From fc60467d305f10b108518b0d1ebe98392d722ce4 Mon Sep 17 00:00:00 2001 From: Marvin Lindner Date: Mon, 1 Jun 2026 14:44:56 +0200 Subject: [PATCH] chore: use shared org-level GitHub Actions and workflows Replace local composite actions (build, deploy-release, scan-with-codeql, scan-with-blackduck) and reusable workflows (issue, stale, prevent-issue-labeling) with their shared equivalents from cap-java/.github. Refactor cf-bind to delegate CF CLI install and login to the shared cf-login action. Closes #54 --- .github/actions/build/action.yml | 33 -------- .github/actions/cf-bind/action.yml | 36 ++------- .github/actions/deploy-release/action.yml | 71 ----------------- .../actions/scan-with-blackduck/action.yml | 79 ------------------- .github/actions/scan-with-codeql/action.yml | 52 ------------ .github/workflows/issue.yml | 19 +---- .github/workflows/main.yml | 4 +- .github/workflows/pipeline.yml | 3 +- .github/workflows/prevent-issue-labeling.yml | 14 +--- .github/workflows/release.yml | 16 ++-- .github/workflows/stale.yml | 12 +-- 11 files changed, 25 insertions(+), 314 deletions(-) delete mode 100644 .github/actions/build/action.yml delete mode 100644 .github/actions/deploy-release/action.yml delete mode 100644 .github/actions/scan-with-blackduck/action.yml delete mode 100644 .github/actions/scan-with-codeql/action.yml diff --git a/.github/actions/build/action.yml b/.github/actions/build/action.yml deleted file mode 100644 index b62d932..0000000 --- a/.github/actions/build/action.yml +++ /dev/null @@ -1,33 +0,0 @@ -name: Maven Build -description: Builds a Maven project. - -inputs: - java-version: - description: The Java version the build will run with. - required: true - maven-version: - description: The Maven version the build will run with. - required: true - -runs: - using: composite - steps: - - name: Set up Java ${{ inputs.java-version }} - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 - with: - java-version: ${{ inputs.java-version }} - distribution: sapmachine - cache: maven - - - name: Set up Maven ${{ inputs.maven-version }} - uses: stCarolas/setup-maven@d6af6abeda15e98926a57b5aa970a96bb37f97d1 # v5 - with: - maven-version: ${{ inputs.maven-version }} - - - name: Install @sap/cds-dk - run: npm i -g @sap/cds-dk@9.9.1 - shell: bash - - - name: Maven Build - run: mvn clean install -DskipTests -B -ntp -Dcds.install-node.skip -P '!with-integration-tests' - shell: bash diff --git a/.github/actions/cf-bind/action.yml b/.github/actions/cf-bind/action.yml index e88154e..06c12c8 100644 --- a/.github/actions/cf-bind/action.yml +++ b/.github/actions/cf-bind/action.yml @@ -21,36 +21,14 @@ inputs: runs: using: composite steps: - - name: Install CF CLI - shell: bash - env: - CF_CLI_VERSION: '8.18.3' - run: | - wget -q "https://packages.cloudfoundry.org/stable?release=linux64-binary&version=${CF_CLI_VERSION}&source=github-rel" -O cf-cli.tar.gz - tar -xzf cf-cli.tar.gz - sudo mv cf8 /usr/local/bin/cf - cf --version - - name: CF Login - shell: bash - env: - CF_USERNAME: ${{ inputs.cf-username }} - CF_PASSWORD: ${{ inputs.cf-password }} - CF_API: ${{ inputs.cf-api }} - CF_ORG: ${{ inputs.cf-org }} - CF_SPACE: ${{ inputs.cf-space }} - run: | - for i in {1..5}; do - cf api "$CF_API" && \ - cf auth && \ - cf target -o "$CF_ORG" -s "$CF_SPACE" && break - if [ "$i" -eq 5 ]; then - echo "cf login failed after 5 attempts." - exit 1 - fi - echo "cf login failed, retrying ($i/5)..." - sleep 10 - done + uses: cap-java/.github/actions/cf-login@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main + with: + cf-api: ${{ inputs.cf-api }} + cf-username: ${{ inputs.cf-username }} + cf-password: ${{ inputs.cf-password }} + cf-org: ${{ inputs.cf-org }} + cf-space: ${{ inputs.cf-space }} - name: Install @sap/cds-dk shell: bash diff --git a/.github/actions/deploy-release/action.yml b/.github/actions/deploy-release/action.yml deleted file mode 100644 index 5f38a83..0000000 --- a/.github/actions/deploy-release/action.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Deploy Release to Maven Central -description: Deploys released artifacts to Maven Central repository. - -inputs: - user: - description: The user used for the upload (technical user for maven central upload) - required: true - password: - description: The password used for the upload (technical user for maven central upload) - required: true - pgp-pub-key: - description: The public pgp key ID - required: true - pgp-private-key: - description: The private pgp key - required: true - pgp-passphrase: - description: The passphrase for pgp - required: true - revision: - description: The revision of cds-feature-ai - required: true - maven-version: - description: The Maven version the build will run with. - required: true - -runs: - using: composite - steps: - - name: Set up Java - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 - with: - distribution: sapmachine - java-version: '17' - cache: maven - server-id: central - server-username: MAVEN_CENTRAL_USER - server-password: MAVEN_CENTRAL_PASSWORD - - - name: Set up Maven ${{ inputs.maven-version }} - uses: stCarolas/setup-maven@d6af6abeda15e98926a57b5aa970a96bb37f97d1 # v5 - with: - maven-version: ${{ inputs.maven-version }} - - - name: Install @sap/cds-dk - run: npm i -g @sap/cds-dk@9.9.1 - shell: bash - - - name: Import GPG Key - run: | - echo "$PGP_PRIVATE_KEY" | gpg --batch --passphrase "$PASSPHRASE" --import - shell: bash - env: - PGP_PRIVATE_KEY: ${{ inputs.pgp-private-key }} - PASSPHRASE: ${{ inputs.pgp-passphrase }} - - - name: Deploy to Maven Central - run: > - mvn -B -ntp --show-version - -Dmaven.install.skip=true - -Dmaven.test.skip=true - -Dcds.install-node.skip - -Dgpg.passphrase="$GPG_PASSPHRASE" - -Dgpg.keyname="$GPG_PUB_KEY" - clean deploy -P deploy-release,'!with-integration-tests' - shell: bash - env: - MAVEN_CENTRAL_USER: ${{ inputs.user }} - MAVEN_CENTRAL_PASSWORD: ${{ inputs.password }} - GPG_PASSPHRASE: ${{ inputs.pgp-passphrase }} - GPG_PUB_KEY: ${{ inputs.pgp-pub-key }} diff --git a/.github/actions/scan-with-blackduck/action.yml b/.github/actions/scan-with-blackduck/action.yml deleted file mode 100644 index f8e3292..0000000 --- a/.github/actions/scan-with-blackduck/action.yml +++ /dev/null @@ -1,79 +0,0 @@ -name: Scan with BlackDuck -description: Scans the project with BlackDuck - -inputs: - blackduck_token: - description: The token to use for BlackDuck authentication - required: true - github_token: - description: The token to use for GitHub authentication - required: true - java-version: - description: The version of Java to use - default: "17" - required: false - maven-version: - description: The Maven version the build shall run with. - required: true - version: - description: The project version to report to Black Duck (e.g. release tag). If empty, falls back to the Maven `revision` reduced to major-minor. - required: false - default: "" - scan_mode: - description: The scan mode to use (FULL uploads a report to the Black Duck server; RAPID is a fast policy gate without server upload). - default: "FULL" - required: false - -runs: - using: composite - steps: - - name: Set up Java ${{ inputs.java-version }} - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 - with: - java-version: ${{ inputs.java-version }} - distribution: sapmachine - cache: maven - - - name: Set up Maven ${{ inputs.maven-version }} - uses: stCarolas/setup-maven@d6af6abeda15e98926a57b5aa970a96bb37f97d1 # v5 - with: - maven-version: ${{ inputs.maven-version }} - - - name: Resolve Project Version - id: resolve-version - env: - VERSION_INPUT: ${{ inputs.version }} - run: | - if [ -n "$VERSION_INPUT" ]; then - VERSION="$VERSION_INPUT" - else - REVISION=$(mvn help:evaluate -Dexpression=revision -q -DforceStdout) - VERSION=$(echo "$REVISION" | cut -d. -f1,2) - fi - echo "VERSION=$VERSION" >> "$GITHUB_OUTPUT" - echo "Resolved BlackDuck project version: $VERSION" - shell: bash - - - name: BlackDuck Security Scan - uses: blackduck-inc/black-duck-security-scan@659a0742e793a093377fab3117b0d90f23b04bfa # v2.9.0 - with: - blackducksca_url: https://sap.blackducksoftware.com/ - blackducksca_token: ${{ inputs.blackduck_token }} - blackducksca_scan_full: ${{ inputs.scan_mode == 'FULL' }} - github_token: ${{ inputs.github_token }} - detect_args: > - --detect.project.name=com.sap.cds.cds-ai - --detect.project.version.name=${{ steps.resolve-version.outputs.VERSION }} - --detect.project.user.groups=CDSJAVA-OPEN-SOURCE - --detect.included.detector.types=MAVEN - --detect.excluded.directories=**/*test*,**/samples/** - --detect.maven.included.modules=cds-feature-ai-core,cds-feature-recommendations,cds-starter-ai - --detect.maven.excluded.scopes=test,provided - --detect.tools=DETECTOR,BINARY_SCAN - --detect.timeout=6000 - --detect.risk.report.pdf=false - --detect.policy.check.fail.on.severities=NONE - --detect.force.success.on.skip=true - --blackduck.signature.scanner.memory=4096 - --blackduck.trust.cert=true - --logging.level.detect=INFO diff --git a/.github/actions/scan-with-codeql/action.yml b/.github/actions/scan-with-codeql/action.yml deleted file mode 100644 index 5cbd337..0000000 --- a/.github/actions/scan-with-codeql/action.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: CodeQL Analysis -description: Runs CodeQL security analysis on the project. - -inputs: - java-version: - description: The Java version to use for the build. - required: true - maven-version: - description: The Maven version to use for the build. - required: true - language: - description: The CodeQL language to analyze (java-kotlin or actions). - required: true - -runs: - using: composite - steps: - - name: Set up Java ${{ inputs.java-version }} - if: inputs.language == 'java-kotlin' - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 - with: - java-version: ${{ inputs.java-version }} - distribution: sapmachine - cache: maven - - - name: Set up Maven ${{ inputs.maven-version }} - if: inputs.language == 'java-kotlin' - uses: stCarolas/setup-maven@d6af6abeda15e98926a57b5aa970a96bb37f97d1 # v5 - with: - maven-version: ${{ inputs.maven-version }} - - - name: Initialize CodeQL - uses: github/codeql-action/init@ed410739ba306e4ebe5e123421a6bd694e494a2b # v4 - with: - languages: ${{ inputs.language }} - build-mode: ${{ inputs.language == 'java-kotlin' && 'manual' || 'none' }} - queries: security-extended - - - name: Install @sap/cds-dk - if: inputs.language == 'java-kotlin' - run: npm i -g @sap/cds-dk@9.9.1 - shell: bash - - - name: Build Java code - if: inputs.language == 'java-kotlin' - run: mvn clean compile -B -ntp -Dcds.install-node.skip - shell: bash - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@ed410739ba306e4ebe5e123421a6bd694e494a2b # v4 - with: - category: "/language:${{ inputs.language }}" diff --git a/.github/workflows/issue.yml b/.github/workflows/issue.yml index 6aa729f..5d37720 100644 --- a/.github/workflows/issue.yml +++ b/.github/workflows/issue.yml @@ -9,23 +9,6 @@ on: jobs: label_issues: - runs-on: ubuntu-latest + uses: cap-java/.github/.github/workflows/issue.yml@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main permissions: issues: write - steps: - - run: gh issue edit "$NUMBER" --add-label "$LABELS" - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GH_REPO: ${{ github.repository }} - NUMBER: ${{ github.event.issue.number }} - LABELS: New - - - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 - with: - script: | - await github.rest.issues.createComment({ - issue_number: context.issue.number, - owner: context.repo.owner, - repo: context.repo.repo, - body: `👋 Hello @${context.payload.issue.user.login}, thank you for submitting this issue. Our team is reviewing your report and will follow up with you as soon as possible.` - }) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 738ce1b..923d44d 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -20,11 +20,13 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Scan With Black Duck - uses: ./.github/actions/scan-with-blackduck + uses: cap-java/.github/actions/scan-with-blackduck@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main with: blackduck_token: ${{ secrets.BLACK_DUCK_TOKEN }} github_token: ${{ secrets.GITHUB_TOKEN }} maven-version: ${{ env.MAVEN_VERSION }} + project-name: com.sap.cds.cds-ai + included-modules: cds-feature-ai-core,cds-feature-recommendations,cds-starter-ai scan_mode: FULL build-and-test: diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml index 361896b..4fc361f 100644 --- a/.github/workflows/pipeline.yml +++ b/.github/workflows/pipeline.yml @@ -210,8 +210,9 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: CodeQL Analysis - uses: ./.github/actions/scan-with-codeql + uses: cap-java/.github/actions/scan-with-codeql@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main with: java-version: '17' maven-version: ${{ env.MAVEN_VERSION }} language: ${{ matrix.language }} + queries: security-extended diff --git a/.github/workflows/prevent-issue-labeling.yml b/.github/workflows/prevent-issue-labeling.yml index 6c35030..4c99391 100644 --- a/.github/workflows/prevent-issue-labeling.yml +++ b/.github/workflows/prevent-issue-labeling.yml @@ -8,18 +8,6 @@ on: jobs: remove_new_label: - runs-on: ubuntu-latest + uses: cap-java/.github/.github/workflows/prevent-issue-labeling.yml@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main permissions: issues: write - steps: - - name: Remove "New" label if applied by non-bot user - if: > - contains(github.event.issue.labels.*.name, 'New') && - github.event.label.name == 'New' && - github.event.sender.login != 'github-actions[bot]' - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GH_REPO: ${{ github.repository }} - ISSUE_NUMBER: ${{ github.event.issue.number }} - run: | - gh issue edit "$ISSUE_NUMBER" --remove-label "New" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2c468e9..6857eb6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -71,11 +71,13 @@ jobs: ref: ${{ github.event.release.tag_name }} - name: Scan With Black Duck - uses: ./.github/actions/scan-with-blackduck + uses: cap-java/.github/actions/scan-with-blackduck@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main with: blackduck_token: ${{ secrets.BLACK_DUCK_TOKEN }} github_token: ${{ secrets.GITHUB_TOKEN }} maven-version: ${{ env.MAVEN_VERSION }} + project-name: com.sap.cds.cds-ai + included-modules: cds-feature-ai-core,cds-feature-recommendations,cds-starter-ai version: ${{ github.event.release.tag_name }} build: @@ -92,10 +94,11 @@ jobs: ref: ${{ github.event.release.tag_name }} - name: Build - uses: ./.github/actions/build + uses: cap-java/.github/actions/build@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main with: java-version: ${{ env.JAVA_VERSION }} maven-version: ${{ env.MAVEN_VERSION }} + maven-args: "-P '!with-integration-tests'" deploy: name: Deploy to Maven Central @@ -112,12 +115,13 @@ jobs: ref: ${{ github.event.release.tag_name }} - name: Deploy - uses: ./.github/actions/deploy-release + uses: cap-java/.github/actions/deploy-release@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main with: user: ${{ secrets.CENTRAL_REPOSITORY_USER }} password: ${{ secrets.CENTRAL_REPOSITORY_PASS }} - pgp-pub-key: ${{ secrets.PGP_PUBKEY_ID }} - pgp-private-key: ${{ secrets.PGP_PRIVATE_KEY }} - pgp-passphrase: ${{ secrets.PGP_PASSPHRASE }} + gpg-pub-key: ${{ secrets.PGP_PUBKEY_ID }} + gpg-private-key: ${{ secrets.PGP_PRIVATE_KEY }} + gpg-passphrase: ${{ secrets.PGP_PASSPHRASE }} revision: ${{ github.event.release.tag_name }} maven-version: ${{ env.MAVEN_VERSION }} + maven-profiles: "deploy-release,'!with-integration-tests'" diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 3813641..8bbf3c1 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -8,18 +8,8 @@ on: jobs: stale: - runs-on: ubuntu-latest + uses: cap-java/.github/.github/workflows/stale.yml@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main permissions: actions: write issues: write pull-requests: write - steps: - - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10 - with: - close-issue-message: "This issue has been automatically closed due to 2 weeks of inactivity. If you believe this was a mistake, please reopen or comment to continue the discussion." - days-before-stale: -1 - days-before-issue-close: 14 - days-before-pr-close: -1 - stale-issue-label: "author action" - remove-issue-stale-when-updated: true - labels-to-remove-when-unstale: "author action"