INTERNAL-2043 Add GitHub release actions to open-source plugin repos

.github/workflows/build-publish.yml

@@ -0,0 +1,40 @@
+name: Build and Publish
+
+# Thin caller around the shared reusable workflow in
+# NrgXnat/xnat-ci-workflows. Plugin variant — no GHCR Docker image
+# (plugins ship a jar to JFrog only).
+
+on:
+  push:
+    branches:
+      - main
+      - develop
+      - 'releases/*'   # RC / release branches, e.g. releases/1.6.0-rc
+  workflow_dispatch:
+    inputs:
+      publish_jfrog:
+        description: 'Publish jar to JFrog Artifactory (nrgxnat)'
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  packages: write   # required by reusable workflow's publish-ghcr job (gated by if: inputs.publish-ghcr but parsed at startup)
+
+jobs:
+  build-publish:
+    uses: NrgXnat/xnat-ci-workflows/.github/workflows/gradle-build-publish.yml@v1
+    with:
+      # ──── Artifact ────
+      artifact-glob: 'build/libs/*.jar'
+      artifact-name: 'openid-auth-plugin-jar'
+
+      # ──── JFrog ────
+      # On any push to a triggered branch: publish. On dispatch: only when publish_jfrog ticked.
+      publish-jfrog: ${{ github.event_name == 'push' || inputs.publish_jfrog }}
+
+      # publish-ghcr deliberately omitted — defaults to false in the reusable workflow.
+
+    # secrets: inherit passes XNAT_ARTIFACTORY_USER/TOKEN (org-level) and
+    # the auto-injected GITHUB_TOKEN through to the reusable workflow.
+    secrets: inherit

.github/workflows/release-cut-rc.yml

@@ -0,0 +1,37 @@
+name: Release - Cut RC Branch
+
+# Thin caller around the shared reusable workflow in NrgXnat/xnat-ci-workflows.
+# Cuts a `releases/<release>-rc` branch from source_branch and bumps
+# source_branch to the next dev version. All release-cut logic lives in the
+# reusable workflow; this file only defines our triggers + inputs.
+
+on:
+  workflow_dispatch:
+    inputs:
+      next_dev_version:
+        description: 'Next dev SNAPSHOT version (e.g. 1.7.0-SNAPSHOT)'
+        type: string
+        required: true
+      source_branch:
+        description: 'Branch to cut from (default: develop)'
+        type: string
+        required: false
+        default: develop
+      trigger_build:
+        description: 'After cut, dispatch build/publish on RC and source_branch'
+        type: boolean
+        required: false
+        default: true
+
+permissions:
+  contents: write
+  actions:  write   # dispatch build-publish workflow
+
+jobs:
+  cut-rc:
+    uses: NrgXnat/xnat-ci-workflows/.github/workflows/gradle-release-cut-rc.yml@v1
+    with:
+      next_dev_version: ${{ inputs.next_dev_version }}
+      source_branch:    ${{ inputs.source_branch }}
+      trigger_build:    ${{ inputs.trigger_build }}
+    secrets: inherit

.github/workflows/release-promote.yml

@@ -0,0 +1,37 @@
+name: Release - Promote RC to Main
+
+# Thin caller around the shared reusable workflow in NrgXnat/xnat-ci-workflows.
+# Promotes a stabilized RC branch to a tagged release on target_main. All
+# release-promote logic lives in the reusable workflow; this file only defines
+# our triggers + inputs.
+
+on:
+  workflow_dispatch:
+    inputs:
+      rc_branch:
+        description: 'RC branch to promote (e.g. releases/1.6.0-rc)'
+        type: string
+        required: true
+      target_main:
+        description: 'Branch to merge into (default main)'
+        type: string
+        required: false
+        default: main
+      trigger_build:
+        description: 'After promote, dispatch build/publish on target_main'
+        type: boolean
+        required: false
+        default: true
+
+permissions:
+  contents: write   # push RC/main + create tag
+  actions:  write   # dispatch build-publish workflow
+
+jobs:
+  promote:
+    uses: NrgXnat/xnat-ci-workflows/.github/workflows/gradle-release-promote.yml@v1
+    with:
+      rc_branch:     ${{ inputs.rc_branch }}
+      target_main:   ${{ inputs.target_main }}
+      trigger_build: ${{ inputs.trigger_build }}
+    secrets: inherit

build.gradle

@@ -5,7 +5,7 @@
 
 buildscript {
     ext {
-        vXnat = "1.10.0"
+        vXnat = "1.10.1-SNAPSHOT"
     }
 }
 
@@ -20,12 +20,11 @@ plugins {
     id "com.palantir.git-version" version "4.3.0"
     id "io.franzbecker.gradle-lombok" version "5.0.0"
     id "io.spring.dependency-management" version "1.1.7"
-    id "net.linguica.maven-settings" version "0.5"
     id "org.nrg.xnat.build.xnat-data-builder" version "${vXnat}"
 }
 
 group = "au.edu.qcif.xnat.openid"
-version = "1.6.0-SNAPSHOT"
+version "1.6.0-SNAPSHOT"
 description = "XNAT OpenID Authentication Provider"
 
 repositories {
@@ -75,11 +74,37 @@ dependencies {
     implementation "org.apache.commons:commons-lang3"
     implementation "commons-io:commons-io"
     implementation "org.slf4j:slf4j-api"
+    implementation("turbine:turbine") {
+        exclude group: "commons-dbcp"
+        exclude group: "commons-email"
+        exclude group: "commons-pool"
+        exclude group: "fulcrum"
+        exclude group: "javax.activation", module: "activation"
+        exclude group: "javax.mail"
+        exclude group: "javax.servlet"
+        exclude group: "jython"
+        exclude group: "xalan"
+        exclude group: "xml-apis"
+        exclude group: "log4j", module: "log4j"
+        exclude group: "berkeleydb"
+        exclude group: "javax.sql"
+        exclude group: "jndi"
+        exclude group: "mysql"
+        exclude group: "tomcat"
+        exclude group: "xerces"
+        exclude group: "velocity", module: "texen"
+        exclude group: "jamon", module: "jamon"
+    }
+    compileOnly("org.apache.velocity:velocity") { transitive = false }
+    compileOnly "javax.servlet:javax.servlet-api"
     implementAndInclude("com.nimbusds:nimbus-jose-jwt:9.37.3")
     testImplementation "junit:junit"
     testImplementation "org.springframework:spring-test"
     testImplementation "com.github.tomakehurst:wiremock"
     testImplementation "org.mockito:mockito-core"
+    testCompileOnly "javax.servlet:javax.servlet-api"
+    // Mockito ByteBuddy needs servlet-api at test runtime to introspect XnatAppInfo / xdat classes (see CHECKLIST §5.3)
+    testRuntimeOnly "javax.servlet:javax.servlet-api"
 }
 
 java {
@@ -94,7 +119,7 @@ compileJava {
 }
 
 jacoco {
-    toolVersion = dependencyManagement.importedProperties["jacoco.version"]
+    toolVersion = "0.8.12"
 }
 
 jacocoTestReport {
@@ -163,8 +188,8 @@ task xnatPluginJar(type: Jar) {
 }
 
 lombok {
-    version = dependencyManagement.importedProperties["lombok.version"] as String
-    sha256 = dependencyManagement.importedProperties["lombok.checksum"] as String
+    version = "1.18.34"
+    sha256 = "1ea5ad6c6afcff902d75072b2aaa6695585aebee9f12127e15c0036ba95d2918"
 }
 
 tasks.withType(Jar).configureEach {
@@ -272,9 +297,17 @@ publishing {
     }
     repositories {
         maven {
-            url = "https://nrgxnat.jfrog.io/nrgxnat/libs-${project.version.endsWith("-SNAPSHOT") ? "snapshot" : "release"}"
-            // The value for name must match <id> in ~/.m2/settings.xml
             name = "XNAT_Artifactory"
+            url = project.version.toString().endsWith("-SNAPSHOT")
+                ? "https://nrgxnat.jfrog.io/nrgxnat/libs-snapshot-local"
+                : "https://nrgxnat.jfrog.io/nrgxnat/libs-release-local"
+            // CI injects ORG_GRADLE_PROJECT_artifactoryUser/Token env vars (Gradle maps
+            // these to project properties). Local devs can set artifactoryUser/Token in
+            // ~/.gradle/gradle.properties. Mirrors monorepo's buildSrc convention.
+            credentials {
+                username = (project.findProperty("artifactoryUser")  ?: System.getenv("ARTIFACTORY_USER"))  ?: ""
+                password = (project.findProperty("artifactoryToken") ?: System.getenv("ARTIFACTORY_TOKEN")) ?: ""
+            }
         }
     }
 }

gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.3.1-all.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.4.1-all.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME