sigstore-java/.github/workflows/ci.yaml at main · sigstore/sigstore-java · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

# This workflow will build a Java project with Gradle and
# cache/restore any dependencies to improve the workflow execution time
# For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-gradle

name: Test

on:
  push:
    branches: [main]
  pull_request: {}
  workflow_call: {} # allow this workflow to be called by other workflows

jobs:
  build:
    strategy:
      matrix:
        # sigstore-java still supports Java 11, however, we test it with conformance-tests only
        java-version: [17, 21]
      fail-fast: false

    concurrency:
      # On main/release, we don't want any jobs cancelled
      # On PR branches, we cancel the job if new commits are pushed
      # More info: https://stackoverflow.com/a/70972844/1261287
      group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}-${{ matrix.java-version }}
      cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      with:
        persist-credentials: false
    - name: Set up JDK ${{ matrix.java-version }}
      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
      with:
        # We need Java 21 for the build, so we install it always
        java-version: |
          ${{ matrix.java-version }}
          21
        distribution: 'temurin'
    - name: Setup Go environment
      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
      with:
        go-version: '1.26.x'

    # at some point this should just be replaced with something that can bring up a sigstore test env
    - name: Install Fulcio
      run: go install github.com/sigstore/fulcio@main

    - name: Setup Gradle
      uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2

    # if you need to skip staging due to flakiness use "-PskipStaging"
    - name: Test sigstore-java
      run: ./gradlew build -Porg.gradle.java.installations.auto-download=false -PjdkTestVersion=${{ matrix.java-version }}

    - name: Ensure sigstore-java self signing still works
      if: ${{ !github.event.pull_request.head.repo.fork }}
      run: ./gradlew -Porg.gradle.java.installations.auto-download=false sigstore-java:publishToMavenLocal -Prelease -PskipPgpSigning

    - name: Test sigstore-java/sandbox
      run: |
        cd sandbox
        ./gradlew -Porg.gradle.java.installations.auto-download=false build