bump cds and spring-boot versions

.github/workflows/ci.yml

@@ -1,7 +1,7 @@
 name: CI
 
 env:
-  MAVEN_VERSION: '3.6.3'
+  MAVEN_VERSION: '3.9.9'
   # Cloud storage environment variables (available to all jobs that need them)
   AWS_S3_HOST: ${{ secrets.AWS_S3_HOST }}
   AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
@@ -15,7 +15,6 @@ env:
   GS_PROJECT_ID: ${{ secrets.GS_PROJECT_ID }}
   # Tokens
   SONARQ_TOKEN: ${{ secrets.SONARQ_TOKEN }}
-  GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
   BLACK_DUCK_TOKEN: ${{ secrets.BLACK_DUCK_TOKEN }}
   # Other
   DEPLOYMENT_USER: ${{ secrets.DEPLOYMENT_USER }}
@@ -42,67 +41,209 @@ jobs:
     name: Build
     needs: requires-approval
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        java-version: [ 17, 21 ]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
+
+      - name: Set up Java 17
+        uses: actions/setup-java@v4
+        with:
+          java-version: 17
+          distribution: sapmachine
+          cache: maven
+
+      - name: Set up Maven ${{ env.MAVEN_VERSION }}
+        uses: stCarolas/setup-maven@v5
+        with:
+          maven-version: ${{ env.MAVEN_VERSION }}
 
       - name: Spotless check
         run: mvn spotless:check -Dspotless.check.skip=false
 
-      - name: Build
-        uses: ./.github/actions/build
+  # Build once with Java 17, upload artifacts
+  build:
+    name: Build & Mutation Testing
+    runs-on: ubuntu-latest
+    needs: quality-checks
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Java 17
+        uses: actions/setup-java@v4
+        with:
+          java-version: 17
+          distribution: sapmachine
+          cache: maven
+
+      - name: Set up Maven ${{ env.MAVEN_VERSION }}
+        uses: stCarolas/setup-maven@v5
+        with:
+          maven-version: ${{ env.MAVEN_VERSION }}
+
+      - name: Build and install artifacts (skip tests)
+        run: |
+          mvn clean install -DskipTests \
+            -pl cds-feature-attachments,storage-targets/cds-feature-attachments-fs,storage-targets/cds-feature-attachments-oss \
+            -am
+
+      - name: Mutation Testing
+        run: mvn org.pitest:pitest-maven:mutationCoverage -f cds-feature-attachments/pom.xml
+
+      - name: Upload Maven local repository artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: maven-repository
+          path: ~/.m2/repository/com/sap/cds/
+          retention-days: 1
+
+      - name: Upload build targets
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-targets
+          path: |
+            cds-feature-attachments/target/
+            storage-targets/cds-feature-attachments-fs/target/
+            storage-targets/cds-feature-attachments-oss/target/
+          retention-days: 1
+
+  # Test with Java 17 and 21
+  test-java-versions:
+    name: Test Java ${{ matrix.java-version }}
+    runs-on: ubuntu-latest
+    needs: build
+    strategy:
+      matrix:
+        java-version: [ 17, 21 ]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Java ${{ matrix.java-version }}
+        uses: actions/setup-java@v4
         with:
           java-version: ${{ matrix.java-version }}
+          distribution: sapmachine
+          cache: maven
+
+      - name: Set up Maven ${{ env.MAVEN_VERSION }}
+        uses: stCarolas/setup-maven@v5
+        with:
           maven-version: ${{ env.MAVEN_VERSION }}
 
-  integration-tests:
-    name: Integration Tests (Java ${{ matrix.java-version }})
+      - name: Download Maven repository
+        uses: actions/download-artifact@v4
+        with:
+          name: maven-repository
+          path: ~/.m2/repository/com/sap/cds/
+
+      - name: Run tests
+        run: mvn test -ntp -B -pl cds-feature-attachments,storage-targets/cds-feature-attachments-fs,storage-targets/cds-feature-attachments-oss
+
+  # Integration tests with current CAP version (Java 17 & 21)
+  integration-tests-current:
+    name: Integration Tests - CAP (Java ${{ matrix.java-version }})
     runs-on: ubuntu-latest
     needs: build
     strategy:
       matrix:
         java-version: [ 17, 21 ]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
-      - name: Integration Tests
-        uses: ./.github/actions/integration-tests
+        uses: actions/checkout@v4
+
+      - name: Set up Java ${{ matrix.java-version }}
+        uses: actions/setup-java@v4
         with:
           java-version: ${{ matrix.java-version }}
+          distribution: sapmachine
+          cache: maven
+
+      - name: Set up Maven ${{ env.MAVEN_VERSION }}
+        uses: stCarolas/setup-maven@v5
+        with:
+          maven-version: ${{ env.MAVEN_VERSION }}
+
+      - name: Download Maven repository
+        uses: actions/download-artifact@v4
+        with:
+          name: maven-repository
+          path: ~/.m2/repository/com/sap/cds/
+
+      - name: Integration Tests with current CAP Java version
+        run: mvn verify -ntp -B -P integration-tests-current
+
+  # Integration tests for Object Store Service (Java 17 only)
+  integration-tests-oss:
+    name: Integration Tests - OSS (Java 17)
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Java 17
+        uses: actions/setup-java@v4
+        with:
+          java-version: 17
+          distribution: sapmachine
+          cache: maven
+
+      - name: Set up Maven ${{ env.MAVEN_VERSION }}
+        uses: stCarolas/setup-maven@v5
+        with:
           maven-version: ${{ env.MAVEN_VERSION }}
 
+      - name: Download Maven repository
+        uses: actions/download-artifact@v4
+        with:
+          name: maven-repository
+          path: ~/.m2/repository/com/sap/cds/
+
+      - name: Integration Tests for Object Store Service
+        run: mvn verify -ntp -B -P integration-tests-oss
+
   sonarqube-scan:
     name: SonarQube Scan
     runs-on: ubuntu-latest
-    needs: build
+    needs: [build]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
+
+      - name: Download Maven repository
+        uses: actions/download-artifact@v4
+        with:
+          name: maven-repository
+          path: ~/.m2/repository/com/sap/cds/
+
+      - name: Download build targets
+        uses: actions/download-artifact@v4
+        with:
+          name: build-targets
+
       - name: SonarQube Scan
         uses: ./.github/actions/scan-with-sonar
         with:
           java-version: 17
           maven-version: ${{ env.MAVEN_VERSION }}
           sonarq-token: ${{ env.SONARQ_TOKEN }}
-          github-token: ${{ env.GITHUB_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
   scan:
     name: Blackduck Scan
     runs-on: ubuntu-latest
-    needs: build
+    needs: [build]
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
       - name: Scan
         uses: ./.github/actions/scan-with-blackduck
         with:
           blackduck_token: ${{ env.BLACK_DUCK_TOKEN }}
-          github_token: ${{ env.GITHUB_TOKEN }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
           maven-version: ${{ env.MAVEN_VERSION }}
 
   deploy-snapshot:

.github/workflows/main-build-and-deploy-oss.yml

@@ -2,7 +2,7 @@ name: Deploy to Maven Central
 
 env:
   JAVA_VERSION: '17'
-  MAVEN_VERSION: '3.6.3'
+  MAVEN_VERSION: '3.9.9'
 
 on:
   release:
@@ -15,7 +15,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
 
       - name: Scan With Black Duck
         uses: ./.github/actions/scan-with-blackduck
@@ -29,9 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          token: ${{ secrets.GH_TOKEN }}
+        uses: actions/checkout@v4
 
       - name: Update version
         uses: ./.github/actions/newrelease

.mvn/maven.config

@@ -0,0 +1,16 @@
+# Maven configuration for consistent behavior across local and CI environments
+# This file is automatically applied to all Maven commands
+
+# Batch mode: Run in non-interactive mode
+-B
+
+# Suppress transfer progress
+-ntp
+
+# Use UTF-8 encoding
+-Dproject.build.sourceEncoding=UTF-8
+-Dproject.reporting.outputEncoding=UTF-8
+
+# Enable Spotless formatting checks by default
+# Developers can skip with: mvn -Dspotless.check.skip=true ...
+-Dspotless.check.skip=false

.pipeline/config.yml

@@ -17,12 +17,14 @@ steps:
     versioningModel: "major-minor"
     detectTools: [ 'DETECTOR', 'BINARY_SCAN' ]
     installArtifacts: true
+    installArtifactsExcludes:
+      - samples/**
     repository: '/cap-java/cds-feature-attachments'
     verbose: true
     scanProperties:
       - --detect.included.detector.types=MAVEN
-      - --detect.excluded.directories='**/node_modules,**/*test*,**/localrepo,**/target/site,**/*-site.jar'
-      - --detect.maven.excluded.modules=integration-tests,integration-tests/db,integration-tests/srv
+      - --detect.excluded.directories='**/node_modules,**/*test*,**/localrepo,**/target/site,**/*-site.jar,**/samples'
+      - --detect.maven.excluded.modules=integration-tests,integration-tests/db,integration-tests/srv,samples/bookshop,samples/bookshop/srv
       - --detect.maven.build.command='-pl com.sap.cds:cds-feature-attachments'
     # https://www.project-piper.io/steps/detectExecuteScan/#dockerimage
     # If empty, Docker is not used and the command is executed directly on the Jenkins system.

README.md

@@ -1,4 +1,4 @@
-[![Java Build with Maven](https://github.com/cap-java/cds-feature-attachments/actions/workflows/main-build.yml/badge.svg)](https://github.com/cap-java/cds-feature-attachments/actions/workflows/main-build.yml) [![Deploy new Version with Maven](https://github.com/cap-java/cds-feature-attachments/actions/workflows/main-build.yml/badge.svg?branch=main)](https://github.com/cap-java/cds-feature-attachments/actions/workflows/main-build.yml) [![REUSE status](https://api.reuse.software/badge/github.com/cap-java/cds-feature-attachments)](https://api.reuse.software/info/github.com/cap-java/cds-feature-attachments)
+[![CI](https://github.com/cap-java/cds-feature-attachments/actions/workflows/ci.yml/badge.svg)](https://github.com/cap-java/cds-feature-attachments/actions/workflows/ci.yml) [![Deploy to Maven Central](https://github.com/cap-java/cds-feature-attachments/actions/workflows/main-build-and-deploy-oss.yml/badge.svg)](https://github.com/cap-java/cds-feature-attachments/actions/workflows/main-build-and-deploy-oss.yml) [![REUSE status](https://api.reuse.software/badge/github.com/cap-java/cds-feature-attachments)](https://api.reuse.software/info/github.com/cap-java/cds-feature-attachments)
 
 # Attachments Plugin for SAP Cloud Application Programming Model (CAP)
 
@@ -12,28 +12,30 @@ It supports the [AWS, Azure, and Google object stores](storage-targets/cds-featu
 
 <!-- TOC -->
 
-* [Quick Start](#quick-start)
-* [Usage](#usage)
-  * [MVN Setup](#mvn-setup)
-  * [Changes in the CDS Models and for the UI](#changes-in-the-cds-models-and-for-the-UI)
-  * [Try the Bookshop Sample](#try-the-bookshop-sample)
-  * [Storage Targets](#storage-targets)
-  * [Malware Scanner](#malware-scanner)
-  * [Outbox](#outbox)
-  * [Restore Endpoint](#restore-endpoint)
-    * [Motivation](#motivation)
-    * [HTTP Endpoint](#http-endpoint)
-    * [Security](#security)
-* [Releases: Maven Central and Artifactory](#releases-maven-central-and-artifactory)
-* [Minimum UI5 and CAP Java Version](#minimum-ui5-and-cap-java-version)
-* [Architecture Overview](#architecture-overview)
-  * [Design](#design)
-  * [Multitenancy](#multitenancy)
-  * [Object Stores](#object-stores)
-  * [Model Texts](#model-texts)
-* [Monitoring \& Logging](#monitoring--logging)
-* [Support, Feedback, Contributing](#support-feedback-contributing)
-* [References \& Links](#references--links)
+- [Attachments Plugin for SAP Cloud Application Programming Model (CAP)](#attachments-plugin-for-sap-cloud-application-programming-model-cap)
+  - [Table of Contents](#table-of-contents)
+  - [Quick Start](#quick-start)
+  - [Usage](#usage)
+    - [MVN Setup](#mvn-setup)
+    - [Changes in the CDS Models and for the UI](#changes-in-the-cds-models-and-for-the-ui)
+    - [Try the Bookshop Sample](#try-the-bookshop-sample)
+    - [Storage Targets](#storage-targets)
+    - [Malware Scanner](#malware-scanner)
+    - [Outbox](#outbox)
+    - [Restore Endpoint](#restore-endpoint)
+      - [Motivation](#motivation)
+      - [HTTP Endpoint](#http-endpoint)
+      - [Security](#security)
+  - [Releases: Maven Central and Artifactory](#releases-maven-central-and-artifactory)
+  - [Minimum UI5 and CAP Java Version](#minimum-ui5-and-cap-java-version)
+  - [Architecture Overview](#architecture-overview)
+    - [Design](#design)
+    - [Multitenancy](#multitenancy)
+    - [Object Stores](#object-stores)
+    - [Model Texts](#model-texts)
+  - [Monitoring \& Logging](#monitoring--logging)
+  - [Support, Feedback, Contributing](#support-feedback-contributing)
+  - [References \& Links](#references--links)
 
 ## Quick Start