From be34e92cadd27e9683e401a8e62af79181ad398c Mon Sep 17 00:00:00 2001
From: Sakthivel Subramanian <sakthipvmj@gmail.com>
Date: Mon, 27 Jan 2025 17:07:38 +0530
Subject: [PATCH] ci(spanner): use airlock for presubmit jobs

---
 .kokoro/build.sh                   |  10 ++-
 .kokoro/dependencies.sh            |  18 ++++-
 .kokoro/presubmit/dependencies.cfg |   5 ++
 .mvn/extensions.xml                |   8 ++
 pom.xml                            | 118 +++++++++++++++++++++++++++++
 5 files changed, 156 insertions(+), 3 deletions(-)
 create mode 100644 .mvn/extensions.xml

diff --git a/.kokoro/build.sh b/.kokoro/build.sh
index 8875b41d373..9254e74cebf 100755
--- a/.kokoro/build.sh
+++ b/.kokoro/build.sh
@@ -15,6 +15,8 @@
 
 set -eo pipefail
 
+set -x
+
 ## Get the directory of the build script
 scriptDir=$(realpath $(dirname "${BASH_SOURCE[0]}"))
 ## cd to the parent directory, i.e. the root of the git repo
@@ -33,9 +35,15 @@ fi
 mvn -version
 echo ${JOB_TYPE}
 
+INSTALL_OPTS=""
+if [[ $ENABLE_AIRLOCK = 'true' ]]; then
+  INSTALL_OPTS="-Pairlock-trusted"
+fi
+
 # attempt to install 3 times with exponential backoff (starting with 10 seconds)
 retry_with_backoff 3 10 \
-  mvn install -B -V -ntp \
+  mvn install -B -V \
+    ${INSTALL_OPTS} \
     -DskipTests=true \
     -Dclirr.skip=true \
     -Denforcer.skip=true \
diff --git a/.kokoro/dependencies.sh b/.kokoro/dependencies.sh
index 3c613d6b56d..b82d99cfaa5 100755
--- a/.kokoro/dependencies.sh
+++ b/.kokoro/dependencies.sh
@@ -16,6 +16,8 @@
 set -eo pipefail
 shopt -s nullglob
 
+set -x
+
 ## Get the directory of the build script
 scriptDir=$(realpath $(dirname "${BASH_SOURCE[0]}"))
 ## cd to the parent directory, i.e. the root of the git repo
@@ -53,9 +55,21 @@ if [ ! -z "${JAVA11_HOME}" ]; then
   setJava "${JAVA11_HOME}"
 fi
 
+INSTALL_OPTS=""
+if [[ $ENABLE_AIRLOCK = 'true' ]]; then
+  INSTALL_OPTS="-Pairlock-trusted"
+  wget -q https://archive.apache.org/dist/maven/maven-3/3.9.9/binaries/apache-maven-3.9.9-bin.zip -O /tmp/maven.zip && \
+    unzip /tmp/maven.zip -d /tmp/maven && \
+    rm -r /usr/local/lib/maven && \
+    mv  /tmp/maven/apache-maven-3.9.9 /usr/local/lib/maven && \
+    rm /tmp/maven.zip && \
+    ls -la /usr/local/lib/maven
+fi
+
 # this should run maven enforcer
 retry_with_backoff 3 10 \
-  mvn install -B -V -ntp \
+  mvn install -U -B -V \
+    ${INSTALL_OPTS} \
     -DskipTests=true \
     -Dmaven.javadoc.skip=true \
     -Dclirr.skip=true
@@ -64,4 +78,4 @@ if [ ! -z "${JAVA8_HOME}" ]; then
   setJava "${JAVA8_HOME}"
 fi
 
-mvn -B dependency:analyze -DfailOnWarning=true
+mvn -B ${INSTALL_OPTS} dependency:analyze -DfailOnWarning=true
diff --git a/.kokoro/presubmit/dependencies.cfg b/.kokoro/presubmit/dependencies.cfg
index 808bf138e1c..9e1ffbc98d7 100644
--- a/.kokoro/presubmit/dependencies.cfg
+++ b/.kokoro/presubmit/dependencies.cfg
@@ -10,3 +10,8 @@ env_vars: {
   key: "TRAMPOLINE_BUILD_FILE"
   value: "github/java-spanner/.kokoro/dependencies.sh"
 }
+
+env_vars: {
+  key: "ENABLE_AIRLOCK",
+  value: "true"
+}
\ No newline at end of file
diff --git a/.mvn/extensions.xml b/.mvn/extensions.xml
new file mode 100644
index 00000000000..38f37df431b
--- /dev/null
+++ b/.mvn/extensions.xml
@@ -0,0 +1,8 @@
+<extensions xmlns="http://maven.apache.org/EXTENSIONS/1.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/EXTENSIONS/1.0.0 http://maven.apache.org/xsd/core-extensions-1.0.0.xsd">
+  <extension>
+    <groupId>com.google.cloud.artifactregistry</groupId>
+    <artifactId>artifactregistry-maven-wagon</artifactId>
+    <version>2.2.3</version>
+  </extension>
+</extensions>
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index 40da1f5fc69..191dedd73b0 100644
--- a/pom.xml
+++ b/pom.xml
@@ -163,6 +163,11 @@
           <showDeprecation>true</showDeprecation>
         </configuration>
       </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-resources-plugin</artifactId>
+        <version>3.2.0</version>
+      </plugin>
     </plugins>
   </build>
 
@@ -234,4 +239,117 @@
       </plugin>
     </plugins>
   </reporting>
+
+  <profiles>
+    <profile>
+      <!-- Profile to use Airlock (go/airlock/howto_maven). Disabled by default. -->
+      <id>airlock-trusted</id>
+      <pluginRepositories>
+        <pluginRepository>
+          <id>airlock</id>
+          <name>Airlock</name>
+          <url>artifactregistry://us-maven.pkg.dev/artifact-foundry-prod/maven-3p-trusted</url>
+          <layout>default</layout>
+          <releases>
+            <enabled>true</enabled>
+          </releases>
+          <snapshots>
+            <enabled>true</enabled>
+          </snapshots>
+        </pluginRepository>
+        <!-- Adding a fallback to airlock 3p staging till all the license verification issues are resolved -->
+        <pluginRepository>
+          <id>airlock-staging</id>
+          <name>Airlock</name>
+          <url>artifactregistry://us-maven.pkg.dev/artifact-foundry-prod/ah-3p-staging-maven</url>
+          <layout>default</layout>
+          <releases>
+            <enabled>true</enabled>
+          </releases>
+          <snapshots>
+            <enabled>true</enabled>
+          </snapshots>
+        </pluginRepository>
+        <pluginRepository>
+          <id>central</id>
+          <!-- Disable default Maven Central -->
+          <name>Maven Central remote repository</name>
+          <url>https://repo.maven.apache.org/maven2</url>
+          <layout>default</layout>
+          <releases>
+            <enabled>false</enabled>
+          </releases>
+          <snapshots>
+            <enabled>false</enabled>
+          </snapshots>
+        </pluginRepository>
+        <pluginRepository>
+          <id>rso-public-grid</id>
+          <!-- Disable default sonatype public grid -->
+          <name>Maven Central Sonatype repository</name>
+          <url>https://repository.sonatype.org/content/groups/sonatype-public-grid</url>
+          <layout>default</layout>
+          <releases>
+            <enabled>false</enabled>
+          </releases>
+          <snapshots>
+            <enabled>false</enabled>
+          </snapshots>
+        </pluginRepository>
+      </pluginRepositories>
+      <repositories>
+        <repository>
+          <id>airlock</id>
+          <name>Airlock</name>
+          <url>artifactregistry://us-maven.pkg.dev/artifact-foundry-prod/maven-3p-trusted</url>
+          <layout>default</layout>
+          <releases>
+            <enabled>true</enabled>
+          </releases>
+          <snapshots>
+            <enabled>true</enabled>
+          </snapshots>
+        </repository>
+        <!-- Adding a fallback to airlock 3p staging till all the license verification issues are resolved -->
+        <repository>
+          <id>airlock-staging</id>
+          <name>Airlock</name>
+          <url>artifactregistry://us-maven.pkg.dev/artifact-foundry-prod/ah-3p-staging-maven</url>
+          <layout>default</layout>
+          <releases>
+            <enabled>true</enabled>
+          </releases>
+          <snapshots>
+            <enabled>true</enabled>
+          </snapshots>
+        </repository>
+        <repository>
+          <id>central</id>
+          <!-- Disable default Maven Central -->
+          <name>Maven Central remote repository</name>
+          <url>https://repo.maven.apache.org/maven2</url>
+          <layout>default</layout>
+          <releases>
+            <enabled>false</enabled>
+          </releases>
+          <snapshots>
+            <enabled>false</enabled>
+          </snapshots>
+        </repository>
+        <repository>
+          <id>rso-public-grid</id>
+          <!-- Disable default sonatype public grid -->
+          <name>Maven Central Sonatype repository</name>
+          <url>https://repository.sonatype.org/content/groups/sonatype-public-grid</url>
+          <layout>default</layout>
+          <releases>
+            <enabled>false</enabled>
+          </releases>
+          <snapshots>
+            <enabled>false</enabled>
+          </snapshots>
+        </repository>
+      </repositories>
+    </profile>
+  </profiles>
 </project>