read Nexus credentials from shared Vault path

.drone.yml

@@ -1,18 +1,167 @@
 kind: pipeline
 name: default
 
+clone:
+  retries: 3
+
+concurrency:
+  limit: 1
+
 steps:
-#  docker 打包
-  - name: docker
-    image: plugins/docker
-    settings:
-      context: ./
-      dockerfile: ./Dockerfile
-      username:
+  # 拉取并打包 Shopee WES
+  - name: deploy
+    image: gradle:9-alpine
+    pull: if-not-exists
+    environment:
+      DOCKER_CONFIG: /home/gradle/.docker
+      JIB_USERNAME:
         from_secret: docker_username
-      password:
+      JIB_PASSWORD:
         from_secret: docker_password
-      registry: https://registry.cn-hangzhou.aliyuncs.com
-      repo:  registry.cn-hangzhou.aliyuncs.com/loghub/wms-system-service
-      tags:
-        - gradle6
+      NEXUS_USERNAME:
+        from_secret: nexus_username
+      NEXUS_PASSWORD:
+        from_secret: nexus_password
+      NPM_USERNAME:
+        from_secret: nexus_username
+      NPM_PASSWORD:
+        from_secret: nexus_password
+    commands:
+      - |
+        if grep -qs ' /cache ' /proc/self/mountinfo && [ -w /cache ]; then
+          export GRADLE_USER_HOME=/cache/wes-loghub/gradle-9.6.1
+          export WES_WORKSPACE=/cache/wes-loghub/workspace
+          mkdir -p "$GRADLE_USER_HOME" "$(dirname "$WES_WORKSPACE")"
+          echo "===== persistent Gradle cache enabled: $GRADLE_USER_HOME ====="
+          echo "===== persistent WES workspace enabled: $WES_WORKSPACE ====="
+        else
+          export GRADLE_USER_HOME=/opt/gradle-user-home
+          export WES_WORKSPACE=/drone/src/wes-loghub
+          echo "===== WARNING: /cache is not mounted; using ephemeral Gradle cache ====="
+        fi
+      - git --version
+      - |
+        test -n "${NEXUS_USERNAME:-${NPM_USERNAME:-}}" || {
+          echo "Nexus username secret is missing"
+          exit 1
+        }
+        test -n "${NEXUS_PASSWORD:-${NPM_PASSWORD:-}}" || {
+          echo "Nexus password secret is missing"
+          exit 1
+        }
+      - |
+        if [ -d "$WES_WORKSPACE/.git" ]; then
+          echo "===== updating persistent WES workspace ====="
+          time git -C "$WES_WORKSPACE" fetch \
+            --depth 1 \
+            --no-tags \
+            https://zwzeng:glpat-nuzkafsdgYKM0KAgvpL4Bm86MQp1OnkH.01.0w0tr4xa1@git.ittx.com.cn/wms/wes-loghub.git \
+            proj-shopee-test
+          git -C "$WES_WORKSPACE" checkout -B proj-shopee-test FETCH_HEAD
+        else
+          echo "===== creating persistent WES workspace ====="
+          time git clone \
+            -b proj-shopee-test \
+            --depth 1 \
+            --no-tags \
+            https://zwzeng:glpat-nuzkafsdgYKM0KAgvpL4Bm86MQp1OnkH.01.0w0tr4xa1@git.ittx.com.cn/wms/wes-loghub.git \
+            "$WES_WORKSPACE"
+        fi
+        git -C "$WES_WORKSPACE" remote set-url origin https://git.ittx.com.cn/wms/wes-loghub.git
+      - git -C "$WES_WORKSPACE" log -1 --format='===== WES commit %H %s ====='
+      - cd "$WES_WORKSPACE"
+      - |
+        (
+          gradle_pids() {
+            for proc_path in /proc/[0-9]*; do
+              [ -r "$proc_path/cmdline" ] || continue
+              proc_cmd=$(tr '\0' ' ' < "$proc_path/cmdline" 2>/dev/null)
+              case "$proc_cmd" in
+                *GradleDaemon*|*GradleWorkerMain*) basename "$proc_path" ;;
+              esac
+            done
+          }
+          heartbeat_count=0
+          while true; do
+            heartbeat_count=$((heartbeat_count + 1))
+            echo "===== build heartbeat $(date -Iseconds) ====="
+            echo "load: $(cat /proc/loadavg)"
+            awk '/MemTotal|MemAvailable/ { printf "%s %s kB  ", $1, $2 } END { print "" }' /proc/meminfo
+            echo "===== active Gradle tasks ====="
+            cat /tmp/gradle-active-tasks 2>/dev/null || echo "none"
+            echo "===== top processes ====="
+            if command -v top >/dev/null 2>&1; then
+              top -b -n 1 2>/dev/null | head -n 20
+            else
+              ps -ef
+            fi
+            echo "===== Gradle JVM I/O ====="
+            for pid in $(gradle_pids); do
+              echo "--- pid=$pid cmd=$(tr '\0' ' ' < /proc/$pid/cmdline 2>/dev/null)"
+              awk '/read_bytes|write_bytes|cancelled_write_bytes/ { printf "%s ", $0 } END { print "" }' "/proc/$pid/io" 2>/dev/null || true
+            done
+            if [ $((heartbeat_count % 15)) -eq 0 ]; then
+              echo "===== Gradle JVM thread dump after $((heartbeat_count * 60)) seconds ====="
+              for pid in $(gradle_pids); do
+                jcmd "$pid" Thread.print -l || true
+              done
+            fi
+            sleep 60
+          done
+        ) &
+        echo $! > /tmp/build-heartbeat.pid
+        trap 'kill "$(cat /tmp/build-heartbeat.pid)" 2>/dev/null || true' EXIT
+      - >
+        time gradle jib -stacktrace
+        --init-script=/drone/src/gradle-repositories.init.gradle
+        --init-script=/drone/src/gradle-diagnostics.init.gradle
+        --no-daemon
+        --info
+        --console=plain
+        --warning-mode=summary
+        --build-cache
+        --configure-on-demand
+        --parallel
+        --max-workers=8
+        -x test 
+        -PdockerBuild=true  
+        -Dcybertrans.idp.enabled=false 
+        -Djib.disableUpdateChecks=true
+        -Djib.baseImageCache=$GRADLE_USER_HOME/caches/jib/base
+        -Djib.applicationCache=$GRADLE_USER_HOME/caches/jib/application
+        -Djib.from.image=registry.cn-hangzhou.aliyuncs.com/ttx/amazoncorretto:25-alpine3.23-jdk
+        -Djib.from.auth.username=$JIB_USERNAME
+        -Djib.from.auth.password=$JIB_PASSWORD
+        -Djib.to.auth.username=$JIB_USERNAME
+        -Djib.to.auth.password=$JIB_PASSWORD
+        -Djib.to.image=registry.cn-hangzhou.aliyuncs.com/loghub/wes:shopee-wes-test-3
+        -Djib.to.tags=shopee-wes-test-3
+        -Djib.container.entrypoint='INHERIT'
+        -Djib.container.args='java,-Dfile.encoding=utf-8,-Dspring.profiles.active=k8s,-Dserver.port=9210,-cp,/app/resources:/app/classes:/app/libs/*,com.ittx.Application'
+      - >
+        kill "$(cat /tmp/build-heartbeat.pid)" 2>/dev/null || true
+
+---
+kind: secret
+name: docker_username
+get:
+  path: drone/data/docker_username
+  name: docker_username
+---
+kind: secret
+name: docker_password
+get:
+  path: drone/data/docker_password
+  name: docker_password
+---
+kind: secret
+name: nexus_username
+get:
+  path: drone/data/nexus
+  name: nexus_username
+---
+kind: secret
+name: nexus_password
+get:
+  path: drone/data/nexus
+  name: nexus_password

.gitignore

@@ -0,0 +1 @@
+.idea/

.ossutilconfig

@@ -1,6 +0,0 @@
-[Credentials]
-language=EN
-endpoint=oss-cn-hangzhou.aliyuncs.com
-AccessKeyID=LTAIiOKICUiT4Mxf
-AccessKeySecret=Y2srJsSPJiRNx41fomps0zmWHvCges
-region = cn-hangzhou                     # 增加此行，配置Region

Dockerfile

@@ -1,23 +0,0 @@
-FROM gradle:6.9-jdk8
-
-RUN set -eux; \
-    sed -i 's|http://archive.ubuntu.com/ubuntu|https://mirrors.aliyun.com/ubuntu|g' /etc/apt/sources.list; \
-    sed -i 's|http://security.ubuntu.com/ubuntu|https://mirrors.aliyun.com/ubuntu|g' /etc/apt/sources.list; \
-    apt-get update; \
-    apt-get install -y --no-install-recommends \
-      nodejs \
-      npm; \
-    command -v node; \
-    command -v npm; \
-    npm config set registry https://registry.npmmirror.com; \
-    npm install -g coffeescript@2.7.0 stylus@0.54.8; \
-    stylus --version; \
-    coffee --version; \
-    rm -rf /var/lib/apt/lists/*
-
-ADD ossutil /usr/local/bin/ossutil
-RUN chmod +x /usr/local/bin/ossutil
-ADD .ossutilconfig /root/.ossutilconfig
-
-ADD init.gradle /root/.gradle/
-ADD config.json /root/.docker/

Dockerfile_back

@@ -1,90 +0,0 @@
-FROM eclipse-temurin:8-jdk-alpine
-
-CMD ["gradle"]
-
-ENV GRADLE_HOME=/opt/gradle
-
-RUN set -o errexit -o nounset \
-    && echo "Adding gradle user and group" \
-    && addgroup --system --gid 1000 gradle \
-    && adduser --system --ingroup gradle --uid 1000 --shell /bin/ash gradle \
-    && mkdir /home/gradle/.gradle \
-    && chown -R gradle:gradle /home/gradle \
-    && chmod -R o+rwx /home/gradle \
-    \
-    && echo "Symlinking root Gradle cache to gradle Gradle cache" \
-    && ln -s /home/gradle/.gradle /root/.gradle
-
-VOLUME /home/gradle/.gradle
-
-WORKDIR /home/gradle
-
-RUN set -o errexit -o nounset \
-    && echo "Switching apk mirror to aliyun" \
-    && sed -i 's|https\?://dl-cdn.alpinelinux.org/alpine|https://mirrors.aliyun.com/alpine|g' /etc/apk/repositories \
-    && apk update \
-    \
-    && apk add --no-cache \
-      curl \
-      make \
-      breezy \
-      py3-tzlocal \
-      git \
-      git-lfs \
-      mercurial \
-      subversion \
-    \
-    && echo "Testing common utilities" \
-    && which awk \
-    && which curl \
-    && which cut \
-    && which grep \
-    && which gunzip \
-    && which sha256sum \
-    && which sed \
-    && which tar \
-    && which tr \
-    && which unzip \
-    && which wget \
-    \
-    && echo "Testing VCSes" \
-    && which git \
-    && which git-lfs \
-    && which hg \
-    && which svn
-
-ENV GRADLE_VERSION=6.9.4
-ARG GRADLE_DOWNLOAD_SHA256=3e240228538de9f18772a574e99a0ba959e83d6ef351014381acd9631781389a
-RUN set -o errexit -o nounset \
-    && echo "Downloading Gradle" \
-    && wget --no-verbose --output-document=gradle.zip "https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-bin.zip" \
-    \
-    && echo "Checking Gradle download hash" \
-    && echo "${GRADLE_DOWNLOAD_SHA256} *gradle.zip" | sha256sum -c - \
-    \
-    && echo "Installing Gradle" \
-    && unzip gradle.zip \
-    && rm gradle.zip \
-    && mv "gradle-${GRADLE_VERSION}" "${GRADLE_HOME}/" \
-    && ln -s "${GRADLE_HOME}/bin/gradle" /usr/bin/gradle
-
-USER gradle
-
-RUN set -o errexit -o nounset \
-    && echo "Testing Gradle installation" \
-    && gradle --version
-
-USER root
-
-RUN set -eux; \
-    apk  add  nodejs  npm
-
-RUN set -eux; \
-    npm install -g coffee-script  stylus
-
-ADD ossutil /usr/local/bin/ossutil
-RUN chmod +x /usr/local/bin/ossutil
-ADD .ossutilconfig /root/.ossutilconfig
-
-ADD init.gradle  /root/.gradle/
-ADD config.json  /root/.docker/

config.json

@@ -1,31 +0,0 @@
-{
-  "auths": {
-    "qa-wms-acr-registry.cn-shanghai.cr.aliyuncs.com": {
-      "auth": "c2hhbnl1bi5ndUBTSElOVEFDQ1FBUzAxOnNmakxqemZmRThEMCNWZE4="
-    },
-    "registry-vpc.cn-hangzhou.aliyuncs.com": {
-      "auth": "c3d1QGl0dHguY29tLmNuOml0dHgyMDE4"
-    },
-    "registry.cn-hangzhou.aliyuncs.com": {
-      "auth": "c3d1QGl0dHguY29tLmNuOml0dHgyMDE4"
-    },
-    "registry.cn-shanghai.aliyuncs.com": {
-      "auth": "Zy5zaGFueXVuQGdtYWlsLmNvbTpBYTExMTIzNA=="
-    },
-    "sh2-cnepb-acr-pd-epp-registry.cn-shanghai.cr.aliyuncs.com": {
-      "auth": "U2h1aHVpLlBFTkctQURNQDEwNjU1NTY0ODc1NDYzNDI6eWRCQ2QyWVdxVWhUdExqMSUzb0RzRWxQQDJ3UmdI"
-    },
-    "ttx-registry-vpc.cn-hangzhou.cr.aliyuncs.com": {
-      "auth": "Y2J0X2plbmtpbnNfY3JAMTU0MzYwMDc2MDE3NjU0MDpzYmhXUXJWSFBWUU11SyEz"
-    },
-    "ttx-registry.cn-hangzhou.cr.aliyuncs.com": {
-      "auth": "c3lndUAxNTQzNjAwNzYwMTc2NTQwOlR0eEAyMDI1"
-    },
-    "wms-acr-registry.cn-shanghai.cr.aliyuncs.com": {
-      "auth": "c2hhbnl1bi5ndUBTSElOVEFDQ1BSRDAxOkFhMTIzNDU2"
-    }
-  },
-  "HttpHeaders": {
-    "User-Agent": "Docker-Client/19.03.1 (linux)"
-  }
-}

gradle-diagnostics.init.gradle

@@ -0,0 +1,34 @@
+import java.util.concurrent.ConcurrentHashMap
+import org.gradle.api.tasks.compile.GroovyCompile
+
+def taskStartNanos = new ConcurrentHashMap<String, Long>()
+def activeTasksFile = new File('/tmp/gradle-active-tasks')
+
+def writeActiveTasks = {
+    synchronized (taskStartNanos) {
+        def activeTasks = taskStartNanos.keySet().sort()
+        activeTasksFile.text = activeTasks
+                ? activeTasks.join(System.lineSeparator()) + System.lineSeparator()
+                : "none${System.lineSeparator()}"
+    }
+}
+
+gradle.beforeProject { project ->
+    project.tasks.withType(GroovyCompile).configureEach {
+        options.forkOptions.memoryMaximumSize = '1g'
+    }
+}
+
+gradle.taskGraph.beforeTask { task ->
+    taskStartNanos.put(task.path, System.nanoTime())
+    writeActiveTasks()
+    println "[TASK START] ${task.path}"
+}
+
+gradle.taskGraph.afterTask { task, state ->
+    def startedAt = taskStartNanos.remove(task.path)
+    def elapsedMs = startedAt == null ? 0 : (System.nanoTime() - startedAt) / 1_000_000
+    def outcome = state.failure ? 'FAILED' : state.skipped ? 'SKIPPED' : 'DONE'
+    println "[TASK END] ${task.path} ${outcome} ${elapsedMs} ms"
+    writeActiveTasks()
+}

gradle-repositories.init.gradle

@@ -0,0 +1,71 @@
+def nexusUsername = System.getenv('NEXUS_USERNAME') ?: System.getenv('NPM_USERNAME')
+def nexusPassword = System.getenv('NEXUS_PASSWORD') ?: System.getenv('NPM_PASSWORD')
+
+if (!nexusUsername || !nexusPassword) {
+    throw new GradleException('Nexus credentials are not configured')
+}
+
+buildscript {
+    repositories {
+        mavenLocal()
+        maven { url = 'https://nexus.freeicu.top/repository/maven-public/' }
+        maven {
+            url = 'https://nexus.loghub.com/repository/public/'
+            credentials {
+                username = nexusUsername
+                password = nexusPassword
+            }
+        }
+        maven { url = 'https://repo.huaweicloud.com/repository/maven/huaweicloudsdk' }
+        maven { url = 'https://build.shibboleth.net/nexus/content/repositories/releases/' }
+    }
+}
+
+allprojects {
+    buildscript {
+        repositories {
+            mavenLocal()
+            maven { url = 'https://nexus.freeicu.top/repository/maven-public/' }
+            maven {
+                url = 'https://nexus.loghub.com/repository/public/'
+                credentials {
+                    username = nexusUsername
+                    password = nexusPassword
+                }
+            }
+            maven { url = 'https://repo.huaweicloud.com/repository/maven/huaweicloudsdk' }
+            maven { url = 'https://build.shibboleth.net/nexus/content/repositories/releases/' }
+        }
+    }
+    repositories {
+        mavenLocal()
+        maven { url = 'https://nexus.freeicu.top/repository/maven-public/' }
+        maven {
+            url = 'https://nexus.loghub.com/repository/public/'
+            credentials {
+                username = nexusUsername
+                password = nexusPassword
+            }
+        }
+        maven { url = 'https://repo.huaweicloud.com/repository/maven/huaweicloudsdk' }
+        maven { url = 'https://build.shibboleth.net/nexus/content/repositories/releases/' }
+    }
+}
+
+settingsEvaluated { settings ->
+    settings.pluginManagement {
+        repositories {
+            mavenLocal()
+            maven { url = 'https://nexus.freeicu.top/repository/maven-public/' }
+            maven {
+                url = 'https://nexus.loghub.com/repository/public/'
+                credentials {
+                    username = nexusUsername
+                    password = nexusPassword
+                }
+            }
+            maven { url = 'https://repo.huaweicloud.com/repository/maven/huaweicloudsdk' }
+            maven { url = 'https://build.shibboleth.net/nexus/content/repositories/releases/' }
+        }
+    }
+}

init.gradle

@@ -1,68 +0,0 @@
-buildscript {
-    repositories {
-        mavenLocal()
-        maven { url 'https://nexus.freeicu.top/repository/maven-public/' }
-        maven { url "https://repo.huaweicloud.com/repository/maven/huaweicloudsdk" }
-        maven { url "https://build.shibboleth.net/nexus/content/repositories/releases/" }
-        maven {
-            url 'https://nexus.loghub.com/repository/public/'
-            credentials {
-                username = "developer"
-                password = "95bb05e9-1540-4caa"
-            }
-        }
-
-    }
-}
-allprojects {
-    buildscript {
-        repositories {
-            mavenLocal()
-            maven { url 'https://nexus.freeicu.top/repository/maven-public/' }
-            maven { url "https://repo.huaweicloud.com/repository/maven/huaweicloudsdk" }
-            maven { url "https://build.shibboleth.net/nexus/content/repositories/releases/" }
-
-            maven {
-                url 'https://nexus.loghub.com/repository/public/'
-                credentials {
-                    username = "developer"
-                    password = "95bb05e9-1540-4caa"
-                }
-            }
-        }
-    }
-    repositories {
-        mavenLocal()
-        maven { url 'https://nexus.freeicu.top/repository/maven-public/' }
-        maven { url "https://repo.huaweicloud.com/repository/maven/huaweicloudsdk" }
-        maven { url "https://build.shibboleth.net/nexus/content/repositories/releases/" }
-
-        maven {
-            url 'https://nexus.loghub.com/repository/public/'
-            credentials {
-                username = "developer"
-                password = "95bb05e9-1540-4caa"
-            }
-        }
-    }
-}
-
-settingsEvaluated { settings ->
-    settings.pluginManagement {
-        repositories {
-            mavenLocal()
-            maven { url 'https://nexus.freeicu.top/repository/maven-public/' }
-            maven { url "https://repo.huaweicloud.com/repository/maven/huaweicloudsdk" }
-            maven { url "https://build.shibboleth.net/nexus/content/repositories/releases/" }
-
-            maven {
-                url 'https://nexus.loghub.com/repository/public/'
-                credentials {
-                    username = "developer"
-                    password = "95bb05e9-1540-4caa"
-                }
-            }
-        }
-    }
-}
-