ci: share build artifacts with contract-test and cancel stale runs#80
Conversation
I3: contract-test recompiled fr-batch-service and ticket-pdf-job that the build job had already compiled, paying for two Maven builds per PR. The build job now uploads the executable backend JAR and the plugin JAR; the contract-test job downloads them instead of rebuilding. This also lets contract-test drop its GitHub Packages auth step and Maven cache, since it no longer runs Maven at all. I4: add a concurrency group with cancel-in-progress so a new push to a PR branch cancels the in-progress run instead of queuing on top of it (each contract-test holds a MySQL service container for minutes).
📝 WalkthroughWalkthroughThe Maven CI workflow adds a concurrency block to cancel stale in-progress runs. The ChangesMaven CI Workflow Refactor
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/maven.yml:
- Line 73: Replace all floating version tags in the GitHub Actions workflow with
immutable full 40-character commit SHAs. Specifically, update the `uses`
statements for actions/upload-artifact@v4 (line 73), actions/checkout@v3 (line
34), actions/setup-java@v3 (line 111), actions/download-artifact@v4 (line 129),
and all other action references on lines 185, 215, 222, 225, 251, 254 to pin
them to their respective full commit SHAs instead of using floating version
tags. This ensures supply-chain integrity by preventing unexpected changes from
new action versions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 45f295cd-bad4-4644-887e-8acdac4392cb
📒 Files selected for processing (1)
.github/workflows/maven.yml
| # Hand the executable backend JAR and the ticket-pdf-job plugin JAR to | ||
| # contract-test so it doesn't recompile what this job already built. | ||
| - name: Upload JARs needed by contract-test | ||
| uses: actions/upload-artifact@v4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Unpinned workflow actions (tag-based refs):"
rg -nP '^\s*uses:\s*[^@]+@v[0-9]+(\s*)$' .github/workflows/maven.yml || true
echo
echo "Pinned workflow actions (40-char SHA refs):"
rg -nP '^\s*uses:\s*[^@]+@[0-9a-f]{40}\s*$' .github/workflows/maven.yml || trueRepository: fronzec/spring-batch-projects
Length of output: 601
🏁 Script executed:
# Search for policy or documentation about GitHub Actions pinning
find . -type f \( -name "*.md" -o -name "*.txt" -o -name "*.yml" -o -name "*.yaml" \) | head -20 | xargs grep -l "pin\|SHA\|immutable" 2>/dev/null || trueRepository: fronzec/spring-batch-projects
Length of output: 332
🏁 Script executed:
# Check for contributing guidelines or policy files
git ls-files | grep -iE "(CONTRIBUTING|POLICY|SECURITY|README)" || trueRepository: fronzec/spring-batch-projects
Length of output: 600
🏁 Script executed:
# Look for any comments in the maven.yml file that mention pinning policy
head -20 .github/workflows/maven.ymlRepository: fronzec/spring-batch-projects
Length of output: 882
🏁 Script executed:
# Check main README for any GitHub Actions pinning policy
cat README.md | head -100Repository: fronzec/spring-batch-projects
Length of output: 1363
🏁 Script executed:
# Search specifically for any mention of "blanket policy" or GitHub Actions pinning requirement
rg -i "pin.*github|github.*action.*pin|blanket policy" --max-count=10Repository: fronzec/spring-batch-projects
Length of output: 55
🏁 Script executed:
# Check if there are any CONTRIBUTING or security guidelines
find . -maxdepth 2 -iname "*CONTRIBUT*" -o -iname "*SECURITY*" | xargs cat 2>/dev/null || echo "No contributing/security files found"Repository: fronzec/spring-batch-projects
Length of output: 55
Pin GitHub Actions to immutable SHAs.
The workflow uses floating @v4 and @v3/@v5 tags on multiple actions, which weakens supply-chain integrity. Lines 73, 129, and others (34, 111, 185, 215, 222, 225, 251, 254) should pin to full 40-character commit SHAs instead.
Suggested patch
- - name: Upload JARs needed by contract-test
- uses: actions/upload-artifact@v4
+ - name: Upload JARs needed by contract-test
+ uses: actions/upload-artifact@<FULL_40_CHAR_COMMIT_SHA>
@@
- - name: Download prebuilt JARs from the build job
- uses: actions/download-artifact@v4
+ - name: Download prebuilt JARs from the build job
+ uses: actions/download-artifact@<FULL_40_CHAR_COMMIT_SHA>🧰 Tools
🪛 zizmor (1.25.2)
[error] 73-73: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/maven.yml at line 73, Replace all floating version tags in
the GitHub Actions workflow with immutable full 40-character commit SHAs.
Specifically, update the `uses` statements for actions/upload-artifact@v4 (line
73), actions/checkout@v3 (line 34), actions/setup-java@v3 (line 111),
actions/download-artifact@v4 (line 129), and all other action references on
lines 185, 215, 222, 225, 251, 254 to pin them to their respective full commit
SHAs instead of using floating version tags. This ensures supply-chain integrity
by preventing unexpected changes from new action versions.
Source: Linters/SAST tools
1 participant
What
Two CI efficiency fixes in
maven.yml(backlog I3 + I4).I3 — stop double-compiling.
contract-testranmvn packageforfr-batch-serviceandticket-pdf-job— the exact modules thebuildjob already compiled — paying for two Maven builds per PR. Now:builduploads the executable backend JAR + the ticket-pdf-job plugin JAR (actions/upload-artifact, 1-day retention).contract-testdownloads them (actions/download-artifact) instead of rebuilding.contract-testno longer runs Maven, its GitHub Packages auth step and Maven cache are removed too — just a JDK to runjava -jar.I4 — cancel stale runs. Added a workflow-level
concurrencygroup withcancel-in-progress: true, so a new push to a PR branch cancels the in-progress run rather than queuing on top of it. Eachcontract-testholds a MySQL service container for minutes, so pile-ups were costly.Verification
This PR's own CI run is the validation: it exercises the real upload→download path (a wrong artifact path fails
contract-test) and thecontract-testjob no longer has a Maven build step.Summary by CodeRabbit