From cb26f03e544afdcff1f443aad8d8d33ea36a5005 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C3=ABl=20Hompus?= Date: Sat, 10 Oct 2026 14:05:54 +0200 Subject: [PATCH] Enhance CI/CD workflows --- .github/dependabot.yml | 4 ++ .github/workflows/Continuous.yml | 70 +++++++++++++++++++++++--------- .github/workflows/Release.yml | 34 ++++++++++++---- 3 files changed, 81 insertions(+), 27 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 273fff0..b44cfbd 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,3 +9,7 @@ updates: directory: "/" # Location of package manifests schedule: interval: "weekly" + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" diff --git a/.github/workflows/Continuous.yml b/.github/workflows/Continuous.yml index ab1f7f0..b176873 100644 --- a/.github/workflows/Continuous.yml +++ b/.github/workflows/Continuous.yml @@ -8,34 +8,66 @@ on: branches: - main +permissions: + contents: read + +concurrency: + group: continuous-${{ github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + jobs: - ubuntu-latest: - name: ubuntu-latest - runs-on: ubuntu-latest - permissions: - contents: read - packages: write + verify: + name: Verify + runs-on: ubuntu-24.04 + timeout-minutes: 20 steps: - - uses: actions/checkout@v4 + - name: Checkout repository + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Set up JDK 21 - uses: actions/setup-java@v4 + uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: java-version: '21' - distribution: 'temurin' + distribution: temurin cache: maven - name: Run the Maven verify phase - run: mvn verify jacoco:report -e --update-snapshots --no-transfer-progress - env: - MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }} + run: mvn --batch-mode --no-transfer-progress verify jacoco:report -Dgpg.skip=true - name: Report Coveralls - uses: coverallsapp/github-action@v2 - - run: mkdir staging && cp target/*.jar staging - - uses: actions/upload-artifact@v4 + uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2.3.8 + - name: Stage package artifacts + run: mkdir staging && cp target/*.jar staging/ + - name: Upload package artifacts + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: - name: Package - path: staging + name: java-tool-package + path: staging/*.jar + if-no-files-found: error + + publish-github-packages: + name: Publish to GitHub Packages + if: github.repository == 'dendrodocs/java-tool' && github.event_name == 'push' && github.ref == 'refs/heads/main' + needs: verify + runs-on: ubuntu-24.04 + timeout-minutes: 20 + permissions: + contents: read + packages: write + steps: + - name: Checkout repository + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false + - name: Set up JDK 21 and GitHub Packages credentials + uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 + with: + java-version: '21' + distribution: temurin + server-id: github + server-username: GITHUB_ACTOR + server-password: GITHUB_TOKEN - name: Publish package - if: "${{ github.head_ref == '' }}" - run: mvn deploy -Dmaven.install.skip=true --no-transfer-progress + run: mvn --batch-mode --no-transfer-progress deploy -Dmaven.install.skip=true env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITHUB_ACTOR: ${{ github.actor }} diff --git a/.github/workflows/Release.yml b/.github/workflows/Release.yml index 09effe2..897e512 100644 --- a/.github/workflows/Release.yml +++ b/.github/workflows/Release.yml @@ -1,27 +1,45 @@ name: Publish package to the Maven Central Repository + on: release: types: [created] + +permissions: + contents: read + +concurrency: + group: release-${{ github.event.release.tag_name }} + cancel-in-progress: false + jobs: publish: - runs-on: ubuntu-latest + if: github.repository == 'dendrodocs/java-tool' + runs-on: ubuntu-24.04 + timeout-minutes: 30 + permissions: + contents: read steps: - - uses: actions/checkout@v4 + - name: Checkout repository + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Set up Maven Central Repository - uses: actions/setup-java@v4 + uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 with: java-version: '21' - distribution: 'temurin' - server-id: 'central' + distribution: temurin + server-id: central server-username: MAVEN_USERNAME server-password: MAVEN_PASSWORD gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} gpg-passphrase: MAVEN_GPG_PASSPHRASE - name: Update version in pom.xml - run: mvn versions:set -DnewVersion=${{ github.event.release.tag_name }} -DgenerateBackupPoms=false + run: mvn --batch-mode --no-transfer-progress versions:set "-DnewVersion=$RELEASE_TAG" -DgenerateBackupPoms=false + env: + RELEASE_TAG: ${{ github.event.release.tag_name }} - name: Publish package - run: mvn deploy -P publish -Dmaven.install.skip=true --no-transfer-progress + run: mvn --batch-mode --no-transfer-progress deploy -P publish -Dmaven.install.skip=true env: MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }} MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }} - MAVEN_GPG_PASSPHRASE : ${{ secrets.MAVEN_GPG_PASSPHRASE }} + MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}