|
17 | 17 |
|
18 | 18 | permissions: |
19 | 19 | contents: read |
| 20 | + pull-requests: read |
20 | 21 |
|
21 | 22 | jobs: |
22 | 23 | publish-build-scans: |
23 | 24 | name: Publish Develocity build scans |
24 | | - if: github.repository == 'hibernate/hibernate-validator' && github.event.workflow_run.conclusion != 'cancelled' |
25 | 25 | runs-on: ubuntu-latest |
26 | 26 | steps: |
27 | 27 | # Different branches might have different versions of Develocity, and we want to make sure |
28 | 28 | # that we publish with the one that we built the scan with in the first place: |
29 | 29 | - name: Determine the Branch Reference for which the original action was triggered |
30 | 30 | id: determine_branch_ref |
| 31 | + env: |
| 32 | + GH_TOKEN: ${{ github.token }} |
31 | 33 | run: | |
32 | | - if [ -n "${{ github.event.workflow_run.pull_requests[0].base.ref }}" ]; then |
33 | | - BRANCH_REF="${{ github.event.workflow_run.pull_requests[0].base.ref }}" |
| 34 | + FORK_OWNER="${{ github.event.workflow_run.head_repository.owner.login }}" |
| 35 | + BRANCH_NAME="${{ github.event.workflow_run.head_branch }}" |
| 36 | + TARGET_BRANCH=$(gh pr view "$FORK_OWNER:$BRANCH_NAME" --repo ${{ github.event.workflow_run.repository.full_name }} --json baseRefName -q .baseRefName) |
| 37 | + |
| 38 | + if [ -n "$TARGET_BRANCH" ]; then |
| 39 | + echo "::notice::PR found. Target branch is: $TARGET_BRANCH" |
| 40 | + echo "branch=$TARGET_BRANCH" >> "$GITHUB_OUTPUT" |
34 | 41 | else |
35 | | - BRANCH_REF="${{ github.event.workflow_run.head_branch }}" |
| 42 | + echo "::notice::PR not found. Defaulting to head_branch." |
| 43 | + echo "branch=$BRANCH_NAME" >> "$GITHUB_OUTPUT" |
36 | 44 | fi |
| 45 | + |
37 | 46 | echo "original_branch_ref=$BRANCH_REF" >> "$GITHUB_OUTPUT" |
38 | 47 | # Checkout target branch which has trusted code |
39 | 48 | - name: Check out target branch |
40 | 49 | uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2 |
41 | 50 | with: |
42 | 51 | persist-credentials: false |
| 52 | + # Different branches might have different versions of Develocity, and we want to make sure |
| 53 | + # that we publish with the one that we built the scan with in the first place: |
43 | 54 | ref: ${{ steps.determine_branch_ref.outputs.original_branch_ref }} |
44 | 55 | - name: Set up Java 21 |
45 | 56 | uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # 4.7.1 |
46 | 57 | with: |
47 | 58 | java-version: 21 |
48 | 59 | distribution: temurin |
49 | | - # https://github.com/actions/cache/blob/main/examples.md#java---maven |
50 | | - - name: Cache local Maven repository |
51 | | - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # 4.2.3 |
52 | | - with: |
53 | | - path: ~/.m2/repository |
54 | | - # use a different key than workflows running untrusted code |
55 | | - key: trusted-${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} |
56 | | - restore-keys: | |
57 | | - trusted-${{ runner.os }}-maven- |
58 | | - - name: Set up Maven |
59 | | - run: ./mvnw -v |
60 | | - - name: Download GitHub Actions artifacts for the Develocity build scans |
61 | | - id: downloadBuildScan |
62 | | - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # 4.3.0 |
63 | | - with: |
64 | | - pattern: build-scan-data-* |
65 | | - github-token: ${{ github.token }} |
66 | | - repository: ${{ github.repository }} |
67 | | - run-id: ${{ github.event.workflow_run.id }} |
68 | | - path: /tmp/downloaded-build-scan-data/ |
69 | | - # Don't fail the build if there are no matching artifacts |
70 | | - continue-on-error: true |
71 | | - - name: Publish Develocity build scans for previous builds |
72 | | - if: ${{ steps.downloadBuildScan.outcome != 'failure'}} |
73 | | - run: | |
74 | | - shopt -s nullglob # Don't run the loop below if there are no artifacts |
75 | | - status=0 |
76 | | - mkdir -p ~/.m2/.develocity/ |
77 | | - for build_scan_data_directory in /tmp/downloaded-build-scan-data/* |
78 | | - do |
79 | | - rm -rf ~/.m2/.develocity/build-scan-data |
80 | | - mv "$build_scan_data_directory" ~/.m2/.develocity/build-scan-data \ |
81 | | - && ./mvnw $MAVEN_ARGS develocity:build-scan-publish-previous || status=1 |
82 | | - done |
83 | | - exit $status |
84 | | - env: |
85 | | - DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY_PR }} |
0 commit comments