From 010b420b2c792b147e88999d40947b93a43cee71 Mon Sep 17 00:00:00 2001 From: Lisa Julia Nebel Date: Sun, 12 Jul 2026 09:43:33 +0200 Subject: [PATCH] Use workflows of cap-java/.github and pin versions to commit shas --- .github/actions/build/action.yml | 34 ------- .github/actions/deploy-release/action.yml | 71 -------------- .../actions/scan-with-blackduck/action.yaml | 62 ------------- .github/actions/scan-with-codeql/action.yaml | 49 ---------- .github/actions/scan-with-sonar/action.yaml | 48 ---------- .github/workflows/codeql.yml | 92 ------------------- .../workflows/main-build-and-deploy-oss.yml | 49 +++++----- .github/workflows/main-build.yml | 34 ++++--- .github/workflows/pull-request-build.yml | 60 +++++++++++- 9 files changed, 105 insertions(+), 394 deletions(-) delete mode 100644 .github/actions/build/action.yml delete mode 100644 .github/actions/deploy-release/action.yml delete mode 100644 .github/actions/scan-with-blackduck/action.yaml delete mode 100644 .github/actions/scan-with-codeql/action.yaml delete mode 100644 .github/actions/scan-with-sonar/action.yaml delete mode 100644 .github/workflows/codeql.yml diff --git a/.github/actions/build/action.yml b/.github/actions/build/action.yml deleted file mode 100644 index 8a50941..0000000 --- a/.github/actions/build/action.yml +++ /dev/null @@ -1,34 +0,0 @@ -name: Maven Build -description: "Builds a Maven project." - -inputs: - java-version: - description: "The Java version the build shall run with." - required: true - maven-version: - description: "The Maven version the build shall run with." - required: true - mutation-testing: - description: "Whether to run mutation testing." - default: 'true' - required: false - -runs: - using: composite - steps: - - name: Set up Java ${{ inputs.java-version }} - uses: actions/setup-java@v4 - with: - java-version: ${{ inputs.java-version }} - distribution: sapmachine - cache: maven - - - name: Setup Maven ${{ inputs.maven-version }} - uses: stCarolas/setup-maven@v5 - with: - maven-version: ${{ inputs.maven-version }} - - - name: Piper Maven build - uses: SAP/project-piper-action@main - with: - step-name: mavenBuild diff --git a/.github/actions/deploy-release/action.yml b/.github/actions/deploy-release/action.yml deleted file mode 100644 index b1ef193..0000000 --- a/.github/actions/deploy-release/action.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: Deploy Release to Maven Central -description: "Deploys released artifacts to Maven Central repository." - -inputs: - user: - description: "The user used for the upload (technical user for maven central upload)" - required: true - password: - description: "The password used for the upload (technical user for maven central upload)" - required: true - pgp-pub-key: - description: "The public pgp key ID" - required: true - pgp-private-key: - description: "The private pgp key" - required: true - pgp-passphrase: - description: "The passphrase for pgp" - required: true - revision: - description: "The revision of cds-feature-event-hub" - required: true - maven-version: - description: "The Maven version the build shall run with." - required: true - -runs: - using: composite - steps: - - name: Echo Inputs - run: | - echo "user: ${{ inputs.user }}" - echo "revision: ${{ inputs.revision }}" - shell: bash - - - name: Set up Java - uses: actions/setup-java@v4 - with: - distribution: sapmachine - java-version: '17' - cache: maven - server-id: central - server-username: MAVEN_CENTRAL_USER - server-password: MAVEN_CENTRAL_PASSWORD - - - name: Set up Maven ${{ inputs.maven-version }} - uses: stCarolas/setup-maven@v5 - with: - maven-version: ${{ inputs.maven-version }} - - - name: Import GPG Key - run: | - echo "${{ inputs.pgp-private-key }}" | gpg --batch --passphrase "$PASSPHRASE" --import - shell: bash - env: - PASSPHRASE: ${{ inputs.pgp-passphrase }} - - - name: Deploy to Maven Central - run: > - mvn -B -ntp --show-version - -Dmaven.install.skip=true - -Dmaven.test.skip=true - -Dgpg.passphrase="$GPG_PASSPHRASE" - -Dgpg.keyname="$GPG_PUB_KEY" - clean deploy -P deploy-release - shell: bash - env: - MAVEN_CENTRAL_USER: ${{ inputs.user }} - MAVEN_CENTRAL_PASSWORD: ${{ inputs.password }} - GPG_PASSPHRASE: ${{ inputs.pgp-passphrase }} - GPG_PUB_KEY: ${{ inputs.pgp-pub-key }} diff --git a/.github/actions/scan-with-blackduck/action.yaml b/.github/actions/scan-with-blackduck/action.yaml deleted file mode 100644 index 414875c..0000000 --- a/.github/actions/scan-with-blackduck/action.yaml +++ /dev/null @@ -1,62 +0,0 @@ -name: "Scan with BlackDuck" -description: "Scans the project with BlackDuck" - -inputs: - blackduck_token: - description: "The token to use for BlackDuck authentication" - required: true - github_token: - description: "The token to use for GitHub authentication" - required: true - java-version: - description: "The version of Java to use" - default: '17' - required: false - maven-version: - description: "The Maven version the build shall run with." - required: true - scan_mode: - description: The scan mode to use (FULL or RAPID) - default: 'RAPID' - required: false - -runs: - using: composite - steps: - - name: Set up Java ${{ inputs.java-version }} - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 - with: - java-version: ${{ inputs.java-version }} - distribution: sapmachine - cache: maven - - - name: Set up Maven ${{ inputs.maven-version }} - uses: stCarolas/setup-maven@d6af6abeda15e98926a57b5aa970a96bb37f97d1 # v5 - with: - maven-version: ${{ inputs.maven-version }} - - - name: Get Revision - id: get-revision - run: | - echo "REVISION=$(mvn help:evaluate -Dexpression=revision -q -DforceStdout)" >> $GITHUB_OUTPUT - shell: bash - - - name: BlackDuck Security Scan - uses: blackduck-inc/black-duck-security-scan@659a0742e793a093377fab3117b0d90f23b04bfa # v2.9.0 - with: - blackducksca_url: https://sap.blackducksoftware.com/ - blackducksca_token: ${{ inputs.blackduck_token }} - blackducksca_scan_full: ${{ inputs.scan_mode == 'FULL' }} - github_token: ${{ inputs.github_token }} - detect_args: > - --detect.project.name=com.sap.cds.feature.event-hub - --detect.project.version.name=${{ steps.get-revision.outputs.REVISION }} - --detect.included.detector.types=MAVEN - --detect.excluded.directories=**/node_modules,**/*test*,**/localrepo,**/target/site,**/*-site.jar,**/samples/** - --detect.tools=DETECTOR,BINARY_SCAN - --detect.risk.report.pdf=false - --logging.level.detect=INFO - env: - BLACKDUCKSCA_TOKEN: ${{ inputs.blackduck_token }} - BLACKDUCKSCA_URL: https://sap.blackducksoftware.com/ - BLACKDUCK_API_TOKEN: ${{ inputs.blackduck_token }} diff --git a/.github/actions/scan-with-codeql/action.yaml b/.github/actions/scan-with-codeql/action.yaml deleted file mode 100644 index bdaca32..0000000 --- a/.github/actions/scan-with-codeql/action.yaml +++ /dev/null @@ -1,49 +0,0 @@ -name: Scan with CodeQL -description: Scans the project with CodeQL - -inputs: - java-version: - description: The Java version to use for the build. - required: true - maven-version: - description: The Maven version to use for the build. - required: true - -runs: - using: composite - steps: - - name: Set up Java ${{ inputs.java-version }} - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 - with: - java-version: ${{ inputs.java-version }} - distribution: sapmachine - cache: maven - - - name: Set up Maven ${{ inputs.maven-version }} - uses: stCarolas/setup-maven@d6af6abeda15e98926a57b5aa970a96bb37f97d1 # v5 - with: - maven-version: ${{ inputs.maven-version }} - - - name: Initialize CodeQL - uses: github/codeql-action/init@ed410739ba306e4ebe5e123421a6bd694e494a2b # v4 - with: - languages: java-kotlin - build-mode: manual - queries: security-extended - - - name: Install @sap/cds-dk - run: npm i -g @sap/cds-dk - shell: bash - - - name: Install npm dependencies - run: npm install - shell: bash - - - name: Build Java code - run: mvn clean compile -B -ntp -Dcds.install-node.skip - shell: bash - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@ed410739ba306e4ebe5e123421a6bd694e494a2b # v4 - with: - category: "/language:java-kotlin" diff --git a/.github/actions/scan-with-sonar/action.yaml b/.github/actions/scan-with-sonar/action.yaml deleted file mode 100644 index 34522cf..0000000 --- a/.github/actions/scan-with-sonar/action.yaml +++ /dev/null @@ -1,48 +0,0 @@ -name: Scan with SonarQube -description: Scans the project with SonarQube - -inputs: - sonarq-token: - description: The token to use for SonarQube authentication - required: true - github-token: - description: The token to use for GitHub authentication - required: true - java-version: - description: The version of Java to use - required: true - maven-version: - description: The version of Maven to use - required: true - -runs: - using: composite - - steps: - - name: Set up Java ${{inputs.java-version}} - uses: actions/setup-java@v4 - with: - java-version: ${{inputs.java-version}} - distribution: sapmachine - cache: maven - - - name: Set up Maven ${{inputs.maven-version}} - uses: stCarolas/setup-maven@v5 - with: - maven-version: ${{inputs.maven-version}} - - - name: Get Revision - id: get-revision - run: | - echo "REVISION=$(mvn help:evaluate -Dexpression=revision -q -DforceStdout)" >> $GITHUB_OUTPUT - shell: bash - - - name: Print Revision - run: echo "${{steps.get-revision.outputs.REVISION}}" - shell: bash - - - name: SonarQube Scan - uses: SAP/project-piper-action@main - with: - step-name: sonarExecuteScan - flags: --token=${{inputs.sonarq-token}} --githubToken=${{inputs.github-token}} --version=${{steps.get-revision.outputs.REVISION}} --inferJavaBinaries=true diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index 4337ef6..0000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,92 +0,0 @@ -# For most projects, this workflow file will not need changing; you simply need -# to commit it to your repository. -# -# You may wish to alter this file to override the set of languages analyzed, -# or to provide custom queries or build logic. -# -# ******** NOTE ******** -# We have attempted to detect the languages in your repository. Please check -# the `language` matrix defined below to confirm you have the correct set of -# supported CodeQL languages. -# -name: "CodeQL Advanced" - -on: - push: - branches: [ "main" ] - pull_request: - branches: [ "main" ] - schedule: - - cron: '24 18 * * 2' - -jobs: - analyze: - name: Analyze (${{ matrix.language }}) - # Runner size impacts CodeQL analysis time. To learn more, please see: - # - https://gh.io/recommended-hardware-resources-for-running-codeql - # - https://gh.io/supported-runners-and-hardware-resources - # - https://gh.io/using-larger-runners (GitHub.com only) - # Consider using larger runners or machines with greater resources for possible analysis time improvements. - runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} - permissions: - # required for all workflows - security-events: write - - # required to fetch internal or private CodeQL packs - packages: read - - # only required for workflows in private repositories - actions: read - contents: read - - strategy: - fail-fast: false - matrix: - include: - - language: java-kotlin - build-mode: none # This mode only analyzes Java. Set this to 'autobuild' or 'manual' to analyze Kotlin too. - # CodeQL supports the following values keywords for 'language': 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' - # Use `c-cpp` to analyze code written in C, C++ or both - # Use 'java-kotlin' to analyze code written in Java, Kotlin or both - # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both - # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis, - # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning. - # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how - # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@v3 - with: - languages: ${{ matrix.language }} - build-mode: ${{ matrix.build-mode }} - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. - - # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs - # queries: security-extended,security-and-quality - - # If the analyze step fails for one of the languages you are analyzing with - # "We were unable to automatically build your code", modify the matrix above - # to set the build mode to "manual" for that language. Then modify this step - # to build your code. - # ℹī¸ Command-line programs to run using the OS shell. - # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun - - if: matrix.build-mode == 'manual' - shell: bash - run: | - echo 'If you are using a "manual" build mode for one or more of the' \ - 'languages you are analyzing, replace this with the commands to build' \ - 'your code, for example:' - echo ' make bootstrap' - echo ' make release' - exit 1 - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 - with: - category: "/language:${{matrix.language}}" diff --git a/.github/workflows/main-build-and-deploy-oss.yml b/.github/workflows/main-build-and-deploy-oss.yml index 303959b..920864d 100644 --- a/.github/workflows/main-build-and-deploy-oss.yml +++ b/.github/workflows/main-build-and-deploy-oss.yml @@ -13,38 +13,48 @@ jobs: name: Blackduck Scan runs-on: ubuntu-latest timeout-minutes: 30 + permissions: + contents: read steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Scan With Black Duck - uses: ./.github/actions/scan-with-blackduck + uses: cap-java/.github/actions/scan-with-blackduck@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main with: blackduck_token: ${{ secrets.BLACK_DUCK_TOKEN }} - github_token: ${{ secrets.GITHUB_TOKEN }} maven-version: ${{ env.MAVEN_VERSION }} - scan_mode: RAPID + project-name: com.sap.cds.feature.event-hub + included-modules: cds-feature-event-hub + scan_mode: FULL + codeql: name: CodeQL Scan runs-on: ubuntu-latest timeout-minutes: 60 + permissions: + contents: read + actions: read + security-events: write + packages: read steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Scan With CodeQL - continue-on-error: true - uses: ./.github/actions/scan-with-codeql + uses: cap-java/.github/actions/scan-with-codeql@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main with: maven-version: ${{ env.MAVEN_VERSION }} java-version: ${{ env.JAVA_VERSION }} + language: java-kotlin + queries: security-extended # update-version: # name: Update Version # runs-on: ubuntu-latest # steps: # - name: Checkout -# uses: actions/checkout@v4 +# uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 # with: # token: ${{ secrets.GH_TOKEN }} # - name: Update version @@ -53,12 +63,13 @@ jobs: # java-version: ${{ env.JAVA_VERSION }} # maven-version: ${{ env.MAVEN_VERSION }} # - name: Upload Changed Artifacts -# uses: actions/upload-artifact@v4 +# uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7 # with: # name: root-new-version # path: . # include-hidden-files: true # retention-days: 1 + requires-approval: runs-on: ubuntu-latest name: "Waiting for release approval" @@ -70,32 +81,26 @@ jobs: run: echo "Release has been approved!" build: - #name: Build and Sonar Scan name: Build runs-on: ubuntu-latest - #needs: update-version needs: requires-approval steps: - name: Checkout - uses: actions/checkout@v4 -# - name: Download artifact -# uses: actions/download-artifact@v4 -# with: -# name: root-new-version + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Build - uses: ./.github/actions/build + uses: cap-java/.github/actions/build@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main with: java-version: ${{ env.JAVA_VERSION }} maven-version: ${{ env.MAVEN_VERSION }} #- name: Sonar Scan - # uses: ./.github/actions/scan-with-sonar + # uses: cap-java/.github/actions/scan-with-sonar@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main # with: # java-version: ${{ env.JAVA_VERSION }} # maven-version: ${{ env.MAVEN_VERSION }} # sonarq-token: ${{ secrets.SONARQ_TOKEN }} # github-token: ${{ secrets.GITHUB_TOKEN }} - name: Upload Changed Artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v6 with: name: root-build include-hidden-files: true @@ -110,17 +115,17 @@ jobs: needs: [build] steps: - name: Download artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8 with: name: root-build - name: Deploy - uses: ./.github/actions/deploy-release + uses: cap-java/.github/actions/deploy-release@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main with: user: ${{ secrets.CAP_JAVA_CDS_FEATURE_EVENT_HUB_USER }} password: ${{ secrets.CAP_JAVA_CDS_FEATURE_EVENT_HUB_PASS }} - pgp-pub-key: ${{ secrets.PGP_PUBKEY_ID }} - pgp-private-key: ${{ secrets.PGP_PRIVATE_KEY }} - pgp-passphrase: ${{ secrets.PGP_PASSPHRASE }} + gpg-pub-key: ${{ secrets.PGP_PUBKEY_ID }} + gpg-private-key: ${{ secrets.PGP_PRIVATE_KEY }} + gpg-passphrase: ${{ secrets.PGP_PASSPHRASE }} revision: ${{ github.event.release.tag_name }} maven-version: ${{ env.MAVEN_VERSION }} - name: Echo Status diff --git a/.github/workflows/main-build.yml b/.github/workflows/main-build.yml index 7817807..0428c4d 100644 --- a/.github/workflows/main-build.yml +++ b/.github/workflows/main-build.yml @@ -17,17 +17,17 @@ jobs: java-version: [ 17, 21 ] steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Build - uses: ./.github/actions/build + uses: cap-java/.github/actions/build@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main with: java-version: ${{ matrix.java-version }} maven-version: ${{ env.MAVEN_VERSION }} #- name: SonarQube Scan - # uses: ./.github/actions/scan-with-sonar - # if: ${{ matrix.java-version == 17 }} + # uses: cap-java/.github/actions/scan-with-sonar@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main + # if: ${{ matrix.java-version == 21 }} # with: # java-version: ${{ matrix.java-version }} # maven-version: ${{ env.MAVEN_VERSION }} @@ -38,31 +38,41 @@ jobs: name: Blackduck Scan runs-on: ubuntu-latest timeout-minutes: 30 + permissions: + contents: read steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Scan With Black Duck - uses: ./.github/actions/scan-with-blackduck + uses: cap-java/.github/actions/scan-with-blackduck@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main with: blackduck_token: ${{ secrets.BLACK_DUCK_TOKEN }} - github_token: ${{ secrets.GITHUB_TOKEN }} maven-version: ${{ env.MAVEN_VERSION }} - scan_mode: RAPID + project-name: com.sap.cds.feature.event-hub + included-modules: cds-feature-event-hub + scan_mode: FULL + codeql: name: CodeQL Scan runs-on: ubuntu-latest timeout-minutes: 60 + permissions: + contents: read + actions: read + security-events: write + packages: read steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Scan With CodeQL - continue-on-error: true - uses: ./.github/actions/scan-with-codeql + uses: cap-java/.github/actions/scan-with-codeql@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main with: maven-version: ${{ env.MAVEN_VERSION }} java-version: ${{ env.JAVA_VERSION }} + language: java-kotlin + queries: security-extended deploy-snapshot: name: Deploy snapshot to Artifactory @@ -71,10 +81,10 @@ jobs: environment: release-secrets steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Set up Java ${{ env.JAVA_VERSION }} - uses: actions/setup-java@v4 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 with: java-version: ${{ env.JAVA_VERSION }} distribution: sapmachine @@ -84,7 +94,7 @@ jobs: server-password: DEPLOYMENT_PASS - name: Set up Maven ${{ env.MAVEN_VERSION }} - uses: stCarolas/setup-maven@v5 + uses: stCarolas/setup-maven@d6af6abeda15e98926a57b5aa970a96bb37f97d1 # v5 with: maven-version: ${{ env.MAVEN_VERSION }} diff --git a/.github/workflows/pull-request-build.yml b/.github/workflows/pull-request-build.yml index 723f3b6..3ce2318 100644 --- a/.github/workflows/pull-request-build.yml +++ b/.github/workflows/pull-request-build.yml @@ -1,13 +1,44 @@ name: Pull Request Voter +permissions: + actions: read + contents: read + packages: read + security-events: write + env: MAVEN_VERSION: '3.9.15' on: + workflow_dispatch: pull_request: branches: [ "main" ] + types: [reopened, synchronize, opened] jobs: + blackduck: + name: Blackduck Scan + runs-on: ubuntu-latest + timeout-minutes: 30 + permissions: + contents: read + steps: + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + + - name: Scan With Black Duck + uses: cap-java/.github/actions/scan-with-blackduck@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main + with: + blackduck_token: ${{ secrets.BLACK_DUCK_TOKEN }} + maven-version: ${{ env.MAVEN_VERSION }} + project-name: com.sap.cds.feature.event-hub + included-modules: cds-feature-event-hub + # scan_mode and rapid_compare_mode determine the type of scan to perform + # FULL scan on main, RAPID scan on a PR that will only tag issues introduced by the PR + # not pre-existing issues that could have appeared in the main branch in the meantime + scan_mode: FULL + rapid_compare_mode: BOM_COMPARE + build: runs-on: ubuntu-latest @@ -18,19 +49,40 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Build - uses: ./.github/actions/build + uses: cap-java/.github/actions/build@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main with: java-version: ${{ matrix.java-version }} maven-version: ${{ env.MAVEN_VERSION }} #- name: SonarQube Scan - # uses: ./.github/actions/scan-with-sonar - # if: ${{ matrix.java-version == 17 }} + # uses: cap-java/.github/actions/scan-with-sonar@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main + # if: ${{ matrix.java-version == 21 }} # with: # java-version: ${{ matrix.java-version }} # maven-version: ${{ env.MAVEN_VERSION }} # sonarq-token: ${{ secrets.SONARQ_TOKEN }} # github-token: ${{ secrets.GITHUB_TOKEN }} + + codeql: + name: CodeQL Scan + runs-on: ubuntu-latest + timeout-minutes: 60 + permissions: + contents: read + actions: read + security-events: write + packages: read + steps: + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + + - name: Scan With CodeQL + uses: cap-java/.github/actions/scan-with-codeql@296573b55e906f5c77a1855bcfe4285cbbc5cac4 # main + with: + maven-version: ${{ env.MAVEN_VERSION }} + java-version: '21' + language: java-kotlin + queries: security-extended