Skip to content

Commit 9727061

Browse files
wenytang-msCopilot
andcommitted
build: resolve maven artifacts through the CFS feed
SFI Network Isolation requires builds to stop reaching public package hosts, and Maven is the last source of egress from these pipelines now that npm has moved. Two independent paths reach repo.maven.apache.org: artifact resolution, and the wrapper's download of the Maven distribution -- which happens before Maven exists, so no settings file can influence it. Both are closed with configuration Maven and its wrapper already understand, declared as pipeline variables so they reach every step in the job. That last part matters: these builds never name Maven on a command line, they start it from an npm script, so there is nowhere to add a flag. MAVEN_ARGS points Maven at a committed settings.xml carrying the mirror and its credential. The mirror is scoped to `central` rather than `external:*` because Tycho resolves p2 repositories through the same configuration and the feed cannot serve p2. MVNW_REPOURL substitutes the host in distributionUrl, which is why the wrapper properties still name the public host and need no edit at all. MVNW_REPOURL requires the Apache wrapper -- the Takari one bundled here reads the URL only from the properties file and honours no override -- so it is replaced by the script-only distribution of Apache maven-wrapper 3.3.3, which also removes maven-wrapper.jar from the tree. 3.3.3 and not 3.3.2 because the latter selects the mvnd path pattern for non-mvnd builds on Windows and produces a malformed URL. This replaces an earlier attempt that had a pipeline step rewrite the user settings.xml and the tracked wrapper properties. It needed to locate the JVM's user.home, edit XML that another task had just written, and leave the checkout dirty. None of that is necessary. The jacoco agent was fetched with curl straight from repo1.maven.org, which no settings file can redirect because Maven is not the one making the request. It now comes from `dependency:copy`, so it follows whatever repository the build is already pointed at. `-N` keeps that on the parent pom, whose packaging is `pom`, so Tycho has no module to build and skips a second target platform resolution. Nothing here changes a local build: MAVEN_ARGS and MVNW_* are set only on the agents, so ./mvnw keeps using the developer's own settings and the public central. If either variable were missing, the build fails against an unusable repository rather than quietly falling back to the public host. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ac225268-483d-4498-a08f-fe79a87d4d2e
1 parent 498b158 commit 9727061

10 files changed

Lines changed: 515 additions & 286 deletions

File tree

.azure-pipelines/cfs-settings.xml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
Maven settings for the build pipelines in this directory. SFI Network Isolation
4+
requires builds to resolve artifacts through the Central Feed Service (CFS) instead
5+
of reaching a public host, and this file is the artifact-resolution half of that.
6+
7+
It is applied through MAVEN_ARGS rather than by passing -s at each call site; see
8+
maven-cfs-variables.yml for why. Because MAVEN_ARGS is set only on the build agents,
9+
a developer running ./mvnw locally is unaffected and keeps using their own settings.
10+
11+
The mirror is scoped to `central` rather than `external:*` deliberately. Tycho
12+
resolves p2 repositories through the same mirror configuration, and CFS cannot serve
13+
p2, so a wildcard mirror would break target platform resolution.
14+
15+
The two ids must stay equal: that pairing is how Maven attaches the credential to
16+
the mirror. Neither value below is a secret. The URL is a feed address, and the
17+
password is an environment reference that is only resolved on the agent. If either
18+
variable is missing the build fails against an unusable repository rather than
19+
quietly falling back to the public central, which is the outcome this change exists
20+
to prevent.
21+
-->
22+
<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
23+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
24+
xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">
25+
<mirrors>
26+
<mirror>
27+
<id>vscjava</id>
28+
<name>Central Feed Service</name>
29+
<url>${env.CFS_MAVEN_URL}</url>
30+
<mirrorOf>central</mirrorOf>
31+
</mirror>
32+
</mirrors>
33+
<servers>
34+
<server>
35+
<id>vscjava</id>
36+
<username>AzureDevOps</username>
37+
<password>${env.SYSTEM_ACCESSTOKEN}</password>
38+
</server>
39+
</servers>
40+
</settings>
Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# Variables that route Maven through the Central Feed Service (CFS), as required by
2+
# SFI Network Isolation. Consumed by every pipeline in this directory that builds the
3+
# Java side of the extension:
4+
#
5+
# variables:
6+
# - template: /.azure-pipelines/maven-cfs-variables.yml@self
7+
#
8+
# There is deliberately no companion steps template. Everything the redirect needs is
9+
# already understood by Maven and its wrapper as environment variables, so no task has
10+
# to rewrite a settings file and nothing in the checked-out tree is modified. Pipeline
11+
# variables are exported to every step in the job, which is what makes this work for
12+
# the Maven runs these builds start indirectly -- from an npm script or a gulp task --
13+
# and never name on a command line of their own.
14+
#
15+
# Two independent egress paths have to be closed, and only the first is obvious.
16+
variables:
17+
# The feed's maven/v1 endpoint, read by cfs-settings.xml and by the wrapper below.
18+
# Committing it matches npm-cfs-variables.yml: a feed address is not a secret, and
19+
# the token that makes it usable never leaves the agent.
20+
- name: CFS_MAVEN_URL
21+
value: https://pkgs.dev.azure.com/mseng/VSJava/_packaging/vscjava/maven/v1
22+
23+
# Path one: artifact resolution. The `mvn` launcher prepends MAVEN_ARGS to every
24+
# invocation, so build scripts keep calling `mvnw` with no extra flags of their own.
25+
# Supported by Maven 3.9 and newer, which is what the wrapper here pins.
26+
- name: MAVEN_ARGS
27+
value: -s $(Build.SourcesDirectory)/.azure-pipelines/cfs-settings.xml
28+
# System.AccessToken is not an environment variable on the agent unless it is mapped
29+
# like this. cfs-settings.xml reads it as the mirror's password.
30+
- name: SYSTEM_ACCESSTOKEN
31+
value: $(System.AccessToken)
32+
33+
# Path two: the Maven distribution itself. The wrapper downloads it from
34+
# distributionUrl before Maven exists, so settings.xml cannot influence that request.
35+
# MVNW_REPOURL substitutes everything ahead of /org/apache/maven/ in that URL, which
36+
# is why .mvn/wrapper/maven-wrapper.properties still names the public host and needs
37+
# no edit: contributors keep a wrapper that works, agents resolve it from the feed.
38+
- name: MVNW_REPOURL
39+
value: $(CFS_MAVEN_URL)
40+
- name: MVNW_USERNAME
41+
value: AzureDevOps
42+
- name: MVNW_PASSWORD
43+
value: $(System.AccessToken)

.azure-pipelines/vscode-java-test-ci.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ variables:
33
- name: Codeql.Enabled
44
value: true
55
- template: /.azure-pipelines/npm-cfs-variables.yml@self
6+
- template: /.azure-pipelines/maven-cfs-variables.yml@self
67
resources:
78
repositories:
89
- repository: self

.azure-pipelines/vscode-java-test-nightly.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ variables:
33
- name: Codeql.Enabled
44
value: true
55
- template: /.azure-pipelines/npm-cfs-variables.yml@self
6+
- template: /.azure-pipelines/maven-cfs-variables.yml@self
67
schedules:
78
- cron: 0 2 * * *
89
branches:

.azure-pipelines/vscode-java-test-rc.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ variables:
33
- name: Codeql.Enabled
44
value: true
55
- template: /.azure-pipelines/npm-cfs-variables.yml@self
6+
- template: /.azure-pipelines/maven-cfs-variables.yml@self
67
resources:
78
repositories:
89
- repository: self
-46.7 KB
Binary file not shown.
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.3/apache-maven-3.9.3-bin.zip
1+
distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.3/apache-maven-3.9.3-bin.zip

0 commit comments

Comments
 (0)