feat: reproducible keystore generation, remove committed keystores

.github/actions/setup/action.yml

@@ -10,6 +10,19 @@
 runs:
     using: "composite"
     steps:
+        -   name: Install openssl if missing
+            run: |
+                if ! command -v openssl &>/dev/null; then
+                    if [ "$(id -u)" = "0" ]; then apt-get update && apt-get install -y openssl
+                    else sudo apt-get update && sudo apt-get install -y openssl; fi
+                fi
+            shell: bash
+        -   name: Download keystores
+            uses: actions/download-artifact@v4
+            with:
+                name: keystores-${{ env.JOB_ID }}
+                path: keystore/
+            continue-on-error: true
         -   name: Set up JDK ${{ inputs.jdkVersion }}
             uses: actions/setup-java@v4
             with:
@@ -18,8 +31,8 @@
         -   name: Set up Node
             uses: actions/setup-node@v4
             with:
-                node-version: '24.18.0'
-        -   run: npm install -g npm@10.9.8
+                node-version: '24.18.0'    # keep in sync with gradle/versions.gradle projectNode
+        -   run: npm install -g npm@10.9.8   # keep in sync with gradle/versions.gradle projectNpm
             shell: bash
         -   name: Grant execute permission for gradlew
             run: chmod +x gradlew

.gitignore

@@ -132,3 +132,15 @@ deploy-apiml.sh
 
 tools/*
 otel/otel-collector/export/*.json
+
+# Generated keystores — do not commit, regenerate via scripts/generate-keystores.sh
+keystore/**/*.p12
+keystore/**/*.cer
+keystore/**/*.key
+keystore/**/*.pem
+keystore/**/*.srl
+keystore/**/*.crt
+keystore/**/*.csr
+zaas-client/src/test/resources/localhost.keystore.p12
+zaas-client/src/test/resources/localhost.truststore.p12
+common-service-core/src/test/resources/jwt-public-key.pub

build.gradle

@@ -145,6 +145,10 @@ configure(subprojects.findAll { it.name in [
 configure(subprojects.findAll {it.name != 'platform'}) {
     apply plugin: 'java-library'
 
+    tasks.withType(JavaCompile).configureEach {
+        dependsOn generateKeystores
+    }
+
     java {
         sourceCompatibility = JavaVersion.VERSION_17
         targetCompatibility = JavaVersion.VERSION_17
@@ -358,6 +362,83 @@ task runChaoticHATests(dependsOn: ":integration-tests:runChaoticHATests") {
 
 clean.dependsOn nodejsClean
 
+def generateKeystores = tasks.register('generateKeystores', Exec) {
+    group = 'build'
+    description = 'Generate TLS keystores for local development and testing'
+    workingDir = rootProject.projectDir
+    if (System.getProperty('os.name').toLowerCase().contains('win')) {
+        commandLine 'cmd', '/c', 'bash scripts/generate-keystores.sh'
+    } else {
+        commandLine 'bash', 'scripts/generate-keystores.sh'
+    }
+    onlyIf {
+        if (project.hasProperty('skipKeystoreGeneration')) {
+            logger.lifecycle('Keystore generation skipped: skipKeystoreGeneration property is set')
+            return false
+        }
+        def keystoreDir = file('keystore')
+        if (keystoreDir.exists() && !fileTree(keystoreDir).matching { include '**/*.p12' }.empty) {
+            logger.lifecycle('Keystore generation skipped: keystores already exist in {}', keystoreDir)
+            return false
+        }
+        try {
+            def proc = 'openssl version'.execute()
+            proc.waitFor()
+            if (proc.exitValue() != 0) {
+                logger.lifecycle('Keystore generation skipped: openssl not available')
+                return false
+            }
+        } catch (IOException e) {
+            logger.lifecycle('Keystore generation skipped: openssl not available')
+            return false
+        }
+        true
+    }
+}
+
+// Copy generated keystores to zaas-client test resources
+// Runs when keystore/ is populated (generation OR artifact download)
+tasks.register('copyTestKeystores', Copy) {
+    group = 'build'
+    description = 'Copy generated keystores to zaas-client test resources'
+    from('keystore/localhost') {
+        include 'localhost.keystore.p12', 'localhost.truststore.p12'
+    }
+    into layout.projectDirectory.dir('zaas-client/src/test/resources')
+    onlyIf {
+        file('keystore/localhost/localhost.keystore.p12').exists()
+    }
+}
+
+// Extract JWT public key from localhost keystore for common-service-core tests
+tasks.register('extractJwtPublicKey', Exec) {
+    group = 'build'
+    description = 'Extract JWT public key for common-service-core tests'
+    workingDir = rootProject.projectDir
+    commandLine 'bash', '-c', """
+        openssl pkcs12 -in keystore/localhost/localhost.keystore.p12 \\
+            -passin pass:password -nokeys 2>/dev/null \\
+            | openssl x509 -pubkey -noout 2>/dev/null \\
+            | openssl pkey -pubin -outform DER 2>/dev/null \\
+            | base64 -w0 > "common-service-core/src/test/resources/jwt-public-key.pub"
+    """
+    onlyIf {
+        file('keystore/localhost/localhost.keystore.p12').exists()
+    }
+}
+
+// Wire tasks into subproject build lifecycle
+project(':zaas-client') {
+    tasks.named('processTestResources') {
+        dependsOn rootProject.tasks.named('copyTestKeystores')
+    }
+}
+project(':common-service-core') {
+    tasks.named('processTestResources') {
+        dependsOn rootProject.tasks.named('extractJwtPublicKey')
+    }
+}
+
 publishAllVersions.dependsOn publishZoweServerArtifacts
 
 publishAllSDKVersions.dependsOn publishZoweServerArtifacts

gradle/versions.gradle

@@ -1,9 +1,9 @@
 dependencyResolutionManagement {
     versionCatalogs {
         libs {
-            // for node projects
-            version('projectNode', '24.10.0')
-            version('projectNpm', '10.9.0')
+            // for node projects — keep in sync with .github/actions/setup/action.yml
+            version('projectNode', '24.18.0')
+            version('projectNpm', '10.9.8')     // keep in sync with .github/actions/setup/action.yml
 
             version('springBoot', '3.5.16')
             version('springBootGraphQl', '3.5.16')