Skip to content

Commit fd79326

Browse files
lisajulialisajulia
committed
Add workflows for main, prs to main and scan with blackduck and sonar action
1 parent fd3af51 commit fd79326

6 files changed

Lines changed: 416 additions & 0 deletions

File tree

‎.github/actions/build/action.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: Maven Build
2+
description: Builds a Maven project.
3+
4+
inputs:
5+
java-version:
6+
description: The Java version the build will run with.
7+
required: true
8+
maven-version:
9+
description: The Maven version the build will run with.
10+
required: true
11+
mutation-testing:
12+
description: Whether to run mutation testing or not.
13+
default: 'true'
14+
required: false
15+
16+
runs:
17+
using: composite
18+
steps:
19+
- name: Set up Java ${{ inputs.java-version }}
20+
uses: actions/setup-java@v5
21+
with:
22+
java-version: ${{ inputs.java-version }}
23+
distribution: sapmachine
24+
cache: maven
25+
26+
- name: Set up Maven ${{ inputs.maven-version }}
27+
uses: stCarolas/setup-maven@v5
28+
with:
29+
maven-version: ${{ inputs.maven-version }}
30+
31+
- name: Piper Maven build
32+
uses: SAP/project-piper-action@main
33+
with:
34+
step-name: mavenBuild
35+
docker-image: ''
36+
37+
- name: Mutation Testing
38+
if: ${{ inputs.mutation-testing == 'true' }}
39+
run: mvn org.pitest:pitest-maven:mutationCoverage -f cds-feature-ai/pom.xml -ntp -B
40+
shell: bash

‎.github/actions/scan-with-blackduck/action.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: Scan with BlackDuck
2+
description: Scans the project with BlackDuck
3+
4+
inputs:
5+
blackduck_token:
6+
description: The token to use for BlackDuck authentication
7+
required: true
8+
github_token:
9+
description: The token to use for GitHub authentication
10+
required: true
11+
java-version:
12+
description: The version of Java to use
13+
default: '17'
14+
required: false
15+
maven-version:
16+
description: The Maven version the build shall run with.
17+
required: true
18+
scan_mode:
19+
description: The scan mode to use (FULL or RAPID)
20+
default: 'FULL'
21+
required: false
22+
23+
runs:
24+
using: composite
25+
steps:
26+
- name: Set up Java ${{ inputs.java-version }}
27+
uses: actions/setup-java@v5
28+
with:
29+
java-version: ${{ inputs.java-version }}
30+
distribution: sapmachine
31+
cache: maven
32+
33+
- name: Set up Maven ${{ inputs.maven-version }}
34+
uses: stCarolas/setup-maven@v5
35+
with:
36+
maven-version: ${{ inputs.maven-version }}
37+
38+
- name: Get Major Version
39+
id: get-major-version
40+
run: |
41+
echo "REVISION=$(mvn help:evaluate -Dexpression=revision -q -DforceStdout)" >> $GITHUB_OUTPUT
42+
shell: bash
43+
44+
- name: Print Version Number
45+
run: echo "${{ steps.get-major-version.outputs.REVISION }}"
46+
shell: bash
47+
48+
- name: BlackDuck Scan
49+
uses: SAP/project-piper-action@main
50+
with:
51+
step-name: detectExecuteScan
52+
flags: \
53+
--githubToken=$GITHUB_token \
54+
--version=${{ steps.get-major-version.outputs.REVISION }}
55+
env:
56+
PIPER_token: ${{ inputs.blackduck_token }}
57+
GITHUB_token: ${{ inputs.github_token }}
58+
SCAN_MODE: ${{ inputs.scan_mode }}

‎.github/actions/scan-with-sonar/action.yml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: Scan with SonarQube
2+
description: Scans the project with SonarQube
3+
4+
inputs:
5+
sonarq-token:
6+
description: The token to use for SonarQube authentication
7+
required: true
8+
github-token:
9+
description: The token to use for GitHub authentication
10+
required: true
11+
java-version:
12+
description: The version of Java to use
13+
required: true
14+
maven-version:
15+
description: The version of Maven to use
16+
required: true
17+
18+
runs:
19+
using: composite
20+
21+
steps:
22+
- name: Set up Java ${{inputs.java-version}}
23+
uses: actions/setup-java@v5
24+
with:
25+
java-version: ${{inputs.java-version}}
26+
distribution: sapmachine
27+
cache: maven
28+
29+
- name: Set up Maven ${{inputs.maven-version}}
30+
uses: stCarolas/setup-maven@v5
31+
with:
32+
maven-version: ${{inputs.maven-version}}
33+
34+
- name: Get Revision
35+
id: get-revision
36+
run: |
37+
echo "REVISION=$(mvn help:evaluate -Dexpression=revision -q -DforceStdout)" >> $GITHUB_OUTPUT
38+
shell: bash
39+
40+
- name: Print Revision
41+
run: echo "${{steps.get-revision.outputs.REVISION}}"
42+
shell: bash
43+
44+
- name: Build project for SonarQube scan
45+
run: |
46+
mvn clean verify -ntp -B
47+
shell: bash
48+
49+
- name: Verify JaCoCo reports exist
50+
run: |
51+
echo "=== Checking JaCoCo reports ==="
52+
find . -name "jacoco.xml" -type f
53+
if [ -f "cds-feature-ai/target/site/jacoco/jacoco.xml" ]; then
54+
echo "Found: cds-feature-ai/target/site/jacoco/jacoco.xml"
55+
else
56+
echo "Missing: cds-feature-ai/target/site/jacoco/jacoco.xml"
57+
fi
58+
if [ -f "coverage-report/target/site/jacoco-aggregate/jacoco.xml" ]; then
59+
echo "Found: coverage-report/target/site/jacoco-aggregate/jacoco.xml"
60+
else
61+
echo "Missing: coverage-report/target/site/jacoco-aggregate/jacoco.xml"
62+
exit 1
63+
fi
64+
shell: bash
65+
66+
- name: SonarQube Scan
67+
uses: SAP/project-piper-action@main
68+
with:
69+
step-name: sonarExecuteScan
70+
flags: >
71+
--token=${{ inputs.sonarq-token }}
72+
--githubToken=${{ inputs.github-token }}
73+
--version=${{ steps.get-revision.outputs.REVISION }}
74+
--inferJavaBinaries=true
75+
--options=-Dsonar.exclusions=**/samples/**,-Dsonar.coverage.jacoco.xmlReportPaths=coverage-report/target/site/jacoco-aggregate/jacoco.xml

‎.github/workflows/main.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: CI - MAIN
2+
3+
env:
4+
MAVEN_VERSION: '3.9.12'
5+
6+
on:
7+
workflow_dispatch:
8+
push:
9+
branches: [main]
10+
11+
permissions:
12+
contents: read
13+
actions: read
14+
security-events: write
15+
packages: read
16+
17+
jobs:
18+
blackduck:
19+
name: Blackduck Scan
20+
runs-on: ubuntu-latest
21+
timeout-minutes: 30
22+
steps:
23+
- name: Checkout
24+
uses: actions/checkout@v6
25+
26+
- name: Scan With Black Duck
27+
uses: ./.github/actions/scan-with-blackduck
28+
with:
29+
blackduck_token: ${{ secrets.BLACK_DUCK_TOKEN }}
30+
github_token: ${{ secrets.GITHUB_TOKEN }}
31+
maven-version: ${{ env.MAVEN_VERSION }}
32+
scan_mode: RAPID
33+
34+
build-and-test:
35+
uses: ./.github/workflows/pipeline.yml
36+
with:
37+
deploy-snapshot: true
38+
secrets: inherit

‎.github/workflows/pipeline.yml‎

Lines changed: 175 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,175 @@
1+
name: Reusable Workflow
2+
3+
env:
4+
MAVEN_VERSION: '3.9.12'
5+
6+
on:
7+
workflow_call:
8+
inputs:
9+
deploy-snapshot:
10+
required: true
11+
type: boolean
12+
default: false
13+
14+
jobs:
15+
build:
16+
name: Build (Java ${{ matrix.java-version }})
17+
runs-on: ubuntu-latest
18+
timeout-minutes: 30
19+
strategy:
20+
matrix:
21+
java-version: [ 17, 21 ]
22+
steps:
23+
- name: Checkout
24+
uses: actions/checkout@v6
25+
with:
26+
# For internal PRs (same repo), checkout PR head to test actual changes
27+
# For external PRs (forks), checkout base branch for security
28+
ref: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.head.sha || github.sha }}
29+
30+
- name: Spotless check
31+
run: mvn spotless:check -Dspotless.check.skip=false
32+
33+
- name: Build
34+
uses: ./.github/actions/build
35+
with:
36+
java-version: ${{ matrix.java-version }}
37+
maven-version: ${{ env.MAVEN_VERSION }}
38+
39+
- name: Upload build artifacts
40+
uses: actions/upload-artifact@v7
41+
with:
42+
name: build-artifacts-java-${{ matrix.java-version }}
43+
path: |
44+
**/target/*.jar
45+
**/pom.xml
46+
.mvn/
47+
retention-days: 1
48+
49+
integration-tests:
50+
name: Integration Tests (Java ${{ matrix.java-version }}, ${{ matrix.test-type }})
51+
runs-on: ubuntu-latest
52+
timeout-minutes: 30
53+
needs: build
54+
#env:
55+
# cf login for tests against aicore
56+
strategy:
57+
fail-fast: false
58+
matrix:
59+
java-version: [ 17, 21 ]
60+
test-type: [ build-version, latest-version, oss ]
61+
steps:
62+
- name: Checkout
63+
uses: actions/checkout@v6
64+
with:
65+
ref: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.head.sha || github.sha }}
66+
67+
- name: Download build artifacts
68+
uses: actions/download-artifact@v8
69+
with:
70+
name: build-artifacts-java-${{ matrix.java-version }}
71+
72+
sonarqube-scan:
73+
name: SonarQube Scan
74+
runs-on: ubuntu-latest
75+
timeout-minutes: 30
76+
needs: build
77+
steps:
78+
- name: Checkout
79+
uses: actions/checkout@v6
80+
with:
81+
ref: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.head.sha || github.sha }}
82+
- name: SonarQube Scan
83+
uses: ./.github/actions/scan-with-sonar
84+
with:
85+
java-version: 17
86+
maven-version: ${{ env.MAVEN_VERSION }}
87+
sonarq-token: ${{ secrets.SONARQ_TOKEN }}
88+
github-token: ${{ secrets.GH_TOKEN }}
89+
90+
codeql:
91+
name: CodeQL Analysis
92+
runs-on: ubuntu-latest
93+
needs: build
94+
timeout-minutes: 30
95+
permissions:
96+
security-events: write
97+
packages: read
98+
actions: read
99+
contents: read
100+
steps:
101+
- name: Checkout repository
102+
uses: actions/checkout@v6
103+
with:
104+
ref: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.head.sha || github.sha }}
105+
106+
- name: Set up Java
107+
uses: actions/setup-java@v5
108+
with:
109+
java-version: '17'
110+
distribution: 'sapmachine'
111+
cache: 'maven'
112+
113+
- name: Initialize CodeQL
114+
uses: github/codeql-action/init@v4
115+
with:
116+
languages: java-kotlin
117+
build-mode: manual
118+
119+
- name: Build Java code
120+
run: mvn clean compile -DskipTests -B -ntp
121+
122+
- name: Perform CodeQL Analysis
123+
uses: github/codeql-action/analyze@v4
124+
with:
125+
category: "/language:java-kotlin"
126+
127+
deploy-snapshot:
128+
name: Deploy snapshot to Artifactory
129+
runs-on: ubuntu-latest
130+
timeout-minutes: 30
131+
if: ${{ inputs.deploy-snapshot == true }}
132+
needs: [build, integration-tests, codeql]
133+
steps:
134+
- name: Checkout
135+
uses: actions/checkout@v6
136+
with:
137+
ref: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.head.sha || github.sha }}
138+
139+
- name: Set up Java
140+
uses: actions/setup-java@v5
141+
with:
142+
java-version: '17'
143+
distribution: 'sapmachine'
144+
cache: 'maven'
145+
server-id: artifactory
146+
server-username: DEPLOYMENT_USER
147+
server-password: DEPLOYMENT_PASS
148+
149+
- name: Set up Maven ${{ env.MAVEN_VERSION }}
150+
uses: stCarolas/setup-maven@v5
151+
with:
152+
maven-version: ${{ env.MAVEN_VERSION }}
153+
154+
- name: Set Dry Run for Pull Request
155+
if: github.event_name == 'pull_request_target'
156+
run: echo "DRY_RUN_PARAM=-DaltDeploymentRepository=local-repo::default::file:./local-repo" >> $GITHUB_ENV
157+
shell: bash
158+
159+
- name: Get Revision
160+
id: get-revision
161+
run: |
162+
echo "REVISION=$(mvn help:evaluate -Dexpression=revision -q -DforceStdout)" >> $GITHUB_OUTPUT
163+
shell: bash
164+
165+
- name: Print Revision
166+
run: echo "Current revision ${{ steps.get-revision.outputs.REVISION }}"
167+
shell: bash
168+
169+
- name: Deploy snapshot
170+
if: ${{ endsWith(steps.get-revision.outputs.REVISION, '-SNAPSHOT') }}
171+
run: mvn -B -ntp -fae -pl !integration-tests,!integration-tests/db,!integration-tests/generic,!integration-tests/mtx-local/srv -Dmaven.install.skip=true -Dmaven.test.skip=true -DdeployAtEnd=true deploy
172+
env:
173+
DEPLOYMENT_USER: ${{ secrets.DEPLOYMENT_USER }}
174+
DEPLOYMENT_PASS: ${{ secrets.DEPLOYMENT_PASS }}
175+
shell: bash

0 commit comments

Comments
 (0)