Add workflows for main, prs to main and scan with blackduck and sonar… #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Reusable Workflow | ||
| env: | ||
| MAVEN_VERSION: '3.9.12' | ||
| on: | ||
| workflow_call: | ||
| inputs: | ||
| deploy-snapshot: | ||
| required: true | ||
| type: boolean | ||
| default: false | ||
| jobs: | ||
| build: | ||
| name: Build (Java ${{ matrix.java-version }}) | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 30 | ||
| strategy: | ||
| matrix: | ||
| java-version: [ 17, 21 ] | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| # For internal PRs (same repo), checkout PR head to test actual changes | ||
| # For external PRs (forks), checkout base branch for security | ||
| ref: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.head.sha || github.sha }} | ||
| - name: Spotless check | ||
| run: mvn spotless:check -Dspotless.check.skip=false | ||
| - name: Build | ||
| uses: ./.github/actions/build | ||
| with: | ||
| java-version: ${{ matrix.java-version }} | ||
| maven-version: ${{ env.MAVEN_VERSION }} | ||
| - name: Upload build artifacts | ||
| uses: actions/upload-artifact@v7 | ||
| with: | ||
| name: build-artifacts-java-${{ matrix.java-version }} | ||
| path: | | ||
| **/target/*.jar | ||
| **/pom.xml | ||
| .mvn/ | ||
| retention-days: 1 | ||
| integration-tests: | ||
| name: Integration Tests (Java ${{ matrix.java-version }}, ${{ matrix.test-type }}) | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 30 | ||
| needs: build | ||
| env: | ||
| # cf login for test | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| java-version: [ 17, 21 ] | ||
| test-type: [ build-version, latest-version, oss ] | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.head.sha || github.sha }} | ||
| - name: Download build artifacts | ||
| uses: actions/download-artifact@v8 | ||
| with: | ||
| name: build-artifacts-java-${{ matrix.java-version }} | ||
| sonarqube-scan: | ||
| name: SonarQube Scan | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 30 | ||
| needs: build | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.head.sha || github.sha }} | ||
| - name: SonarQube Scan | ||
| uses: ./.github/actions/scan-with-sonar | ||
| with: | ||
| java-version: 17 | ||
| maven-version: ${{ env.MAVEN_VERSION }} | ||
| sonarq-token: ${{ secrets.SONARQ_TOKEN }} | ||
| github-token: ${{ secrets.GH_TOKEN }} | ||
| codeql: | ||
| name: CodeQL Analysis | ||
| runs-on: ubuntu-latest | ||
| needs: build | ||
| timeout-minutes: 30 | ||
| permissions: | ||
| security-events: write | ||
| packages: read | ||
| actions: read | ||
| contents: read | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.head.sha || github.sha }} | ||
| - name: Set up Java | ||
| uses: actions/setup-java@v5 | ||
| with: | ||
| java-version: '17' | ||
| distribution: 'sapmachine' | ||
| cache: 'maven' | ||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@v4 | ||
| with: | ||
| languages: java-kotlin | ||
| build-mode: manual | ||
| - name: Build Java code | ||
| run: mvn clean compile -DskipTests -B -ntp | ||
| - name: Perform CodeQL Analysis | ||
| uses: github/codeql-action/analyze@v4 | ||
| with: | ||
| category: "/language:java-kotlin" | ||
| deploy-snapshot: | ||
| name: Deploy snapshot to Artifactory | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 30 | ||
| if: ${{ inputs.deploy-snapshot == true }} | ||
| needs: [build, integration-tests, codeql] | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.head.sha || github.sha }} | ||
| - name: Set up Java | ||
| uses: actions/setup-java@v5 | ||
| with: | ||
| java-version: '17' | ||
| distribution: 'sapmachine' | ||
| cache: 'maven' | ||
| server-id: artifactory | ||
| server-username: DEPLOYMENT_USER | ||
| server-password: DEPLOYMENT_PASS | ||
| - name: Set up Maven ${{ env.MAVEN_VERSION }} | ||
| uses: stCarolas/setup-maven@v5 | ||
| with: | ||
| maven-version: ${{ env.MAVEN_VERSION }} | ||
| - name: Set Dry Run for Pull Request | ||
| if: github.event_name == 'pull_request_target' | ||
| run: echo "DRY_RUN_PARAM=-DaltDeploymentRepository=local-repo::default::file:./local-repo" >> $GITHUB_ENV | ||
| shell: bash | ||
| - name: Get Revision | ||
| id: get-revision | ||
| run: | | ||
| echo "REVISION=$(mvn help:evaluate -Dexpression=revision -q -DforceStdout)" >> $GITHUB_OUTPUT | ||
| shell: bash | ||
| - name: Print Revision | ||
| run: echo "Current revision ${{ steps.get-revision.outputs.REVISION }}" | ||
| shell: bash | ||
| - name: Deploy snapshot | ||
| if: ${{ endsWith(steps.get-revision.outputs.REVISION, '-SNAPSHOT') }} | ||
| run: mvn -B -ntp -fae -pl !integration-tests,!integration-tests/db,!integration-tests/generic,!integration-tests/mtx-local/srv -Dmaven.install.skip=true -Dmaven.test.skip=true -DdeployAtEnd=true deploy | ||
| env: | ||
| DEPLOYMENT_USER: ${{ secrets.DEPLOYMENT_USER }} | ||
| DEPLOYMENT_PASS: ${{ secrets.DEPLOYMENT_PASS }} | ||
| shell: bash | ||
