From 0a68ac20a535b8e6a1526fbe4ef3d6ea136a308e Mon Sep 17 00:00:00 2001
From: micronaut-build <65172877+micronaut-build@users.noreply.github.com>
Date: Thu, 9 Jan 2025 10:42:50 +0100
Subject: [PATCH] Sonatype Scan Gradle Plugin (#562)

https://github.com/sonatype-nexus-community/scan-gradle-plugin
---
 .github/renovate.json                         | 22 +++++++++++++------
 .github/workflows/gradle.yml                  |  7 ++++++
 .github/workflows/release.yml                 |  2 +-
 buildSrc/build.gradle                         |  1 +
 ...build.internal.elasticsearch-module.gradle | 11 ++++++++++
 gradle/libs.versions.toml                     |  2 ++
 6 files changed, 37 insertions(+), 8 deletions(-)

diff --git a/.github/renovate.json b/.github/renovate.json
index 09c2a598..99eeec10 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -1,24 +1,32 @@
 {
   "extends": [
-    "config:base"
+    "config:recommended"
+  ],
+  "addLabels": [
+    "type: dependency-upgrade"
   ],
-  "addLabels": ["type: dependency-upgrade"],
   "schedule": [
-    "after 10pm every day"
+    "after 10pm"
   ],
   "prHourlyLimit": 1,
   "prConcurrentLimit": 20,
   "timezone": "Europe/Prague",
   "packageRules": [
     {
-      "matchPackagePatterns": ["actions.*"],
       "dependencyDashboardApproval": true,
-      "matchUpdateTypes": ["patch"],
+      "matchUpdateTypes": [
+        "patch"
+      ],
       "matchCurrentVersion": "!/^0/",
-      "automerge": true
+      "automerge": true,
+      "matchPackageNames": [
+        "/actions.*/"
+      ]
     },
     {
-      "matchUpdateTypes": ["patch"],
+      "matchUpdateTypes": [
+        "patch"
+      ],
       "matchCurrentVersion": "!/^0/",
       "automerge": true
     }
diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
index 571e79a2..32d879ad 100644
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -30,6 +30,8 @@ jobs:
       PREDICTIVE_TEST_SELECTION: "${{ github.event_name == 'pull_request' && 'true' || 'false' }}"
       SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      OSS_INDEX_USERNAME: ${{ secrets.OSS_INDEX_USERNAME }}
+      OSS_INDEX_PASSWORD: ${{ secrets.OSS_INDEX_PASSWORD }}
     steps:
        # https://github.com/actions/virtual-environments/issues/709
       - name: "🗑 Free disk space"
@@ -58,6 +60,11 @@ jobs:
         run: |
           [ -f ./setup.sh ] && ./setup.sh || [ ! -f ./setup.sh ]
 
+      - name: "🚔 Sonatype Scan"
+        id: sonatypescan
+        run: |
+          ./gradlew ossIndexAudit --no-parallel --info
+
       - name: "🛠 Build with Gradle"
         id: gradle
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2762f3e2..d760186c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -160,6 +160,6 @@ jobs:
       - name: Upload assets
         # Upload the artifacts to the existing release. Note that the SLSA provenance will
         # attest to each artifact file and not the aggregated ZIP file.
-        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
+        uses: softprops/action-gh-release@7b4da11513bf3f43f9999e90eabced41ab8bb048 # v2.2.0
         with:
           files: artifacts.zip
diff --git a/buildSrc/build.gradle b/buildSrc/build.gradle
index 21e3c454..2fdd54a0 100644
--- a/buildSrc/build.gradle
+++ b/buildSrc/build.gradle
@@ -9,4 +9,5 @@ repositories {
 
 dependencies {
     implementation libs.gradle.micronaut
+    implementation(libs.sonatype.scan)
 }
diff --git a/buildSrc/src/main/groovy/io.micronaut.build.internal.elasticsearch-module.gradle b/buildSrc/src/main/groovy/io.micronaut.build.internal.elasticsearch-module.gradle
index 1615bb52..8e9320da 100644
--- a/buildSrc/src/main/groovy/io.micronaut.build.internal.elasticsearch-module.gradle
+++ b/buildSrc/src/main/groovy/io.micronaut.build.internal.elasticsearch-module.gradle
@@ -1,4 +1,15 @@
 plugins {
     id "io.micronaut.build.internal.elasticsearch-base"
     id "io.micronaut.build.internal.module"
+    id("org.sonatype.gradle.plugins.scan")
+}
+String ossIndexUsername = System.getenv("OSS_INDEX_USERNAME") ?: project.properties["ossIndexUsername"]
+String ossIndexPassword = System.getenv("OSS_INDEX_PASSWORD") ?: project.properties["ossIndexPassword"]
+boolean sonatypePluginConfigured = ossIndexUsername != null && ossIndexPassword != null
+if (sonatypePluginConfigured) {
+    ossIndexAudit {
+        username = ossIndexUsername
+        password = ossIndexPassword
+        excludeCompileOnly = true
+    }
 }
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 4f86df59..6af62d0e 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -15,6 +15,7 @@ spock = "2.3-groovy-4.0"
 awaitility = "4.2.2"
 apache-http-client = "4.5.14"
 apache-http-async-client = "4.1.5"
+sonatype-scan = "3.0.0"
 
 [libraries]
 # Core
@@ -31,3 +32,4 @@ graal-svm = { module = "org.graalvm.nativeimage:svm", version.ref = "graal-svm"
 
 awaitility = { module = "org.awaitility:awaitility", version.ref = "awaitility" }
 gradle-micronaut = { module = "io.micronaut.gradle:micronaut-gradle-plugin", version.ref = "micronaut-gradle-plugin" }
+sonatype-scan = { module = "org.sonatype.gradle.plugins:scan-gradle-plugin", version.ref = "sonatype-scan" }