Publish contrast-mcp-core Artifact

 87    dependencies {
-88        implementation enforcedPlatform("org.springframework.boot:spring-boot-dependencies:${springBootVersion}")
+88        if (project.name == 'contrast-mcp-core') {
+89            // Published libraries should not force Spring-managed dependency versions on consumers.
+90            // The tested baseline is the Spring Boot BOM version pinned by springBootVersion.
+91            implementation platform("org.springframework.boot:spring-boot-dependencies:${springBootVersion}")
+92        } else {
+93            // Deployable modules run with the exact Spring Boot dependency set tested by this repo.
+94            implementation enforcedPlatform("org.springframework.boot:spring-boot-dependencies:${springBootVersion}")
+95        }
    

+6plugins {
+7    id 'maven-publish'
+8}
+ 
 10dependencies {
 11    api 'org.springframework:spring-core'
 12    api 'com.google.code.gson:gson'
 13
 14    implementation 'org.slf4j:slf4j-api'
 15}
+ 
+17publishing {
+18    publications {
+19        mavenJava(MavenPublication) {
+20            from components.java
+21            pom {
+22                name = 'contrast-mcp-core'
+23                description = 'Transport-neutral shared support library for Contrast MCP servers.'
+24                url = 'https://github.com/Contrast-Security-Inc/mcp-contrast'
+25                licenses {
+26                    license {
+27                        name = 'Apache License, Version 2.0'
+28                        url = 'https://www.apache.org/licenses/LICENSE-2.0'
+29                    }
+30                }
+31            }
+32        }
+33    }
+34    repositories {
+35        maven {
+36            name = version.toString().endsWith('-SNAPSHOT')
+37                ? 'contrastInternalSnapshot'
+38                : 'contrastInternalRelease'
+39            url = uri(version.toString().endsWith('-SNAPSHOT')
+40                ? 'https://pkg.contrastsecurity.com/artifactory/maven-snapshot-local'
+41                : 'https://pkg.contrastsecurity.com/artifactory/maven-release-local')
+42            credentials {
+43                username = findProperty('contrastArtifactoryUser') ?: ''
+44                password = findProperty('contrastArtifactoryPassword') ?: ''
+45            }
+46        }
+47    }
+48}
    

+50tasks.register('verifyCorePublicationMetadata') {
+51    description = 'Validates published contrast-mcp-core POM and Gradle module metadata.'
+52    group = 'verification'
+53    dependsOn 'generateMetadataFileForMavenJavaPublication'
+54    dependsOn 'generatePomFileForMavenJavaPublication'
+55
+56    doLast {
+57        def pomFile = layout.buildDirectory.file('publications/mavenJava/pom-default.xml').get().asFile
+58        def moduleFile = layout.buildDirectory.file('publications/mavenJava/module.json').get().asFile
    

+76        [
+77            'org.springframework:spring-core:compile',
+78            'com.google.code.gson:gson:compile',
+79            'org.slf4j:slf4j-api:runtime'
+80        ].each { expectedDependency ->
+81            if (!dependencies.contains(expectedDependency)) {
+82                throw new GradleException(
+83                    "Missing expected POM dependency ${expectedDependency}; found ${dependencies}")
+84            }
+85        }
    

+87        [
+88            'org.projectlombok:lombok',
+89            'com.contrast.labs.ai.mcp:contrast-mcp-stdio-app',
+90            'com.contrastsecurity:contrast-sdk-java',
+91            'org.springframework.ai:spring-ai-starter-mcp-server'
+92        ].each { forbiddenDependency ->
+93            if (dependencies.any { it.startsWith("${forbiddenDependency}:") }) {
+94                throw new GradleException("POM must not publish ${forbiddenDependency}")
+95            }
+96        }
    

+123check.dependsOn tasks.named('verifyCorePublicationMetadata')
    

+1#!/usr/bin/env bash
+2set -euo pipefail
+3
+4ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+5
+6log() {
+7  printf '[core-publication] %s\n' "$*"
+8}
+9
+10cd "${ROOT_DIR}"
+11
+12version="$(./gradlew -q printVersion)"
+13jar_path="${ROOT_DIR}/contrast-mcp-core/build/libs/contrast-mcp-core-${version}.jar"
+14
+15log "gate=S3B-CORE-BOUNDARY-SMOKE step=publishToMavenLocal version=${version}"
+16./gradlew --no-daemon :contrast-mcp-core:publishToMavenLocal :contrast-mcp-core:verifyCorePublicationMetadata
    

+24required_classes=(
+25  "com/contrast/labs/ai/mcp/contrast/tool/validation/ToolValidationContext.class"
+26  "com/contrast/labs/ai/mcp/contrast/tool/base/ToolParams.class"
+27  "com/contrast/labs/ai/mcp/contrast/hints/HintGenerator.class"
+28)
+29
+39forbidden_classes=(
+40  "com/contrast/labs/ai/mcp/contrast/McpContrastApplication.class"
+41  "com/contrast/labs/ai/mcp/contrast/config/ContrastProperties.class"
+42  "com/contrast/labs/ai/mcp/contrast/config/ContrastSDKFactory.class"
+43  "com/contrast/labs/ai/mcp/contrast/config/SDKExtensionFactory.class"
+44  "com/contrast/labs/ai/mcp/contrast/client/SdkApiClient.class"
+45  "com/contrast/labs/ai/mcp/contrast/sdkextension/SDKHelper.class"
+46  "com/contrast/labs/ai/mcp/contrast/sdkextension/SDKExtension.class"
+47  "com/contrast/labs/ai/mcp/contrast/tool/sast/GetSastResultsTool.class"
+48)
    

-6env:
-7  DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: "${{secrets.DIGICERT_PKEY_PASSPHRASE}}"
-8  DOCKER_CONTENT_TRUST_KEY_FILENAME: "${{secrets.DIGICERT_PKEY_FILENAME}}"
-9  DOCKER_CONTENT_TRUST_PKEY_ROLE: "${{secrets.DIGICERT_PKEY_ROLE}}"
-10  DOCKER_CONTENT_TRUST: 1
    

 151      - name: Push and sign Docker image with DCT
+152        env:
+153          DOCKER_CONTENT_TRUST: 1
+154          DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: ${{ secrets.DIGICERT_PKEY_PASSPHRASE }}
 155        run: |
 156          echo "${{ steps.meta.outputs.tags }}" | while read -r tag; do
 157            echo "Pushing and signing $tag"
-158            docker push $tag
+158            docker push "$tag"
 159          done