compose workflows

Author: KevinVlaanderen

.github/workflows/build-module.yml

@@ -1,11 +1,6 @@
 name: Export module package
 on:
-  push:
-    paths:
-      - "module/**"
-  pull_request:
-    paths:
-      - "module/**"
+  workflow_call:
   workflow_dispatch:
 jobs:
   build:

.github/workflows/build-widget.yml

@@ -1,17 +1,12 @@
 name: Build widget
 on:
-  push:
-    paths:
-      - "widget/**"
-  pull_request:
-    paths:
-      - "widget/**"
+  workflow_call:
   workflow_dispatch:
 defaults:
   run:
     working-directory: ./widget
 jobs:
-  build-widget:
+  build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

.github/workflows/pull-request.yml

@@ -0,0 +1,13 @@
+name: Build widget
+on:
+  pull_request:
+jobs:
+  build-module:
+    uses: ./.github/workflows/build-module.yml
+    secrets: inherit
+  build-widget:
+    uses: ./.github/workflows/build-widget.yml
+    secrets: inherit
+  snyk:
+    uses: ./.github/workflows/snyk.yml
+    secrets: inherit

.github/workflows/push-master.yml

@@ -0,0 +1,13 @@
+name: Run Snyk scan
+
+on:
+  push:
+    branches: [ "master", "mx8" ]
+
+jobs:
+  snyk:
+    uses: ./.github/workflows/snyk.yml
+    with:
+      command: "monitor"
+      suffix: -${{ github.ref_name }}
+    secrets: inherit

.github/workflows/snyk.yml

@@ -1,19 +1,47 @@
 name: Run Snyk scan
 
 on:
-  push:
-    branches: [ "master" ]
+  workflow_call:
+    inputs:
+      command:
+        type: string
+        required: false
+        default: 'test'
+      suffix:
+        type: string
+        required: false
   workflow_dispatch:
 
 jobs:
-  snyk-test:
-    runs-on: ubuntu-latest
+  snyk-test-gradle:
+    runs-on: windows-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          repository: 'mendixlabs/mendix-gradle-plugin'
+          path: 'mendix-gradle-plugin'
+          ref: '114bde309b52b037583d95a9beffee18eb71b65f'
+          ssh-key: ${{ secrets.MENDIX_GRADLE_PLUGIN_SSH }}
+          ssh-strict: false
+
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 #4.7.1
+        with:
+          distribution: 'adopt'
+          java-version: '21'
+      - uses: gradle/actions/setup-gradle@06832c7b30a0129d7fb559bcc6e43d26f6374244 #4.3.1
+
+      - name: Build mendix-gradle-plugin
+        working-directory: mendix-gradle-plugin
+        run: |
+          echo "kotlin.jvm.target.validation.mode = IGNORE" >> gradle.properties
+          ./gradlew build publishToMavenLocal
+
       - name: Run Snyk to check for vulnerabilities
         uses: snyk/actions/gradle@b98d498629f1c368650224d6d212bf7dfa89e4bf # 0.4.0
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
         with:
-          command: monitor
-          args: --project-name="MxPushNotifications" --file=build.gradle
+          command: ${{ inputs.command }}
+          args: --project-name="gradle${{ inputs.suffix }}" --file=module/build.gradle

README.md

@@ -58,4 +58,7 @@ The userlibs for the PushNotifications module are not part of the repo.
 To fetch them, run the `updateUserLibs` task after checking out the repo (and after switching branches).
 
 Changes to the `userlib` folder are ignored by git.
-If you make any changes to the libraries required by other modules, you must commit these explicitly, using e.g. `git add -f <path>`.
+If you make any changes to the libraries required by other modules, you must commit these explicitly, using e.g. `git add -f <path>`.
+
+Although the widget is built as part of the CI workflows, it is not integrated into the module.
+Newly built widget versions must always be committed manually.