Build Maintenance (#639)

* Fix missing case in MDM

* Update mill-version

* Update versions

* Update magnolia versions

* Lint + downgrading scala native (#640)

* Update zio-json, zio-json-golden to 0.7.1

* Lint + downgrading scala native

---------

Co-authored-by: Scala Steward <scala_steward@virtuslab.com>

* Add sonatype scanning

* fix build deps

* Rollback to Scala Native 0.4.17

* Fix ZIO version

* Downgrading zio json (#641)

* Build maintenance (#642)

* Downgrading zio json

* Upgrading bun and moon

---------

Co-authored-by: Michelle <6752211+michelchan@users.noreply.github.com>
Co-authored-by: Scala Steward <scala_steward@virtuslab.com>

.github/workflows/ci.yml

@@ -3,6 +3,11 @@ name: CI
 env:
   JDK_JAVA_OPTIONS: -XX:+PrintCommandLineFlags -Xss10M # JDK_JAVA_OPTIONS is _the_ env. variable to use for modern Java
   JVM_OPTS: -XX:+PrintCommandLineFlags -Xss10M # for Java 8 only (sadly, it is not modern enough for JDK_JAVA_OPTIONS)
+  SonatypeUrl: 'https://finos.sonatype.app/platform/'
+  SonatypeAppId: morphir-scala
+  SonatypeStage: 'build' 
+  SonatypeScanTarget: '.' # depCache/coursier/v1/https/repo1.maven.org/maven2/
+  ExcludeDirectory: " -D fileExcludes='*.class, **/website/, **/docs/, **/.*' "
 
 on:
   pull_request:
@@ -166,10 +171,69 @@ jobs:
             out/morphir/${{matrix.scala}}/**/native/
           key: ${{ runner.os }}-mill-native-${{matrix.java}}-${{ matrix.scala }}-${{ github.sha }}-${{ hashFiles('out') }}
 
+  ############### SONATYPE SCAN ###############
+  sonatype-scan:
+    if: always()
+    needs: [ci]
+    runs-on: ubuntu-latest
+    steps:
+    - name: Cache scala dependencies
+      uses: coursier/cache-action@v6
+
+    - name: Get OUT cache
+      uses: actions/cache/restore@v4
+      with:
+        path: out/
+        key: ${{ runner.os }}-*
+
+    - name: Copy Cache for SCA Scan
+      run: |
+        mkdir depCache/ #Create local copy of cache for Sonatype Scanner
+        cp -r /home/runner/.cache/coursier/ depCache/
+    # - name: Save resolvedIvyDeps.json
+    #   run: ./mill show __.resolvedIvyDeps > depCache/resolvedIvyDeps.json
+
+    # - name: Upload Dependency Cache (optional)
+    #   uses: actions/upload-artifact@v4
+    #   with:
+    #     name: Dependency Cache
+    #     path: depCache/
+
+    - name: Sonatype Lifecycle SCA Scan
+      uses: sonatype-nexus-community/iq-github-action@master
+      with:
+        username: ${{ secrets.SONATYPE_USER }}
+        password: ${{ secrets.SONATYPE_PASSWORD }}
+        serverUrl: ${{ env.SonatypeUrl }}
+        applicationId: ${{ env.SonatypeAppId }}
+        stage: ${{ env.SonatypeStage }}
+        target: ${{ env.SonatypeScanTarget }} ${{ env.ExcludeDirectory }}
+
+    - name: Retrieve Sonatype SBOM (SPDX)
+      if: always()
+      run: |
+        mkdir reports/
+        iqCredentials=${{ secrets.SONATYPE_USER }}:${{ secrets.SONATYPE_PASSWORD }}
+        echo 'Get internal app ID for public ID: '$SonatypeAppId
+        res=$(curl -u $iqCredentials --location $SonatypeUrl'api/v2/applications?publicId='$SonatypeAppId)
+        IFS='"' read -a array <<< "$res"
+        echo 'Internal app ID: '${array[5]}
+        internalID=${array[5]}
+        curl -u $iqCredentials --location $SonatypeUrl'api/v2/spdx/'$internalID'/stages/'$SonatypeStage -H 'Accept: application/xml' > reports/$SonatypeAppId.spdx.json
+        echo 'Sonatype SBOM (SPDX): '
+        cat reports/$SonatypeAppId.spdx.json
+    - name: Upload Sonatype SBOM (SPDX)
+      if: always()
+      uses: actions/upload-artifact@v4
+      with:
+        name: ${{ env.SonatypeAppId }} Sonatype SBOM (SPDX) 
+        path: reports/
+  #############################################          
+
   publish-sonatype:
     # when in master repo: all commits to main branch and all additional tags
     if: github.repository == 'finos/morphir-scala' && ( github.ref == 'refs/heads/main' || (github.ref != 'refs/heads/main' && startsWith( github.ref, 'refs/tags/') ) )
-    needs: [ci]
+    needs: [sonatype-scan, ci]
 
     runs-on: ubuntu-latest
 

.mill-version

@@ -1 +1 @@
-0.11.7-86-18d144
+0.11.8

.prototools

@@ -1,5 +1,5 @@
-bun = "1.1.7"
-moon = "1.24.4"
+bun = "1.1.18"
+moon = "1.26.7"
 
 [plugins]
 moon = "source:https://raw.githubusercontent.com/moonrepo/moon/master/proto-plugin.toml"

mill-build/src/millbuild/settings/MillSettings.scala

@@ -13,6 +13,6 @@ case class MillSettings(
 object MillSettings {
   val config: Config[MillSettings]                          = deriveConfig[MillSettings]
   lazy val default: MillSettings                            = MillSettings()
-  lazy val defaultScalaVersion                              = "2.13.10"
+  lazy val defaultScalaVersion                              = "2.13.13"
   implicit val rw: upickle.default.ReadWriter[MillSettings] = upickle.default.macroRW
 }

morphir/runtime/src/org/finos/morphir/runtime/quick/testing/Expect.scala

@@ -594,12 +594,12 @@ private[runtime] object Expect {
         context: CallStackFrame,
         arg1: TransparentArg
     ): SingleTestResult =
-    arg1.value match {
-      case RT.Primitive.Boolean(true)  => SingleTestResult.Passed
-      case RT.Primitive.Boolean(false) => SingleTestResult.Failed(explainFailure(globals, context, arg1.ir))
-      case _ =>
-        SingleTestResult.Err(UnexpectedTypeWithIR("Bool type", arg1.value, arg1.ir, hint = "(in Expext.assert)"))
-    }
+      arg1.value match {
+        case RT.Primitive.Boolean(true)  => SingleTestResult.Passed
+        case RT.Primitive.Boolean(false) => SingleTestResult.Failed(explainFailure(globals, context, arg1.ir))
+        case _ =>
+          SingleTestResult.Err(UnexpectedTypeWithIR("Bool type", arg1.value, arg1.ir, hint = "(in Expext.assert)"))
+      }
 
     /**
      * This helper function inspects the IR and matches it against recognized patterns for more detailed reporting

morphir/runtime/src/org/finos/morphir/runtime/quick/testing/UnitTesting.scala

@@ -92,7 +92,7 @@ object UnitTesting {
         val detailedReport = reportResult(globals, dists, testNames)
 
         if (detailedReport.passed == simplePassed)
-        RTAction.succeed(detailedReport)
+          RTAction.succeed(detailedReport)
         // If the results were different, something went wrong in our test framework - it either hid an error, or created one that didn't exist in the simple pass
         else if (detailedReport.passed && (!simplePassed))
           throw new InvalidState(s"""Detailed Test Report passed, but simple morphir-based testing failed.
@@ -158,25 +158,25 @@ object UnitTesting {
     // Top-level tests without a name are given a name from their FQN
     // TODO: Preserve the FQName either way, for better tooling integration (code coverage?)
     val testSet: TestSet[RT] =
-    TestSet[RT](
-      testRTValues
-        .groupBy { case (fqn, _) => (fqn.pack, fqn.getModuleName) }
-        .map { case ((pkgName, modName), tests) =>
-          ModuleTests[RT](
-            pkgName,
-            modName,
-            tests.map {
-              case (fqn, Left(err)) => TestTree.Error(fqn.localName.toCamelCase, err)
-              case (fqn, Right(rt)) =>
-                TestTree.fromRTValue(rt) match {
-                  case d: TestTree.Describe[_]   => d
-                  case s: TestTree.SingleTest[_] => s
-                  case other                     => TestTree.Describe(fqn.localName.toCamelCase, List(other))
-                }
-            }
-          )
-        }.toList
-    ).resolveOnly // "Only" requires special handling, so do that here
+      TestSet[RT](
+        testRTValues
+          .groupBy { case (fqn, _) => (fqn.pack, fqn.getModuleName) }
+          .map { case ((pkgName, modName), tests) =>
+            ModuleTests[RT](
+              pkgName,
+              modName,
+              tests.map {
+                case (fqn, Left(err)) => TestTree.Error(fqn.localName.toCamelCase, err)
+                case (fqn, Right(rt)) =>
+                  TestTree.fromRTValue(rt) match {
+                    case d: TestTree.Describe[_]   => d
+                    case s: TestTree.SingleTest[_] => s
+                    case other                     => TestTree.Describe(fqn.localName.toCamelCase, List(other))
+                  }
+              }
+            )
+          }.toList
+      ).resolveOnly // "Only" requires special handling, so do that here
     // User-defined thunks, and non-introspected expect calls (the magic SDK functions) are run here
     val withExpects = TestSet.getExpects(newGlobals, testSet)
     // And then the generated thunks are introspected, giving us our final SingleTestResults

morphir/src/org/finos/morphir/Dumper.scala

@@ -161,7 +161,7 @@ object Dumper extends DumperVersionSpecific with DumperSyntax {
    * Constructs a `Dumper[A]` from a function that converts a value of type `A` to a `Repr`.
    */
   def make[A](f: A => Dumper.Repr): Dumper[A] =
-  f(_)
+    f(_)
 
   /**
    * Derives a `Dumper[Array[A]]` given a `Dumper[A]`.

morphir/src/org/finos/morphir/ir/internal/Value.scala

@@ -370,11 +370,11 @@ object Value {
     def apply[TA, VA](attributes: VA, function: Value[TA, VA], arguments: scala.List[Value[TA, VA]])(implicit
         @unused ev: NeedsAttributes[VA]
     ): Value[TA, VA] =
-    arguments match {
-      case Nil => function
-      case head :: tail =>
-        tail.foldLeft(Apply(attributes, function, head)) { case (acc, arg) => Apply(acc.attributes, acc, arg) }
-    }
+      arguments match {
+        case Nil => function
+        case head :: tail =>
+          tail.foldLeft(Apply(attributes, function, head)) { case (acc, arg) => Apply(acc.attributes, acc, arg) }
+      }
     // arguments.foldLeft(Apply(attributes, function, arguments.head)) { case (acc, arg) => Apply(acc.attributes, acc, arg) }
 
     type Raw = Apply[scala.Unit, scala.Unit]

morphir/src/org/finos/morphir/qname.scala

@@ -33,7 +33,7 @@ trait QNameModule { self: ModuleNameModule with NameModule with PathModule =>
 
     /// Creates a qualified name from strings representing a module path and a local name.
     def fromName(modulePath: String, localName: String): QName =
-    QName(Path.fromString(modulePath), Name.fromString(localName))
+      QName(Path.fromString(modulePath), Name.fromString(localName))
 
     /// Get the local name part of a qualified name.
     def getLocalName(qname: QName): Name = qname.localName

morphir/src/org/finos/morphir/util/PrintDiff.scala

@@ -88,24 +88,24 @@ private class PrintDiff(val defaultWidth: Int = 150) extends pprint.Walker {
   }
 
   def duplicateTree(tree: Tree): (Tree, Tree) =
-  tree match {
-    case Apply(prefix, body) =>
-      val (aBody, bBody) = body.toList.map(duplicateTree(_)).unzip
-      (Apply(prefix, aBody.iterator), Apply(prefix, bBody.iterator))
+    tree match {
+      case Apply(prefix, body) =>
+        val (aBody, bBody) = body.toList.map(duplicateTree(_)).unzip
+        (Apply(prefix, aBody.iterator), Apply(prefix, bBody.iterator))
 
-    case KeyValue(key, value) =>
-      val (value1, value2) = duplicateTree(value)
-      (KeyValue(key, value1), KeyValue(key, value2))
+      case KeyValue(key, value) =>
+        val (value1, value2) = duplicateTree(value)
+        (KeyValue(key, value1), KeyValue(key, value2))
 
-    case l @ Lazy(_) => (l, l)
+      case l @ Lazy(_) => (l, l)
 
-    case Infix(lhs, op, rhs) =>
-      val (lhs1, lhs2) = duplicateTree(lhs)
-      val (rhs1, rhs2) = duplicateTree(rhs)
-      (Infix(lhs1, op, rhs1), Infix(lhs2, op, rhs2))
+      case Infix(lhs, op, rhs) =>
+        val (lhs1, lhs2) = duplicateTree(lhs)
+        val (rhs1, rhs2) = duplicateTree(rhs)
+        (Infix(lhs1, op, rhs1), Infix(lhs2, op, rhs2))
 
-    case l @ Tree.Literal(_) => (l, l)
-  }
+      case l @ Tree.Literal(_) => (l, l)
+    }
 
   // IMPORTANT - This function is actually destructive since it will make the Tree.Apply.body's iterator go to the end,
   // make sure to copy the tree before doing it

project/deps.sc

@@ -220,7 +220,7 @@ object Versions {
   val spire                      = "0.18.0"
   val `tasty-query`              = "0.5.6"
   val upickle                    = "3.0.0-M1"
-  val zio                        = "2.1.5"
+  val zio                        = "2.1.6"
   val `zio-cli`                  = "0.5.0"
   val `zio-config`               = "4.0.2"
   val `zio-interop-cats`         = "23.1.0.2"