Skip to content

Commit 12e8ecd

Browse files
uhafneruhafner
committed
Move dependency check to different pipeline
Let quality monitor combine the results of both quality pipelines.
1 parent 14fb5c4 commit 12e8ecd

File tree

5 files changed

+216
-32
lines changed

5 files changed

+216
-32
lines changed

‎.github/scripts/fetch-artifacts.sh‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
# This script expects the following environment variables:
5+
# REPO: owner/repo
6+
# HEAD_SHA: the commit SHA for which the producer workflows ran
7+
# TOKEN: a token with read access to Actions (GITHUB_TOKEN or a PAT)
8+
# OTHER_WORKFLOWS: comma-separated list of workflow filenames or workflow IDs
9+
# ARTIFACT_NAMES: comma-separated list of artifact names (in the same order as WORKFLOWS)
10+
# Optional:
11+
# RETRIES: number of polling attempts per workflow (default: 30)
12+
# SLEEP_SEC: seconds to wait between attempts (default: 10)
13+
14+
IFS=',' read -r -a WORKFLOWS_ARR <<< "${OTHER_WORKFLOWS}"
15+
IFS=',' read -r -a ARTIFACTS_ARR <<< "${ARTIFACT_NAMES}"
16+
REPO="${REPO}"
17+
SHA="${HEAD_SHA}"
18+
TOKEN="${TOKEN}"
19+
API_BASE="https://api.github.com/repos/${REPO}"
20+
RETRIES=${RETRIES:-30}
21+
SLEEP_SEC=${SLEEP_SEC:-10}
22+
23+
mkdir -p artifacts
24+
25+
if [ ${#WORKFLOWS_ARR[@]} -ne ${#ARTIFACTS_ARR[@]} ]; then
26+
echo "ERROR: OTHER_WORKFLOWS and ARTIFACT_NAMES must have the same number of items"
27+
exit 1
28+
fi
29+
30+
for idx in "${!WORKFLOWS_ARR[@]}"; do
31+
wf_raw="${WORKFLOWS_ARR[$idx]}"
32+
wf=$(echo "$wf_raw" | tr -d '[:space:]')
33+
art_raw="${ARTIFACTS_ARR[$idx]}"
34+
art=$(echo "$art_raw" | tr -d '[:space:]')
35+
36+
echo "-- Waiting for workflow '$wf' to succeed for sha $SHA (artifact: $art)"
37+
attempt=0
38+
39+
while true; do
40+
attempt=$((attempt+1))
41+
echo " attempt $attempt/$RETRIES"
42+
43+
# 1) Liste Runs für das Workflow (workflow id/name/file)
44+
resp=$(curl -s -H "Authorization: Bearer ${TOKEN}" "${API_BASE}/actions/workflows/${wf}/runs?per_page=50")
45+
46+
# 2) Finde Run mit matching head_sha
47+
run_id=$(echo "$resp" | jq -r --arg SHA "$SHA" '.workflow_runs[] | select(.head_sha==$SHA) | .id' | head -n1 || true)
48+
run_status=$(echo "$resp" | jq -r --arg SHA "$SHA" '.workflow_runs[] | select(.head_sha==$SHA) | .status' | head -n1 || true)
49+
run_conclusion=$(echo "$resp" | jq -r --arg SHA "$SHA" '.workflow_runs[] | select(.head_sha==$SHA) | .conclusion' | head -n1 || true)
50+
51+
if [ -n "${run_id}" ] && [ "${run_id}" != "null" ]; then
52+
echo " Found run ${run_id} status=${run_status} conclusion=${run_conclusion}"
53+
54+
if [ "${run_status}" = "completed" ]; then
55+
if [ "${run_conclusion}" = "success" ]; then
56+
echo " Run succeeded — listing artifacts"
57+
art_resp=$(curl -s -H "Authorization: Bearer ${TOKEN}" "${API_BASE}/actions/runs/${run_id}/artifacts")
58+
art_id=$(echo "$art_resp" | jq -r --arg NAME "$art" '.artifacts[] | select(.name==$NAME) | .id' | head -n1 || true)
59+
60+
if [ -n "${art_id}" ] && [ "${art_id}" != "null" ]; then
61+
echo " Downloading artifact '$art' (id=${art_id})"
62+
out_zip="artifacts/${art}.zip"
63+
curl -L -s -H "Authorization: Bearer ${TOKEN}" "${API_BASE}/actions/artifacts/${art_id}/zip" -o "${out_zip}"
64+
echo " Unpacking to artifacts/${art}/"
65+
mkdir -p "artifacts/${art}"
66+
unzip -o "${out_zip}" -d "artifacts/${art}" >/dev/null
67+
rm -f "${out_zip}"
68+
echo " Artifact $art downloaded and unpacked"
69+
break
70+
else
71+
echo " ERROR: Artifact '$art' not found in run ${run_id}"
72+
exit 1
73+
fi
74+
else
75+
echo " ERROR: Run completed but conclusion='${run_conclusion}'"
76+
exit 1
77+
fi
78+
else
79+
echo " Run exists but not completed yet (status=${run_status}), will retry"
80+
fi
81+
else
82+
echo " No run found for workflow '${wf}' and sha ${SHA} yet"
83+
fi
84+
85+
if [ ${attempt} -ge ${RETRIES} ]; then
86+
echo "ERROR: Timeout waiting for workflow '${wf}' to succeed for sha ${SHA}"
87+
exit 1
88+
fi
89+
90+
sleep ${SLEEP_SEC}
91+
done
92+
93+
done
94+
95+
echo "All requested artifacts downloaded into ./artifacts/"
96+
exit 0

‎.github/workflows/dependency-check.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: 'Dependency Check'
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request_target:
8+
9+
jobs:
10+
build:
11+
runs-on: [ubuntu-latest]
12+
name: Create report
13+
14+
steps:
15+
- name: Checkout project
16+
uses: actions/checkout@v6
17+
- name: Set up JDK
18+
uses: actions/setup-java@v5
19+
with:
20+
distribution: 'temurin'
21+
java-version: 25
22+
check-latest: true
23+
cache: 'maven'
24+
- name: Set up Maven
25+
uses: stCarolas/setup-maven@v5
26+
with:
27+
maven-version: 3.9.12
28+
- name: Cache the NVD database
29+
uses: actions/cache@v5
30+
with:
31+
path: ~/.m2/repository/org/owasp/dependency-check-data
32+
key: dependency-check
33+
- name: Build with Maven
34+
env:
35+
NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
36+
OSS_INDEX_TOKEN: ${{ secrets.OSS_INDEX_TOKEN }}
37+
run: |
38+
mvn -V --color always -ntp verify -Pci -Powasp
39+
if [ "${PIPESTATUS[0]}" != "0" ]; then
40+
exit 1;
41+
fi
42+
- name: Upload Dependency Report
43+
uses: actions/upload-artifact@v6
44+
with:
45+
name: dependency-report
46+
path: |
47+
**/target/dependency-check-report.json
48+

‎.github/workflows/quality-monitor-build.yml‎

Lines changed: 10 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,30 @@
1-
name: 'Quality Monitor Build'
1+
name: 'Quality Monitor'
22

33
on:
4+
push:
5+
branches:
6+
- main
47
pull_request:
58

69
jobs:
710
build:
811
runs-on: [ubuntu-latest]
9-
name: Create quality reports
12+
name: Create reports
1013

1114
steps:
12-
- name: Checkout PR
15+
- name: Checkout project
1316
uses: actions/checkout@v6
14-
- name: Set up JDK 21
17+
- name: Set up JDK
1518
uses: actions/setup-java@v5
1619
with:
1720
distribution: 'temurin'
18-
java-version: 21
21+
java-version: 25
1922
check-latest: true
2023
cache: 'maven'
2124
- name: Set up Maven
2225
uses: stCarolas/setup-maven@v5
2326
with:
24-
maven-version: 3.9.11
25-
- name: Cache the NVD database
26-
uses: actions/cache@v5
27-
with:
28-
path: ~/.m2/repository/org/owasp/dependency-check-data
29-
key: dependency-check
27+
maven-version: 3.9.12
3028
- name: Check if quality monitor reports mutation coverage
3129
run: |
3230
FILE='.github/quality-monitor.json'
@@ -38,12 +36,10 @@ jobs:
3836
fi
3937
- name: Build with Maven
4038
env:
41-
NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
42-
OSS_INDEX_TOKEN: ${{ secrets.OSS_INDEX_TOKEN }}
4339
PIT: ${{ env.PIT }}
4440
BROWSER: chrome-container
4541
run: |
46-
mvn -V --color always -ntp clean verify $PIT -Pci -Powasp | tee maven.log
42+
mvn -V --color always -ntp clean verify $PIT -Pci | tee maven.log
4743
if [ "${PIPESTATUS[0]}" != "0" ]; then
4844
exit 1;
4945
fi

‎.github/workflows/quality-monitor-comment-pr.yml‎

Lines changed: 32 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@ name: 'Quality Monitor Comment PR'
22

33
on:
44
workflow_run:
5-
workflows: [ "Quality Monitor Build" ]
6-
types: [ completed ]
5+
workflows: ['Quality Monitor', 'Dependency Check']
6+
types: [completed]
77

88
permissions:
99
actions: read
@@ -13,7 +13,7 @@ permissions:
1313

1414
jobs:
1515
comment:
16-
if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request' }}
16+
if: ${{ github.event.workflow_run.event == 'pull_request' }}
1717
runs-on: ubuntu-latest
1818
name: Comment on PR
1919

@@ -22,18 +22,40 @@ jobs:
2222
id: pr
2323
run: |
2424
pr_number='${{ github.event.workflow_run.pull_requests[0].number }}'
25-
echo "number=$pr_number" >> "$GITHUB_OUTPUT"
25+
echo "number=$pr_number" >> "$GITHUB_OUTPUT"
2626
sha='${{ github.event.workflow_run.head_sha }}'
27-
echo "sha=$sha" >> "$GITHUB_OUTPUT"
27+
echo "sha=$sha" >> "$GITHUB_OUTPUT"
2828
- name: Checkout PR
2929
uses: actions/checkout@v6
3030
with:
3131
ref: ${{ steps.pr.outputs.sha }}
32-
- name: Download PR Quality Reports from Quality Monitor Build workflow
33-
uses: dawidd6/action-download-artifact@v14
34-
with:
35-
run_id: ${{ github.event.workflow_run.id }}
36-
name: quality-reports
32+
- name: Install jq and unzip
33+
run: sudo apt-get update && sudo apt-get install -y jq unzip
34+
- name: Prepare environment
35+
env:
36+
HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
37+
REPO: ${{ github.repository }}
38+
TOKEN: ${{ secrets.GITHUB_TOKEN }}
39+
run: |
40+
echo "HEAD_SHA=$HEAD_SHA"
41+
echo "REPO=$REPO"
42+
- name: Fetch reports from dependency check and quality monitor workflows
43+
env:
44+
REPO: ${{ github.repository }}
45+
HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
46+
TOKEN: ${{ secrets.GITHUB_TOKEN }}
47+
OTHER_WORKFLOWS: "quality-monitor-build.yml,dependency-check.yml"
48+
ARTIFACT_NAMES: "quality-reports,dependency-report"
49+
RETRIES: 30
50+
SLEEP_SEC: 10
51+
run: |
52+
chmod +x ./.github/scripts/fetch-artifacts.sh
53+
./.github/scripts/fetch-artifacts.sh
54+
- name: List downloaded reports
55+
run: |
56+
mkdir -p reports/target
57+
mv artifacts/*/target/* reports/target
58+
ls -la reports/target/* || true
3759
- name: Read Quality Monitor Configuration
3860
id: quality-monitor
3961
run: echo "json=$(jq -c . .github/quality-monitor-pr.json)" >> "$GITHUB_OUTPUT"

‎.github/workflows/quality-monitor-comment.yml‎

Lines changed: 30 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@ name: 'Quality Monitor Comment'
22

33
on:
44
workflow_run:
5-
workflows: [ "Quality Monitor Build" ]
6-
types: [ completed ]
5+
workflows: ['Quality Monitor', 'Dependency Check']
6+
types: [completed]
77

88
permissions:
99
actions: read
@@ -13,18 +13,40 @@ permissions:
1313

1414
jobs:
1515
comment:
16-
if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main' }}
16+
if: ${{ github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main' }}
1717
runs-on: ubuntu-latest
1818
name: Comment main branch
1919

2020
steps:
2121
- name: Checkout main branch
2222
uses: actions/checkout@v6
23-
- name: Download Quality Reports from Quality Monitor Build workflow
24-
uses: dawidd6/action-download-artifact@v14
25-
with:
26-
run_id: ${{ github.event.workflow_run.id }}
27-
name: quality-reports
23+
- name: Install jq and unzip
24+
run: sudo apt-get update && sudo apt-get install -y jq unzip
25+
- name: Prepare environment
26+
env:
27+
HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
28+
REPO: ${{ github.repository }}
29+
TOKEN: ${{ secrets.GITHUB_TOKEN }}
30+
run: |
31+
echo "HEAD_SHA=$HEAD_SHA"
32+
echo "REPO=$REPO"
33+
- name: Fetch reports from dependency check and quality monitor workflows
34+
env:
35+
REPO: ${{ github.repository }}
36+
HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
37+
TOKEN: ${{ secrets.GITHUB_TOKEN }}
38+
OTHER_WORKFLOWS: "quality-monitor-build.yml,dependency-check.yml"
39+
ARTIFACT_NAMES: "quality-reports,dependency-report"
40+
RETRIES: 30
41+
SLEEP_SEC: 10
42+
run: |
43+
chmod +x ./.github/scripts/fetch-artifacts.sh
44+
./.github/scripts/fetch-artifacts.sh
45+
- name: List downloaded reports
46+
run: |
47+
mkdir -p reports/target
48+
mv artifacts/*/target/* reports/target
49+
ls -la reports/target/* || true
2850
- name: Read Quality Monitor Configuration
2951
id: quality-monitor
3052
run: echo "json=$(jq -c . .github/quality-monitor.json)" >> "$GITHUB_OUTPUT"

0 commit comments

Comments
 (0)