From ee478943c99b964a174fe3c03d7d8b9fda98e50b Mon Sep 17 00:00:00 2001 From: Lisa Julia Nebel Date: Mon, 1 Jun 2026 14:26:35 +0200 Subject: [PATCH 1/5] Clean up workflow files: Use the ones from https://github.com/cap-java/.github/ --- .github/workflows/issue.yml | 24 ++------------------ .github/workflows/prevent-issue-labeling.yml | 19 ++-------------- .github/workflows/releases.yml | 0 3 files changed, 4 insertions(+), 39 deletions(-) delete mode 100644 .github/workflows/releases.yml diff --git a/.github/workflows/issue.yml b/.github/workflows/issue.yml index 88e28f6..3f65099 100644 --- a/.github/workflows/issue.yml +++ b/.github/workflows/issue.yml @@ -1,30 +1,10 @@ name: Label issues -permissions: - issues: write - on: issues: types: - opened jobs: - label_issues: - runs-on: ubuntu-latest - steps: - - run: gh issue edit "$NUMBER" --add-label "$LABELS" - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GH_REPO: ${{ github.repository }} - NUMBER: ${{ github.event.issue.number }} - LABELS: New - - - uses: actions/github-script@v8 - with: - script: | - github.rest.issues.createComment({ - issue_number: context.issue.number, - owner: context.repo.owner, - repo: context.repo.repo, - body: `👋 Hello @${{github.event.issue.user.login}}, thank you for submitting this issue. Our team is reviewing your report and will follow up with you as soon as possible.` - }) \ No newline at end of file + label-issue: + uses: cap-java/.github/.github/workflows/issue.yml@main diff --git a/.github/workflows/prevent-issue-labeling.yml b/.github/workflows/prevent-issue-labeling.yml index 5f546f3..63242f0 100644 --- a/.github/workflows/prevent-issue-labeling.yml +++ b/.github/workflows/prevent-issue-labeling.yml @@ -1,24 +1,9 @@ name: Prevent "New" Label on Issues -permissions: - issues: write - on: issues: types: [labeled] jobs: - remove_new_label: - runs-on: ubuntu-latest - steps: - - name: Remove "New" label if applied by non-bot user - if: > - contains(github.event.issue.labels.*.name, 'New') && - github.event.label.name == 'New' && - github.event.sender.login != 'github-actions[bot]' - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GH_REPO: ${{ github.repository }} - ISSUE_NUMBER: ${{ github.event.issue.number }} - run: | - gh issue edit "$ISSUE_NUMBER" --remove-label "New" \ No newline at end of file + prevent-issue-labeling: + uses: cap-java/.github/.github/workflows/prevent-issue-labeling.yml@main diff --git a/.github/workflows/releases.yml b/.github/workflows/releases.yml deleted file mode 100644 index e69de29..0000000 From 3d102a01963a93fb83bba65878ef432d89d2433c Mon Sep 17 00:00:00 2001 From: Lisa Julia Nebel Date: Mon, 1 Jun 2026 14:45:28 +0200 Subject: [PATCH 2/5] Create main and pr workflows --- .github/workflows/main.yml | 50 ++++++++++++++++++++++++++++++++++++++ .github/workflows/pr.yml | 37 ++++++++++++++++++++++++++++ 2 files changed, 87 insertions(+) create mode 100644 .github/workflows/main.yml create mode 100644 .github/workflows/pr.yml diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml new file mode 100644 index 0000000..15e2985 --- /dev/null +++ b/.github/workflows/main.yml @@ -0,0 +1,50 @@ +name: CI - MAIN + +env: + MAVEN_VERSION: "3.9.15" + +on: + workflow_dispatch: + push: + branches: [main] + +jobs: + blackduck: + name: Blackduck Scan + runs-on: ubuntu-latest + timeout-minutes: 30 + permissions: + contents: read + steps: + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + + - name: Scan With Black Duck + uses: cap-java/.github/actions/scan-with-blackduck@main + with: + blackduck_token: ${{ secrets.BLACK_DUCK_TOKEN }} + maven-version: ${{ env.MAVEN_VERSION }} + project-name: com.sap.cds.feature.notifications + included-modules: cds-feature-notifications + scan_mode: FULL + + codeql: + name: CodeQL Scan + runs-on: ubuntu-latest + timeout-minutes: 60 + permissions: + contents: read + actions: read + security-events: write + packages: read + steps: + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + + - name: Scan With CodeQL + uses: cap-java/.github/actions/scan-with-codeql@main + with: + maven-version: ${{ env.MAVEN_VERSION }} + java-version: '17' + language: java-kotlin + queries: security-extended diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml new file mode 100644 index 0000000..7aea465 --- /dev/null +++ b/.github/workflows/pr.yml @@ -0,0 +1,37 @@ +name: CI - PR + +permissions: + actions: read + contents: read + packages: read + security-events: write + +env: + MAVEN_VERSION: "3.9.15" + +on: + workflow_dispatch: + pull_request: + branches: [main] + types: [reopened, synchronize, opened] + +jobs: + blackduck: + name: Blackduck Scan + runs-on: ubuntu-latest + timeout-minutes: 30 + permissions: + contents: read + steps: + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + + - name: Scan With Black Duck + uses: cap-java/.github/actions/scan-with-blackduck@main + with: + blackduck_token: ${{ secrets.BLACK_DUCK_TOKEN }} + maven-version: ${{ env.MAVEN_VERSION }} + project-name: com.sap.cds.feature.notifications + included-modules: cds-feature-notifications + scan_mode: RAPID + rapid_compare_mode: BOM_COMPARE # PRs might only be blocked by things they introduce, not by pre-existing issues that could have appeared in the main branch in the meantime From ae6612afb376e980ab6159b2c42995e287a35632 Mon Sep 17 00:00:00 2001 From: Lisa Julia Nebel Date: Tue, 2 Jun 2026 15:20:48 +0200 Subject: [PATCH 3/5] Changed pinned version from main to commit sha for actions from https://github.com/cap-java/.github --- .github/workflows/issue.yml | 2 +- .github/workflows/main.yml | 4 ++-- .github/workflows/pr.yml | 2 +- .github/workflows/prevent-issue-labeling.yml | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/issue.yml b/.github/workflows/issue.yml index 3f65099..cb2f5a8 100644 --- a/.github/workflows/issue.yml +++ b/.github/workflows/issue.yml @@ -7,4 +7,4 @@ on: jobs: label-issue: - uses: cap-java/.github/.github/workflows/issue.yml@main + uses: cap-java/.github/.github/workflows/issue.yml@296573b55e906f5c77a1855bcfe4285cbbc5cac4 #main diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 15e2985..83a7d03 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -20,7 +20,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Scan With Black Duck - uses: cap-java/.github/actions/scan-with-blackduck@main + uses: cap-java/.github/actions/scan-with-blackduck@296573b55e906f5c77a1855bcfe4285cbbc5cac4 #main with: blackduck_token: ${{ secrets.BLACK_DUCK_TOKEN }} maven-version: ${{ env.MAVEN_VERSION }} @@ -42,7 +42,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Scan With CodeQL - uses: cap-java/.github/actions/scan-with-codeql@main + uses: cap-java/.github/actions/scan-with-codeql@296573b55e906f5c77a1855bcfe4285cbbc5cac4 #main with: maven-version: ${{ env.MAVEN_VERSION }} java-version: '17' diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 7aea465..7338243 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -27,7 +27,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Scan With Black Duck - uses: cap-java/.github/actions/scan-with-blackduck@main + uses: cap-java/.github/actions/scan-with-blackduck@296573b55e906f5c77a1855bcfe4285cbbc5cac4 #main with: blackduck_token: ${{ secrets.BLACK_DUCK_TOKEN }} maven-version: ${{ env.MAVEN_VERSION }} diff --git a/.github/workflows/prevent-issue-labeling.yml b/.github/workflows/prevent-issue-labeling.yml index 63242f0..ba2473b 100644 --- a/.github/workflows/prevent-issue-labeling.yml +++ b/.github/workflows/prevent-issue-labeling.yml @@ -6,4 +6,4 @@ on: jobs: prevent-issue-labeling: - uses: cap-java/.github/.github/workflows/prevent-issue-labeling.yml@main + uses: cap-java/.github/.github/workflows/prevent-issue-labeling.yml@296573b55e906f5c77a1855bcfe4285cbbc5cac4 #main From 99291e5ea7cec182136e7374737b03c3d060e8c7 Mon Sep 17 00:00:00 2001 From: Lisa Julia Nebel Date: Tue, 2 Jun 2026 08:41:47 +0200 Subject: [PATCH 4/5] produce full scan --- .github/workflows/pr.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 7338243..d66f822 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -33,5 +33,5 @@ jobs: maven-version: ${{ env.MAVEN_VERSION }} project-name: com.sap.cds.feature.notifications included-modules: cds-feature-notifications - scan_mode: RAPID - rapid_compare_mode: BOM_COMPARE # PRs might only be blocked by things they introduce, not by pre-existing issues that could have appeared in the main branch in the meantime + scan_mode: FULL + #rapid_compare_mode: BOM_COMPARE # PRs might only be blocked by things they introduce, not by pre-existing issues that could have appeared in the main branch in the meantime From 4b258ca98f4d742598d305a3e0c46303a35b363c Mon Sep 17 00:00:00 2001 From: busehalis-sap Date: Mon, 15 Jun 2026 13:46:18 +0200 Subject: [PATCH 5/5] Update linter.yml --- .github/workflows/linter.yml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml index 745be57..1e991ab 100644 --- a/.github/workflows/linter.yml +++ b/.github/workflows/linter.yml @@ -13,7 +13,5 @@ jobs: java-version: '17' distribution: 'temurin' - - name: Run Checkstyle - # This command will automatically fail the build if style issues are found - # because of the true config in the pom.xml - run: mvn checkstyle:check \ No newline at end of file + - name: Run Spotless + run: mvn spotless:check