Skip to content

Commit 9d0785d

Browse files
cx-atish-jadhavcx-luis-ventuzelos
cx-atish-jadhav
and
cx-luis-ventuzelos
committed
Updating ast-cli version and binaries 2.3.54 (#485)
* Updating ast-cli version and binaries * Harden workflows: scope permissions, fix set-output, replace dev-drprasad, remove repository_dispatch, comment notify and spotbugs * Remove Maven cache from release and CI workflows * Add publish input to gate Maven Central deploy --------- Co-authored-by: Luís Ventuzelos <207163323+cx-luis-ventuzelos@users.noreply.github.com>
1 parent c854db1 commit 9d0785d

9 files changed

Lines changed: 68 additions & 65 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 5 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -21,14 +21,6 @@ jobs:
2121
- name: Checkout LFS objects
2222
run: git lfs checkout
2323

24-
- name: Cache local Maven repository
25-
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
26-
with:
27-
path: ~/.m2/repository
28-
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
29-
restore-keys: |
30-
${{ runner.os }}-maven-
31-
3224
- name: Set up JDK 11
3325
uses: actions/setup-java@2dfa2011c5b2a0f1489bf9e433881c92c1631f88 # v4.3.0
3426
with:
@@ -82,8 +74,8 @@ jobs:
8274
- name: Build with Maven
8375
run: mvn -B verify -DskipTests -Dgpg.skip --file pom.xml
8476

85-
- name: Run SpotBugs Analysis
86-
if: ${{ github.actor != 'dependabot[bot]' }}
87-
uses: jwgmeligmeyling/spotbugs-github-action@b8e2c3523acb34c87f14e18cbcd2d87db8c8584e #v1.2
88-
with:
89-
path: '**/spotbugsXml.xml'
77+
# - name: Run SpotBugs Analysis
78+
# if: ${{ github.actor != 'dependabot[bot]' }}
79+
# uses: jwgmeligmeyling/spotbugs-github-action@b8e2c3523acb34c87f14e18cbcd2d87db8c8584e #v1.2
80+
# with:
81+
# path: '**/spotbugsXml.xml'

‎.github/workflows/nightly.yml‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,20 +5,24 @@ on:
55
branches:
66
- main
77

8+
permissions:
9+
contents: read
10+
811
jobs:
912
delete_tag:
13+
permissions:
14+
contents: write
1015
runs-on: cx-public-ubuntu-x64
1116
steps:
12-
- name: Delete release
13-
uses: dev-drprasad/delete-tag-and-release@8cd619d00037e4aeb781909c9a6b03940507d0da # v1.0.1
17+
- name: Delete release and tag
1418
env:
15-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
16-
with:
17-
delete_release: true
18-
tag_name: 1.0.0-SNAPSHOT
19+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
20+
run: |
21+
gh release delete "1.0.0-SNAPSHOT" --yes --cleanup-tag --repo ${{ github.repository }} || true
22+
1923
nightly:
2024
needs: delete_tag
21-
uses: CheckmarxDev/ast-cli-java-wrapper/.github/workflows/release.yml@main
25+
uses: Checkmarx/ast-cli-java-wrapper/.github/workflows/release.yml@main
2226
with:
2327
tag: "1.0.0-SNAPSHOT"
2428
dev: true

‎.github/workflows/release.yml‎

Lines changed: 41 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,11 @@ on:
1616
description: 'Version of the CLI to bundle'
1717
required: false
1818
type: string
19+
publish:
20+
description: 'Publish package to Maven Central'
21+
required: false
22+
default: false
23+
type: boolean
1924
workflow_call:
2025
inputs:
2126
tag:
@@ -31,6 +36,14 @@ on:
3136
description: 'Version of the CLI to bundle'
3237
required: false
3338
type: string
39+
publish:
40+
description: 'Publish package to Maven Central'
41+
required: false
42+
default: false
43+
type: boolean
44+
45+
permissions:
46+
contents: read
3447
secrets:
3548
MAVEN_GPG_PASSPHRASE:
3649
required: true
@@ -45,6 +58,9 @@ on:
4558

4659
jobs:
4760
release:
61+
permissions:
62+
id-token: write
63+
contents: write
4864
runs-on: cx-public-ubuntu-x64
4965
outputs:
5066
CLI_VERSION: ${{ steps.extract_cli_version.outputs.CLI_VERSION }}
@@ -68,7 +84,7 @@ jobs:
6884
CLI_VERSION=$(./src/main/resources/cx-linux version | grep -Eo '^[0-9]+\.[0-9]+\.[0-9]+')
6985
echo "CLI version being packed is $CLI_VERSION"
7086
echo "CLI_VERSION=$CLI_VERSION" >> $GITHUB_ENV
71-
echo "::set-output name=CLI_VERSION::$CLI_VERSION"
87+
echo "CLI_VERSION=$CLI_VERSION" >> $GITHUB_OUTPUT
7288
7389
- name: Check if CLI version is latest
7490
if: ${{ github.event.inputs.dev == 'false' && !github.event.inputs.cliTag && github.ref == 'refs/heads/main' }}
@@ -96,15 +112,7 @@ jobs:
96112
git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
97113
git tag -a "${tag}" -m "${message}"
98114
git push origin "${tag}"
99-
echo "::set-output name=TAG_NAME::${{ inputs.tag }}"
100-
101-
- name: Cache local Maven repository
102-
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
103-
with:
104-
path: ~/.m2/repository
105-
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
106-
restore-keys: |
107-
${{ runner.os }}-maven-
115+
echo "TAG_NAME=${{ inputs.tag }}" >> $GITHUB_OUTPUT
108116
109117
- name: Set up Maven Central Repository
110118
uses: actions/setup-java@2dfa2011c5b2a0f1489bf9e433881c92c1631f88 # v4.3.0
@@ -129,6 +137,7 @@ jobs:
129137
echo "AID_PROP=${prop}" >> $GITHUB_ENV
130138
131139
- name: Publish package
140+
if: inputs.publish == true
132141
run: mvn --batch-mode deploy -DskipTests ${{ env.AID_PROP }}
133142
env:
134143
MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}
@@ -142,26 +151,26 @@ jobs:
142151
tag_name: ${{ inputs.tag }}
143152
prerelease: ${{ inputs.dev }}
144153

145-
notify:
146-
if: inputs.dev == false
147-
needs: release
148-
uses: Checkmarx/plugins-release-workflow/.github/workflows/release-notify.yml@main
149-
with:
150-
product_name: Java Wrapper
151-
release_version: ${{ needs.release.outputs.TAG_NAME }}
152-
cli_release_version: ${{ needs.release.outputs.CLI_VERSION }}
153-
release_author: "Sypher Team"
154-
release_url: https://github.com/Checkmarx/ast-cli-java-wrapper/releases/tag/${{ needs.release.outputs.TAG_NAME }}
155-
jira_product_name: JAVA_WRAPPER
156-
secrets: inherit
154+
# notify:
155+
# if: inputs.dev == false
156+
# needs: release
157+
# uses: Checkmarx/plugins-release-workflow/.github/workflows/release-notify.yml@main
158+
# with:
159+
# product_name: Java Wrapper
160+
# release_version: ${{ needs.release.outputs.TAG_NAME }}
161+
# cli_release_version: ${{ needs.release.outputs.CLI_VERSION }}
162+
# release_author: "Sypher Team"
163+
# release_url: https://github.com/Checkmarx/ast-cli-java-wrapper/releases/tag/${{ needs.release.outputs.TAG_NAME }}
164+
# jira_product_name: JAVA_WRAPPER
165+
# secrets: inherit
157166

158-
dispatch_auto_release:
159-
name: Update Jenkins/Jetbrains/Eclipse Extensions With new Wrapper Version
160-
if: inputs.dev == false
161-
needs: notify
162-
uses: Checkmarx/plugins-release-workflow/.github/workflows/dispatch-workflow.yml@main
163-
with:
164-
cli_version: ${{ needs.release.outputs.CLI_VERSION }}
165-
is_cli_release: false
166-
is_java_release: true
167-
secrets: inherit
167+
# dispatch_auto_release:
168+
# name: Update Jenkins/Jetbrains/Eclipse Extensions With new Wrapper Version
169+
# if: inputs.dev == false
170+
# needs: notify
171+
# uses: Checkmarx/plugins-release-workflow/.github/workflows/dispatch-workflow.yml@main
172+
# with:
173+
# cli_version: ${{ needs.release.outputs.CLI_VERSION }}
174+
# is_cli_release: false
175+
# is_java_release: true
176+
# secrets: inherit

‎.github/workflows/update-cli.yml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,6 @@ name: Update checkmarx ast cli
22

33
on:
44
workflow_dispatch:
5-
repository_dispatch:
6-
types: [cli-version-update]
75

86
permissions:
97
contents: read
@@ -31,8 +29,8 @@ jobs:
3129
- name: Get Latest Checkmarx API version
3230
id: checkmarx-ast-cli
3331
run: |
34-
echo ::set-output name=release_tag::$(curl -sL https://api.github.com/repos/checkmarx/ast-cli/releases/latest | jq -r ".tag_name")
35-
echo ::set-output name=current_tag::$(<checkmarx-ast-cli.version)
32+
echo "release_tag=$(curl -sL https://api.github.com/repos/checkmarx/ast-cli/releases/latest | jq -r '.tag_name')" >> $GITHUB_OUTPUT
33+
echo "current_tag=$(<checkmarx-ast-cli.version)" >> $GITHUB_OUTPUT
3634
3735
- name: Update Checkmarx cli version
3836
if: steps.checkmarx-ast-cli.outputs.current_tag != steps.checkmarx-ast-cli.outputs.release_tag

‎checkmarx-ast-cli.version‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
2.3.48
1+
2.3.54

‎src/main/resources/cx-linux‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
version https://git-lfs.github.com/spec/v1
2-
oid sha256:f73e555c94ea77a10d31e37de49e40d3468ec2787e4e6d917539409210a8fe8d
3-
size 81281208
2+
oid sha256:776d9864c0104e1d0023641ef931bd1c58478cf56768ce77f2bfbfd6e9e64493
3+
size 80568482

‎src/main/resources/cx-linux-arm‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
version https://git-lfs.github.com/spec/v1
2-
oid sha256:101acdd3d54073d9964986e279da786e527d0e649f5ae5473a79481bbb8389ef
3-
size 76415160
2+
oid sha256:d40b3cfb9f930e96a9d6b494d4c7b9cd98e3bb857e55a0f55c92d764bb8c3c1a
3+
size 75235490

‎src/main/resources/cx-mac‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
version https://git-lfs.github.com/spec/v1
2-
oid sha256:71a744df366cddf2312b2e4a51f1174ab785d06b48506e08c3c8ee9cde8f82cf
3-
size 162260464
2+
oid sha256:df4a2d6b72936afa65df8730f0ee491f6d518286421063f50df2e48d3d5b56f9
3+
size 160422432

‎src/main/resources/cx.exe‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
version https://git-lfs.github.com/spec/v1
2-
oid sha256:489659950e778b01bf66ba126cd52a1acf8f124db62407b190516c12648baf6b
3-
size 83262400
2+
oid sha256:c7227ac9dd89f344c12629d367774a2428595b3daff0a2e710981d924f13dbf4
3+
size 82488128

0 commit comments

Comments
 (0)