUS_AWS_ACCOUNT}.dkr.ecr.eu-central-1.amazonaws.com/base:j21-latest

cpu: 4

memory: 4G

env:

SIGN_KEY: VAULT[development/kv/data/sign data.key]

PGP_PASSPHRASE: VAULT[development/kv/data/sign data.passphrase]

# analysis on next

SONAR_TOKEN: VAULT[development/kv/data/next data.token]

SONAR_HOST_URL: https://next.sonarqube.com/sonarqube

#allow deployment of pull request artifacts to repox

DEPLOY_PULL_REQUEST: true

maven_cache:

folder: ${CIRRUS_WORKING_DIR}/.m2/repository

orchestrator_cache_preparation_definition: &ORCHESTRATOR_CACHE_PREPARATION_DEFINITION

set_orchestrator_home_script: |

export TODAY=$(date '+%Y-%m-%d')

echo "TODAY=${TODAY}" >> $CIRRUS_ENV

echo "ORCHESTRATOR_HOME=${CIRRUS_WORKING_DIR}/orchestrator/${TODAY}" >> $CIRRUS_ENV

mkdir_orchestrator_home_script: |

echo "Create dir ${ORCHESTRATOR_HOME} if needed"

mkdir -p ${ORCHESTRATOR_HOME}

orchestrator_cache_elements_definition: &ORCHESTRATOR_CACHE_ELEMENTS_DEFINITION

folder: ${ORCHESTRATOR_HOME}

fingerprint_script: echo ${TODAY}

reupload_on_changes: "true"

# Only compile without "test and sonar:sonar". Note: Do not rename "build", it is used by "Check Releasability"

build_task:

<<: *COMMON_BUILD_DEFINITION

build_script:

- source cirrus-env BUILD

- regular_mvn_build_deploy_analyze -Dmaven.test.skip=true -Dsonar.skip=true -pl '!java-checks-test-sources/default,!java-checks-test-sources/aws'

cleanup_before_cache_script: cleanup_maven_repository

test_analyze_task:

<<: *COMMON_BUILD_DEFINITION

build_script:

- source cirrus-env BUILD

# ignore duplications in the SE engine plugin, as it will be moved away from sonar-java at some point

- PULL_REQUEST_SHA=$GIT_SHA1 regular_mvn_build_deploy_analyze -P-deploy-sonarsource,-release,-sign -Dmaven.deploy.skip=true -Dsonar.analysisCache.enabled=true -Dsonar.cpd.exclusions=java-symbolic-execution/**

- ./check-license-compliance.sh

cleanup_before_cache_script: cleanup_maven_repository

ws_scan_task:

<<: *ONLY_SONARSOURCE_QA

eks_container:

<<: *CONTAINER_DEFINITION

image: ${CIRRUS_AWS_ACCOUNT}.dkr.ecr.eu-central-1.amazonaws.com/base:j17-latest

cpu: 4

memory: 4G

# run only on master and long-term branches

only_if: $CIRRUS_USER_COLLABORATOR == 'true' && ($CIRRUS_BRANCH == "master" || $CIRRUS_BRANCH =~ "branch-.*" || $CIRRUS_BRANCH =~ "mend-.*")

env:

WS_APIKEY: VAULT[development/kv/data/mend data.apikey]

maven_cache:

folder: ${CIRRUS_WORKING_DIR}/.m2/repository

whitesource_script:

- source cirrus-env QA

- source set_maven_build_version $BUILD_NUMBER

- mvn clean install -Dmaven.test.skip=true -pl '!java-checks-test-sources,!java-checks-test-sources/default,!java-checks-test-sources/aws,!java-checks-test-sources/spring-3.2'

- source ws_scan.sh

allow_failures: "true"

always:

ws_artifacts:

path: "whitesource/**/*"

qa_os_win_task:

ec2_instance:

image: base-windows-jdk21-v*

<<: *WINDOWS_VM_DEFINITION

maven_cache:

folder: ${CIRRUS_WORKING_DIR}/.m2/repository

build_script:

- source cirrus-env CI

- mvn.cmd clean verify

cleanup_before_cache_script: cleanup_maven_repository

plugin_qa_task:

depends_on:

- build

<<: *ONLY_SONARSOURCE_QA

eks_container:

<<: *CONTAINER_DEFINITION

image: ${CIRRUS_AWS_ACCOUNT}.dkr.ecr.eu-central-1.amazonaws.com/base:j17-latest

cpu: 14

memory: 6G

<<: *ORCHESTRATOR_CACHE_PREPARATION_DEFINITION

matrix:

- env:

SQ_VERSION: LATEST_RELEASE[10.3]

orchestrator_LATEST_RELEASE_cache:

<<: *ORCHESTRATOR_CACHE_ELEMENTS_DEFINITION

- env:

SQ_VERSION: DEV

orchestrator_DEV_cache:

<<: *ORCHESTRATOR_CACHE_ELEMENTS_DEFINITION

maven_cache:

folder: ${CIRRUS_WORKING_DIR}/.m2/repository

submodules_script:

- git submodule update --init --recursive

qa_script:

- source cirrus-env QA

- source set_maven_build_version $BUILD_NUMBER

- cd its/plugin

- mvn package -Pit-plugin -Dsonar.runtimeVersion=${SQ_VERSION} -Dmaven.test.redirectTestOutputToFile=false -B -e -V -Dparallel=classes -DuseUnlimitedThreads=true

cleanup_before_cache_script: cleanup_maven_repository

sanity_task:

depends_on:

- build

<<: *ONLY_SONARSOURCE_QA

eks_container:

<<: *CONTAINER_DEFINITION

image: ${CIRRUS_AWS_ACCOUNT}.dkr.ecr.eu-central-1.amazonaws.com/base:j21-latest

cpu: 4

memory: 2G

maven_cache:

folder: ${CIRRUS_WORKING_DIR}/.m2/repository

sanity_script:

- source cirrus-env QA

- source set_maven_build_version $BUILD_NUMBER

- mvn clean compile --projects java-checks-test-sources --also-make-dependents

- mvn verify -f sonar-java-plugin/pom.xml -Psanity -Dtest=SanityTest

cleanup_before_cache_script: cleanup_maven_repository

ruling_task:

depends_on:

- build

<<: *ONLY_SONARSOURCE_QA

eks_container:

<<: *CONTAINER_DEFINITION

image: ${CIRRUS_AWS_ACCOUNT}.dkr.ecr.eu-central-1.amazonaws.com/base:j17-latest

cpu: 14

memory: 6G

maven_cache:

folder: ${CIRRUS_WORKING_DIR}/.m2/repository

<<: *ORCHESTRATOR_CACHE_PREPARATION_DEFINITION

orchestrator_LATEST_RELEASE_cache:

<<: *ORCHESTRATOR_CACHE_ELEMENTS_DEFINITION

submodules_script:

- git submodule update --init --recursive

env:

MAVEN_OPTS: "-Xmx3g"

matrix:

- PROFILE: without-sonarqube-project

- PROFILE: only-sonarqube-project

ruling_script:

- source cirrus-env QA

- source set_maven_build_version $BUILD_NUMBER

- cd its/ruling

- mvn package "-Pit-ruling,$PROFILE" -Dsonar.runtimeVersion=LATEST_RELEASE[10.3] -Dmaven.test.redirectTestOutputToFile=false -B -e -V -Dparallel=methods -DuseUnlimitedThreads=true

cleanup_before_cache_script: cleanup_maven_repository

on_failure:

actual_artifacts:

path: "${CIRRUS_WORKING_DIR}/its/ruling/target/actual/**/*"

ruling_win_task:

depends_on:

- build

<<: *ONLY_SONARSOURCE_QA

ec2_instance:

image: base-windows-jdk17-v*

<<: *WINDOWS_VM_DEFINITION

maven_cache:

folder: ${CIRRUS_WORKING_DIR}/.m2/repository

<<: *ORCHESTRATOR_CACHE_PREPARATION_DEFINITION

orchestrator_LATEST_RELEASE_cache:

<<: *ORCHESTRATOR_CACHE_ELEMENTS_DEFINITION

env:

MAVEN_OPTS: "-Xmx3g"

matrix:

- PROFILE: without-sonarqube-project

- PROFILE: only-sonarqube-project

ruling_script:

- source cirrus-env QA

- source set_maven_build_version $BUILD_NUMBER

- init_git_submodules its/sources

- git submodule update --init --recursive

- cd its/ruling

- mvn package "-Pit-ruling,$PROFILE" -Dsonar.runtimeVersion=LATEST_RELEASE[10.3] -Dmaven.test.redirectTestOutputToFile=false -B -e -V -Dparallel=methods -DuseUnlimitedThreads=true

cleanup_before_cache_script: cleanup_maven_repository

autoscan_task:

depends_on:

- build

<<: *ONLY_SONARSOURCE_QA

eks_container:

<<: *CONTAINER_WITH_DOCKER_DEFINITION

# For now, this autoscan_task need to execute two mvn commands:

# * The build of java-checks-test-sources module which requires Java 21.

# * The tests using Orchestrator and SonarQube that, for now, fail to work using Java 21

# This is why we have a local Dockerfile that provide the 2 versions of Java, 17 and 21.

cpu: 14

memory: 6G

maven_cache:

folder: ${CIRRUS_WORKING_DIR}/.m2/repository

<<: *ORCHESTRATOR_CACHE_PREPARATION_DEFINITION

orchestrator_LATEST_RELEASE_cache:

<<: *ORCHESTRATOR_CACHE_ELEMENTS_DEFINITION

autoscan_script:

- source cirrus-env QA

- source set_maven_build_version $BUILD_NUMBER

- JAVA_HOME="${JAVA_21_HOME}" mvn clean compile --projects java-checks-test-sources --also-make-dependents

- cd its/autoscan

- mvn clean package --batch-mode --errors --show-version --activate-profiles it-autoscan -Dsonar.runtimeVersion=LATEST_RELEASE[10.3] -Dmaven.test.redirectTestOutputToFile=false -Dparallel=methods -DuseUnlimitedThreads=true

cleanup_before_cache_script: cleanup_maven_repository

on_failure:

actual_artifacts:

path: "${CIRRUS_WORKING_DIR}/its/autoscan/target/actual/**/*"

promote_task:

depends_on:

- build

- test_analyze

- qa_os_win

- sanity

- ruling

- ruling_win

- plugin_qa

- ws_scan

- autoscan

<<: *ONLY_SONARSOURCE_QA

eks_container:

<<: *CONTAINER_DEFINITION

image: ${CIRRUS_AWS_ACCOUNT}.dkr.ecr.eu-central-1.amazonaws.com/base:j17-latest

cpu: 2

memory: 1G

env:

#promotion cloud function

ARTIFACTORY_PROMOTE_ACCESS_TOKEN: VAULT[development/artifactory/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-promoter access_token]

GITHUB_TOKEN: VAULT[development/github/token/${CIRRUS_REPO_OWNER}-${CIRRUS_REPO_NAME}-promotion token]

#artifacts that will have downloadable links in burgr

ARTIFACTS: org.sonarsource.java:sonar-java-plugin:jar

maven_cache:

folder: ${CIRRUS_WORKING_DIR}/.m2/repository

script: cirrus_promote_maven

cleanup_before_cache_script: cleanup_maven_repository

# This task can be used to debug the cache content

inspect_orchestrator_cache_task:

<<: *ONLY_SONARSOURCE_QA

depends_on: ruling # To improve cache usage we should introduce a task to warm the cache.

trigger_type: manual

eks_container:

<<: *CONTAINER_WITH_DOCKER_DEFINITION

cpu: 1

memory: 1G

<<: *ORCHESTRATOR_CACHE_PREPARATION_DEFINITION

matrix:

- orchestrator_LATEST_RELEASE_cache:

<<: *ORCHESTRATOR_CACHE_ELEMENTS_DEFINITION

- orchestrator_DEV_cache:

<<: *ORCHESTRATOR_CACHE_ELEMENTS_DEFINITION

inspect_cache_script: |

echo "Inspecting cache ${ORCHESTRATOR_HOME}..."

cd "${ORCHESTRATOR_HOME}"

ls -l

find . -ls

echo "Inspecting cache done."