Add Eclipse P2 mirror to avoid download.eclipse.org outages (neural-search)

[peterzhuamazon]

Description

Add withP2Mirrors to Spotless eclipse formatter to use ci.opensearch.org/eclipse/ CloudFront mirror instead of hitting download.eclipse.org directly. This prevents CI failures when Eclipse's download server is down or slow.

Issues Resolved

opensearch-project/opensearch-build#6421 (comment)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[peterzhuamazon]

expected mirror update.

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit f285ee5.

⛔ Hard block: Issues at High severity or above will block this PR from merging.

Path	Line	Severity	Description
formatter/formatting.gradle	10	high	Adds a P2 mirror that redirects Eclipse plugin downloads from the official 'https://download.eclipse.org/' to 'https://ci.opensearch.org/'. This modifies the source from which build-time Eclipse formatter artifacts (plugins/features) are fetched. Per mandatory supply chain rules, any change to package source URLs or build plugin registries must be flagged regardless of whether the target domain appears legitimate. A compromised or attacker-controlled mirror at ci.opensearch.org could serve malicious Eclipse plugins executed during the build process.

The table above displays the top 10 most important findings.

Total: 1 | Critical: 0 | High: 1 | Medium: 0 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.43%. Comparing base (746c7df) to head (d0f19a4).

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #1940      +/-   ##
============================================
+ Coverage     83.42%   83.43%   +0.01%     
- Complexity     3883     3886       +3     
============================================
  Files           291      291              
  Lines         13821    13821              
  Branches       2295     2295              
============================================
+ Hits          11530    11532       +2     
  Misses         1457     1457              
+ Partials        834      832       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

PR Reviewer Guide 🔍

(Review updated until commit d0f19a4)

Here are some key observations to aid the review process:

🧪 No relevant tests

🔒 No security concerns identified

✅ No TODO sections

🔀 No multiple PR themes

⚡ Recommended focus areas for review PR Scope Mismatch The PR description states this change adds withP2Mirrors to the Spotless eclipse formatter to use the ci.opensearch.org/eclipse/ CloudFront mirror. However, the diff only modifies .github/workflows/CI.yml (adding fail-fast: false and re-indenting the integMultiNodeTest job) and contains no Gradle/Spotless configuration change. The stated fix for the Eclipse P2 outage issue is not present in this diff. jobs: Get-CI-Image-Tag: uses: opensearch-project/opensearch-build/.github/workflows/get-ci-image-tag.yml@main with: product: opensearch Check-neural-search-linux: needs: Get-CI-Image-Tag strategy: fail-fast: false matrix: java: [21, 25] os: [ubuntu-latest] permissions: contents: read id-token: write name: Gradle Check Linux runs-on: ${{ matrix.os }} container: # using the same image which is used by opensearch-build team to build the OpenSearch Distribution # this image tag is subject to change as more dependencies and updates will arrive over time image: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-version-linux }} # need to switch to root so that github actions can install runner binary on container without permission issues. options: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-start-options }} steps: - name: Run start commands run: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-start-command }} - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Setup Java ${{ matrix.java }} uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4 with: distribution: 'temurin' java-version: ${{ matrix.java }} cache: 'gradle' - name: Run build run: | chown -R 1000:1000 `pwd` su `id -un 1000` -c "./gradlew check --parallel -x integTest" - name: Upload Coverage Report if: ${{ !cancelled() && contains(matrix.os, 'ubuntu') && contains(matrix.java, '21') }} uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5 with: token: ${{ secrets.CODECOV_TOKEN }} use_oidc: ${{ env.ACTIONS_ID_TOKEN_REQUEST_URL != '' }} use_pypi: true Check-neural-search-windows: strategy: fail-fast: false matrix: java: [21, 25] os: [windows-latest] name: Gradle Check Windows runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Setup Java ${{ matrix.java }} uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4 with: distribution: 'temurin' java-version: ${{ matrix.java }} cache: 'gradle' - name: Run build run: | ./gradlew check --parallel -x integTest Precommit-neural-search-linux: needs: Get-CI-Image-Tag strategy: fail-fast: false matrix: java: [21, 25] os: [ubuntu-latest] name: Pre-commit Linux runs-on: ${{ matrix.os }} container: # using the same image which is used by opensearch-build team to build the OpenSearch Distribution # this image tag is subject to change as more dependencies and updates will arrive over time image: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-version-linux }} # need to switch to root so that github actions can install runner binary on container without permission issues. options: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-start-options }} steps: - name: Run start commands run: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-start-command }} - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Setup Java ${{ matrix.java }} uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4 with: distribution: 'temurin' java-version: ${{ matrix.java }} cache: 'gradle' - name: Run build run: | chown -R 1000:1000 `pwd` su `id -un 1000` -c "./gradlew precommit -x integTest --parallel" integTest: needs: Precommit-neural-search-linux strategy: fail-fast: false matrix: java: [ 21, 25 ] os: [ ubuntu-latest ] name: Integ Test JDK${{ matrix.java }}, ${{ matrix.os }} runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Set up JDK ${{ matrix.java }} uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4 with: java-version: ${{ matrix.java }} cache: 'gradle' distribution: temurin - name: Build and Run Tests run: | ./gradlew integTest --parallel integMultiNodeTest: needs: Precommit-neural-search-linux strategy: fail-fast: false matrix: java: [ 21 ] os: [ ubuntu-latest ] configureNodeRoles: [ false, true ] name: Multi-Node Integ Test JDK${{ matrix.java }}, With Role Assignment ${{ matrix.configureNodeRoles }} runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Set up JDK ${{ matrix.java }} uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4 with: java-version: ${{ matrix.java }} distribution: temurin cache: 'gradle' - name: Build and Run Tests run: | ./gradlew integTest --parallel -PnumNodes=3 -PconfigureNodeRoles=${{ matrix.configureNodeRoles }}

[github-actions]

Persistent review updated to latest commit d0f19a4

[opensearch-ci-bot]

The backport to 3.8 failed. Please backport manually. See failed workflow run: https://github.com/opensearch-project/neural-search/actions/runs/31832669174