diff --git a/.codecov.yml b/.codecov.yml index 6166576e..b5739f89 100644 --- a/.codecov.yml +++ b/.codecov.yml @@ -7,11 +7,23 @@ coverage: ignore: - - generated/* - - examples/* - - test/* + - "**/generated/**/*" + - "**/examples/**/*" + - "**/test/**/*" status: + # https://docs.codecov.com/docs/github-checks#yaml-configuration-for-github-checks-and-codecov patch: false + # https://docs.codecov.com/docs/commit-status + project: + default: + target: auto + threshold: 0.05% + base: auto + paths: + - "src" + if_ci_failed: error + informational: false + only_pulls: true comment: layout: "header, diff, changes, uncovered" diff --git a/.gitattributes b/.gitattributes index a7a1df40..810ea7ff 100644 --- a/.gitattributes +++ b/.gitattributes @@ -55,5 +55,7 @@ pull text eol=lf *.scpt binary *.scssc binary -# Encoded files +# Encrypted files *.enc binary +*.gpg binary +*.weis binary diff --git a/.github/keys/cloudrepo.properties.gpg b/.github/keys/cloudrepo.properties.gpg new file mode 100644 index 00000000..1084e34e Binary files /dev/null and b/.github/keys/cloudrepo.properties.gpg differ diff --git a/.github/keys/deploy_key_rsa.gpg b/.github/keys/deploy_key_rsa.gpg new file mode 100644 index 00000000..7f434966 Binary files /dev/null and b/.github/keys/deploy_key_rsa.gpg differ diff --git a/.github/keys/firebase-sa.json.gpg b/.github/keys/firebase-sa.json.gpg new file mode 100644 index 00000000..4925f29b Binary files /dev/null and b/.github/keys/firebase-sa.json.gpg differ diff --git a/.github/keys/gcs-auth-key.json.gpg b/.github/keys/gcs-auth-key.json.gpg new file mode 100644 index 00000000..5f37d1d4 Binary files /dev/null and b/.github/keys/gcs-auth-key.json.gpg differ diff --git a/.github/keys/gradle-plugin-portal.secret.properties.gpg b/.github/keys/gradle-plugin-portal.secret.properties.gpg new file mode 100644 index 00000000..8ec9a8aa --- /dev/null +++ b/.github/keys/gradle-plugin-portal.secret.properties.gpg @@ -0,0 +1,2 @@ +  2.y:ҢF`J1$9 D~ze!yuGBU2K0! q =˂p@zeqB>R#qj?1m굘U^2*kJ 3wq84}. +2M< \ No newline at end of file diff --git a/.github/keys/maven-publisher.json.gpg b/.github/keys/maven-publisher.json.gpg new file mode 100644 index 00000000..f5655f93 Binary files /dev/null and b/.github/keys/maven-publisher.json.gpg differ diff --git a/.github/workflows/build-on-ubuntu.yml b/.github/workflows/build-on-ubuntu.yml new file mode 100644 index 00000000..0217c322 --- /dev/null +++ b/.github/workflows/build-on-ubuntu.yml @@ -0,0 +1,36 @@ +name: Build under Ubuntu + +on: push + +jobs: + build: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v2 + + - uses: actions/setup-java@v2 + with: + java-version: 11 + distribution: zulu + cache: gradle + + - name: Pull config + run: git submodule update --init --recursive + + - name: Build project and run tests + shell: bash + run: ./gradlew build --stacktrace + + # See: https://github.com/marketplace/actions/junit-report-action + - name: Publish Test Report + uses: mikepenz/action-junit-report@v2.8.4 + if: always() # always run even if the previous step fails + with: + report_paths: '**/build/test-results/test/TEST-*.xml' + + - name: Upload code coverage report + uses: codecov/codecov-action@v2 + with: + fail_ci_if_error: false + verbose: true diff --git a/.github/workflows/build-on-windows.yml b/.github/workflows/build-on-windows.yml new file mode 100644 index 00000000..a11a7daa --- /dev/null +++ b/.github/workflows/build-on-windows.yml @@ -0,0 +1,31 @@ +name: Build under Windows + +on: pull_request + +jobs: + build: + runs-on: windows-latest + + steps: + - uses: actions/checkout@v2 + + - uses: actions/setup-java@v2 + with: + java-version: 11 + distribution: zulu + cache: gradle + + - name: Pull config + run: git submodule update --init --recursive + + - name: Build project and run tests + shell: cmd + # For the reason on `--no-daemon` see https://github.com/actions/cache/issues/454 + run: gradlew.bat build --stacktrace --no-daemon + + # See: https://github.com/marketplace/actions/junit-report-action + - name: Publish Test Report + uses: mikepenz/action-junit-report@v2.8.4 + if: always() # always run even if the previous step fails + with: + report_paths: '**/build/test-results/test/TEST-*.xml' diff --git a/.github/workflows/detekt-analysis.yml b/.github/workflows/detekt-analysis.yml new file mode 100644 index 00000000..f65f98df --- /dev/null +++ b/.github/workflows/detekt-analysis.yml @@ -0,0 +1,103 @@ +# This workflow performs a static analysis of your Kotlin source code using +# Detekt. +# +# Scans are triggered: +# 1. On every push to default and protected branches +# 2. On every Pull Request targeting the default branch +# 3. On a weekly schedule +# 4. Manually, on demand, via the "workflow_dispatch" event +# +# The workflow should work with no modifications, but you might like to use a +# later version of the Detekt CLI by modifing the $DETEKT_RELEASE_TAG +# environment variable. +name: Scan with Detekt + +on: + # Triggers the workflow on push or pull request events but only for default and protected branches + push: + branches: [ master ] + pull_request: + branches: [ master ] + schedule: + - cron: '19 17 * * 4' + + # Allows you to run this workflow manually from the Actions tab + workflow_dispatch: + +env: + # Release tag associated with version of Detekt to be installed + # SARIF support (required for this workflow) was introduced in Detekt v1.15.0 + DETEKT_RELEASE_TAG: v1.15.0 + +# A workflow run is made up of one or more jobs that can run sequentially or in parallel +jobs: + # This workflow contains a single job called "scan" + scan: + name: Scan + # The type of runner that the job will run on + runs-on: ubuntu-latest + + # Steps represent a sequence of tasks that will be executed as part of the job + steps: + # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it + - uses: actions/checkout@v2 + + # Gets the download URL associated with the $DETEKT_RELEASE_TAG + - name: Get Detekt download URL + id: detekt_info + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + DETEKT_DOWNLOAD_URL=$( gh api graphql --field tagName=$DETEKT_RELEASE_TAG --raw-field query=' + query getReleaseAssetDownloadUrl($tagName: String!) { + repository(name: "detekt", owner: "detekt") { + release(tagName: $tagName) { + releaseAssets(name: "detekt", first: 1) { + nodes { + downloadUrl + } + } + } + } + } + ' | \ + jq --raw-output '.data.repository.release.releaseAssets.nodes[0].downloadUrl' ) + echo "::set-output name=download_url::$DETEKT_DOWNLOAD_URL" + + # Sets up the detekt cli + - name: Setup Detekt + run: | + dest=$( mktemp -d ) + curl --request GET \ + --url ${{ steps.detekt_info.outputs.download_url }} \ + --silent \ + --location \ + --output $dest/detekt + chmod a+x $dest/detekt + echo $dest >> $GITHUB_PATH + + # Performs static analysis using Detekt + - name: Run Detekt + continue-on-error: true + run: | + detekt --input ${{ github.workspace }} --report sarif:${{ github.workspace }}/detekt.sarif.json + + # Modifies the SARIF output produced by Detekt so that absolute URIs are relative + # This is so we can easily map results onto their source files + # This can be removed once relative URI support lands in Detekt: https://git.io/JLBbA + - name: Make artifact location URIs relative + continue-on-error: true + run: | + echo "$( + jq \ + --arg github_workspace ${{ github.workspace }} \ + '. | ( .runs[].results[].locations[].physicalLocation.artifactLocation.uri |= if test($github_workspace) then .[($github_workspace | length | . + 1):] else . end )' \ + ${{ github.workspace }}/detekt.sarif.json + )" > ${{ github.workspace }}/detekt.sarif.json + + # Uploads results to GitHub repository using the upload-sarif action + - uses: github/codeql-action/upload-sarif@v1 + with: + # Path to SARIF file relative to the root of the repository + sarif_file: ${{ github.workspace }}/detekt.sarif.json + checkout_path: ${{ github.workspace }} diff --git a/.github/workflows/ensure-reports.updated.yml b/.github/workflows/ensure-reports.updated.yml new file mode 100644 index 00000000..6bb34787 --- /dev/null +++ b/.github/workflows/ensure-reports.updated.yml @@ -0,0 +1,24 @@ +# Ensures that the license report files were modified in this PR. + +name: Ensure license reports updated + +on: + pull_request: + branches: + - '**' + +jobs: + build: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v2 + with: + # Configure the checkout of all branches, so that it is possible to run the comparison. + fetch-depth: 0 + # Check out the `config` submodule to fetch the required script file. + submodules: true + + - name: Check that `pom.xml` and `license-report.md` are modified + shell: bash + run: chmod +x ./config/scripts/ensure-reports-updated.sh && ./config/scripts/ensure-reports-updated.sh diff --git a/.github/workflows/gradle-wrapper-validation.yml b/.github/workflows/gradle-wrapper-validation.yml new file mode 100644 index 00000000..72435c63 --- /dev/null +++ b/.github/workflows/gradle-wrapper-validation.yml @@ -0,0 +1,18 @@ +name: Validate Gradle Wrapper +on: + push: + branches: + - main + pull_request: + branches: + - '**' + +jobs: + validation: + name: Validation + runs-on: ubuntu-latest + steps: + - name: Checkout latest code + uses: actions/checkout@v2 + - name: Validate Gradle Wrapper + uses: gradle/wrapper-validation-action@v1 diff --git a/.github/workflows/increment_guard.yml b/.github/workflows/increment-guard.yml similarity index 61% rename from .github/workflows/increment_guard.yml rename to .github/workflows/increment-guard.yml index 7bda0bbd..c96b081b 100644 --- a/.github/workflows/increment_guard.yml +++ b/.github/workflows/increment-guard.yml @@ -5,22 +5,25 @@ name: Check version increment on: push: - branches: '**' + branches: + - '**' jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v1 + - uses: actions/checkout@v2 - - uses: actions/setup-java@v1 + - uses: actions/setup-java@v2 with: - java-version: 1.8 + java-version: 11 + distribution: zulu + cache: gradle - name: Pull config run: git submodule update --init --recursive - name: Check version is not yet published shell: bash - run: ./gradlew checkVersionIncrement + run: ./gradlew checkVersionIncrement --stacktrace diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml new file mode 100644 index 00000000..abe26417 --- /dev/null +++ b/.github/workflows/publish.yml @@ -0,0 +1,63 @@ +name: Publish + +on: + push: + branches: [master] + +jobs: + publish: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v2 + + - uses: actions/setup-java@v2 + with: + java-version: 11 + distribution: zulu + cache: gradle + + - run: git submodule update --init --recursive + + - name: Decrypt CloudRepo credentials + run: ./config/scripts/decrypt.sh "$CLOUDREPO_CREDENTIALS_KEY" ./.github/keys/cloudrepo.properties.gpg ./cloudrepo.properties + env: + CLOUDREPO_CREDENTIALS_KEY: ${{ secrets.CLOUDREPO_CREDENTIALS_KEY }} + + - name: Decrypt Git SSH credentials + run: ./config/scripts/decrypt.sh "$GIT_CREDENTIALS_KEY" ./.github/keys/deploy_key_rsa.gpg ./deploy_key_rsa + env: + GIT_CREDENTIALS_KEY: ${{ secrets.GIT_CREDENTIALS_KEY }} + + # Make sure the SSH key is not "too visible". SSH agent will not accept it otherwise. + - name: Set file system permissions + run: chmod 400 ./deploy_key_rsa && chmod +x ./config/scripts/register-ssh-key.sh + + - name: Decrypt GCS credentials + run: ./config/scripts/decrypt.sh "$GCS_CREDENTIALS_KEY" ./.github/keys/gcs-auth-key.json.gpg ./gcs-auth-key.json + env: + GCS_CREDENTIALS_KEY: ${{ secrets.GCS_CREDENTIALS_KEY }} + + - name: Decrypt GCAR credentials + run: ./config/scripts/decrypt.sh "$MAVEN_PUBLISHER_KEY" ./.github/keys/maven-publisher.json.gpg ./maven-publisher.json + env: + MAVEN_PUBLISHER_KEY: ${{ secrets.MAVEN_PUBLISHER_KEY }} + + - name: Decrypt Git SSH credentials + run: ./config/scripts/decrypt.sh "$GRADLE_PORTAL_CREDENTIALS_KEY" ./.github/keys/gradle-plugin-portal.secret.properties.gpg ./gradle-plugin-portal.secret.properties + env: + GRADLE_PORTAL_CREDENTIALS_KEY: ${{ secrets.GRADLE_PORTAL_CREDENTIALS_KEY }} + + - name: Append Gradle properties + run: cat ./gradle-plugin-portal.secret.properties >> ./gradle.properties + + - name: Publish artifacts to Maven + # Since we're in the `master` branch already, this means that tests of a PR passed. + # So, no need to run the tests again when publishing. + run: ./gradlew publish -x test --stacktrace + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + FORMAL_GIT_HUB_PAGES_AUTHOR: developers@spine.io + # https://docs.github.com/en/actions/reference/environment-variables + REPO_SLUG: $GITHUB_REPOSITORY # e.g. SpineEventEngine/core-java + GOOGLE_APPLICATION_CREDENTIALS: ./maven-publisher.json + NPM_TOKEN: ${{ secrets.NPM_SECRET }} diff --git a/.github/workflows/win.yml b/.github/workflows/win.yml deleted file mode 100644 index 03cca76b..00000000 --- a/.github/workflows/win.yml +++ /dev/null @@ -1,31 +0,0 @@ -name: Tests on Windows - -on: - pull_request: - branches: - - master - -jobs: - build: - - runs-on: windows-latest - - steps: - - uses: actions/checkout@v1 - - - name: Set up JDK 1.8 - uses: actions/setup-java@v1 - with: - java-version: 1.8 - - - name: Pull config - run: git submodule update --init --recursive - - - name: Run tests with Gradle - shell: cmd - run: > - choco install dart-sdk --limitoutput - && refreshenv - && pub global activate protoc_plugin - && pub global activate dart_code_gen - && gradlew.bat build diff --git a/.idea/codeStyles/Project.xml b/.idea/codeStyles/Project.xml index 5a399bd1..809943cc 100644 --- a/.idea/codeStyles/Project.xml +++ b/.idea/codeStyles/Project.xml @@ -26,13 +26,6 @@ - - -