-
Notifications
You must be signed in to change notification settings - Fork 0
141 lines (116 loc) · 3.69 KB
/
ci.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
name: "🏗️ CI"
on:
push:
branches:
- main
- development
- '!feature/**'
paths:
- '**'
- '!.github/**/*.yml'
tags:
- '*'
pull_request:
branches:
- main
- development
- 'feature/**'
permissions:
contents: read
packages: write
pull-requests: read
jobs:
build:
runs-on: ubuntu-latest
name: "🛠️ build"
steps:
- uses: actions/checkout@v3
name: Checkout project
with:
fetch-depth: 0 #spotless fix
- name: debug
shell: bash
env:
JSON: ${{ toJSON(github) }}
run: echo $JSON
- name: install_shared_actions
uses: ./.github/actions/install_shared_actions
with:
token: ${{secrets.EFA_CICD_REPO_ACCESS_TOKEN}}
tag: v2.5.3
- name: ensure branch strategy compliance
id: check_branch_strategy
uses: ./.github/actions/shared/check_branch_name
- name: project setup
uses: ./.github/actions/shared/setup_jdk_17
- name: build without tests
uses: gradle/[email protected]
with:
arguments: build -x test
- name: scan dependencies for vulnerabilities
if: ${{ vars.TRIVY_ROOTFS_SCAN_ENABLED == 'true' }}
uses: docker://docker.io/aquasec/trivy
with:
args: rootfs --skip-dirs=.sonar --ignore-unfixed --severity "HIGH,CRITICAL" --scanners "vuln" --exit-code 1 --debug .
test:
needs: [build]
runs-on: ubuntu-latest
name: "📝 run tests"
steps:
- uses: actions/checkout@v3
name: Checkout project
- name: install_shared_actions
uses: ./.github/actions/install_shared_actions
with:
token: ${{secrets.EFA_CICD_REPO_ACCESS_TOKEN}}
tag: v2.5.3
- name: project setup
uses: ./.github/actions/shared/setup_jdk_17
- name: run unit tests
id: run_tests
uses: gradle/[email protected]
with:
arguments: test --info -Pgpr.key=${{ inputs.xray-ghp-token }}
- name: publish test report
uses: mikepenz/[email protected]
if: always() # always run even if the previous step fails
with:
report_paths: '**/build/test-results/test/TEST-*.xml'
annotate_only: true
- name: check sonarcloud.io
id: sonarcloud_probe
shell: bash +e {0}
run: |
curl -kv https://sonarcloud.io
echo "exit=$?" >> $GITHUB_OUTPUT
exit 0
- name: run sonar scan
if: ${{ github.actor != 'dependabot[bot]' && vars.SONAR_SCAN_ENABLED == 'true' && steps.sonarcloud_probe.outputs.exit == '0' }}
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
SONAR_HOST_URL: https://sonarcloud.io
uses: gradle/[email protected]
with:
arguments: sonarqube --info
publish:
if: ${{ github.actor != 'dependabot[bot]' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/development') }}
needs: [test]
runs-on: ubuntu-latest
name: "🚀 publish"
steps:
- uses: actions/checkout@v3
name: checkout project
- name: install_shared_actions
uses: ./.github/actions/install_shared_actions
with:
token: ${{secrets.EFA_CICD_REPO_ACCESS_TOKEN}}
tag: v2.5.3
- name: project setup
uses: ./.github/actions/shared/setup_jdk_17
- name: publish package
uses: gradle/[email protected]
with:
arguments: publish
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}