Technology Blogs by SAP
Learn how to extend and personalize SAP applications. Follow the SAP technology blog for insights into SAP BTP, ABAP, SAP Analytics Cloud, SAP HANA, and more.
cancel
Showing results for 
Search instead for 
Did you mean: 
christoph_pohl
Product and Topic Expert
Product and Topic Expert

Since its first announcement, SAP BTP, ABAP environment  (a.k.a. Steampunk) has been using git-based repositories for customer lifecycle management under the hood. However, customer developers have hardly ever noticed this in daily work, and despite gCTS being used internally, it was hard to tap into the benefits of a git-based lifecycle. This now changes with the 2402 release of SAP BTP ABAP Environment.

You will be able to choose your own git service provider and thus also connect CI/CD pipelines (cf. CI/CD Tools for SAP BTP ABAP Environment) of your choice directly to the commit hooks of that service.

 

Prerequisites

First, you need to create a new git repository with an initial commit and branch  at the git service of your choice. We have used GitHub in our example below. The repository must be accessible from the internet, i.e., not hidden behind a firewall. You need a user with permissions to clone, pull, and push the chosen repository. Lastly, the SAP BTP ABAP systems you want to connect (e.g., dev, test, prod) all need to belong to the same global account.

 

Create and clone a new Software Component

You log on to the SAP Fiori Launchpad of your development system with a user holding a business role from template id SAP_BR_ADMINISTRATOR and go to the Manage Software Components app to create a new software component. With release 2402 you will notice the additional, optional Repository URL field on the New Software Component dialog:

christoph_pohl_0-1706542646691.png

As the name suggests, here you enter the URL of your initially empty git repository that your software component shall be connected to. The repo must already have an initial branch, usually „main“. Otherwise the user cannot clone the repository. In this case the user will see a „No branches were found. Please create a branch before cloning.“ message in the clone popup.

christoph_pohl_1-1706542646707.png

You will see the resulting software component as available in the Manage Software Components app. The connection to your git repository is registered but not yet locally cloned.

christoph_pohl_2-1706542646718.png

Next step is to clone the remote git repository to your app server’s local filesystem from where the objects will be imported into the ABAP runtime. You need to provide user credentials with sufficient privileges for this purpose on the first page of the Clone Software Component dialog. After the credentials have been validated, you must select a branch to be checked out and decide on the local role of your repository. For development systems, choose the role “Source” so that you can also push from your system to the remote repository.

christoph_pohl_3-1706542646726.pngchristoph_pohl_4-1706542646733.png

Once you are done, you will see a new commit on your remote repository that has written a new file “.gcts.properties.json”. This file must not be deleted because it stores essential configuration data for gCTS.

christoph_pohl_5-1706542646737.png

 

Branching

Afterwards you need to pull the branch of your choice using the Manage Software Components app. It is important that your branches always contain the aforementioned “.gcts.properties.json” file created by the commit titled “Modify repository layout”. Otherwise, you will not be able to pull this branch to your system. Then you are ready to start some development.

christoph_pohl_6-1706542646758.png

 

Develop and release transports

As a developer you can now create some objects in ABAP Development Tools for Eclipse (ADT) underneath the structure package corresponding to the name of your software component. Changes will be recorded in tasks of transport requests as usual. Release them when you are ready with your development.

christoph_pohl_7-1706542646786.png

As soon as you have released a transport request, a new commit will become visible in your remote git repository on the active branch that you have chosen. You will notice that new files and folders have been created there.

christoph_pohl_8-1706542646790.png

 

Pull into target system

To import your released transport into a target system (e.g., your test or production system), your administrator must clone the same software component to the desired system. The only difference is the “Repository Role”, which now must be set to “Target”. After pulling the corresponding commit to the system, the changes will be imported to the ABAP runtime.

christoph_pohl_9-1706542646794.png

 

Fingerprints and external changes

Now let’s have a closer look at the details of the files written to git.

Besides the metadata and sources, a file FINGERPRINT.json is written for every transported object. It contains fingerprints for every include file of the object, which will be validated in the target system during pull from git.

christoph_pohl_10-1706542646800.png

This fingerprint is calculated from the content hash of your file and a secret that is only known internally to ABAP Cloud systems of your global account. The following picture gives an overview.

christoph_pohl_11-1706542646804.png

This ensures that only commits pushed (and validated) from ABAP Cloud systems can be pulled to target systems. Otherwise, stability of target systems could be jeopardized when external changes from git that have not passed ABAP Cloud allow-list checks and consistency rules are inadvertently imported. This is especially important for production systems.

Now let’s check what happens when you try pull an external commit. Therefore, let’s arbitrarily change some file directly in your git service.

christoph_pohl_12-1706542646807.png

When trying to pull this into one of the ABAP Cloud systems in your account via the Manage Software Components app, you will receive an error in the Execution Log.

christoph_pohl_13-1706542646817.png

You can further drill down into the transport logs to finally see that there was an exception when matching the fingerprints of pulled files.

christoph_pohl_14-1706542646824.png

To recover from this situation, you must revert the conflicting commit on your remote repository. It is important that the fingerprints match again to the files as originally exported from your development system, before pulling again to an ABAP Cloud system.

 

Outlook

Being able to edit ABAP sources with external tools would have a lot of benefits, e.g., for conflict resolution after merging or cherry-picking. For the future, the idea is to allow also external changes by falling back to an inactive import in case of mismatching fingerprints. This will ensure that all necessary ABAP Cloud checks are conducted when activating the objects again in the importing (development) system.

Another restriction is that there is currently no straightforward possibility to migrate existing applications to your own git repository, especially when it has already been deployed to production. This feature is of course also high on the wish list.

 

Further Information

 

12 Comments
fabianlupa
Contributor

Hey @christoph_pohl ,

the title seems highly misleading, at least to me. I somewhat assumed I can now use my onpremise git hosts behind VPN with abapGit (and gCTS...) in SAP BTP ABAP Environment (and hopefully S/4HANA Public Cloud) and there would be some details on how to configure this with proxies, authentication etc. Which is something I would look forward to and actively use. However:

 


@christoph_pohl wrote:

However, customer developers have hardly ever noticed this in daily work, and despite gCTS being used internally, it was hard to tap into the benefits of a git-based lifecycle. This now changes with the 2402 release of SAP BTP ABAP Environment.

You will be able to choose your own git service provider and thus also connect CI/CD pipelines (cf. CI/CD Tools for SAP BTP ABAP Environment) of your choice directly to the commit hooks of that service.

[...]

First, you need to create a new git repository with an initial commit and branch  at the git service of your choice. We have used GitHub in our example below. The repository must be accessible from the internet, i.e., not hidden behind a firewall.


I'd therefore argue it's still hard to tap into the benefits 😛 Are there plans to allow onpremise git installations like it works in BAS? (Connecting to a Corporate Git Repository | SAP Help Portal)

Regarding the details below that: Isn't it the same as it always was with gCTS? The fingerprinting stuff is news to me but everything else is the same as onpremise gCTS? Was gCTS not available at all in Steampunk yet or were there restrictions compared to onpremise gCTS that are now lifted?

The further information links do not work by the way. The tutorial link leads to "Sorry, we couldn't find that tutorial" and the SAP Help link just links to the "SAP BTP, ABAP environment" main page so I couldn't find any answers to my questions there. Maybe these documents are not public yet?

Best regards
Fabian

christoph_pohl
Product and Topic Expert
Product and Topic Expert

Dear @fabianlupa ,

thanks for your candid feedback! Yes, there are plans to support also custom on-premise git services, e.g., using SAP Cloud Connector. However, there is no committed roadmap yet for this feature.

Regarding your question about gCTS: Customers use a dedicated gCTS UI for their on-premise installations, while the Manage Software Components app hides some of the potential complexity in ABAP Cloud. gCTS was used all the time in Steampunk under the hood, though.

The link to the tutorial should be working now. Thanks for spotting the slip error.

HTH,

Christoph

BjörnS
Explorer
0 Kudos

Hello @christoph_pohl,

are there any further configuration steps for the ABAP envrionment to do? When I try to log-in into the GitHub account (Clone software component), I get a handshake error (message from browser console):

Request failed with status code 400: GET fetch_branches?sap-client=100&sc_name='###'&git_user='###'&git_token='###'&repo_url='https%3A%2F%2Fgithub.com%2F###.git' - [{"code":"A4C_A2G/000","message":"SSL handshake with github.com:443 failed: SSSLERR_","persistent":true,"targets":["/SoftwareComponents"],"type":"Error"}] sap.ui.model.odata.ODataMessageParser

 

There is an active main branch for this repository.

Greetings 

Björn

christoph_pohl
Product and Topic Expert
Product and Topic Expert

Hello @BjörnS 

GitHub.com has recently switched their SSL certificate to a different Root CA, which is currently not yet on the SAP Global Trust List, see https://github.tools.sap/sgs/SAP-Global-Trust-List  and https://me.sap.com/notes/2801396 

The workaround is to manually add this to your system's trust list as described by @Andre_Fischer  :

https://community.sap.com/t5/technology-q-a/how-to-overcome-an-http-error-421-occured-ssl-handshake-... 

Sorry for the inconvenience!

Best, Christoph

rmnachi_kx
Explorer
0 Kudos

Hello @christoph_pohl 

First - Thank you for the wonderful step by step blog 🙂 

I tried to replicate this using GitHub and BitBucket. With both the option - my clone failed at "Step 9: Saving User Credentials". 

I tried with Bit Bucket first and thought the problem may be with some access at Bit Bucket level, however I see the same error message and roll back for Git Hub as well while cloning.

The error messages are not helping much. Looks like authentication successful, local repository, software component, structure package creations are successful. After that, a step of saving credential is failing &  roll back happens. I understand somewhere SAP is trying to store credential but not sure where. 

Execution logs of clone failure

rmnachi_kx_0-1712580238035.png

 

 

ivanrodrigo
Discoverer
0 Kudos

Hi @rmnachi_kx @christoph_pohl 

Today i had the same problem you mentioned. Looking, i think it may be because the Credential Store instance is not configured in the subaccount. It's the only thing I can think of.

Do you have the credential store configured?

Greetings and thanks

 

rmnachi_kx
Explorer
0 Kudos

Hello @ivanrodrigo ,

Yes - I have configured right after getting the error. However, its of no use. I'm still stuck in this space and no other documentation available anywhere to the best of my knowledge. Please update if you find any solution. 

@christoph_pohl : Is there any new change happened and do we need to add any other step like configure / save credentials elsewhere ? I'm not sure why this is failing with "Saving Credentials failed". Any further help on this is highly appreciated. 

ivanrodrigo
Discoverer
0 Kudos

Hi,

Well, I haven't found it. In the end we will do it through gCTS to deploy between subaccounts. And I will use abapgit for backup and for other types of deployments.

I was also not convinced that the repository had to be public. We are developing a product and need something private.

Anything I find out I'll tell you.

Best regards

 

rmnachi_kx
Explorer
0 Kudos

Hello @ivanrodrigo / @christoph_pohl ,

I have created an SAP incident asking for where SAP is expecting to store credentials and I received below response. Looks like its another certificate expiration issue with Github Root, which will be patched in 2405 in Mid-May. As of now, SAP consultant has installed the certificate in our system & I'm able to successfully clone GitHub. 

SAP Response

"Unfortunately the issue became recently known to us and it is caused by an expired Github Root certificate that needs to be installed in the correct folder. We have taken note of this problem and it will be automatically fixed starting with the release of 2405 in mid-May. I have installed the certificate in your system, could you please try the clone again and let me know if it worked?"

ivanrodrigo
Discoverer
0 Kudos

Hello,

Thanks for the reply. I had updated the certificates because I was having problems with abapgit in eclipse.

At the moment we are using gCts which works well for us internally.

Best regards

rmnachi_kx
Explorer
0 Kudos

To others, if you are facing the storing credentials issue. 

Its not https://github.tools.sap/sgs/SAP-Global-Trust-List  , which has caused the issue. Because, I have updated this after going through the blog while connecting with GitHut. Looks like, there is something more, that needs to be installed. So, if you are doing before may - reach out to SAP. In the incident, I havent received any information about what certificate was installed in our system. FYIP.

christoph_pohl
Product and Topic Expert
Product and Topic Expert

Sorry for the confusion. The workaround described at https://community.sap.com/t5/technology-q-a/how-to-overcome-an-http-error-421-occured-ssl-handshake-... does not work here as expected, because it updates only the system's user trust list but not for technical SAP users.

Meanwhile the SAP Global Trust List has been updated with the new root CA "UserTrust ECC Authority" that GitHub.com is using. But it will take still some time until the change has been propagated through all running systems with the next 2405 upgrade mid of May.

Sorry for the inconvenience,

Christoph