generated from micronaut-projects/micronaut-project-template
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
6eb7d48
commit fd831d5
Showing
6 changed files
with
116 additions
and
23 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| # WARNING: Do not edit this file directly. Instead, go to: | ||
| # | ||
| # https://github.com/micronaut-projects/micronaut-project-template/tree/master/.github/workflows | ||
| # | ||
| # and edit them there. Note that it will be sync'ed to all the Micronaut repos | ||
| name: GraalVM CE CI | ||
| on: | ||
| push: | ||
| branches: | ||
| - master | ||
| - '[1-9]+.[0-9]+.x' | ||
| pull_request: | ||
| branches: | ||
| - master | ||
| - '[1-9]+.[0-9]+.x' | ||
| jobs: | ||
| build: | ||
| if: github.repository != 'micronaut-projects/micronaut-project-template' | ||
| runs-on: ubuntu-latest | ||
| strategy: | ||
| matrix: | ||
| java: ['17'] | ||
| graalvm: ['latest', 'dev'] | ||
| steps: | ||
| # https://github.com/actions/virtual-environments/issues/709 | ||
| - name: Free disk space | ||
| run: | | ||
| sudo rm -rf "/usr/local/share/boost" | ||
| sudo rm -rf "$AGENT_TOOLSDIRECTORY" | ||
| sudo apt-get clean | ||
| df -h | ||
| - uses: actions/checkout@v3 | ||
| - uses: actions/cache@v3 | ||
| with: | ||
| path: ~/.gradle/caches | ||
| key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }} | ||
| restore-keys: | | ||
| ${{ runner.os }}-gradle- | ||
| - name: Setup GraalVM CE | ||
| uses: graalvm/setup-graalvm@v1 | ||
| with: | ||
| version: ${{ matrix.graalvm }} | ||
| java-version: ${{ matrix.java }} | ||
| components: 'native-image' | ||
| - name: Build with Gradle | ||
| run: | | ||
| if ./gradlew tasks --no-daemon --all | grep -w "testNativeImage" | ||
| then | ||
| ./gradlew check testNativeImage --continue --no-daemon | ||
| else | ||
| ./gradlew check --continue --no-daemon | ||
| fi | ||
| env: | ||
| TESTCONTAINERS_RYUK_DISABLED: true | ||
| GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }} | ||
| GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USERNAME }} | ||
| GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }} | ||
| PREDICTIVE_TEST_SELECTION: "${{ github.event_name == 'pull_request' && 'true' || 'false' }}" | ||
| - name: Publish Test Report | ||
| if: always() | ||
| uses: mikepenz/[email protected] | ||
| with: | ||
| check_name: GraalVM CE CI / Test Report (Java ${{ matrix.java }}) | ||
| report_paths: '**/build/test-results/test/TEST-*.xml' | ||
| check_retries: 'true' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -10,7 +10,7 @@ on: | |
| jobs: | ||
| release: | ||
| outputs: | ||
| hashes: ${{ steps.hash.outputs.hashes }} # Computed hashes for build artifacts. | ||
| artifacts-sha256: ${{ steps.hash.outputs.artifacts-sha256 }} # Computed hashes for build artifacts. | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout repository | ||
|
|
@@ -21,11 +21,11 @@ jobs: | |
| - name: Set up JDK | ||
| uses: actions/setup-java@v3 | ||
| with: | ||
| distribution: 'adopt' | ||
| java-version: '17' | ||
| distribution: 'temurin' | ||
| java-version: '11' | ||
| - name: Set the current release version | ||
| id: release_version | ||
| run: echo ::set-output name=release_version::${GITHUB_REF:17} | ||
| run: echo ::set-output name=release_version::${GITHUB_REF:11} | ||
| - name: Run pre-release | ||
| uses: micronaut-projects/github-actions/pre-release@master | ||
| env: | ||
|
|
@@ -52,22 +52,30 @@ jobs: | |
| VERSION=$(./gradlew properties | grep 'version:' | awk '{print $2}') | ||
| # Read the project group from gradle.properties. | ||
| GROUP_PATH=$(./gradlew properties| grep "projectGroup" | awk '{print $2}' | sed 's/\./\//g') | ||
| echo "::set-output name=version::$VERSION" | ||
| echo "::set-output name=group::$GROUP_PATH" | ||
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | ||
| echo "group=$GROUP_PATH" >> "$GITHUB_OUTPUT" | ||
| - name: Generate subject | ||
| id: hash | ||
| run: | | ||
| # Find the relevant published artifacts in the local repository. | ||
| ARTIFACTS=$(find build/repo/${{ steps.publish.outputs.group }}/*/${{ steps.publish.outputs.version }}/* \ | ||
| -regextype sed -regex '\(.*\.jar\|.*\.pom\|.*\.module\|.*\.toml\)') | ||
| # Compute the hashes for the artifacts. | ||
| echo "::set-output name=hashes::$(sha256sum $ARTIFACTS | base64 -w0)" | ||
| # Set the hash as job output for debugging. | ||
| echo "artifacts-sha256=$(sha256sum $ARTIFACTS | base64 -w0)" >> "$GITHUB_OUTPUT" | ||
| # Store the hash in a file, which is uploaded as a workflow artifact. | ||
| echo $(sha256sum $ARTIFACTS | base64 -w0) > artifacts-sha256 | ||
| - name: Upload build artifacts | ||
| uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0 | ||
| with: | ||
| name: gradle-build-outputs | ||
| path: build/repo/${{ steps.publish.outputs.group }}/*/${{ steps.publish.outputs.version }}/* | ||
| if-no-files-found: error | ||
| retention-days: 5 | ||
| - name: Upload artifacts-sha256 | ||
| uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0 | ||
| with: | ||
| name: artifacts-sha256 | ||
| path: artifacts-sha256 | ||
| retention-days: 5 | ||
| - name: Generate docs | ||
| env: | ||
|
|
@@ -113,27 +121,47 @@ jobs: | |
| with: | ||
| token: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| provenance: | ||
| provenance-subject: | ||
| needs: [release] | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| artifacts-sha256: ${{ steps.set-hash.outputs.artifacts-sha256 }} | ||
| steps: | ||
| - name: Download artifacts-sha256 | ||
| uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # v3.0.1 | ||
| with: | ||
| name: artifacts-sha256 | ||
| # The SLSA provenance generator expects the hash digest of artifacts to be passed as a job | ||
| # output. So we need to download the artifacts-sha256 and set it as job output. The hash of | ||
| # the artifacts should be set as output directly in the release job. But due to a known bug | ||
| # in GitHub Actions we have to use a workaround. | ||
| # See https://github.com/community/community/discussions/37942. | ||
| - name: Set artifacts-sha256 as output | ||
| id: set-hash | ||
| shell: bash | ||
| run: echo "artifacts-sha256=$(cat artifacts-sha256)" >> "$GITHUB_OUTPUT" | ||
|
|
||
| provenance: | ||
| needs: [release, provenance-subject] | ||
| permissions: | ||
| actions: read # To read the workflow path. | ||
| id-token: write # To sign the provenance. | ||
| contents: write # To add assets to a release. | ||
| uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected].0 | ||
| uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected].2 | ||
| with: | ||
| base64-subjects: "${{ needs.release.outputs.hashes }}" | ||
| base64-subjects: "${{ needs.provenance-subject.outputs.artifacts-sha256 }}" | ||
| upload-assets: true # Upload to a new release. | ||
| compile-generator: true # Build the generator from source. | ||
|
|
||
| github_release: | ||
| needs: [release, provenance] | ||
| needs: [release] | ||
| runs-on: ubuntu-latest | ||
| if: startsWith(github.ref, 'refs/tags/') | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v3.0.2 | ||
| - name: Download artifacts | ||
| uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v3.0.0 | ||
| uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # v3.0.1 | ||
| with: | ||
| name: gradle-build-outputs | ||
| path: build/repo | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters