Merge branch 'develop' into SDMEXT-2853

Author: akgarg06

.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# Workflow files — any change requires approval from one of the owners below
+/.github/                    @vibhutikumar07 @yashmeet29
+/.github/workflows/          @vibhutikumar07 @yashmeet29

.github/actions/deploy-release/action.yml

@@ -29,7 +29,6 @@ runs:
   steps:
     - name: "Echo Inputs"
       run: |
-        echo "user: ${{ inputs.user }}"
         echo "profile: ${{ inputs.profile }}"
       shell: bash
 
@@ -45,9 +44,13 @@ runs:
 
     - name: "Import GPG Key"
       run: |
-        echo "${{ inputs.pgp-private-key }}" | gpg --batch --passphrase "$PASSPHRASE" --import
-      shell: bash  
+        set +x
+        echo "::add-mask::$PGP_PRIVATE_KEY"
+        echo "::add-mask::$PASSPHRASE"
+        echo "$PGP_PRIVATE_KEY" | gpg --batch --passphrase "$PASSPHRASE" --import
+      shell: bash
       env:
+        PGP_PRIVATE_KEY: ${{ inputs.pgp-private-key }}
         PASSPHRASE: ${{ inputs.pgp-passphrase }}
 
     - name: "Ensure Local Repo Directory"
@@ -57,12 +60,17 @@ runs:
       shell: bash
 
     - name: Deploy to Maven Central
-      run: >
-        mvn -B -ntp --show-version
-        -Dmaven.install.skip=true
-        -Dmaven.test.skip=true
-        -Dgpg.passphrase="$GPG_PASSPHRASE"
-        -Dgpg.keyname="$GPG_PUB_KEY"
+      run: |
+        set +x
+        echo "::add-mask::$MAVEN_CENTRAL_USER"
+        echo "::add-mask::$MAVEN_CENTRAL_PASSWORD"
+        echo "::add-mask::$GPG_PASSPHRASE"
+        echo "::add-mask::$GPG_PUB_KEY"
+        mvn -B -ntp --show-version \
+        -Dmaven.install.skip=true \
+        -Dmaven.test.skip=true \
+        -Dgpg.passphrase="$GPG_PASSPHRASE" \
+        -Dgpg.keyname="$GPG_PUB_KEY" \
         clean deploy -P deploy-release
       shell: bash
       env:

.github/actions/newrelease/action.yml

@@ -28,14 +28,14 @@ runs:
     - name: Update version
       run: |
         VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
-        echo $VERSION > cap-notebook/version.txt
+        echo $VERSION > app/single-tenant/central-space/demoapp/version.txt
         mvn --no-transfer-progress versions:set-property -Dproperty=revision -DnewVersion=$VERSION
         #chmod +x ensure-license.sh
         #./ensure-license.sh
         git config --global user.name 'github-actions[bot]'
         git config --global user.email 'github-actions[bot]@users.noreply.github.com'
         git checkout -b develop
-        git add cap-notebook/version.txt
+        git add app/single-tenant/central-space/demoapp/version.txt
         git commit -am "Update version to $VERSION"
         git push --set-upstream origin develop
       shell: bash

.github/workflows/SAPUI5_Version_Monitoring.yml

@@ -8,16 +8,17 @@ on:
 jobs:
   update-version:
     name: Check and Update SAPUI5 Version
+    environment: dev
     runs-on: ubuntu-latest
     permissions:
       contents: write
       pull-requests: write
 
     steps:
-      - name: Checkout the develop_deploy branch
+      - name: Checkout the develop branch
         uses: actions/checkout@v6
         with:
-          ref: develop_deploy
+          ref: develop
 
       - name: Install dependencies
         run: |
@@ -26,9 +27,9 @@ jobs:
         id: run_script
         run: |
           #!/bin/bash
-          
+
           # Define the target file
-          FILE_PATH="cap-notebook/demoapp/app/index.html"
+          FILE_PATH="app/single-tenant/central-space/demoapp/app/index.html"
           
           # Function to get the latest version and its corresponding latest patch version
           fetch_versions() {
@@ -107,5 +108,5 @@ jobs:
             Current Version: ${{ steps.run_script.outputs.current_version }}
             Latest patch version: ${{ steps.run_script.outputs.latest_version }}
           branch: 'update-sapui5-version'
-          base: develop_deploy
+          base: develop
           assignees: yashmeet29

.github/workflows/blackduck.yml

@@ -16,6 +16,7 @@ permissions:
 
 jobs:
   build:
+    environment: pr-analysis
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -32,19 +33,25 @@ jobs:
 
       - name: Install dependencies
         run: |
-          mvn clean install -P unit-tests  -DskipIntegrationTests
+          mvn clean install -P unit-tests -DskipIntegrationTests
+          mvn clean install -f app/single-tenant/central-space/demoapp/pom.xml -DskipTests
+          mvn clean install -f app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml -DskipTests
         
       # - name: Download Synopsys Detect Script
       #   run: curl --silent -O https://detect.synopsys.com/detect9.sh
       - name: Download Black Duck Detect Script
         run: curl --silent -O https://detect.blackduck.com/detect9.sh
 
       - name: Run & analyze BlackDuck Scan
+        env:
+          BLACKDUCK_TOKEN: ${{ secrets.BLACKDUCK_TOKEN }}
         run: |
+          set +x
+          echo "::add-mask::$BLACKDUCK_TOKEN"
           bash ./detect9.sh -d \
           --logging.level.com.synopsys.integration=DEBUG  \
           --blackduck.url="https://sap.blackducksoftware.com" \
-          --blackduck.api.token=""${{ secrets.BLACKDUCK_TOKEN }}""   \
+          --blackduck.api.token="$BLACKDUCK_TOKEN"   \
           --detect.blackduck.signature.scanner.arguments="--min-scan-interval=0" \
           --detect.maven.build.command="install -P unit-tests  -DskipIntegrationTests" \
           --detect.latest.release.version="9.6.0" \
@@ -56,4 +63,4 @@ jobs:
           --detect.project.name="SAP_DOC_MGMT_CAPPLUGIN_JAVA1.0" \
           --detect.project.version.name="1.0" \
           --detect.code.location.name="SAP_DOC_MGMT_CAPPLUGIN_JAVA1.0/1.0" \
-          --detect.source.path="/home/runner/work/sdm/sdm/sdm"
+          --detect.source.path="/home/runner/work/sdm/sdm"

.github/workflows/cfdeploy.yml

@@ -32,6 +32,7 @@ permissions:
 
 jobs:
   Deploy:
+    environment: dev
     runs-on: ubuntu-latest
     if: ${{ github.event.inputs.workflow_choice == 'Deploy' }}
 
@@ -53,18 +54,6 @@ jobs:
           mvn clean install -P unit-tests -DskipIntegrationTests
           echo "✅ Build and packaging completed successfully!"
 
-      - name: Verify and Checkout Deploy Branch 🔄
-        run: |
-          git fetch origin
-          echo "📂 Verifying 'local_deploy' branch..."
-          if git rev-parse --verify origin/local_deploy; then
-            git checkout local_deploy
-            echo "✅ Branch checked out successfully!"
-          else
-            echo "❌ Branch 'local_deploy' not found. Please verify the branch name."
-            exit 1
-          fi
-
       - name: Set REPOSITORY_ID 🔍
         id: set_repository_id
         run: |
@@ -84,11 +73,15 @@ jobs:
 
       - name: Prepare and Deploy to Cloud Foundry ☁️
         run: |
+          set +x
+          echo "::add-mask::$CF_API"
+          echo "::add-mask::$CF_USER"
+          echo "::add-mask::$CF_PASSWORD"
+          echo "::add-mask::$CF_ORG"
           echo "🔄 Preparing to deploy..."
           echo "Current Branch: 📂"
-          git branch
           pwd
-          cd /home/runner/work/sdm/sdm/cap-notebook/demoapp/app
+          cd /home/runner/work/sdm/sdm/app/single-tenant/personal-space/demoapp/app
           echo "Changed to app directory 📂"
           pwd
 
@@ -120,14 +113,20 @@ jobs:
           cf install-plugin multiapps -f
 
           echo "🔑 Logging into Cloud Foundry..."
-          cf login -a ${{ secrets.CF_API }} -u ${{ secrets.CF_USER }} -p ${{ secrets.CF_PASSWORD }} -o ${{ secrets.CF_ORG }} -s ${{ github.event.inputs.cf_space }}
+          cf login -a "$CF_API" -u "$CF_USER" -p "$CF_PASSWORD" -o "$CF_ORG" -s ${{ github.event.inputs.cf_space }} > /dev/null
           echo "✅ Logged in successfully!"
 
           echo "🚀 Running cf deploy..."
           cf deploy mta_archives/demoappjava_1.0.0.mtar -f
           echo "✅ Deployment complete!"
+        env:
+          CF_API: ${{ secrets.CF_API }}
+          CF_USER: ${{ secrets.CF_USER }}
+          CF_PASSWORD: ${{ secrets.CF_PASSWORD }}
+          CF_ORG: ${{ secrets.CF_ORG }}
 
   SnapshotDeploy:
+    environment: dev
     runs-on: ubuntu-latest
     if: ${{ github.event.inputs.workflow_choice == 'Snapshot Deploy' }}
 
@@ -143,25 +142,13 @@ jobs:
           java-version: 21
           distribution: 'temurin'
 
-      - name: Verify and Checkout Deploy Branch 🔄
-        run: |
-          git fetch origin
-          echo "📂 Verifying 'develop_deploy' branch..."
-          if git rev-parse --verify origin/develop_deploy; then
-            git checkout develop_deploy
-            echo "✅ Branch checked out successfully!"
-          else
-            echo "❌ Branch 'develop_deploy' not found. Please verify the branch name."
-            exit 1
-          fi
-
       - name: Override cds.services.version (runtime only)
         if: ${{ github.event.inputs.cds_services_version != '' }}
         env:
           TARGET_CDS_SERVICES_VERSION: ${{ github.event.inputs.cds_services_version }}
         run: |
           echo "Override requested: cds.services.version -> ${TARGET_CDS_SERVICES_VERSION}"
-          FILES=$(grep -Rl "<cds.services.version>" . | grep pom.xml || true)
+          FILES=$(grep -Rl "<cds.services.version>" app/single-tenant/central-space/demoapp | grep pom.xml || true)
           if [ -z "$FILES" ]; then
             echo "No pom.xml files with <cds.services.version> found" >&2; exit 1;
           fi
@@ -219,11 +206,15 @@ jobs:
 
       - name: Prepare and Deploy to Cloud Foundry ☁️
         run: |
+          set +x
+          echo "::add-mask::$CF_API"
+          echo "::add-mask::$CF_USER"
+          echo "::add-mask::$CF_PASSWORD"
+          echo "::add-mask::$CF_ORG"
           echo "🔄 Preparing to deploy..."
           echo "Current Branch: 📂"
-          git branch
           pwd
-          cd /home/runner/work/sdm/sdm/cap-notebook/demoapp
+          cd /home/runner/work/sdm/sdm/app/single-tenant/central-space/demoapp
 
           cd app
           echo "🔄 Removing node_modules for fresh install..."
@@ -255,9 +246,14 @@ jobs:
           cf install-plugin multiapps -f
 
           echo "🔑 Logging into Cloud Foundry..."
-          cf login -a ${{ secrets.CF_API }} -u ${{ secrets.CF_USER }} -p ${{ secrets.CF_PASSWORD }} -o ${{ secrets.CF_ORG }} -s ${{ github.event.inputs.cf_space }}
+          cf login -a "$CF_API" -u "$CF_USER" -p "$CF_PASSWORD" -o "$CF_ORG" -s ${{ github.event.inputs.cf_space }} > /dev/null
           echo "✅ Logged in successfully!"
 
           echo "🚀 Running cf deploy..."
           cf deploy mta_archives/demoappjava_1.0.0.mtar -f
           echo "✅ Deployment complete!"
+        env:
+          CF_API: ${{ secrets.CF_API }}
+          CF_USER: ${{ secrets.CF_USER }}
+          CF_PASSWORD: ${{ secrets.CF_PASSWORD }}
+          CF_ORG: ${{ secrets.CF_ORG }}

.github/workflows/demo-build.yml

@@ -7,6 +7,7 @@ on:
 
 jobs:
   build:
+    environment: dev
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

.github/workflows/internalArticatory.yml

@@ -87,11 +87,17 @@ jobs:
 
       - name: Verify artifact in Artifactory
         if: ${{ endsWith(steps.bump-version.outputs.updated_version || steps.read-revision.outputs.updated_version, '-SNAPSHOT') }}
+        env:
+          CAP_DEPLOYMENT_USER: ${{ secrets.CAP_DEPLOYMENT_USER }}
+          CAP_DEPLOYMENT_PASS: ${{ secrets.CAP_DEPLOYMENT_PASS }}
         run: |
+          set +x
+          echo "::add-mask::$CAP_DEPLOYMENT_USER"
+          echo "::add-mask::$CAP_DEPLOYMENT_PASS"
           group_path="com/sap/cds/sdm"
           version="${{ steps.bump-version.outputs.updated_version || steps.read-revision.outputs.updated_version }}"
           echo "Checking metadata for $version"
-          curl -u "${{ secrets.CAP_DEPLOYMENT_USER }}:${{ secrets.CAP_DEPLOYMENT_PASS }}" -f -I \
+          curl -u "$CAP_DEPLOYMENT_USER:$CAP_DEPLOYMENT_PASS" -f -I \
             "$ARTIFACTORY_URL/$group_path/$version/maven-metadata.xml" || { echo "Metadata not found"; exit 1; }
           echo "Artifact metadata accessible for $version"
       - name: Summary

.github/workflows/main-build-and-deploy-oss.yml

@@ -8,6 +8,9 @@ on:
   release:
     types: [ "released" ]
 
+permissions:
+  contents: read
+
 jobs:
 
   update-version:
@@ -86,8 +89,10 @@ jobs:
 
   deploy:
     name: Deploy to Maven Central
+    environment: maven-central
     runs-on: ubuntu-latest
     needs: build
+    timeout-minutes: 30
     steps:
       - name: Download artifact
         uses: actions/download-artifact@v7

.github/workflows/main-build-and-deploy.yml

@@ -13,6 +13,7 @@ on:
 jobs:
 
   update-version:
+    environment: dev
     runs-on: ubuntu-latest
     #needs: blackduck
     steps:
@@ -36,6 +37,7 @@ jobs:
           retention-days: 1
 
   build:
+    environment: dev
     runs-on: ubuntu-latest
     needs: update-version
     steps:
@@ -60,6 +62,7 @@ jobs:
 
   deploy:
     name: Deploy to Artifactory
+    environment: dev
     runs-on: ubuntu-latest
     needs: build
     steps: