Skip to content

Commit a9ca98e

Browse files
nscuronscuro
authored
Merge pull request #424 from CycloneDX/improve-ci-pipeline
CI pipeline improvements
2 parents e93b8d1 + c21d53e commit a9ca98e

File tree

6 files changed

+119
-66
lines changed

6 files changed

+119
-66
lines changed

‎.github/workflows/codeql-analysis.yml

+14-40
Original file line numberDiff line numberDiff line change
@@ -2,65 +2,39 @@ name: "CodeQL"
22

33
on:
44
push:
5-
branches: [master]
5+
branches:
6+
- master
67
pull_request:
7-
# The branches below must be a subset of the branches above
8-
branches: [master]
8+
branches:
9+
- master
910
schedule:
10-
- cron: '0 9 * * 5'
11+
- cron: '0 9 * * 5'
12+
13+
permissions: { }
1114

1215
jobs:
1316
analyze:
1417
name: Analyze
1518
runs-on: ubuntu-latest
16-
17-
strategy:
18-
fail-fast: false
19-
matrix:
20-
# Override automatic language detection by changing the below list
21-
# Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
22-
language: ['java']
23-
# Learn more...
24-
# https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
25-
19+
permissions:
20+
security-events: write
2621
steps:
2722
- name: Checkout repository
28-
uses: actions/checkout@v4.1.7
23+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # tag=v4.1.7
2924
with:
3025
# We must fetch at least the immediate parents so that if this is
3126
# a pull request then we can checkout the head.
3227
fetch-depth: 2
33-
3428
# If this run was triggered by a pull request event, then checkout
3529
# the head of the pull request instead of the merge commit.
3630
- run: git checkout HEAD^2
3731
if: ${{ github.event_name == 'pull_request' }}
38-
3932
# Initializes the CodeQL tools for scanning.
4033
- name: Initialize CodeQL
41-
uses: github/codeql-action/init@v3
34+
uses: github/codeql-action/init@23acc5c183826b7a8a97bce3cecc52db901f8251 # tag=v3.25.10
4235
with:
43-
languages: ${{ matrix.language }}
44-
# If you wish to specify custom queries, you can do so here or in a config file.
45-
# By default, queries listed here will override any specified in a config file.
46-
# Prefix the list here with "+" to use these queries and those in the config file.
47-
# queries: ./path/to/local/query, your-org/your-repo/queries@main
48-
49-
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
50-
# If this step fails, then you should remove it and run the build manually (see below)
36+
languages: java
5137
- name: Autobuild
52-
uses: github/codeql-action/autobuild@v3
53-
54-
# ℹ️ Command-line programs to run using the OS shell.
55-
# 📚 https://git.io/JvXDl
56-
57-
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
58-
# and modify them (or add more) to build your code if your project
59-
# uses a compiled language
60-
61-
#- run: |
62-
# make bootstrap
63-
# make release
64-
38+
uses: github/codeql-action/autobuild@23acc5c183826b7a8a97bce3cecc52db901f8251 # tag=v3.25.10
6539
- name: Perform CodeQL Analysis
66-
uses: github/codeql-action/analyze@v3
40+
uses: github/codeql-action/analyze@23acc5c183826b7a8a97bce3cecc52db901f8251 # tag=v3.25.10

‎.github/workflows/docs.yml

+10-8
Original file line numberDiff line numberDiff line change
@@ -6,24 +6,26 @@ on:
66
- master
77
workflow_dispatch:
88

9+
permissions: { }
10+
911
jobs:
1012
build-documentation:
1113
name: "Build documentation"
1214
runs-on: ubuntu-latest
15+
permissions:
16+
contents: write # Required to push commits to gh-pages branch
1317
timeout-minutes: 30
1418
steps:
15-
- uses: actions/checkout@v4.1.7
19+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # tag=v4.1.7
1620
- name: Set up JDK 8
17-
uses: actions/setup-java@v4
21+
uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # tag=v4.2.1
1822
with:
1923
distribution: temurin
2024
java-version: 8
2125
- name: Build with Maven
22-
run: mvn package --file pom.xml
23-
26+
run: mvn -B --no-transfer-progress package
2427
- name: Deploy documentation
25-
uses: JamesIves/github-pages-deploy-action@releases/v3
28+
uses: JamesIves/github-pages-deploy-action@5c6e9e9f3672ce8fd37b9856193d2a537941e66c # tag=v4.6.1
2629
with:
27-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
28-
BRANCH: gh-pages
29-
FOLDER: target/apidocs
30+
branch: gh-pages
31+
folder: target/apidocs

‎.github/workflows/maven.yml

+37-12
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,47 @@
11
name: Maven CI
22

3-
on: [push, pull_request]
3+
on:
4+
push:
5+
branches:
6+
- master
7+
pull_request:
8+
branches:
9+
- master
10+
11+
permissions: { }
412

513
jobs:
6-
build:
14+
test:
15+
name: Test
716
strategy:
817
matrix:
9-
os: [ ubuntu-latest ]
10-
java-version: [ 8 ]
11-
distro: [ 'zulu', 'temurin' ]
12-
runs-on: ${{ matrix.os }}
13-
18+
java-version: [ 8, 11, 17, 21 ]
19+
runs-on: ubuntu-latest
20+
timeout-minutes: 5
1421
steps:
15-
- uses: actions/checkout@v4.1.7
22+
- name: Checkout Repository
23+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # tag=v4.1.7
1624
- name: Set up JDK ${{ matrix.java-version }}
17-
uses: actions/setup-java@v4
25+
uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # tag=v4.2.1
1826
with:
19-
distribution: ${{ matrix.distro }}
27+
distribution: temurin
2028
java-version: ${{ matrix.java-version }}
21-
- name: Build with Maven
22-
run: mvn package --file pom.xml
29+
cache: maven
30+
- name: Test
31+
run: mvn -B --no-transfer-progress clean verify
32+
# Publishing coverage to Codacy is only possible for builds of push events.
33+
# PRs from forks do not get access to repository secrets.
34+
# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
35+
- name: Publish test coverage
36+
if: ${{ github.event_name != 'pull_request' && github.repository_owner == 'CycloneDX' && matrix.java-version == '21' }}
37+
uses: codacy/codacy-coverage-reporter-action@89d6c85cfafaec52c72b6c5e8b2878d33104c699 # tag=v1.3.0
38+
with:
39+
project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
40+
language: Java
41+
coverage-reports: target/site/jacoco/jacoco.xml
42+
- name: Upload PR test coverage report
43+
if: ${{ github.event_name == 'pull_request' }}
44+
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # tag=v4.3.3
45+
with:
46+
name: pr-test-coverage-report-java-${{ matrix.java-version }}
47+
path: target/site/jacoco/jacoco.xml

‎.github/workflows/pr-test-coverage.yml

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: Report PR Test Coverage
2+
3+
on:
4+
workflow_run:
5+
workflows:
6+
- Maven CI
7+
types:
8+
- completed
9+
10+
permissions: { }
11+
12+
jobs:
13+
publish:
14+
name: Report Coverage
15+
runs-on: ubuntu-latest
16+
if: |-
17+
github.event.workflow_run.event == 'pull_request'
18+
&& github.event.workflow_run.conclusion == 'success'
19+
steps:
20+
- name: Download PR test coverage report
21+
uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # tag=v4.1.7
22+
with:
23+
name: pr-test-coverage-report-java-21
24+
github-token: ${{ secrets.GITHUB_TOKEN }}
25+
run-id: ${{ github.event.workflow_run.id }}
26+
- name: Report Coverage to Codacy
27+
run: |-
28+
bash <(curl -Ls https://coverage.codacy.com/get.sh) report \
29+
--project-token ${{ secrets.CODACY_PROJECT_TOKEN }} \
30+
--commit-uuid ${{ github.event.workflow_run.head_sha }} \
31+
--coverage-reports ./target/site/jacoco/jacoco.xml \
32+
--language Java

‎.github/workflows/release-drafter.yml

+6-6
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
name: Release Drafter
2+
23
on:
34
push:
45
branches:
5-
- master
6+
- master
67

7-
permissions:
8-
contents: read
8+
permissions: { }
99

1010
jobs:
1111
update_release_draft:
@@ -14,6 +14,6 @@ jobs:
1414
contents: write
1515
runs-on: ubuntu-latest
1616
steps:
17-
- uses: release-drafter/release-drafter@v5
18-
env:
19-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
17+
- uses: release-drafter/release-drafter@3f0f87098bd6b5c5b9a36d49c41d998ea58f9348 # tag=v6.0.0
18+
env:
19+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎pom.xml

+20
Original file line numberDiff line numberDiff line change
@@ -247,6 +247,26 @@
247247
</execution>
248248
</executions>
249249
</plugin>
250+
<plugin>
251+
<groupId>org.jacoco</groupId>
252+
<artifactId>jacoco-maven-plugin</artifactId>
253+
<version>0.8.12</version>
254+
<executions>
255+
<execution>
256+
<id>default-prepare-agent</id>
257+
<goals>
258+
<goal>prepare-agent</goal>
259+
</goals>
260+
</execution>
261+
<execution>
262+
<id>report</id>
263+
<phase>verify</phase>
264+
<goals>
265+
<goal>report</goal>
266+
</goals>
267+
</execution>
268+
</executions>
269+
</plugin>
250270
<plugin>
251271
<groupId>org.cyclonedx</groupId>
252272
<artifactId>cyclonedx-maven-plugin</artifactId>

0 commit comments

Comments
 (0)