From 7b724f584818835a2abb4cc73f1bb5ffeb35d0e1 Mon Sep 17 00:00:00 2001 From: atishj99 Date: Thu, 3 Sep 2026 14:39:11 +0530 Subject: [PATCH 1/3] Grant OIDC permissions to cleanup job Adds the required workflow permissions for the dev-release cleanup job. This enables OIDC token generation and allows the job to delete git tags/releases and clean up package artifacts during release processing. --- .github/workflows/release.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fb50eb21..be91e4fa 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -38,6 +38,10 @@ permissions: {} jobs: deleteDevReleases: + permissions: + id-token: write # for OIDC token generation + contents: write # for git tag/release deletion + packages: write # for artifact registry cleanup uses: Checkmarx/ast-eclipse-plugin/.github/workflows/delete-dev-releases.yml@a776dbbfa70cda798753bec14dd7c1f47d094595 with: tag: ${{ inputs.rbranch }} From be95874a6285dbcf0a873382a7ceea973735ab75 Mon Sep 17 00:00:00 2001 From: atishj99 Date: Thu, 3 Sep 2026 15:04:36 +0530 Subject: [PATCH 2/3] Exclude Eclipse and Sonatype from Echo mirror The release workflow now configures the Echo Maven mirror to exclude org.eclipse.* and org.sonatype.* artifacts while still mirroring Maven Central. This avoids dependency resolution issues for Eclipse and Sonatype dependencies during release builds. --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index be91e4fa..21dd957e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -109,7 +109,7 @@ jobs: - name: Configure echo mirror for dependency resolution run: | - sed -i 's||echocentralhttps://maven.echohq.com|' ~/.m2/settings.xml + sed -i 's||echocentral,!org.eclipse.*,!org.sonatype.*https://maven.echohq.com|' ~/.m2/settings.xml - name: Update the POM version From 1a8a56aa5f5a7ea2841d4358b313d1758538c8e4 Mon Sep 17 00:00:00 2001 From: atishj99 Date: Thu, 3 Sep 2026 15:28:40 +0530 Subject: [PATCH 3/3] Make Maven echo mirror update idempotent Update .github/workflows/release.yml to replace the unconditional sed insertion with conditional logic: if a exists in ~/.m2/settings.xml, update its to include exclusions (central,!org.eclipse.*,!org.sonatype.*); otherwise insert a new echo mirror block. This avoids duplicate mirror entries and ensures Eclipse and Sonatype artifacts remain excluded while configuring the echo mirror. --- .github/workflows/release.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 21dd957e..871997b8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -109,7 +109,12 @@ jobs: - name: Configure echo mirror for dependency resolution run: | - sed -i 's||echocentral,!org.eclipse.*,!org.sonatype.*https://maven.echohq.com|' ~/.m2/settings.xml + # Update existing mirror or create new one with Eclipse artifacts excluded + if grep -q '' ~/.m2/settings.xml; then + sed -i 's|.*|central,!org.eclipse.*,!org.sonatype.*|g' ~/.m2/settings.xml + else + sed -i 's||echocentral,!org.eclipse.*,!org.sonatype.*https://maven.echohq.com|' ~/.m2/settings.xml + fi - name: Update the POM version