Skip to content

Commit 3188479

Browse files
kabirkabir
authored
chore: Add proper testing of -P release of pull requests (#559)
Remove the -Pjavadoc profile and workaround
1 parent a14fd2e commit 3188479

File tree

4 files changed

+139
-56
lines changed

4 files changed

+139
-56
lines changed

‎.github/workflows/build-and-test.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
distribution: 'temurin'
2727
cache: maven
2828
- name: Build with Maven and run tests
29-
run: mvn -Pjavadoc -B package --file pom.xml -fae
29+
run: mvn -B package --file pom.xml -fae
3030
- name: Upload Test Reports
3131
if: failure()
3232
uses: actions/upload-artifact@v4

‎.github/workflows/build-with-release-profile-run.yml‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
name: Build with '-Prelease' (Run)
2+
3+
# Workflow_run job for release profile build verification.
4+
# This workflow has access to secrets and runs the actual build.
5+
# Triggered by build-with-release-profile.yml completion.
6+
# See: https://securitylab.github.com/research/github-actions-preventing-pwn-requests
7+
8+
on:
9+
workflow_run:
10+
workflows: ["Build with '-Prelease' (Trigger)"]
11+
types:
12+
- completed
13+
14+
permissions: {}
15+
16+
jobs:
17+
build:
18+
# Only run for successful trigger workflow from main repository
19+
if: >
20+
${{ github.event.workflow_run.conclusion == 'success' &&
21+
github.event.workflow_run.repository.full_name == 'a2aproject/a2a-java' }}
22+
runs-on: ubuntu-latest
23+
permissions:
24+
contents: read
25+
actions: read # Required to download artifacts
26+
27+
steps:
28+
- name: Download PR info
29+
uses: actions/download-artifact@v4
30+
with:
31+
name: pr-info
32+
github-token: ${{ github.token }}
33+
run-id: ${{ github.event.workflow_run.id }}
34+
35+
- name: Extract PR info
36+
id: pr_info
37+
run: |
38+
if [ -f pr_number ]; then
39+
PR_NUMBER=$(cat pr_number)
40+
echo "pr_number=${PR_NUMBER}" >> $GITHUB_OUTPUT
41+
echo "PR Number: ${PR_NUMBER}"
42+
else
43+
echo "No PR number (push event)"
44+
fi
45+
46+
PR_SHA=$(cat pr_sha)
47+
echo "pr_sha=${PR_SHA}" >> $GITHUB_OUTPUT
48+
echo "PR SHA: ${PR_SHA}"
49+
50+
PR_REF=$(cat pr_ref)
51+
echo "pr_ref=${PR_REF}" >> $GITHUB_OUTPUT
52+
echo "PR Ref: ${PR_REF}"
53+
54+
- name: Checkout PR code
55+
uses: actions/checkout@v4
56+
with:
57+
# Checkout the exact commit from the PR (or push)
58+
# This is safe because the workflow code (this file) is always from main
59+
ref: ${{ steps.pr_info.outputs.pr_sha }}
60+
61+
- name: Set up JDK 17
62+
uses: actions/setup-java@v4
63+
with:
64+
java-version: '17'
65+
distribution: 'temurin'
66+
cache: maven
67+
68+
# Use secrets to import GPG key
69+
- name: Import GPG key
70+
uses: crazy-max/ghaction-import-gpg@v6
71+
with:
72+
gpg_private_key: ${{ secrets.GPG_SIGNING_KEY }}
73+
passphrase: ${{ secrets.GPG_SIGNING_PASSPHRASE }}
74+
75+
# Create settings.xml for Maven since it needs the 'central-a2asdk-temp' server.
76+
# Populate with username and password from secrets
77+
- name: Create settings.xml
78+
run: |
79+
mkdir -p ~/.m2
80+
echo "<settings><servers><server><id>central-a2asdk-temp</id><username>${{ secrets.CENTRAL_TOKEN_USERNAME }}</username><password>${{ secrets.CENTRAL_TOKEN_PASSWORD }}</password></server></servers></settings>" > ~/.m2/settings.xml
81+
82+
# Build with the same settings as the deploy job
83+
# -s uses the settings file we created.
84+
- name: Build with same arguments as deploy job
85+
run: >
86+
mvn -B install
87+
-s ~/.m2/settings.xml
88+
-P release
89+
-DskipTests
90+
-Drelease.auto.publish=true
91+
env:
92+
# GPG passphrase is set as an environment variable for the gpg plugin to use
93+
GPG_PASSPHRASE: ${{ secrets.GPG_SIGNING_PASSPHRASE }}
94+
95+
- name: Build Summary
96+
if: always()
97+
run: |
98+
if [ "${{ job.status }}" = "success" ]; then
99+
echo "✅ Release profile build succeeded"
100+
if [ -n "${{ steps.pr_info.outputs.pr_number }}" ]; then
101+
echo " PR #${{ steps.pr_info.outputs.pr_number }} is ready for release"
102+
fi
103+
else
104+
echo "❌ Release profile build failed"
105+
if [ -n "${{ steps.pr_info.outputs.pr_number }}" ]; then
106+
echo " PR #${{ steps.pr_info.outputs.pr_number }} has release profile issues"
107+
fi
108+
fi

‎.github/workflows/build-with-release-profile.yml‎

Lines changed: 30 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
1-
name: Build with '-Prelease'
2-
3-
# Simply runs the build with -Prelease to avoid nasty surprises when running the release-to-maven-central workflow.
1+
name: Build with '-Prelease' (Trigger)
42

3+
# Trigger workflow for release profile build verification.
4+
# This workflow runs on PRs and uploads the PR info for the workflow_run job.
5+
# The actual build with secrets happens in build-with-release-profile-run.yml
6+
# See: https://securitylab.github.com/research/github-actions-preventing-pwn-requests
57

68
on:
7-
# Handle all branches for now
9+
pull_request: # Changed from pull_request_target for security
810
push:
9-
pull_request_target:
1011
workflow_dispatch:
1112

1213
# Only run the latest job
@@ -15,47 +16,35 @@ concurrency:
1516
cancel-in-progress: true
1617

1718
jobs:
18-
build:
19+
trigger:
1920
# Only run this job for the main repository, not for forks
2021
if: github.repository == 'a2aproject/a2a-java'
2122
runs-on: ubuntu-latest
2223
permissions:
2324
contents: read
2425

2526
steps:
26-
- name: Checkout repository
27-
uses: actions/checkout@v4
28-
29-
- name: Set up JDK 17
30-
uses: actions/setup-java@v4
31-
with:
32-
java-version: '17'
33-
distribution: 'temurin'
34-
cache: maven
35-
36-
# Use secrets to import GPG key
37-
- name: Import GPG key
38-
uses: crazy-max/ghaction-import-gpg@v6
39-
with:
40-
gpg_private_key: ${{ secrets.GPG_SIGNING_KEY }}
41-
passphrase: ${{ secrets.GPG_SIGNING_PASSPHRASE }}
42-
43-
# Create settings.xml for Maven since it needs the 'central-a2asdk-temp' server.
44-
# Populate wqith username and password from secrets
45-
- name: Create settings.xml
27+
- name: Prepare PR info
4628
run: |
47-
mkdir -p ~/.m2
48-
echo "<settings><servers><server><id>central-a2asdk-temp</id><username>${{ secrets.CENTRAL_TOKEN_USERNAME }}</username><password>${{ secrets.CENTRAL_TOKEN_PASSWORD }}</password></server></servers></settings>" > ~/.m2/settings.xml
49-
50-
# Build with the same settings as the deploy job
51-
# -s uses the settings file we created.
52-
- name: Build with same arguments as deploy job
53-
run: >
54-
mvn -B install
55-
-s ~/.m2/settings.xml
56-
-P release
57-
-DskipTests
58-
-Drelease.auto.publish=true
59-
env:
60-
# GPG passphrase is set as an environment variable for the gpg plugin to use
61-
GPG_PASSPHRASE: ${{ secrets.GPG_SIGNING_PASSPHRASE }}
29+
mkdir -p pr_info
30+
31+
# Store PR number for workflow_run job
32+
if [ "${{ github.event_name }}" = "pull_request" ]; then
33+
echo ${{ github.event.number }} > pr_info/pr_number
34+
echo ${{ github.event.pull_request.head.sha }} > pr_info/pr_sha
35+
echo ${{ github.event.pull_request.head.ref }} > pr_info/pr_ref
36+
else
37+
# For push events, store the commit sha
38+
echo ${{ github.sha }} > pr_info/pr_sha
39+
echo ${{ github.ref }} > pr_info/pr_ref
40+
fi
41+
42+
echo "Event: ${{ github.event_name }}"
43+
cat pr_info/*
44+
45+
- name: Upload PR info
46+
uses: actions/upload-artifact@v4
47+
with:
48+
name: pr-info
49+
path: pr_info/
50+
retention-days: 1

‎pom.xml‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -511,20 +511,6 @@
511511
</modules>
512512

513513
<profiles>
514-
<profile>
515-
<!--
516-
This profile generates the required javadoc.
517-
-->
518-
<id>javadoc</id>
519-
<build>
520-
<plugins>
521-
<plugin>
522-
<groupId>org.apache.maven.plugins</groupId>
523-
<artifactId>maven-javadoc-plugin</artifactId>
524-
</plugin>
525-
</plugins>
526-
</build>
527-
</profile>
528514
<profile>
529515
<!--
530516
This profile generates the required sources and javadoc in order to be able to deploy.

0 commit comments

Comments
 (0)