diff options
Diffstat (limited to '.github/workflows/build.yml')
| -rw-r--r-- | .github/workflows/build.yml | 195 |
1 files changed, 195 insertions, 0 deletions
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml new file mode 100644 index 00000000..e91f3b1e --- /dev/null +++ b/.github/workflows/build.yml @@ -0,0 +1,195 @@ +name: Build + +on: + push: + branches: + - 'main' + - 'master' + - 'development' + tags: + - 'v*' + pull_request: + branches: + - '**' + workflow_dispatch: + +permissions: + contents: read + checks: write + pull-requests: write + +env: + LC_ALL: "en_US.UTF-8" + LANG: "en_US.UTF-8" + LANGUAGE: "en_US" + LIB_NAME: "PDF-AS 5" + PROJECT_PATH: '.' + PROJECT_NAME: 'pdf-as' + +jobs: + security-checks: + name: Security Scans (Dependency/SAST/Secrets) + runs-on: [self-hosted, linux] + env: + REPO_PATH: repo-${{ github.run_id }}-${{ github.job }} + + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + path: ${{ env.REPO_PATH }} + fetch-depth: 0 + + - name: Install jq + uses: dcarbone/install-jq-action@v3 + + - name: Dependency Scanning (OWASP Dependency-Check) + uses: dependency-check/Dependency-Check_Action@main + with: + project: ${{ env.PROJECT_NAME }} + path: ${{ env.REPO_PATH }} + format: ALL + args: --noupdate + + - name: SAST (Semgrep) + uses: returntocorp/semgrep-action@v1 + continue-on-error: true + with: + config: >- + p/security-audit + p/java + + - name: Secret Detection (TruffleHog) + uses: trufflesecurity/trufflehog@v3.94.3 + with: + path: ${{ env.REPO_PATH }} + extra_args: --results=verified + + build-and-analyse: + name: Build & Quality Checks + runs-on: [self-hosted, linux] + if: ${{ !startsWith(github.ref, 'refs/tags/') }} + needs: [security-checks] + env: + REPO_PATH: repo-${{ github.run_id }}-${{ github.job }} + + defaults: + run: + working-directory: ${{ env.REPO_PATH }} + + steps: + - name: Clean old run folders + working-directory: ${{ github.workspace }} + run: | + set -euo pipefail + find . -maxdepth 1 -type d -name 'repo-*-*' -print -exec rm -rf {} + + + - name: Checkout + uses: actions/checkout@v4 + with: + path: ${{ env.REPO_PATH }} + clean: false + fetch-depth: 2 + submodules: recursive + + - name: Set up JDK 17 + uses: actions/setup-java@v4 + with: + distribution: temurin + java-version: 17 + cache: gradle + + - name: Compile & Test + run: ./gradlew --warning-mode all clean build + + - name: Upload Analysis Reports + uses: actions/upload-artifact@v4 + if: failure() + with: + name: analysis-reports + path: | + ${{ env.REPO_PATH }}/**/build/reports/pmd/*.xml + ${{ env.REPO_PATH }}/**/build/reports/spotbugs/*.xml + ${{ env.REPO_PATH }}/**/build/reports/checkstyle/*.xml + ${{ env.REPO_PATH }}/**/build/reports/jacoco/**/jacocoTestReport.xml + ${{ env.REPO_PATH }}/**/build/test-results/test/TEST-*.xml + if-no-files-found: warn + retention-days: 1 + + - name: Extract Pull Request Number + uses: jwalton/gh-find-current-pr@v1 + if: always() + id: pr + + - name: Detect Test Reports + id: tests + if: always() + run: | + shopt -s globstar nullglob + reports=(**/build/test-results/test/TEST-*.xml) + if [ ${#reports[@]} -gt 0 ]; then + echo "has_tests=true" >> "$GITHUB_OUTPUT" + else + echo "has_tests=false" >> "$GITHUB_OUTPUT" + fi + + - name: Prepare Quality Monitor config + id: qm + if: always() + shell: bash + run: | + if [ "${{ steps.tests.outputs.has_tests }}" = "true" ]; then + echo "name=Run Quality Monitor (with coverage)" >> "$GITHUB_OUTPUT" + echo 'config={"tests":{"tools":[{"id":"junit","name":"Unittests","pattern":"**/build/test-results/test/TEST-*.xml"}]},"analysis":[{"name":"Style","id":"style","tools":[{"id":"checkstyle","pattern":"**/build/reports/checkstyle/*.xml"}]},{"name":"Code Analyzer","id":"pmd","tools":[{"id":"pmd","pattern":"**/build/reports/pmd/*.xml"}]},{"name":"Bugs","id":"bugs","tools":[{"id":"spotbugs","pattern":"**/build/reports/spotbugs/*.xml"}]}],"coverage":[{"name":"JaCoCo","tools":[{"id":"jacoco","metric":"line","pattern":"**/build/reports/jacoco/**/jacocoTestReport.xml"},{"id":"jacoco","metric":"branch","pattern":"**/build/reports/jacoco/**/jacocoTestReport.xml"}]}]}' >> "$GITHUB_OUTPUT" + echo 'gates={"qualityGates":[{"metric":"line","threshold":75.0,"criticality":"UNSTABLE"},{"metric":"branch","threshold":75.0,"criticality":"UNSTABLE"},{"metric":"checkstyle","threshold":70.0,"criticality":"UNSTABLE"},{"metric":"pmd","threshold":70.0,"criticality":"UNSTABLE"},{"metric":"spotbugs","threshold":10.0,"criticality":"UNSTABLE"}]}' >> "$GITHUB_OUTPUT" + else + echo "name=Run Quality Monitor (without coverage)" >> "$GITHUB_OUTPUT" + echo 'config={"tests":{"tools":[{"id":"junit","name":"Unittests","pattern":"**/build/test-results/test/TEST-*.xml"}]},"analysis":[{"name":"Style","id":"style","tools":[{"id":"checkstyle","pattern":"**/build/reports/checkstyle/*.xml"}]},{"name":"Code Analyzer","id":"pmd","tools":[{"id":"pmd","pattern":"**/build/reports/pmd/*.xml"}]},{"name":"Bugs","id":"bugs","tools":[{"id":"spotbugs","pattern":"**/build/reports/spotbugs/*.xml"}]}]}' >> "$GITHUB_OUTPUT" + echo 'gates={"qualityGates":[{"metric":"checkstyle","threshold":70.0,"criticality":"UNSTABLE"},{"metric":"pmd","threshold":70.0,"criticality":"UNSTABLE"},{"metric":"spotbugs","threshold":10.0,"criticality":"UNSTABLE"}]}' >> "$GITHUB_OUTPUT" + fi + + - name: ${{ steps.qm.outputs.name }} + if: always() + uses: uhafner/quality-monitor@v4.2.0 + continue-on-error: true + with: + pr-number: ${{ steps.pr.outputs.number }} + checks-name: Quality Monitor + config: ${{ steps.qm.outputs.config }} + quality-gates: ${{ steps.qm.outputs.gates }} + + publishToEGIZMaven: + name: Assemble Release Package & Publish + runs-on: [self-hosted, linux] + needs: build-and-analyse + if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }} + env: + REPO_PATH: repo-${{ github.run_id }}-${{ github.job }} + + defaults: + run: + working-directory: ${{ env.REPO_PATH }} + + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + path: ${{ env.REPO_PATH }} + + - name: Set up JDK 17 + uses: actions/setup-java@v4 + with: + distribution: temurin + java-version: 17 + cache: gradle + + - name: Setup SSH known_hosts + env: + DEPLOY_EGIZ: ${{ secrets.DEPLOY_EGIZ }} + run: | + mkdir -p ~/.ssh + echo $DEPLOY_EGIZ | base64 --decode > ~/.ssh/known_hosts + chmod 644 ~/.ssh/known_hosts + + - name: Build and Publish + run: ./gradlew --stacktrace -x test publish
\ No newline at end of file |