Resolve Gradle dependencies through the azfunc Azure Artifacts feed

azdevops-pipeline/build-release-artifacts.yml

@@ -24,6 +24,7 @@ steps:
     jdkArchitectureOption: 'x64'
     publishJUnitResults: false
     tasks: clean assemble
+    options: '--init-script init.gradle'
   displayName: Assemble durabletask-client and durabletask-azure-functions
 
 # the secring.gpg file is required to sign the artifacts, it's generated from GnuPG, and it's stored in the library of the durabletaskframework ADO
@@ -42,7 +43,7 @@ steps:
     jdkVersionOption: '$(jdkVersion)'
     jdkArchitectureOption: 'x64'
     tasks: publish
-    options: '-Psigning.keyId=$(gpgSignKey) -Psigning.password=$(gpgSignPassword) -Psigning.secretKeyRingFile=$(gpgSecretFile.secureFilePath)'
+    options: '--init-script init.gradle -Psigning.keyId=$(gpgSignKey) -Psigning.password=$(gpgSignPassword) -Psigning.secretKeyRingFile=$(gpgSecretFile.secureFilePath)'
   displayName: Publish durabletask-client and durabletask-azure-functions
 
 - task: CopyFiles@2

eng/templates/build.yml

@@ -24,6 +24,7 @@ jobs:
             jdkArchitectureOption: 'x64'
             publishJUnitResults: false
             tasks: clean assemble
+            options: '--init-script init.gradle'
           displayName: Assemble durabletask-client and durabletask-azure-functions and durabletask-azuremanaged
 
         # the secring.gpg file is required to sign the artifacts, it's generated from GnuPG, and it's stored in the library of the durabletaskframework ADO
@@ -42,7 +43,7 @@ jobs:
             jdkVersionOption: 1.11
             jdkArchitectureOption: 'x64'
             tasks: publish
-            options: '-Psigning.keyId=$(gpgSignKey) -Psigning.password=$(gpgSignPassword) -Psigning.secretKeyRingFile=$(gpgSecretFile.secureFilePath)'
+            options: '--init-script init.gradle -Psigning.keyId=$(gpgSignKey) -Psigning.password=$(gpgSignPassword) -Psigning.secretKeyRingFile=$(gpgSecretFile.secureFilePath)'
           displayName: Publish durabletask-client and durabletask-azure-functions and durabletask-azuremanaged
 
         - task: CopyFiles@2

init.gradle

@@ -0,0 +1,26 @@
+allprojects {
+    def azfuncFeedUrl = 'https://pkgs.dev.azure.com/azfunc/public/_packaging/upstream-public/maven/v1'
+    def azfuncFeedToken = System.getenv('AZURE_ARTIFACTS_ENV_ACCESS_TOKEN') ?: findProperty('vstsMavenAccessToken')
+    repositories {
+        maven {
+            url azfuncFeedUrl
+            if (azfuncFeedToken) {
+                credentials {
+                    username 'Azure DevOps Services'
+                    password azfuncFeedToken
+                }
+            }
+        }
+    }
+    // Keep only the Azure Artifacts feed (and MavenLocal); remove every other Maven repository so no
+    // public repository can bypass the feed.
+    afterEvaluate { proj ->
+        def isNonFeedMaven = { repo ->
+            repo instanceof MavenArtifactRepository &&
+            repo.name != 'MavenLocal' &&
+            !repo.url.toString().startsWith(azfuncFeedUrl)
+        }
+        proj.repositories.findAll(isNonFeedMaven).each { proj.repositories.remove(it) }
+        proj.buildscript.repositories.findAll(isNonFeedMaven).each { proj.buildscript.repositories.remove(it) }
+    }
+}

settings.gradle

@@ -1,3 +1,21 @@
+pluginManagement {
+    // Resolve plugins from the Azure Artifacts feed when its token is available; otherwise the public portal.
+    def azfuncFeedToken = System.getenv('AZURE_ARTIFACTS_ENV_ACCESS_TOKEN') ?: providers.gradleProperty('vstsMavenAccessToken').orNull
+    repositories {
+        if (azfuncFeedToken) {
+            maven {
+                url 'https://pkgs.dev.azure.com/azfunc/public/_packaging/upstream-public/maven/v1'
+                credentials {
+                    username 'Azure DevOps Services'
+                    password azfuncFeedToken
+                }
+            }
+        } else {
+            gradlePluginPortal()
+        }
+    }
+}
+
 rootProject.name = 'durabletask-java'
 
 include ":client"