Merge branch 'master' into pg_image_14

Author: benbroadaway

.mvn/wrapper/maven-wrapper.properties

@@ -16,4 +16,4 @@
 # under the License.
 wrapperVersion=3.3.2
 distributionType=only-script
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.6.3/apache-maven-3.6.3-bin.zip
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.9/apache-maven-3.9.9-bin.zip

CHANGELOG.md

@@ -1,5 +1,162 @@
 # Change Log
 
+## [2.31.0] - 2025-08-04
+
+### Added
+
+- concord-tasks: add createApiKey action
+([#1194](https://github.com/walmartlabs/concord/pull/1194));
+- concord-server: option to specify API key value
+([#1195](https://github.com/walmartlabs/concord/pull/1195));
+- concord-tasks: add createOrUpdateApiKey action
+([#1196](https://github.com/walmartlabs/concord/pull/1196)).
+
+### Changed
+
+- concord-runtime-model: more flexible interfaces, simplify code
+([#1184](https://github.com/walmartlabs/concord/pull/1184));
+- project: fix typo
+([#1191](https://github.com/walmartlabs/concord/pull/1191));
+- runtime-v2: additional error logging when cloning state fails
+([#1192](https://github.com/walmartlabs/concord/pull/1192));
+- project: update dependencies
+([#1193](https://github.com/walmartlabs/concord/pull/1193)).
+
+
+
+## [2.30.0] - 2025-07-12
+
+### Added
+
+- http-task: support sending int values in multipart
+requests
+([#1174](https://github.com/walmartlabs/concord/pull/1174));
+- concord-server: config option to disable template script
+processing
+([#1176](https://github.com/walmartlabs/concord/pull/1176));
+- common, runtime-v1: add method to assert given path string
+resolves in expected parent
+([#1179](https://github.com/walmartlabs/concord/pull/1179)).
+
+### Changed
+
+- concord-cli: produce an executable binary again
+([#1171](https://github.com/walmartlabs/concord/pull/1171));
+- concord-server: allow get user for concordSystemReader role
+([#1173](https://github.com/walmartlabs/concord/pull/1173));
+- runtime-v2: return copies in ObjectMapperProvider
+([#1175](https://github.com/walmartlabs/concord/pull/1175));
+- concord-server: do not log session token
+([#1177](https://github.com/walmartlabs/concord/pull/1177));
+- concord-server: kill process when resume fails with no
+state
+([#1178](https://github.com/walmartlabs/concord/pull/1178));
+- runtime-v2: validate form name constraints as documented
+([#1180](https://github.com/walmartlabs/concord/pull/1180));
+- runtime-v1: validate form name constraints as documented
+([#1181](https://github.com/walmartlabs/concord/pull/1181));
+- runtime-v2: remove unused imports, dead code
+([#1185](https://github.com/walmartlabs/concord/pull/1185));
+- concord-console2: sort variables in task call details
+([#1186](https://github.com/walmartlabs/concord/pull/1186));
+- http-task: allow send long multipart with debug enabled
+([#1188](https://github.com/walmartlabs/concord/pull/1188));
+- concord-server: fix tx in process card dao
+([#1189](https://github.com/walmartlabs/concord/pull/1189)).
+
+
+
+## [2.29.0] - 2025-06-13
+
+### Added
+
+- concord-server: refactor WebSocketChannelManager, allow
+message sources in plugins
+([#1056](https://github.com/walmartlabs/concord/pull/1056));
+- concord-agent: one-shot mode
+([#1150](https://github.com/walmartlabs/concord/pull/1150));
+- slack-tasks: allow send blocks instead of simple text
+([#1161](https://github.com/walmartlabs/concord/pull/1161));
+- concord-server, concord-console2: add console.cfgFile
+config parameter
+([#1166](https://github.com/walmartlabs/concord/pull/1166));
+- runtime-v2: support expressions for output variables in
+call step
+([#1170](https://github.com/walmartlabs/concord/pull/1170)).
+
+### Changed
+
+- concord-server, concord-console2: use webapp plugin
+([#1154](https://github.com/walmartlabs/concord/pull/1154));
+- runtime-v2: add extra check to testThrowParallelWithPayload
+([#1157](https://github.com/walmartlabs/concord/pull/1157));
+- concord-server-it: reduce agent and server poll delays to
+speed up tests
+([#1159](https://github.com/walmartlabs/concord/pull/1159));
+- concord-runtime-v1/v2-it: reduce agent and server poll
+delays to speed up tests
+([#1163](https://github.com/walmartlabs/concord/pull/1163));
+- runtime-v2: improve handling of @SensitiveData on bridge
+methods
+([#1164](https://github.com/walmartlabs/concord/pull/1164));
+- webapp: fix prefix matching
+([#1167](https://github.com/walmartlabs/concord/pull/1167));
+- oidc: fix role mapping validation
+([#1168](https://github.com/walmartlabs/concord/pull/1168));
+- concord-server-db: use our own implementation of session
+locks
+([#1169](https://github.com/walmartlabs/concord/pull/1169)).
+
+
+
+## [2.28.0] - 2025-06-04
+
+### Added
+
+- concord-server: add more repository-level GitHub events
+([#1149](https://github.com/walmartlabs/concord/pull/1149));
+- runtime-v2: allow marking nested values as sensitive data
+([#1151](https://github.com/walmartlabs/concord/pull/1151));
+- misc-tasks, runtime-v2: support masking when base64
+encoding/decoding sensitive data
+([#1155](https://github.com/walmartlabs/concord/pull/1155)).
+
+### Changed
+
+- runtime-v1, runtime-v2: refactor loader structure
+([#1147](https://github.com/walmartlabs/concord/pull/1147));
+- examples: update description
+([#1153](https://github.com/walmartlabs/concord/pull/1153));
+- concord-server-it: make dependency resolver timeout same
+as in runtime-v2 ITs
+([#1156](https://github.com/walmartlabs/concord/pull/1156));
+- docker-images: update JDK versions
+([#1158](https://github.com/walmartlabs/concord/pull/1158));
+- project: use central-publishing-maven-plugin
+([#1160](https://github.com/walmartlabs/concord/pull/1160)).
+
+
+
+## [2.27.0] - 2025-05-22
+
+### Added
+
+- concord-server: default Git credentials hostname whitelist
+([#1139](https://github.com/walmartlabs/concord/pull/1139));
+- concord-server: log listening address, starting tasks
+([#1141](https://github.com/walmartlabs/concord/pull/1141));
+
+### Changed
+
+- oidc: validate team and role mappings
+([#1144](https://github.com/walmartlabs/concord/pull/1144));
+- concord-server-db: use session locks in Liquibase
+([#1145](https://github.com/walmartlabs/concord/pull/1145));
+- concord-server: handle SIGTERM
+([#1146](https://github.com/walmartlabs/concord/pull/1146)).
+
+
+
 ## [2.26.0] - 2025-05-05
 
 ### Added

SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Reporting a Vulnerability
 
-To report a vulnerabitility please use [GitHub Issues](https://github.com/walmartlabs/concord/issues)
+To report a vulnerability please use [GitHub Issues](https://github.com/walmartlabs/concord/issues)
 or reach the team using the following email address:
 
 - [[email protected]](mailto:[email protected]).

agent-operator/pom.xml

@@ -6,14 +6,16 @@
     <parent>
         <groupId>com.walmartlabs.concord</groupId>
         <artifactId>parent</artifactId>
-        <version>2.26.1-SNAPSHOT</version>
+        <version>2.31.1-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 
     <groupId>com.walmartlabs.concord.k8s</groupId>
     <artifactId>concord-agent-operator</artifactId>
     <packaging>jar</packaging>
 
+    <name>${project.groupId}:${project.artifactId}</name>
+
     <dependencies>
         <dependency>
             <groupId>com.walmartlabs.concord</groupId>

agent/pom.xml

@@ -6,13 +6,15 @@
     <parent>
         <groupId>com.walmartlabs.concord</groupId>
         <artifactId>parent</artifactId>
-        <version>2.26.1-SNAPSHOT</version>
+        <version>2.31.1-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 
     <artifactId>concord-agent</artifactId>
     <packaging>jar</packaging>
 
+    <name>${project.groupId}:${project.artifactId}</name>
+
     <properties>
         <runnerV1.path>
             ${project.basedir}/../runtime/v1/impl/target/concord-runtime-impl-v1-${project.version}-jar-with-dependencies.jar

agent/src/main/java/com/walmartlabs/concord/agent/AgentModule.java

@@ -57,12 +57,11 @@ public void configure(Binder binder) {
 
         binder.bind(AgentConfiguration.class).in(SINGLETON);
         binder.bind(DockerConfiguration.class).in(SINGLETON);
+        binder.bind(RuntimeConfiguration.class).asEagerSingleton();
         binder.bind(GitConfiguration.class).in(SINGLETON);
         binder.bind(ImportConfiguration.class).in(SINGLETON);
         binder.bind(PreForkConfiguration.class).in(SINGLETON);
         binder.bind(RepositoryCacheConfiguration.class).in(SINGLETON);
-        binder.bind(RunnerV1Configuration.class).in(SINGLETON);
-        binder.bind(RunnerV2Configuration.class).in(SINGLETON);
         binder.bind(ServerConfiguration.class).in(SINGLETON);
 
         binder.bind(DefaultDependencies.class).in(SINGLETON);

agent/src/main/java/com/walmartlabs/concord/agent/Main.java

@@ -22,20 +22,31 @@
 
 
 import com.google.inject.Guice;
-import com.google.inject.Injector;
 import org.eclipse.sisu.space.BeanScanning;
 import org.eclipse.sisu.space.SpaceModule;
 import org.eclipse.sisu.space.URLClassSpace;
 import org.eclipse.sisu.wire.WireModule;
 
 public class Main {
 
-    public static void main(String[] args) {
-        ClassLoader cl = Main.class.getClassLoader();
+    public static void main(String[] args) throws Exception {
+        // auto-wire all modules
+        var classLoader = Main.class.getClassLoader();
+        var modules = new WireModule(new SpaceModule(new URLClassSpace(classLoader), BeanScanning.GLOBAL_INDEX));
+        var injector = Guice.createInjector(modules);
 
-        Injector injector = Guice.createInjector(new WireModule(new SpaceModule(new URLClassSpace(cl), BeanScanning.GLOBAL_INDEX)));
-
-        Agent a = injector.getInstance(Agent.class);
-        a.start();
+        if (args.length == 1) {
+            // one-shot mode - read ProcessResponse directly from the command line, execute the process and exit
+            // the current $PWD will be used as ${workDir}
+            var oneShotRunner = injector.getInstance(OneShotRunner.class);
+            oneShotRunner.run(args[0]);
+        } else if (args.length == 0) {
+            // agent mode - connect to the server's websocket and handle ProcessResponses
+            var agent = injector.getInstance(Agent.class);
+            agent.start();
+        } else {
+            throw new IllegalArgumentException("Specify the entire ProcessResponse JSON as the first argument to run in " +
+                                               "the one-shot mode or run without arguments for the default (agent) mode.");
+        }
     }
 }

agent/src/main/java/com/walmartlabs/concord/agent/OneShotRunner.java

@@ -0,0 +1,70 @@
+package com.walmartlabs.concord.agent;
+
+/*-
+ * *****
+ * Concord
+ * -----
+ * Copyright (C) 2017 - 2024 Walmart Inc.
+ * -----
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * =====
+ */
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.google.inject.Injector;
+import com.walmartlabs.concord.agent.cfg.AgentConfiguration;
+import com.walmartlabs.concord.agent.guice.WorkerModule;
+import com.walmartlabs.concord.common.IOUtils;
+import com.walmartlabs.concord.server.queueclient.message.ProcessResponse;
+
+import javax.inject.Inject;
+
+import static java.util.Objects.requireNonNull;
+
+public class OneShotRunner {
+
+    private final AgentConfiguration agentCfg;
+    private final ObjectMapper objectMapper;
+    private final Injector injector;
+
+    @Inject
+    public OneShotRunner(AgentConfiguration agentCfg,
+                         ObjectMapper objectMapper,
+                         Injector injector) {
+
+        this.agentCfg = requireNonNull(agentCfg);
+        this.objectMapper = requireNonNull(objectMapper);
+        this.injector = requireNonNull(injector);
+    }
+
+    public void run(String processResponseJson) throws Exception {
+        var processResponse = objectMapper.readValue(processResponseJson, ProcessResponse.class);
+        var workDir = IOUtils.createTempDir(agentCfg.getPayloadDir(), "workDir");
+        var jobRequest = JobRequest.from(processResponse, workDir);
+
+        var workerModule = new WorkerModule(agentCfg.getAgentId(), jobRequest.getInstanceId(), jobRequest.getSessionToken());
+        var workerFactory = injector.createChildInjector(workerModule).getInstance(WorkerFactory.class);
+        var worker = workerFactory.create(jobRequest, status -> {
+        });
+
+        worker.setThrowOnFailure(true);
+
+        try {
+            worker.run();
+        } catch (Exception e) {
+            System.exit(1);
+        }
+
+        System.exit(0);
+    }
+}

agent/src/main/java/com/walmartlabs/concord/agent/Worker.java

@@ -50,6 +50,7 @@ public class Worker implements Runnable {
     private final JobRequest jobRequest;
 
     private JobInstance jobInstance;
+    private boolean throwOnFailure;
 
     @Inject
     public Worker(RepositoryManager repositoryManager,
@@ -119,6 +120,10 @@ public void cancel() {
         jobInstance.cancel();
     }
 
+    public void setThrowOnFailure(boolean throwOnFailure) {
+        this.throwOnFailure = throwOnFailure;
+    }
+
     private void handleError(UUID instanceId, Throwable error) {
         StatusEnum status = StatusEnum.FAILED;
 
@@ -131,6 +136,13 @@ private void handleError(UUID instanceId, Throwable error) {
 
         onStatusChange(instanceId, status);
         log.info("handleError ['{}'] -> done", instanceId);
+
+        if (throwOnFailure) {
+            if (error instanceof RuntimeException re) {
+                throw re;
+            }
+            throw new RuntimeException(error);
+        }
     }
 
     private void onStatusChange(UUID instanceId, StatusEnum status) {