Merge remote-tracking branch 'origin/main' into jetty-12.1-no-servlets

Author: lachlan-roberts

.github/.release-please-manifest.json

@@ -1 +1 @@
-{"functions-framework-api":"1.1.4","invoker":"1.4.1","function-maven-plugin":"0.11.1"}
+{"functions-framework-api":"1.1.4","invoker":"1.4.3","function-maven-plugin":"0.11.2"}

.github/workflows/buildpack-integration-test.yml

@@ -14,16 +14,16 @@ on:
 permissions: read-all
 
 jobs:
-  java11-buildpack-test:
+  java21-buildpack-test:
     uses: GoogleCloudPlatform/functions-framework-conformance/.github/workflows/buildpack-integration-test.yml@main
     with:
       http-builder-source: '/tmp/tests/conformance'
       http-builder-target: 'com.google.cloud.functions.conformance.HttpConformanceFunction'
       cloudevent-builder-source: '/tmp/tests/conformance'
       cloudevent-builder-target: 'com.google.cloud.functions.conformance.CloudEventsConformanceFunction'
       prerun: 'invoker/conformance/prerun.sh'
-      builder-runtime: 'java11'
-      builder-runtime-version: '11'
+      builder-runtime: 'java21'
+      builder-runtime-version: '21'
       builder-url: gcr.io/serverless-runtimes/google-22-full/builder/java:latest
   java17-buildpack-test:
     uses: GoogleCloudPlatform/functions-framework-conformance/.github/workflows/buildpack-integration-test.yml@main

.github/workflows/codeql.yml

@@ -14,21 +14,21 @@ jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
-    
+
     permissions:
       actions: read
       contents: read
       security-events: write
 
     strategy:
       fail-fast: false
-      matrix: 
+      matrix:
         # Autobuild each of these seperate maven projects
         working-directory: ['invoker', 'functions-framework-api', 'function-maven-plugin']
 
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
       with:
         disable-sudo: true
         egress-policy: block
@@ -37,16 +37,17 @@ jobs:
           github.com:443
           objects.githubusercontent.com:443
           proxy.golang.org:443
+          release-assets.githubusercontent.com:443
           repo.maven.apache.org:443
           storage.googleapis.com:443
           uploads.github.com:443
-          
+
     - name: Checkout repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
+      uses: github/codeql-action/init@64d10c13136e1c5bce3e5fbde8d4906eeaafc885 # v3.30.6
       with:
         # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
         languages: java
@@ -57,15 +58,13 @@ jobs:
         # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
         # queries: security-extended,security-and-quality
 
-
-    
     - name: Build
       run: |
         (cd functions-framework-api/ && mvn install)
         (cd invoker/ && mvn clean install)
         (cd function-maven-plugin && mvn install)
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
+      uses: github/codeql-action/analyze@64d10c13136e1c5bce3e5fbde8d4906eeaafc885 # v3.30.6
       with:
         category: ${{ matrix.working-directory }}

.github/workflows/conformance.yaml

@@ -14,11 +14,12 @@ jobs:
     strategy:
       matrix:
         java: [
-          11.x,
+          17.x,
+          21.x
         ]
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
       with:
         disable-sudo: true
         egress-policy: block
@@ -27,21 +28,22 @@ jobs:
           github.com:443
           objects.githubusercontent.com:443
           proxy.golang.org:443
+          release-assets.githubusercontent.com:443
           repo.maven.apache.org:443
           storage.googleapis.com:443
 
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
     - name: Set up JDK ${{ matrix.java }}
-      uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
+      uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
       with:
         java-version: ${{ matrix.java }}
         distribution: temurin
 
     - name: Setup Go
-      uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+      uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
       with:
-        go-version: '1.21'
+        go-version: '1.25'
 
     - name: Build API with Maven
       run: (cd functions-framework-api/ && mvn install)
@@ -53,15 +55,15 @@ jobs:
       run: (cd function-maven-plugin/ && mvn install)
 
     - name: Run HTTP conformance tests
-      uses: GoogleCloudPlatform/functions-framework-conformance/action@1041a97e93a463d9efb17dda821f3ddc0bf0024f # main
+      uses: GoogleCloudPlatform/functions-framework-conformance/action@6ae50bd9db5ed980c5ceff3cf7b200f705be94fc # main
       with:
         functionType: 'http'
         useBuildpacks: false
         cmd: "'mvn -f invoker/conformance/pom.xml function:run -Drun.functionTarget=com.google.cloud.functions.conformance.HttpConformanceFunction'"
         startDelay: 10
 
     - name: Run Typed conformance tests
-      uses: GoogleCloudPlatform/functions-framework-conformance/action@1041a97e93a463d9efb17dda821f3ddc0bf0024f # main
+      uses: GoogleCloudPlatform/functions-framework-conformance/action@6ae50bd9db5ed980c5ceff3cf7b200f705be94fc # main
       with:
         functionType: 'http'
         declarativeType: 'typed'
@@ -70,7 +72,7 @@ jobs:
         startDelay: 10
 
     - name: Run background event conformance tests
-      uses: GoogleCloudPlatform/functions-framework-conformance/action@1041a97e93a463d9efb17dda821f3ddc0bf0024f # main
+      uses: GoogleCloudPlatform/functions-framework-conformance/action@6ae50bd9db5ed980c5ceff3cf7b200f705be94fc # main
       with:
         functionType: 'legacyevent'
         useBuildpacks: false
@@ -79,7 +81,7 @@ jobs:
         startDelay: 10
 
     - name: Run cloudevent conformance tests
-      uses: GoogleCloudPlatform/functions-framework-conformance/action@1041a97e93a463d9efb17dda821f3ddc0bf0024f # main
+      uses: GoogleCloudPlatform/functions-framework-conformance/action@6ae50bd9db5ed980c5ceff3cf7b200f705be94fc # main
       with:
         functionType: 'cloudevent'
         useBuildpacks: false
@@ -88,10 +90,10 @@ jobs:
         startDelay: 10
 
     - name: Run HTTP concurrency conformance tests
-      uses: GoogleCloudPlatform/functions-framework-conformance/action@1041a97e93a463d9efb17dda821f3ddc0bf0024f # main
+      uses: GoogleCloudPlatform/functions-framework-conformance/action@6ae50bd9db5ed980c5ceff3cf7b200f705be94fc # main
       with:
         functionType: 'http'
         useBuildpacks: false
         validateConcurrency: true
         cmd: "'mvn -f invoker/conformance/pom.xml function:run -Drun.functionTarget=com.google.cloud.functions.conformance.ConcurrentHttpConformanceFunction'"
-        startDelay: 10
+        startDelay: 10

.github/workflows/lint.yaml

@@ -13,18 +13,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
       with:
         disable-sudo: true
         egress-policy: block
         allowed-endpoints: >
           github.com:443
           repo.maven.apache.org:443
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - name: Set up JDK
-      uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
+      uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
       with:
-        java-version: 11.x
+        java-version: 17.x
         distribution: temurin
     - name: Build API with Maven
       run: (cd functions-framework-api/ && mvn install)
@@ -38,15 +38,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 # v2 minimum required
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 # v2 minimum required
       - name: Set up JDK
-        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17.x
+          java-version: 21.x
           distribution: temurin
       - name: Run formatter
         id: formatter

.github/workflows/scorecard.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
         with:
           disable-sudo: true
           egress-policy: block
@@ -43,14 +43,14 @@ jobs:
             www.bestpractices.dev:443
             *.sigstore.dev:443
             *.github.com:443
-          
+
       - name: "Checkout code"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif
@@ -62,6 +62,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
+        uses: github/codeql-action/upload-sarif@64d10c13136e1c5bce3e5fbde8d4906eeaafc885 # v3.30.6
         with:
           sarif_file: results.sarif

.github/workflows/unit.yaml

@@ -13,13 +13,12 @@ jobs:
     strategy:
       matrix:
         java: [
-          11.x,
           17.x,
-          21-ea
+          21.x
         ]
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
       with:
         disable-sudo: true
         egress-policy: block
@@ -28,13 +27,13 @@ jobs:
           repo.maven.apache.org:443
           api.adoptium.net:443
           *.githubusercontent.com:443
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - name: Set up JDK ${{ matrix.java }}
-      uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
+      uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
       with:
         java-version: ${{ matrix.java }}
         distribution: temurin
     - name: Build with Maven
       run: (cd functions-framework-api/ && mvn install)
     - name: Test
-      run: (cd invoker/ && mvn test)
+      run: (cd invoker/ && mvn test)

.kokoro/release.cfg

@@ -6,6 +6,14 @@ before_action {
       keystore_config_id: 75669
       keyname: "functions-framework-java-release-bot-sonatype-password"
     }
+    keystore_resource {
+      keystore_config_id: 75669
+      keyname: "functions-framework-release-sonatype-central-portal-username"
+    }
+    keystore_resource {
+      keystore_config_id: 75669
+      keyname: "functions-framework-release-sonatype-central-portal-password"
+    }
     keystore_resource {
       keystore_config_id: 70247
       keyname: "maven-gpg-pubkeyring"

.kokoro/release.sh

@@ -3,21 +3,19 @@
 # Stop execution when any command fails.
 set -e
 
-# update the Maven version to 3.6.3
+# update the Maven version to 3.9.11
 pushd /usr/local
-wget https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.6.3/apache-maven-3.6.3-bin.tar.gz
-tar -xvzf apache-maven-3.6.3-bin.tar.gz apache-maven-3.6.3
+wget https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.11/apache-maven-3.9.11-bin.tar.gz
+tar -xvzf apache-maven-3.9.11-bin.tar.gz apache-maven-3.9.11
 rm -f /usr/local/apache-maven
-ln -s /usr/local/apache-maven-3.6.3 /usr/local/apache-maven
-rm apache-maven-3.6.3-bin.tar.gz
+ln -s /usr/local/apache-maven-3.9.11 /usr/local/apache-maven
+rm apache-maven-3.9.11-bin.tar.gz
 popd
 
 
 # Get secrets from keystore and set and environment variables.
 setup_environment_secrets() {
   export GPG_TTY=$(tty)
-  export SONATYPE_USERNAME=$(cat ${KOKORO_KEYSTORE_DIR}/75669_functions-framework-java-release-bot-sonatype-password | cut -f1 -d':')
-  export SONATYPE_PASSWORD=$(cat ${KOKORO_KEYSTORE_DIR}/75669_functions-framework-java-release-bot-sonatype-password | cut -f2 -d':')
   export GPG_PASSPHRASE=$(cat ${KOKORO_KEYSTORE_DIR}/70247_maven-gpg-passphrase)
 
   # Add the key ring files to $GNUPGHOME to verify the GPG credentials.
@@ -42,14 +40,9 @@ create_settings_xml_file() {
   </profiles>
   <servers>
     <server>
-      <id>sonatype-nexus-staging</id>
-      <username>${SONATYPE_USERNAME}</username>
-      <password>${SONATYPE_PASSWORD}</password>
-    </server>
-    <server>
-      <id>sonatype-nexus-snapshots</id>
-      <username>${SONATYPE_USERNAME}</username>
-      <password>${SONATYPE_PASSWORD}</password>
+      <id>sonatype-central-portal</id>
+      <username>$(cat "${KOKORO_KEYSTORE_DIR}/75669_functions-framework-release-sonatype-central-portal-username")</username>
+      <password>$(cat "${KOKORO_KEYSTORE_DIR}/75669_functions-framework-release-sonatype-central-portal-password")</password>
     </server>
   </servers>
 </settings>" > $1
@@ -70,10 +63,15 @@ else
 fi
 echo "pwd=$(pwd)"
 
-# Make sure `JAVA_HOME` is set and using jdk11.
-export JAVA_HOME=/usr/lib/jvm/java-1.11.0-openjdk-amd64
+# Make sure `JAVA_HOME` is set and using jdk17.
+JDK_VERSION=17
+apt-get update
+# Install new JDK version
+apt-get install -y openjdk-"${JDK_VERSION}"-jdk
+export JAVA_HOME="$(update-java-alternatives -l | grep "1.${JDK_VERSION}" | head -n 1 | tr -s " " | cut -d " " -f 3)"
 echo "JAVA_HOME=$JAVA_HOME"
-mvn clean deploy -B \
+
+mvn clean deploy -B -q \
   -P sonatype-oss-release \
   --settings=../settings.xml \
   -Dgpg.executable=gpg \

CONTRIBUTING.md

@@ -38,15 +38,15 @@ This project is divided into multiple packages, primarily:
   - `function-maven-plugin` - The Maven plugin for building functions
   - `conformance` - A set of functions used for conformance testing
 
-### Setup JDK 11 / 17
+### Setup JDK 17 / 21
 
-Install JDK 11 and 17. One way to install these is through [SDK man](https://sdkman.io/).
+Install JDK 17 and 21. One way to install these is through [SDK man](https://sdkman.io/).
 
 ```sh
-sdk install java 11.0.2-open
 sdk install java 17-open
+sdk install java 21-open
 sdk use java 17-open
-sdk use java 11.0.2-open
+sdk use java 21-open
 ```
 
 Verify Java version with: