feat: Deterministic Gradle build (#425)

Signed-off-by: Matt Peterson <matt.peterson@swirldslabs.com> Signed-off-by: Jendrik Johannes <jendrik.johannes@gmail.com> Co-authored-by: Jendrik Johannes <jendrik.johannes@gmail.com>
hashgraph · Jan 10, 2025 · 74240cb · 74240cb
1 parent 09b617b
commit 74240cb
Show file tree

Hide file tree

Showing 12 changed files with 776 additions and 280 deletions.
diff --git a/.github/workflows/e2e-tests.yaml b/.github/workflows/e2e-tests.yaml
@@ -45,7 +45,7 @@ jobs:
         uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
         with:
           distribution: "temurin"
-          java-version: "21.0.4"
+          java-version: "21.0.5"
 
       - name: Run Acceptance Tests
         id: acceptance-tests

diff --git a/.github/workflows/pr-checks.yaml b/.github/workflows/pr-checks.yaml
@@ -17,9 +17,27 @@ env:
   GRADLE_EXEC: ./gradlew
 
 permissions:
+  id-token: write
   contents: read
+  packages: write
 
 jobs:
+  check-gradle:
+    name: Gradle
+    uses: ./.github/workflows/zxc-verify-gradle-build-determinism.yaml
+    with:
+      ref: ${{ github.event.inputs.ref || '' }}
+      java-distribution: ${{ inputs.java-distribution || 'temurin' }}
+      java-version: ${{ inputs.java-version || '21.0.5' }}
+
+  check-docker:
+    name: Docker
+    uses: ./.github/workflows/zxc-verify-docker-build-determinism.yaml
+    with:
+      ref: ${{ github.event.inputs.ref || '' }}
+      java-distribution: ${{ inputs.java-distribution || 'temurin' }}
+      java-version: ${{ inputs.java-version || '21.0.5' }}
+
   compile:
     name: "Gradle Checks"
     runs-on: block-node-linux-medium
@@ -46,7 +64,7 @@ jobs:
         uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
         with:
           distribution: "temurin"
-          java-version: "21.0.4"
+          java-version: "21.0.5"
 
       - name: Cache Gradle packages
         uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0

diff --git a/.github/workflows/release-automation.yaml b/.github/workflows/release-automation.yaml
@@ -80,7 +80,7 @@ jobs:
         uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
         with:
           distribution: "temurin"
-          java-version: "21.0.4"
+          java-version: "21.0.5"
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@0bdd871935719febd78681f197cd39af5b6e16a6 # v4.2.2
@@ -181,7 +181,7 @@ jobs:
         uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
         with:
           distribution: "temurin"
-          java-version: "21.0.4"
+          java-version: "21.0.5"
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@0bdd871935719febd78681f197cd39af5b6e16a6 # v4.2.2

diff --git a/.github/workflows/release-push-image.yaml b/.github/workflows/release-push-image.yaml
@@ -20,6 +20,7 @@ defaults:
     shell: bash
 
 permissions:
+  id-token: write
   contents: read
   packages: write
 
@@ -29,23 +30,24 @@ env:
   REGISTRY: ghcr.io
 
 jobs:
-#  check-gradle:
-#    name: Gradle
-#    uses: ./.github/workflows/zxc-verify-gradle-build-determinism.yaml
-#    with:
-#      ref: ${{ github.event.inputs.ref || '' }}
-#      java-distribution: ${{ inputs.java-distribution || 'temurin' }}
-#      java-version: ${{ inputs.java-version || '21.0.4' }}
-
-#  check-docker:
-#    name: Docker
-#    uses: ./.github/workflows/zxc-verify-docker-build-determinism.yaml
-#    with:
-#      ref: ${{ github.event.inputs.ref || '' }}
-#      java-distribution: ${{ inputs.java-distribution || 'temurin' }}
-#      java-version: ${{ inputs.java-version || '21.0.4' }}
+  check-gradle:
+    name: Gradle
+    uses: ./.github/workflows/zxc-verify-gradle-build-determinism.yaml
+    with:
+      ref: ${{ github.event.inputs.ref || '' }}
+      java-distribution: ${{ inputs.java-distribution || 'temurin' }}
+      java-version: ${{ inputs.java-version || '21.0.5' }}
+
+  check-docker:
+    name: Docker
+    uses: ./.github/workflows/zxc-verify-docker-build-determinism.yaml
+    with:
+      ref: ${{ github.event.inputs.ref || '' }}
+      java-distribution: ${{ inputs.java-distribution || 'temurin' }}
+      java-version: ${{ inputs.java-version || '21.0.5' }}
 
   publish:
+    needs: [check-gradle, check-docker]
     runs-on: block-node-linux-medium
 
     steps:
@@ -56,12 +58,14 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        with:
+          fetch-depth: 0
 
       - name: Install JDK
         uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
         with:
           distribution: "temurin"
-          java-version: "21.0.4"
+          java-version: "21.0.5"
 
       - name: Build
         run: ./gradlew clean build
@@ -80,13 +84,22 @@ jobs:
         uses: docker/setup-buildx-action@4fd812986e6c8c2a69e18311145f9371337f27d4 # v3.4.0
         with:
           driver-opts: network=host
+          buildkitd-config-inline: |
+            [registry."docker.io"]
+              mirrors = ["https://hub.mirror.docker.lat.ope.eng.hashgraph.io"]
 
       - name: Extract version
         id: extract_version
         run: |
           VERSION=$(cat version.txt)
           echo "VERSION=${VERSION}" >> $GITHUB_ENV
 
+      - name: Extract Source Date Epoch
+        id: extract_source_date_epoch
+        run: |
+          SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)
+          echo "SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}" >> $GITHUB_ENV
+
       - name: Server - Build and push image
         uses: docker/build-push-action@b32b51a8eda65d6793cd0494a773d4f6bcef32dc # v6.11.0
         with:
@@ -99,6 +112,7 @@ jobs:
           tags: ${{ env.REGISTRY }}/${{ github.repository }}:${{ env.VERSION }}
           build-args: |
             VERSION=${{ env.VERSION }}
+            SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
           build-contexts: |
             distributions=./server/build/distributions
 

diff --git a/.github/workflows/smoke-test.yaml b/.github/workflows/smoke-test.yaml
@@ -46,7 +46,7 @@ jobs:
         uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
         with:
           distribution: "temurin"
-          java-version: "21.0.4"
+          java-version: "21.0.5"
 
       - name: Install grpcurl
         run: |