Skip to content

Commit df8b163

Browse files
beikovyrodiere
beikov
and
yrodiere
committed
Rework/simplify GH Actions jobs
* Use `pull_request` instead of `pull_request_target` * Move Develocity build scan publishing for untrusted code to a separate workflow * Merge Atlas workflow into the main CI workflow * Split caches between trusted and untrusted code * Update secrets to use "Develocity" name instead of "Gradle Enterprise" * Update comments Co-Authored-By: Yoann Rodière <[email protected]>
1 parent d25a86b commit df8b163

File tree

4 files changed

+259
-242
lines changed

4 files changed

+259
-242
lines changed

‎.github/workflows/atlas.yml‎

Lines changed: 0 additions & 117 deletions
This file was deleted.

‎.github/workflows/ci-report.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
name: GH Actions CI reporting
2+
3+
on:
4+
workflow_run:
5+
workflows: [ "GH Actions CI" ]
6+
types: [ completed ]
7+
8+
defaults:
9+
run:
10+
shell: bash
11+
12+
jobs:
13+
publish-build-scans:
14+
name: Publish Develocity build scans
15+
if: github.repository == 'hibernate/hibernate-orm' && github.event.workflow_run.conclusion != 'cancelled'
16+
runs-on: ubuntu-latest
17+
steps:
18+
# Checkout target branch which has trusted code
19+
- name: Check out target branch
20+
uses: actions/checkout@v4
21+
with:
22+
persist-credentials: false
23+
ref: ${{ github.ref }}
24+
- name: Set up Java 17
25+
uses: actions/setup-java@v4
26+
with:
27+
distribution: 'temurin'
28+
java-version: '17'
29+
- name: Get year/month for cache key
30+
id: get-date
31+
run: echo "yearmonth=$(/bin/date -u "+%Y-%m")" >> $GITHUB_OUTPUT
32+
shell: bash
33+
# Note we only restore the caches, we never populate them
34+
- name: Restore Maven/Gradle local caches
35+
uses: actions/cache/restore@v4
36+
id: cache-maven-gradle
37+
with:
38+
path: |
39+
~/.m2/repository/
40+
~/.m2/wrapper/
41+
~/.gradle/caches/
42+
~/.gradle/wrapper/
43+
# refresh cache every month to avoid unlimited growth
44+
# use a different key than workflows running untrusted code
45+
key: trusted-maven-gradle-caches-${{ steps.get-date.outputs.yearmonth }}
46+
- name: Download GitHub Actions artifacts for the Develocity build scans
47+
id: downloadBuildScan
48+
uses: actions/download-artifact@v4
49+
with:
50+
name: build-scan-data-${{ matrix.rdbms }}
51+
github-token: ${{ github.token }}
52+
repository: ${{ github.repository }}
53+
run-id: ${{ github.event.workflow_run.id }}
54+
path: /tmp/downloaded-build-scan-data/
55+
pattern: build-scan-data-*
56+
# Don't fail the build if there are no matching artifacts
57+
continue-on-error: true
58+
- name: Publish Develocity build scans for previous builds
59+
if: ${{ steps.downloadBuildScan.outcome != 'failure'}}
60+
run: |
61+
shopt -s nullglob # Don't run the loop below if there are no artifacts
62+
status=0
63+
for build_scan_data_directory in /tmp/downloaded-build-scan-data/*
64+
do
65+
rm -rf ~/.gradle/build-scan-data
66+
mkdir -p ~/.gradle/build-scan-data
67+
tar -xzf "$build_scan_data_directory/build-scan-data.tgz" -C ~/.gradle/build-scan-data \
68+
&& ./gradlew --no-build-cache buildScanPublishPrevious || status=1
69+
done
70+
exit $status
71+
env:
72+
DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY_PR }}

‎.github/workflows/ci.yml‎

Lines changed: 187 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,187 @@
1+
name: GH Actions CI
2+
3+
on:
4+
push:
5+
branches:
6+
- 'main'
7+
pull_request:
8+
branches:
9+
- 'main'
10+
11+
permissions: {} # none
12+
13+
# See https://github.com/hibernate/hibernate-orm/pull/4615 for a description of the behavior we're getting.
14+
concurrency:
15+
# Consider that two builds are in the same concurrency group (cannot run concurrently)
16+
# if they use the same workflow and are about the same branch ("ref") or pull request.
17+
group: "workflow = ${{ github.workflow }}, ref = ${{ github.event.ref }}, pr = ${{ github.event.pull_request.id }}"
18+
# Cancel previous builds in the same concurrency group even if they are in progress
19+
# for pull requests or pushes to forks (not the upstream repository).
20+
cancel-in-progress: ${{ github.event_name == 'pull_request' || github.repository != 'hibernate/hibernate-orm' }}
21+
22+
jobs:
23+
24+
# Main job for h2/docker DBs.
25+
build:
26+
permissions:
27+
contents: read
28+
name: OpenJDK 17 - ${{matrix.rdbms}}
29+
runs-on: ubuntu-latest
30+
strategy:
31+
fail-fast: false
32+
matrix:
33+
include:
34+
- rdbms: h2
35+
- rdbms: hsqldb
36+
- rdbms: mysql
37+
- rdbms: mariadb
38+
- rdbms: postgresql
39+
- rdbms: edb
40+
- rdbms: oracle
41+
- rdbms: db2
42+
- rdbms: mssql
43+
- rdbms: sybase
44+
# Running with CockroachDB requires at least 2-4 vCPUs, which we don't have on GH Actions runners
45+
# - rdbms: cockroachdb
46+
# Running with HANA requires at least 8GB memory just for the database, which we don't have on GH Actions runners
47+
# - rdbms: hana
48+
steps:
49+
- uses: actions/checkout@v4
50+
with:
51+
persist-credentials: false
52+
- name: Reclaim Disk Space
53+
run: .github/ci-prerequisites.sh
54+
- name: Start database
55+
env:
56+
RDBMS: ${{ matrix.rdbms }}
57+
run: ci/database-start.sh
58+
- name: Set up Java 17
59+
uses: actions/setup-java@v4
60+
with:
61+
distribution: 'temurin'
62+
java-version: '17'
63+
- name: Get year/month for cache key
64+
id: get-date
65+
run: echo "yearmonth=$(/bin/date -u "+%Y-%m")" >> $GITHUB_OUTPUT
66+
shell: bash
67+
- name: Cache Maven/Gradle local caches
68+
uses: actions/cache@v4
69+
id: cache-maven-gradle
70+
with:
71+
path: |
72+
~/.m2/repository/
73+
~/.m2/wrapper/
74+
~/.gradle/caches/
75+
~/.gradle/wrapper/
76+
# refresh cache every month to avoid unlimited growth
77+
# use a different key depending on whether we run in trusted or untrusted mode
78+
key: ${{ github.event_name == 'push' && 'trusted' || 'untrusted' }}-maven-gradle-caches-${{ steps.get-date.outputs.yearmonth }}
79+
- name: Run build script
80+
run: ./ci/build-github.sh
81+
shell: bash
82+
env:
83+
RDBMS: ${{ matrix.rdbms }}
84+
# For jobs running on 'push', publish build scan and cache immediately.
85+
# This won't work for pull requests, since they don't have access to secrets.
86+
POPULATE_REMOTE_GRADLE_CACHE: ${{ github.event_name == 'push' && github.repository == 'hibernate/hibernate-orm' && 'true' || 'false' }}
87+
DEVELOCITY_ACCESS_KEY: "${{ secrets.DEVELOCITY_ACCESS_KEY }}"
88+
89+
# For jobs running on 'pull_request', tar and upload build scan data.
90+
# The actual publishing must be done in a separate job (see ci-report.yml).
91+
# We don't write to the remote cache as that would be unsafe.
92+
- name: Tar build scan content pushed to subsequent jobs
93+
if: "${{ github.event_name == 'pull_request' && !cancelled() }}"
94+
run: tar -czf build-scan-data.tgz -C ~/.gradle/build-scan-data .
95+
- name: Upload GitHub Actions artifact for the Develocity build scan
96+
uses: actions/upload-artifact@v4
97+
if: "${{ github.event_name == 'pull_request' && !cancelled() }}"
98+
with:
99+
name: build-scan-data-${{ matrix.rdbms }}
100+
path: build-scan-data.tgz
101+
102+
- name: Upload test reports (if Gradle failed)
103+
uses: actions/upload-artifact@v4
104+
if: failure()
105+
with:
106+
name: test-reports-java11-${{ matrix.rdbms }}
107+
path: |
108+
./**/target/reports/tests/
109+
- name: Omit produced artifacts from build cache
110+
run: ./ci/before-cache.sh
111+
112+
# Job for builds on Atlas (Oracle) infrastructure.
113+
# This is untrusted, even for pushes, see below.
114+
atlas:
115+
permissions:
116+
contents: read
117+
name: GraalVM 21 - ${{matrix.rdbms}}
118+
# runs-on: ubuntu-latest
119+
runs-on: [self-hosted, Linux, X64, OCI]
120+
strategy:
121+
fail-fast: false
122+
matrix:
123+
include:
124+
- rdbms: oracle_atps
125+
- rdbms: oracle_db19c
126+
- rdbms: oracle_db21c
127+
- rdbms: oracle_db23c
128+
steps:
129+
- uses: actions/checkout@v4
130+
with:
131+
persist-credentials: false
132+
- name: Reclaim Disk Space
133+
run: .github/ci-prerequisites.sh
134+
- name: Start database
135+
env:
136+
RDBMS: ${{ matrix.rdbms }}
137+
RUNID: ${{ github.run_number }}
138+
run: ci/database-start.sh
139+
- name: Set up Java 21
140+
uses: graalvm/setup-graalvm@v1
141+
with:
142+
distribution: 'graalvm'
143+
java-version: '21'
144+
- name: Get year/month for cache key
145+
id: get-date
146+
run: echo "yearmonth=$(/bin/date -u "+%Y-%m")" >> $GITHUB_OUTPUT
147+
shell: bash
148+
- name: Cache Maven/Gradle local caches
149+
uses: actions/cache@v4
150+
id: cache-maven-gradle
151+
with:
152+
path: |
153+
~/.m2/repository/
154+
~/.m2/wrapper/
155+
~/.gradle/caches/
156+
~/.gradle/wrapper/
157+
# refresh cache every month to avoid unlimited growth
158+
# use a different key than jobs running in trusted mode
159+
key: untrusted-maven-gradle-caches-${{ steps.get-date.outputs.yearmonth }}
160+
- name: Run build script
161+
env:
162+
RDBMS: ${{ matrix.rdbms }}
163+
RUNID: ${{ github.run_number }}
164+
run: ./ci/build-github.sh
165+
shell: bash
166+
# Tar and upload build scan data.
167+
# The actual publishing must be done in a separate job (see ci-report.yml).
168+
# We don't write to the remote cache as that would be unsafe.
169+
# That's even on push, because we do not trust Atlas runners to hold secrets: they are shared infrastructure.
170+
- name: Tar build scan content pushed to subsequent jobs
171+
if: "${{ !cancelled() }}"
172+
run: tar -czf build-scan-data.tgz -C ~/.gradle/build-scan-data .
173+
- name: Upload GitHub Actions artifact for the Develocity build scan
174+
uses: actions/upload-artifact@v4
175+
if: "${{ !cancelled() }}"
176+
with:
177+
name: build-scan-data-${{ matrix.rdbms }}
178+
path: build-scan-data.tgz
179+
- name: Upload test reports (if Gradle failed)
180+
uses: actions/upload-artifact@v4
181+
if: failure()
182+
with:
183+
name: test-reports-java11-${{ matrix.rdbms }}
184+
path: |
185+
./**/target/reports/tests/
186+
- name: Omit produced artifacts from build cache
187+
run: ./ci/before-cache.sh

0 commit comments

Comments
 (0)