SONARJAVA-5850 Migrate Windows Build from Cirrus to GitHub action (#5346)

Author: tomasz-tylenda-sonarsource

.cirrus.yml

@@ -89,6 +89,32 @@ build_task:
     - regular_mvn_build_deploy_analyze -Dmaven.test.skip=true -Dsonar.skip=true -pl '!java-checks-test-sources/default,!java-checks-test-sources/aws,!java-checks-test-sources/spring-web-4.0'
   cleanup_before_cache_script: cleanup_maven_repository
 
+sonar_shadow_scan_and_issue_replication_task:
+  <<: *COMMON_BUILD_DEFINITION
+  depends_on:
+    - build
+  # Only run when triggered by the cirrus-ci cron job named "nightly"
+  only_if: $CIRRUS_CRON == "nightly"
+  env:
+    SONAR_PROJECT_KEY: "org.sonarsource.java:java"
+    SHADOW_ORGANIZATION: "sonarsource"
+    SHADOW_PROJECT_KEY: "SonarSource_sonar-java"
+    # to replicate issue states from next
+    SONAR_TOKEN: VAULT[development/kv/data/next data.token]
+    SONAR_HOST_URL: https://next.sonarqube.com/sonarqube
+    matrix:
+      - name: "sonarcloud.io"
+        SHADOW_SONAR_TOKEN: VAULT[development/kv/data/sonarcloud data.token]
+        SHADOW_SONAR_HOST_URL: "https://sonarcloud.io"
+      - name: "sonarqube.us"
+        SHADOW_SONAR_TOKEN: VAULT[development/kv/data/sonarqube-us data.token]
+        SHADOW_SONAR_HOST_URL: "https://sonarqube.us"
+  build_and_shadow_scan_script:
+    - *log_develocity_url_script
+    - source cirrus-env BUILD
+    - ./shadow-scan-and-issue-replication.sh -Dsonar.analysisCache.enabled=true -Dsonar.sca.exclusions="**/test/files/**, **/test/resources/**, its/plugin/projects/**, java-checks-test-sources/**, its/sources/**,"
+  cleanup_before_cache_script: cleanup_maven_repository
+
 # Migrated to GHA.
 test_analyze_task:
   <<: *COMMON_BUILD_DEFINITION
@@ -103,28 +129,7 @@ test_analyze_task:
     - ./check-license-compliance.sh
   cleanup_before_cache_script: cleanup_maven_repository
 
-ws_scan_task:
-  <<: *ONLY_SONARSOURCE_QA
-  eks_container:
-    <<: *CONTAINER_WITH_DOCKER_DEFINITION
-    cpu: 4
-    memory: 4G
-  # run only on master and long-term branches
-  only_if: $CIRRUS_USER_COLLABORATOR == 'true' && ($CIRRUS_BRANCH == "master" || $CIRRUS_BRANCH =~ "branch-.*" || $CIRRUS_BRANCH =~ "mend-.*")
-  env:
-    WS_APIKEY: VAULT[development/kv/data/mend data.apikey]
-  maven_cache:
-    folder: ${CIRRUS_WORKING_DIR}/.m2/repository
-  whitesource_script:
-    - source cirrus-env QA
-    - source set_maven_build_version $BUILD_NUMBER
-    - mvn clean install --batch-mode -Dmaven.test.skip=true -pl '!java-checks-test-sources,!java-checks-test-sources/default,!java-checks-test-sources/aws,!java-checks-test-sources/spring-3.2,!java-checks-test-sources/spring-web-4.0'
-    - source ws_scan.sh
-  allow_failures: "true"
-  always:
-    ws_artifacts:
-      path: "whitesource/**/*"
-
+# Migrated to GHA.
 qa_os_win_task:
   ec2_instance:
     image: base-windows-jdk21-v*
@@ -288,13 +293,13 @@ autoscan_task:
 promote_task:
   depends_on:
     - build
+    - sonar_shadow_scan_and_issue_replication
     - test_analyze
     - qa_os_win
     - sanity
     - ruling
     - ruling_win
     - plugin_qa
-    - ws_scan
     - autoscan
   <<: *ONLY_SONARSOURCE_QA
   eks_container:

.github/workflows/build.yml

@@ -271,3 +271,42 @@ jobs:
           -Dmaven.test.redirectTestOutputToFile=false
           -Dparallel=methods
           -DuseUnlimitedThreads=true
+
+  qa-os-win:
+    name: Build and Unit Test on Windows
+    # No dependency on build step, because we do not need the build number.
+    runs-on: github-windows-latest-m
+    permissions:
+      id-token: write  # Required for Vault OIDC authentication
+      contents: write  # Required for repository access and tagging
+    steps:
+      - name: Config Git
+        run: git config --global core.autocrlf input
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
+        with:
+          version: 2025.7.12
+      - name: Run Maven
+        run: mvn clean verify --batch-mode
+
+  promote:
+    needs:
+      - build
+      - ruling-qa
+      - plugin-qa
+      - sanity
+      - test-analyze
+      - autoscan
+      - qa-os-win
+    if: ${{ needs.build.outputs.deployed }}
+    runs-on: github-ubuntu-latest-s  # Public repo uses custom GitHub-hosted runners
+    name: Promote
+    permissions:
+      id-token: write
+      contents: write
+    env:
+      BUILD_NUMBER: ${{ needs.build.outputs.build-number }}
+    steps:
+      - uses: SonarSource/ci-github-actions/promote@v1
+        with:
+          promote-pull-request: true

java-checks-test-sources/pom.xml

@@ -43,8 +43,7 @@
               <fileSeparator>/</fileSeparator>
               <pathSeparator>:${line.separator}</pathSeparator>
               <includeScope>test</includeScope>
-              <!-- $$ to not evaluate M2_REPO now, this will become ${M2_REPO} in the output file -->
-              <localRepoProperty>$${M2_REPO}</localRepoProperty>
+              <localRepoProperty>M2_REPO</localRepoProperty>
               <outputEncoding>UTF-8</outputEncoding>
               <outputFile>${project.build.directory}/test-classpath.txt</outputFile>
             </configuration>

java-checks-test-sources/test-classpath-reader/src/main/java/org/sonar/java/test/classpath/TestClasspathUtils.java

@@ -158,11 +158,12 @@ public static List<File> loadFromFile(String classpathTextFilePath) {
     String mavenRepository = findMavenLocalRepository(System::getenv, System::getProperty);
     try {
       String content = Files.readString(toPath(classpathTextFilePath), UTF_8);
-      Arrays.stream(content.split(":"))
+      // Split on ":", but not when it follows Windows drive letter (e.g. "C:\").
+      Arrays.stream(content.split("(?<![A-Z]):"))
         .map(String::trim)
         .filter(line -> !line.isBlank())
         .map(TestClasspathUtils::fixSeparator)
-        .map(line -> line.replace("${M2_REPO}", mavenRepository))
+        .map(line -> line.replace("M2_REPO", mavenRepository))
         .map(Paths::get)
         .forEach(dependencyPath -> {
           if (!Files.exists(dependencyPath)) {

java-checks-test-sources/test-classpath-reader/src/test/resources/classpath-example.txt

@@ -1,2 +1,2 @@
-${M2_REPO}/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar:
+M2_REPO/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar:
 

java-checks-test-sources/test-classpath-reader/src/test/resources/invalid-classpath-example.txt

@@ -1,2 +1,2 @@
-${M2_REPO}/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar:
-${M2_REPO}/org/bad/luck/missing-artifact/666/missing-artifact-666.jar:
+M2_REPO/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar:
+M2_REPO/org/bad/luck/missing-artifact/666/missing-artifact-666.jar: