Skip to content

Commit 91c6348

Browse files
hartmut-co-ukhartmut-co-uk
committed
feat: adds GitHub Actions build pipeline
1 parent 8cc5f36 commit 91c6348

10 files changed

+423
-0
lines changed

‎.github/workflows/1.pipeline.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: "> Main Pipeline"
2+
3+
on:
4+
push:
5+
branches: [ "main" ]
6+
tags:
7+
- '*'
8+
pull_request:
9+
branches: ['*']
10+
workflow_dispatch:
11+
inputs:
12+
type:
13+
description: 'Release Library'
14+
required: true
15+
default: '...no release'
16+
type: choice
17+
options:
18+
- '...no release'
19+
- major
20+
- minor
21+
- patch
22+
23+
jobs:
24+
25+
build:
26+
name: Build + unit tests
27+
uses: ./.github/workflows/callable.build.yml
28+
if: | # avoid unnecessary pipeline runs during artifact release process ('gradle release plugin')
29+
!contains(github.event.head_commit.message, '[Gradle Release Plugin] - pre tag commit')
30+
|| github.ref_type == 'tag'
31+
32+
code_analysis:
33+
name: Code Analysis (multi)
34+
permissions:
35+
actions: read
36+
contents: read
37+
security-events: write
38+
uses: ./.github/workflows/callable.code-analysis.yml
39+
needs: build
40+
if: |
41+
github.event_name != 'workflow_dispatch'
42+
|| inputs.type == '...no release'
43+
44+
integration_test:
45+
name: Run integration tests
46+
uses: ./.github/workflows/callable.integration-test.yml
47+
needs: build
48+
49+
gradle_release:
50+
name: Create artifact release
51+
uses: ./.github/workflows/callable.gradle-release.yml
52+
secrets: inherit
53+
with:
54+
type: ${{ inputs.type }}
55+
needs: integration_test
56+
if: |
57+
github.event_name == 'workflow_dispatch'
58+
&& inputs.type != '...no release'
59+
60+
publish_sonatype:
61+
name: Publish to Maven Central (Sonatype)
62+
uses: ./.github/workflows/callable.publish-sonatype.yml
63+
secrets: inherit
64+
needs: integration_test
65+
if: |
66+
(
67+
github.event_name != 'workflow_dispatch'
68+
|| inputs.type == '...no release'
69+
) && (
70+
github.ref == 'refs/heads/main'
71+
|| github.ref_type == 'tag'
72+
)
73+
74+
publish_javadoc:
75+
name: Publish javadoc (GitHub Pages)
76+
permissions:
77+
contents: write
78+
uses: ./.github/workflows/callable.publish-javadoc.yml
79+
needs: integration_test

‎.github/workflows/2.scheduled.code-analysis.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
name: ">> Scheduled Code Analysis"
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: '23 1 * * 6' # weekly, on Saturday at 01:23 UTC
7+
8+
jobs:
9+
code_analysis:
10+
name: Code Analysis (multi)
11+
permissions:
12+
actions: read
13+
contents: read
14+
security-events: write
15+
uses: ./.github/workflows/callable.code-analysis.yml

‎.github/workflows/callable.build.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: Gradle Build
2+
3+
on:
4+
workflow_call:
5+
6+
jobs:
7+
build:
8+
name: gradle build test
9+
runs-on: ubuntu-latest
10+
steps:
11+
- name: Checkout project sources
12+
uses: actions/checkout@v4
13+
14+
- uses: actions/setup-java@v3
15+
with:
16+
distribution: 'corretto'
17+
java-version: '17'
18+
cache: 'gradle'
19+
- uses: gradle/wrapper-validation-action@v1
20+
- name: Setup Gradle
21+
uses: gradle/[email protected]
22+
23+
- name: Run build (incl. test)
24+
run: gradle build -x intTest --no-daemon

‎.github/workflows/callable.code-analysis.codeql.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: CodeQL Analysis
2+
3+
on:
4+
workflow_call:
5+
6+
jobs:
7+
analyze:
8+
name: CodeQL Analysis
9+
# Runner size impacts CodeQL analysis time. To learn more, please see:
10+
# - https://gh.io/recommended-hardware-resources-for-running-codeql
11+
# - https://gh.io/supported-runners-and-hardware-resources
12+
# - https://gh.io/using-larger-runners
13+
# Consider using larger runners for possible analysis time improvements.
14+
runs-on: ubuntu-latest
15+
timeout-minutes: 360
16+
permissions:
17+
actions: read
18+
contents: read
19+
security-events: write
20+
21+
steps:
22+
- name: Checkout repository
23+
uses: actions/checkout@v4
24+
25+
# Initializes the CodeQL tools for scanning.
26+
- name: Initialize CodeQL
27+
uses: github/codeql-action/init@v2
28+
with:
29+
languages: java
30+
# If you wish to specify custom queries, you can do so here or in a config file.
31+
# By default, queries listed here will override any specified in a config file.
32+
# Prefix the list here with "+" to use these queries and those in the config file.
33+
34+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
35+
# queries: security-extended,security-and-quality
36+
queries: security-extended,security-and-quality
37+
38+
- uses: actions/setup-java@v3
39+
with:
40+
distribution: 'corretto'
41+
java-version: '17'
42+
cache: 'gradle'
43+
- uses: gradle/wrapper-validation-action@v1
44+
- name: Setup Gradle
45+
uses: gradle/[email protected]
46+
- name: Run build with Gradle Wrapper
47+
run: |
48+
gradle build -x intTest --no-daemon
49+
# ignore ./.gradle folder for analysis
50+
rm -Rf .gradle
51+
52+
- name: Perform CodeQL Analysis
53+
uses: github/codeql-action/analyze@v2
54+
with:
55+
category: "/language:${{matrix.language}}"

‎.github/workflows/callable.code-analysis.trivy.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: Trivy Security Scan
2+
3+
on:
4+
workflow_call:
5+
6+
jobs:
7+
analyze:
8+
name: Trivy scan (JVM)
9+
runs-on: ubuntu-latest
10+
timeout-minutes: 360
11+
permissions:
12+
actions: read
13+
contents: read
14+
security-events: write
15+
16+
steps:
17+
- name: Checkout repository
18+
uses: actions/checkout@v4
19+
20+
- uses: actions/setup-java@v3
21+
with:
22+
distribution: 'corretto'
23+
java-version: '17'
24+
cache: 'gradle'
25+
- uses: gradle/wrapper-validation-action@v1
26+
- name: Setup Gradle
27+
uses: gradle/[email protected]
28+
29+
- name: Generate gradle.lockfile for trivy scan
30+
run: gradle dependencies --write-locks
31+
32+
- name: Run Trivy vulnerability scanner in repo mode
33+
uses: aquasecurity/trivy-action@master
34+
with:
35+
scan-type: 'fs'
36+
severity: 'CRITICAL,HIGH'
37+
format: 'sarif'
38+
output: 'trivy-results.sarif'
39+
40+
- name: Upload Trivy scan results to GitHub Security tab
41+
uses: github/codeql-action/upload-sarif@v2
42+
with:
43+
sarif_file: 'trivy-results.sarif'

‎.github/workflows/callable.code-analysis.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: Code Analysis
2+
3+
on:
4+
workflow_call:
5+
6+
jobs:
7+
github_codeql_analysis:
8+
name: GitHub CodeQL Analysis
9+
permissions:
10+
actions: read
11+
contents: read
12+
security-events: write
13+
uses: ./.github/workflows/callable.code-analysis.codeql.yml
14+
trivy_scan:
15+
name: Trivy Security Scan
16+
permissions:
17+
actions: read
18+
contents: read
19+
security-events: write
20+
uses: ./.github/workflows/callable.code-analysis.trivy.yml

‎.github/workflows/callable.gradle-release.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: Gradle Release
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
type:
7+
description: 'Release type'
8+
required: true
9+
type: string
10+
11+
jobs:
12+
release:
13+
name: gradle release
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Validate 'Release Type' param
17+
id: validate_type
18+
env:
19+
TYPE: ${{ inputs.type }}
20+
run: |
21+
valid_types=(major minor patch)
22+
if [[ ! ${valid_types[*]} =~ "$TYPE" ]]; then
23+
echo "Unknown release type: $TYPE"
24+
exit 1
25+
fi
26+
- name: Checkout project sources ('main' branch)
27+
uses: actions/checkout@v4
28+
with:
29+
ref: main
30+
token: ${{ secrets.CI_GITHUB_TOKEN }}
31+
- uses: actions/setup-java@v3
32+
with:
33+
distribution: 'corretto'
34+
java-version: '17'
35+
cache: 'gradle'
36+
- uses: gradle/wrapper-validation-action@v1
37+
- name: Setup Gradle
38+
uses: gradle/[email protected]
39+
40+
- name: Get current version
41+
id: get_version
42+
run: |
43+
source gradle.properties
44+
echo "current_version=${version}" >> $GITHUB_ENV
45+
46+
- name: Determine version type
47+
id: bump_version
48+
env:
49+
TYPE: ${{ inputs.type }}
50+
VERSION: ${{ env.current_version }}
51+
run: |
52+
export major=$(echo "${VERSION}" | cut -d. -f1)
53+
export minor=$(echo "${VERSION}" | cut -d. -f2)
54+
export patch=$(echo "${VERSION}" | cut -d. -f3 | cut -d- -f1)
55+
echo "resolved: ${major}.${minor}.${patch}"
56+
57+
if [[ "$TYPE" == "major" ]]; then
58+
echo "new_version=$((major+1)).0.0" >> $GITHUB_ENV
59+
echo "new_snapshot_version=$((major+1)).0.1-SNAPSHOT" >> $GITHUB_ENV
60+
elif [ "$TYPE" == "minor" ]; then
61+
echo "new_version=${major}.$((minor+1)).0" >> $GITHUB_ENV
62+
echo "new_snapshot_version=${major}.$((minor+1)).1-SNAPSHOT" >> $GITHUB_ENV
63+
else
64+
echo "new_version=${major}.${minor}.${patch}" >> $GITHUB_ENV
65+
echo "new_snapshot_version=${major}.${minor}.$((patch+1))-SNAPSHOT" >> $GITHUB_ENV
66+
fi
67+
- name: Set git config 'user.name' and 'user.email'
68+
run: |
69+
git config --local user.email "[email protected]"
70+
git config --local user.name "GitHub Action"
71+
- name: Run 'gradle release'
72+
id: gradle_release
73+
run: |
74+
echo "Type: ${{ inputs.type }}"
75+
echo "Current version: ${{ env.current_version }}"
76+
echo "New version: ${{ env.new_version }}"
77+
echo "New snapshot version: ${{ env.new_snapshot_version }}"
78+
echo "./gradlew release -Prelease.useAutomaticVersion=true -Prelease.releaseVersion=${{ env.new_version }} -Prelease.newVersion=${{ env.new_snapshot_version }}"
79+
gradle release -Prelease.useAutomaticVersion=true -Prelease.releaseVersion=${{ env.new_version }} -Prelease.newVersion=${{ env.new_snapshot_version }}

‎.github/workflows/callable.integration-test.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: Gradle Build + intTests
2+
3+
on:
4+
workflow_call:
5+
6+
jobs:
7+
intTest:
8+
name: gradle intTest
9+
runs-on: ubuntu-latest
10+
steps:
11+
- name: Checkout project sources
12+
uses: actions/checkout@v4
13+
14+
- uses: actions/setup-java@v3
15+
with:
16+
distribution: 'corretto'
17+
java-version: '17'
18+
cache: 'gradle'
19+
- uses: gradle/wrapper-validation-action@v1
20+
- name: Setup Gradle
21+
uses: gradle/[email protected]
22+
23+
- name: Run build (incl. test)
24+
run: gradle build -x intTest --no-daemon
25+
26+
- name: Run integration tests
27+
run: gradle intTest --no-daemon

‎.github/workflows/callable.publish-javadoc.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: Deploy Javadoc
2+
3+
on:
4+
workflow_call:
5+
6+
jobs:
7+
deploy_javadoc:
8+
name: Build & deploy
9+
runs-on: ubuntu-latest
10+
permissions:
11+
contents: write
12+
13+
steps:
14+
- name: Checkout project sources
15+
uses: actions/checkout@v4
16+
17+
- uses: actions/setup-java@v3
18+
with:
19+
distribution: 'corretto'
20+
java-version: '17'
21+
cache: 'gradle'
22+
- uses: gradle/wrapper-validation-action@v1
23+
- name: Setup Gradle
24+
uses: gradle/[email protected]
25+
26+
- name: Run build (incl. test)
27+
run: gradle javadoc
28+
29+
- name: Conclude javadoc version and set env
30+
run: |
31+
if [[ "$GITHUB_REF" == "refs/heads/main" || "$GITHUB_REF" == "refs/heads/master" ]]; then
32+
echo "PUBLISH_VERSION=current" >> $GITHUB_ENV
33+
else
34+
echo "PUBLISH_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
35+
fi
36+
37+
- name: Deploy to GitHub Page 🚀 with Gradle
38+
uses: JamesIves/[email protected]
39+
with:
40+
branch: gh-pages
41+
clean: true
42+
folder: java-library-template/build/docs/javadoc
43+
target-folder: javadoc/${{ env.PUBLISH_VERSION }}

0 commit comments

Comments
 (0)