Skip to content

Commit 6907a62

Browse files
kwinkwin
authored
improve GH actions (#26)
build with Java 8, 11 and 17 make compatible with PRs from forked repos This closes #23
1 parent 76e3304 commit 6907a62

1 file changed

Lines changed: 87 additions & 30 deletions

File tree

‎.github/workflows/maven.yml‎

Lines changed: 87 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,94 @@
11
name: maven-cicd
22

3-
on: [push, pull_request]
3+
on:
4+
# for regular master build (after the merge)
5+
push:
6+
branches:
7+
- main
8+
# for PRs from forked repos and non forked repos
9+
# in order to write status info to the PR we require write repository token (https://github.blog/2020-08-03-github-actions-improvements-for-fork-and-pull-request-workflows/)
10+
pull_request_target:
11+
branches:
12+
- main
13+
types: [opened, synchronize, reopened]
14+
15+
# restrict privileges except for setting commit status, adding PR comments and writing statuses
16+
permissions:
17+
actions: read
18+
checks: write
19+
contents: read
20+
deployments: read
21+
issues: read
22+
packages: read
23+
pull-requests: write
24+
repository-projects: read
25+
security-events: read
26+
statuses: write
427

528
jobs:
629
build:
30+
strategy:
31+
matrix:
32+
os: [ubuntu-latest, macOS-latest] # Windows doe not yet work
33+
jdk: [8, 11, 17]
34+
include:
35+
# lengthy build steps should only be performed on linux with Java 11 (SonarQube analysis, deployment)
36+
- os: ubuntu-latest
37+
jdk: 11
38+
isMainBuildEnv: true
39+
namePrefix: 'Main '
40+
fail-fast: false
41+
42+
name: ${{ matrix.namePrefix }} Maven build (${{ matrix.os }}, JDK ${{ matrix.jdk }})
43+
runs-on: ${{ matrix.os }}
744

8-
runs-on: ubuntu-latest
945
steps:
10-
- name: Git Clone
11-
uses: actions/checkout@v2
12-
- name: Set up JDK 11
13-
uses: actions/setup-java@v2
14-
with:
15-
distribution: 'adopt'
16-
java-version: '11'
17-
server-id: ossrh # Value of the distributionManagement/repository/id field of the pom.xml
18-
server-username: MAVEN_USERNAME # env variable for username in deploy
19-
server-password: MAVEN_PASSWORD # env variable for token in deploy
20-
- name: Adjust Git Config
21-
run: |
22-
git config --global user.email "action@github.com"
23-
git config --global user.name "GitHub Action"
24-
- name: Build with Maven
25-
if: github.ref != 'refs/heads/main'
26-
env:
27-
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
28-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
29-
run: mvn -B clean install org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=Netcentric_aem-cloud-validator -Dsonar.organization=netcentric -Dsonar.host.url=https://sonarcloud.io -Pjacoco-report
30-
- name: Build and Deploy with Maven
31-
if: github.ref == 'refs/heads/main'
32-
env:
33-
MAVEN_USERNAME: ${{ secrets.OSSRH_TOKEN_USER }}
34-
MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN_PASSWORD }}
35-
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
36-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
37-
run: mvn -B clean deploy org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=Netcentric_aem-cloud-validator -Dsonar.organization=netcentric -Dsonar.host.url=https://sonarcloud.io -Pjacoco-report
46+
- name: Checkout
47+
uses: actions/checkout@v2
48+
# always act on the modified source code (even for event pull_request_target)
49+
# is considered potentially unsafe (https://securitylab.github.com/research/github-actions-preventing-pwn-requests/) but actions are only executed after approval from committers
50+
with:
51+
ref: ${{ github.event.pull_request.head.sha }}
52+
# no additional git operations after checkout triggered in workflow, no need to store credentials
53+
persist-credentials: false
54+
55+
- name: Set up JDK
56+
uses: actions/setup-java@v2
57+
with:
58+
cache: 'maven'
59+
distribution: 'temurin'
60+
java-version: ${{ matrix.jdk }}
61+
# generate settings.xml with the correct values
62+
server-id: ossrh # Value of the distributionManagement/repository/id field of the pom.xml
63+
server-username: MAVEN_USERNAME # env variable for username in deploy
64+
server-password: MAVEN_PASSWORD # env variable for token in deploy
65+
66+
# sets environment variables to be used in subsequent steps: https://docs.github.com/en/actions/reference/workflow-commands-for-github-actions#setting-an-environment-variable
67+
- name: Set environment variables
68+
shell: bash
69+
run: |
70+
if [ "${{ matrix.isMainBuildEnv }}" = "true" ]; then
71+
echo "MVN_ADDITIONAL_OPTS=-Dsonar.projectKey=Netcentric_aem-cloud-validator -Dsonar.organization=netcentric -Dsonar.host.url=https://sonarcloud.io -Pjacoco-report" >> $GITHUB_ENV
72+
if [ "${{github.ref}}" = "refs/heads/master" ] && [ "${{github.event_name}}" = "push" ]; then
73+
echo "MAVEN_USERNAME=${{ secrets.OSSRH_TOKEN_USER }}" >> $GITHUB_ENV
74+
echo "MAVEN_PASSWORD=${{ secrets.OSSRH_TOKEN_PASSWORD }}" >> $GITHUB_ENV
75+
echo "MVN_GOAL=clean deploy org.sonarsource.scanner.maven:sonar-maven-plugin:sonar" >> $GITHUB_ENV
76+
echo "STEP_NAME_SUFFIX=(Deploys to OSSRH)" >> $GITHUB_ENV
77+
else
78+
echo "MVN_GOAL=clean verify" >> $GITHUB_ENV
79+
fi
80+
else
81+
echo "MVN_ADDITIONAL_OPTS=" >> $GITHUB_ENV
82+
echo "MVN_GOAL=clean verify" >> $GITHUB_ENV
83+
fi
84+
- name: ${{ matrix.namePrefix }} Build with Maven ${{ env.STEP_NAME_SUFFIX }}
85+
env:
86+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
87+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
88+
run: mvn -e -B -V ${{ env.MVN_GOAL }} ${{ env.MVN_ADDITIONAL_OPTS }}
89+
90+
- name: Publish Test Report
91+
if: ${{ always() }} # make sure to run even if previous Maven execution failed (due to failed test)
92+
uses: scacap/action-surefire-report@v1
93+
with:
94+
check_name: Test report (${{ matrix.os }}, JDK ${{ matrix.jdk }})

0 commit comments

Comments
 (0)