Onboard Maven restores to CFS

.gitattributes

@@ -0,0 +1,7 @@
+# Shell scripts must retain LF endings on every platform.
+*.sh text eol=lf
+
+# Preserve the existing CRLF convention in these standalone sample projects.
+warmup-function/pom.xml whitespace=cr-at-eol
+samples/dependency-injection-example/dagger-function/pom.xml whitespace=cr-at-eol
+samples/dependency-injection-example/guice-function/pom.xml whitespace=cr-at-eol

.gitignore

@@ -259,6 +259,9 @@ target/
 .project
 *.iml
 dependency-reduced-pom.xml
+# The Maven credential provider is an opt-in for ingesting uncached packages. CI authenticates
+# with MavenAuthenticate@0, and committing the extension would break anonymous restores.
+.mvn/
 /functions-coffee-order-demo/src/main/functions/functions-coffee-order.jar
 /functions-coffee-order-demo/src/main/arduino/.build/
 pkg/

README.md

@@ -15,6 +15,112 @@ Please refer to [CONTRIBUTING.md](./CONTRIBUTING.md) for more information.
 
 * Run all maven commands under the root folder of this repository
 
+### Package feed
+
+All Maven packages and plugins are restored from the `upstream-public` Azure Artifacts feed
+(`https://pkgs.dev.azure.com/azfunc/public/_packaging/upstream-public/maven/v1`), which is configured
+as the `central` repository in every `pom.xml` in this repository.
+
+The repository root also has a [`settings.xml`](settings.xml) that mirrors `central` to the same
+feed. It exists because a `pom.xml` cannot cover everything:
+
+- Maven resolves build extensions and plugin prefixes *before* a pom's `<repositories>` are honored,
+	so those requests would otherwise go straight to Maven Central.
+- `MavenAuthenticate@0` and the credential provider key credentials off the Azure Artifacts *feed
+	name* (`upstream-public`), while the pom repository id must be `central` in order to override the
+	id Maven inherits from the Super POM. The mirror id bridges the two.
+
+CI installs this file to `~/.m2/settings.xml`. Locally you only need it when pulling a package or
+version the feed has not cached yet, in which case pass it explicitly with `mvn -s settings.xml`.
+
+#### Anonymous restore (default)
+
+The feed allows anonymous reads, so no credentials are required to build once a package version has
+been saved to the feed. External contributors and fresh clones need no setup. `mvn` just works.
+Never commit credentials or a `<server>` entry to `settings.xml` in this repository because doing so
+would force authentication on everyone.
+
+#### Authenticating (Microsoft developers only)
+
+Authentication is only needed to *ingest* a package version that the feed has not cached yet. The
+first restore of any new or upgraded dependency will fail anonymously with:
+
+> No local versions of package '...'; please provide authentication to access versions from upstream
+> that have not yet been saved to your feed.
+
+When that happens, a Microsoft developer with access to the `azfunc/public` project must run the
+restore once with credentials, which pulls the version from upstream and saves it to the feed. Every
+subsequent anonymous restore then succeeds.
+
+The recommended way to authenticate is the `artifacts-maven-credprovider`, which acquires a token via
+Entra ID so you do not have to manage a PAT.
+
+Run the helper script for your shell from the root of your clone. It installs the credential provider
+into your local Maven repository if it is missing, then writes `.mvn/extensions.xml`. Both scripts
+are idempotent, so re-running them is safe:
+
+```powershell
+./eng/scripts/Install-MavenCredentialProvider.ps1
+```
+
+```bash
+./eng/scripts/install-maven-credprovider.sh
+```
+
+Pass `-Version` / `--version` to install a different release, and `-Force` / `--force` to reinstall or
+to overwrite an `.mvn/extensions.xml` the script does not manage.
+
+If you would rather do it by hand, the equivalent steps are:
+
+1. Bootstrap the credential provider once per machine. Run this from a directory outside any Maven
+	 project, such as your home directory. It downloads the extension from the public `AzureArtifacts`
+	 tools feed, which needs no authentication:
+
+	 ```powershell
+	 mvn dependency:get "-Dartifact=com.microsoft.azure:artifacts-maven-credprovider:3.2.1" "-DremoteRepositories=central::::https://pkgs.dev.azure.com/artifacts-public/PublicTools/_packaging/AzureArtifacts/maven/v1"
+	 ```
+
+	 Using the repository id `central` matters. Maven records the extension as having come from
+	 `central`, which is the same id this repository's `pom.xml` files declare, so the cached copy
+	 validates during later builds.
+
+2. Create `.mvn/extensions.xml` at the root of your clone:
+
+	 ```xml
+	 <extensions xmlns="http://maven.apache.org/EXTENSIONS/1.1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+		 xsi:schemaLocation="http://maven.apache.org/EXTENSIONS/1.1.0 https://maven.apache.org/xsd/core-extensions-1.0.0.xsd">
+		 <extension>
+			 <groupId>com.microsoft.azure</groupId>
+			 <artifactId>artifacts-maven-credprovider</artifactId>
+			 <version>3.2.1</version>
+		 </extension>
+	 </extensions>
+	 ```
+
+`.mvn/` is deliberately listed in `.gitignore`. Do not commit it. The extension exits when it
+detects a build context, and committing it would break anonymous restores for everyone else.
+
+If you would rather not use the credential provider, you can instead add a `<server>` entry to your
+user-level `~/.m2/settings.xml` (never to a file inside this repository), using an Azure DevOps
+personal access token with Packaging read and write scope:
+
+```xml
+<settings>
+	<servers>
+		<server>
+			<!-- Must match the <id> of the repository declared in the pom.xml files. -->
+			<id>central</id>
+			<username>azfunc</username>
+			<password>[PERSONAL_ACCESS_TOKEN]</password>
+		</server>
+	</servers>
+</settings>
+```
+
+CI covers this automatically. The `MavenAuthenticate@0` task in the build templates authenticates the
+`central` repository, so merged changes to dependency versions are ingested by the pipeline. The
+credential provider is not used in pipelines.
+
 ## IntelliJ
 
 * Import the root folder of this repository as an existing project in IntelliJ

dockertests/app-src/BlobSdkType/pom.xml

@@ -24,6 +24,24 @@
         <functionAppName>functions-quickstart-java-azd-eventgrid-blob</functionAppName>
     </properties>
 
+    <repositories>
+        <repository>
+            <id>central</id>
+            <url>https://pkgs.dev.azure.com/azfunc/public/_packaging/upstream-public/maven/v1</url>
+            <releases><enabled>true</enabled></releases>
+            <snapshots><enabled>true</enabled></snapshots>
+        </repository>
+    </repositories>
+
+    <pluginRepositories>
+        <pluginRepository>
+            <id>central</id>
+            <url>https://pkgs.dev.azure.com/azfunc/public/_packaging/upstream-public/maven/v1</url>
+            <releases><enabled>true</enabled></releases>
+            <snapshots><enabled>true</enabled></snapshots>
+        </pluginRepository>
+    </pluginRepositories>
+
     <dependencies>
         <dependency>
             <groupId>com.microsoft.azure.functions</groupId>
@@ -99,4 +117,4 @@
             </plugin>
         </plugins>
     </build>
-</project>
+</project>

dockertests/app-src/TimezoneCheck/pom.xml

@@ -22,6 +22,24 @@
         <functionAppName>timezone-check</functionAppName>
     </properties>
 
+    <repositories>
+        <repository>
+            <id>central</id>
+            <url>https://pkgs.dev.azure.com/azfunc/public/_packaging/upstream-public/maven/v1</url>
+            <releases><enabled>true</enabled></releases>
+            <snapshots><enabled>true</enabled></snapshots>
+        </repository>
+    </repositories>
+
+    <pluginRepositories>
+        <pluginRepository>
+            <id>central</id>
+            <url>https://pkgs.dev.azure.com/azfunc/public/_packaging/upstream-public/maven/v1</url>
+            <releases><enabled>true</enabled></releases>
+            <snapshots><enabled>true</enabled></snapshots>
+        </pluginRepository>
+    </pluginRepositories>
+
     <dependencies>
         <dependency>
             <groupId>com.microsoft.azure.functions</groupId>

emulatedtests/pom.xml

@@ -35,11 +35,10 @@
 
 	<repositories>
 		<repository>
-			<id>maven.snapshots</id>
-			<name>Maven Central Snapshot Repository</name>
-			<url>https://oss.sonatype.org/content/repositories/snapshots/</url>
+			<id>central</id>
+			<url>https://pkgs.dev.azure.com/azfunc/public/_packaging/upstream-public/maven/v1</url>
 			<releases>
-				<enabled>false</enabled>
+				<enabled>true</enabled>
 			</releases>
 			<snapshots>
 				<enabled>true</enabled>
@@ -49,11 +48,10 @@
 
 	<pluginRepositories>
 		<pluginRepository>
-			<id>maven.snapshots</id>
-			<name>Maven Central Snapshot Repository</name>
-			<url>https://oss.sonatype.org/content/repositories/snapshots/</url>
+			<id>central</id>
+			<url>https://pkgs.dev.azure.com/azfunc/public/_packaging/upstream-public/maven/v1</url>
 			<releases>
-				<enabled>false</enabled>
+				<enabled>true</enabled>
 			</releases>
 			<snapshots>
 				<enabled>true</enabled>

endtoendtests/pom.xml

@@ -33,11 +33,10 @@
 
 	<repositories>
 		<repository>
-			<id>maven.snapshots</id>
-			<name>Maven Central Snapshot Repository</name>
-			<url>https://oss.sonatype.org/content/repositories/snapshots/</url>
+			<id>central</id>
+			<url>https://pkgs.dev.azure.com/azfunc/public/_packaging/upstream-public/maven/v1</url>
 			<releases>
-				<enabled>false</enabled>
+				<enabled>true</enabled>
 			</releases>
 			<snapshots>
 				<enabled>true</enabled>
@@ -47,11 +46,10 @@
 
 	<pluginRepositories>
 		<pluginRepository>
-			<id>maven.snapshots</id>
-			<name>Maven Central Snapshot Repository</name>
-			<url>https://oss.sonatype.org/content/repositories/snapshots/</url>
+			<id>central</id>
+			<url>https://pkgs.dev.azure.com/azfunc/public/_packaging/upstream-public/maven/v1</url>
 			<releases>
-				<enabled>false</enabled>
+				<enabled>true</enabled>
 			</releases>
 			<snapshots>
 				<enabled>true</enabled>

eng/ci/templates/jobs/build.yml

@@ -8,6 +8,17 @@ jobs:
       os: windows
 
     steps:
+    # Maven resolves plugins and extensions before a pom's repositories are honored. Install the
+    # mirror before MavenAuthenticate@0, which adds credentials to the same settings file.
+    - pwsh: |
+        $m2 = Join-Path $HOME '.m2'
+        New-Item -ItemType Directory -Path $m2 -Force | Out-Null
+        Copy-Item '$(Build.SourcesDirectory)/settings.xml' (Join-Path $m2 'settings.xml') -Force
+      displayName: 'Install Maven settings.xml'
+    - task: MavenAuthenticate@0
+      displayName: 'Authenticate Maven to CFS'
+      inputs:
+        artifactsFeeds: upstream-public
     - pwsh: |
         Get-Command mvn
       displayName: 'Check Maven is installed'
@@ -16,4 +27,4 @@ jobs:
       displayName: 'Check default java version'
     - pwsh: |
         mvn clean package
-      displayName: 'Build java worker'
+      displayName: 'Build java worker'

eng/ci/templates/jobs/run-docker-tests-linux.yml

@@ -25,6 +25,17 @@ jobs:
           javaVersion: '21'
 
     steps:
+      # Maven resolves plugins and extensions before a pom's repositories are honored. Install the
+      # mirror before MavenAuthenticate@0, which adds credentials to the same settings file.
+      - pwsh: |
+          $m2 = Join-Path $HOME '.m2'
+          New-Item -ItemType Directory -Path $m2 -Force | Out-Null
+          Copy-Item '$(Build.SourcesDirectory)/settings.xml' (Join-Path $m2 'settings.xml') -Force
+        displayName: 'Install Maven settings.xml'
+      - task: MavenAuthenticate@0
+        displayName: 'Authenticate Maven to CFS'
+        inputs:
+          artifactsFeeds: upstream-public
       - bash: |
           echo "=== disk BEFORE cleanup ==="
           df -h /

eng/ci/templates/jobs/run-emulated-tests-linux.yml

@@ -45,6 +45,17 @@ jobs:
           JAVA_VERSION_SPEC: '25'
 
     steps:
+      # Maven resolves plugins and extensions before a pom's repositories are honored. Install the
+      # mirror before MavenAuthenticate@0, which adds credentials to the same settings file.
+      - pwsh: |
+          $m2 = Join-Path $HOME '.m2'
+          New-Item -ItemType Directory -Path $m2 -Force | Out-Null
+          Copy-Item '$(Build.SourcesDirectory)/settings.xml' (Join-Path $m2 'settings.xml') -Force
+        displayName: 'Install Maven settings.xml'
+      - task: MavenAuthenticate@0
+        displayName: 'Authenticate Maven to CFS'
+        inputs:
+          artifactsFeeds: upstream-public
       - bash: |
           echo "=== disk BEFORE cleanup ==="
           df -h /
@@ -148,4 +159,4 @@ jobs:
         env:
           AzureWebJobsStorage: "UseDevelopmentStorage=true"
         displayName: 'Build & Run tests'
-        continueOnError: false
+        continueOnError: false

eng/ci/templates/jobs/run-emulated-tests-windows.yml

@@ -45,6 +45,17 @@ jobs:
           JAVA_VERSION_SPEC: '25'
 
     steps:
+      # Maven resolves plugins and extensions before a pom's repositories are honored. Install the
+      # mirror before MavenAuthenticate@0, which adds credentials to the same settings file.
+      - pwsh: |
+          $m2 = Join-Path $HOME '.m2'
+          New-Item -ItemType Directory -Path $m2 -Force | Out-Null
+          Copy-Item '$(Build.SourcesDirectory)/settings.xml' (Join-Path $m2 'settings.xml') -Force
+        displayName: 'Install Maven settings.xml'
+      - task: MavenAuthenticate@0
+        displayName: 'Authenticate Maven to CFS'
+        inputs:
+          artifactsFeeds: upstream-public
       - task: NuGetToolInstaller@1
         inputs:
           checkLatest: true
@@ -128,4 +139,4 @@ jobs:
         env:
           AzureWebJobsStorage: "UseDevelopmentStorage=true"
         displayName: 'Build & Run tests'
-        continueOnError: false
+        continueOnError: false

eng/ci/templates/official/jobs/build-artifacts.yml

@@ -28,6 +28,17 @@ jobs:
       isRelease: $[variables.isReleaseTemp]
 
     steps:
+      # Maven resolves plugins and extensions before a pom's repositories are honored. Install the
+      # mirror before MavenAuthenticate@0, which adds credentials to the same settings file.
+      - pwsh: |
+          $m2 = Join-Path $HOME '.m2'
+          New-Item -ItemType Directory -Path $m2 -Force | Out-Null
+          Copy-Item '$(Build.SourcesDirectory)/settings.xml' (Join-Path $m2 'settings.xml') -Force
+        displayName: 'Install Maven settings.xml'
+      - task: MavenAuthenticate@0
+        displayName: 'Authenticate Maven to CFS'
+        inputs:
+          artifactsFeeds: upstream-public
       - task: NuGetToolInstaller@1
         inputs:
           checkLatest: true
@@ -57,4 +68,4 @@ jobs:
           Contents: '*.nupkg'
           TargetFolder: '$(Build.ArtifactStagingDirectory)'
           CleanTargetFolder: true
-        displayName: 'Copying files for artifacts'
+        displayName: 'Copying files for artifacts'

eng/ci/templates/official/jobs/run-e2e-tests-linux.yml

@@ -38,6 +38,17 @@ jobs:
           JAVA_VERSION_SPEC: '21'
 
     steps:
+      # Maven resolves plugins and extensions before a pom's repositories are honored. Install the
+      # mirror before MavenAuthenticate@0, which adds credentials to the same settings file.
+      - pwsh: |
+          $m2 = Join-Path $HOME '.m2'
+          New-Item -ItemType Directory -Path $m2 -Force | Out-Null
+          Copy-Item '$(Build.SourcesDirectory)/settings.xml' (Join-Path $m2 'settings.xml') -Force
+        displayName: 'Install Maven settings.xml'
+      - task: MavenAuthenticate@0
+        displayName: 'Authenticate Maven to CFS'
+        inputs:
+          artifactsFeeds: upstream-public
       - task: NuGetToolInstaller@1
         inputs:
           checkLatest: true
@@ -137,4 +148,4 @@ jobs:
           ApplicationInsightAPPID: $(ApplicationInsightAPPID)
           ApplicationInsightAgentVersion: $(ApplicationInsightAgentVersion)
         displayName: 'Build & Run tests'
-        continueOnError: false
+        continueOnError: false