Skip to content

ci(release): simplify semantic-release config #125

ci(release): simplify semantic-release config

ci(release): simplify semantic-release config #125

Workflow file for this run

name: CI
on:
workflow_dispatch:
push:
branches: [main, 'release/v*', next, next-major, beta, alpha]
pull_request:
branches: [main, 'release/v*', next, next-major, beta, alpha]
schedule:
- cron: '5 4 * * *' # Every day at 04:05
permissions: {}
jobs:
build-and-test:
name: Build & Test
runs-on: ubuntu-22.04
timeout-minutes: 300
permissions:
contents: read
env:
COMMITLINT_CONFIG_FILE: ${{ github.workspace }}/.github/commitlint.config.js
steps:
- name: Harden runner
uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
with:
disable-sudo: true
egress-policy: block
allowed-endpoints: >
github.com:443
api.github.com:443
objects.githubusercontent.com:443
repo.maven.apache.org:443
jitpack.io:443
repo.papermc.io:443
api.nuget.org:443
registry.npmjs.org:443
auth.docker.io:443
registry-1.docker.io:443
production.cloudflare.docker.com:443
sonarcloud.io:443
scanner.sonarcloud.io:443
ea6ne4j2sb.execute-api.eu-central-1.amazonaws.com:443
sc-cleancode-sensorcache-eu-central-1-prod.s3.amazonaws.com:443
- name: Checkout repository
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
persist-credentials: false
fetch-depth: 0 # Required by SonarCloud and commitlint
- name: Setup Node.js
uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
with:
node-version: lts/iron
cache: npm
cache-dependency-path: .github/package-lock.json
- name: Install commitlint
working-directory: .github/
run: npm clean-install
- name: Validate current commit (last commit) with commitlint
if: ${{ github.event_name != 'pull_request' }}
working-directory: .github/
run: npx --no-install commitlint --config "${COMMITLINT_CONFIG_FILE}" --verbose --from HEAD~1 --to HEAD
- name: Validate PR commits with commitlint
if: ${{ github.event_name == 'pull_request' }}
working-directory: .github/
run: |
npx --no-install commitlint --config "${COMMITLINT_CONFIG_FILE}" --verbose \
--from ${{ github.event.pull_request.head.sha }}~${{ github.event.pull_request.commits }} \
--to ${{ github.event.pull_request.head.sha }}
- name: Setup Java
uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
with:
java-version: 17
distribution: temurin
cache: maven
- name: Testcontainers - Enable reusable containers
run: echo 'testcontainers.reuse.enable=true' >> ~/.testcontainers.properties
- name: Cache SonarCloud packages
uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
with:
path: ~/.sonar/cache
key: sonar
restore-keys: sonar
- name: Maven build & SonarCloud quality scan
env:
GITHUB_TOKEN: ${{ github.token }}
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
SONAR_HOST_URL: https://sonarcloud.io
run: |
SONAR_ORGANIZATION="$(echo '${{ github.repository_owner }}' | awk '{print tolower($0)}')"
SONAR_PROJECT_KEY="$(echo '${{ github.repository }}' | sed 's/\//_/')"
mvn verify sonar:sonar --activate-profiles ci -Dstyle.color=always \
--batch-mode --errors --strict-checksums --update-snapshots \
-Dsonar.host.url="${SONAR_HOST_URL}" \
-Dsonar.organization="${SONAR_ORGANIZATION}" \
-Dsonar.projectKey="${SONAR_PROJECT_KEY}"
codeql-sast:
name: CodeQL - Static Application Security Testing (SAST)
runs-on: ubuntu-22.04
timeout-minutes: 300
permissions:
actions: read
contents: read
security-events: write
steps:
- name: Harden runner
uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
with:
disable-sudo: true
egress-policy: block
allowed-endpoints: >
github.com:443
api.github.com:443
uploads.github.com:443
objects.githubusercontent.com
repo.maven.apache.org:443
jitpack.io:443
repo.papermc.io:443
api.nuget.org:443
- name: Checkout repository
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
persist-credentials: false
- name: Setup Java
uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
with:
java-version: 17
distribution: temurin
cache: maven
- name: Initialize CodeQL
uses: github/codeql-action/init@012739e5082ff0c22ca6d6ab32e07c36df03c4a4 # v3.22.12
with:
languages: java
- name: Build
run: |
mvn package --activate-profiles fast -Dstyle.color=always \
--batch-mode --errors --strict-checksums --update-snapshots --fail-fast
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@012739e5082ff0c22ca6d6ab32e07c36df03c4a4 # v3.22.12
with:
category: /language:java