`Merge branch 'nytian/exception-provider-middleware' of https://github.com/microsoft/durabletask-java into nytian/exception-provider-middleware

Author: nytian

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/build-validation.yml

@@ -23,16 +23,16 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
 
     - name: Set up JDK 11
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
       with:
         java-version: '11'
         distribution: 'microsoft'
 
     - name: Setup Gradle
-      uses: gradle/gradle-build-action@v2
+      uses: gradle/gradle-build-action@a8f75513eafdebd8141bd1cd4e30fcd194af8dfa # v2.12.0
 
     - name: Build with Gradle
       run: ./gradlew build -x test
@@ -42,7 +42,7 @@ jobs:
       continue-on-error: false
 
     - name: Upload SpotBugs reports
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: SpotBugs Reports
         path: '**/build/reports/spotbugs'
@@ -54,7 +54,7 @@ jobs:
 
     - name: Upload test reports if tests failed
       if: env.UNIT_TEST_FAILED == 'true'
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: Unit Test Reports
         path: '**/build/reports/tests/test'
@@ -131,27 +131,27 @@ jobs:
 
     - name: Upload Durable Task Emulator Logs
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: Durable Task Emulator Logs
         path: durabletask-emulator.log
 
     - name: Archive test report
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: Integration test report
         path: client/build/reports/tests/integrationTest
 
     - name: Archive export history integration test report
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: Export history integration test report
         path: exporthistory/build/reports/tests/integrationTest
         if-no-files-found: ignore
 
     - name: Upload JAR output
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: Package
         path: client/build/libs
@@ -166,16 +166,16 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
 
       - name: Set up JDK 11
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
         with:
           java-version: '11'
           distribution: 'microsoft'
 
       - name: Setup Gradle
-        uses: gradle/gradle-build-action@v2
+        uses: gradle/gradle-build-action@a8f75513eafdebd8141bd1cd4e30fcd194af8dfa # v2.12.0
 
       - name: Publish to local
         run: ./gradlew publishToMavenLocal -PskipSigning
@@ -189,12 +189,12 @@ jobs:
         shell: pwsh
 
       - name: End to End Tests with Gradle
-        uses: gradle/gradle-build-action@v2
+        uses: gradle/gradle-build-action@a8f75513eafdebd8141bd1cd4e30fcd194af8dfa # v2.12.0
         with:
           arguments: endToEndTest
 
       - name: Archive test report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: E2E test report
           path: endtoendtests/build/reports/tests/endToEndTest
@@ -205,16 +205,16 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
 
       - name: Set up JDK 11
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
         with:
           java-version: '11'
           distribution: 'microsoft'
 
       - name: Setup Gradle
-        uses: gradle/gradle-build-action@v2
+        uses: gradle/gradle-build-action@a8f75513eafdebd8141bd1cd4e30fcd194af8dfa # v2.12.0
 
       - name: Publish to local
         run: ./gradlew publishToMavenLocal -PskipSigning
@@ -228,12 +228,12 @@ jobs:
         shell: pwsh
 
       - name: Sample Tests with Gradle
-        uses: gradle/gradle-build-action@v2
+        uses: gradle/gradle-build-action@a8f75513eafdebd8141bd1cd4e30fcd194af8dfa # v2.12.0
         with:
           arguments: sampleTest
 
       - name: Archive test report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: Functions Sample test report
           path: samples-azure-functions/build/reports/tests/sampleTest

azdevops-pipeline/build-release-artifacts.yml

@@ -24,6 +24,7 @@ steps:
     jdkArchitectureOption: 'x64'
     publishJUnitResults: false
     tasks: clean assemble
+    options: '--init-script init.gradle'
   displayName: Assemble durabletask-client and durabletask-azure-functions
 
 # the secring.gpg file is required to sign the artifacts, it's generated from GnuPG, and it's stored in the library of the durabletaskframework ADO
@@ -42,7 +43,7 @@ steps:
     jdkVersionOption: '$(jdkVersion)'
     jdkArchitectureOption: 'x64'
     tasks: publish
-    options: '-Psigning.keyId=$(gpgSignKey) -Psigning.password=$(gpgSignPassword) -Psigning.secretKeyRingFile=$(gpgSecretFile.secureFilePath)'
+    options: '--init-script init.gradle -Psigning.keyId=$(gpgSignKey) -Psigning.password=$(gpgSignPassword) -Psigning.secretKeyRingFile=$(gpgSecretFile.secureFilePath)'
   displayName: Publish durabletask-client and durabletask-azure-functions
 
 - task: CopyFiles@2

eng/templates/build.yml

@@ -24,6 +24,7 @@ jobs:
             jdkArchitectureOption: 'x64'
             publishJUnitResults: false
             tasks: clean assemble
+            options: '--init-script init.gradle'
           displayName: Assemble durabletask-client and durabletask-azure-functions and durabletask-azuremanaged
 
         # the secring.gpg file is required to sign the artifacts, it's generated from GnuPG, and it's stored in the library of the durabletaskframework ADO
@@ -42,7 +43,7 @@ jobs:
             jdkVersionOption: 1.11
             jdkArchitectureOption: 'x64'
             tasks: publish
-            options: '-Psigning.keyId=$(gpgSignKey) -Psigning.password=$(gpgSignPassword) -Psigning.secretKeyRingFile=$(gpgSecretFile.secureFilePath)'
+            options: '--init-script init.gradle -Psigning.keyId=$(gpgSignKey) -Psigning.password=$(gpgSignPassword) -Psigning.secretKeyRingFile=$(gpgSecretFile.secureFilePath)'
           displayName: Publish durabletask-client and durabletask-azure-functions and durabletask-azuremanaged
 
         - task: CopyFiles@2

init.gradle

@@ -0,0 +1,26 @@
+allprojects {
+    def azfuncFeedUrl = 'https://pkgs.dev.azure.com/azfunc/public/_packaging/upstream-public/maven/v1'
+    def azfuncFeedToken = System.getenv('AZURE_ARTIFACTS_ENV_ACCESS_TOKEN') ?: findProperty('vstsMavenAccessToken')
+    repositories {
+        maven {
+            url azfuncFeedUrl
+            if (azfuncFeedToken) {
+                credentials {
+                    username 'Azure DevOps Services'
+                    password azfuncFeedToken
+                }
+            }
+        }
+    }
+    // Keep only the Azure Artifacts feed (and MavenLocal); remove every other Maven repository so no
+    // public repository can bypass the feed.
+    afterEvaluate { proj ->
+        def isNonFeedMaven = { repo ->
+            repo instanceof MavenArtifactRepository &&
+            repo.name != 'MavenLocal' &&
+            !repo.url.toString().startsWith(azfuncFeedUrl)
+        }
+        proj.repositories.findAll(isNonFeedMaven).each { proj.repositories.remove(it) }
+        proj.buildscript.repositories.findAll(isNonFeedMaven).each { proj.buildscript.repositories.remove(it) }
+    }
+}

settings.gradle

@@ -1,3 +1,21 @@
+pluginManagement {
+    // Resolve plugins from the Azure Artifacts feed when its token is available; otherwise the public portal.
+    def azfuncFeedToken = System.getenv('AZURE_ARTIFACTS_ENV_ACCESS_TOKEN') ?: providers.gradleProperty('vstsMavenAccessToken').orNull
+    repositories {
+        if (azfuncFeedToken) {
+            maven {
+                url 'https://pkgs.dev.azure.com/azfunc/public/_packaging/upstream-public/maven/v1'
+                credentials {
+                    username 'Azure DevOps Services'
+                    password azfuncFeedToken
+                }
+            }
+        } else {
+            gradlePluginPortal()
+        }
+    }
+}
+
 rootProject.name = 'durabletask-java'
 
 include ":client"