Skip to content

Commit 48035cc

Browse files
adangeladangel
authored
Refactor GitHub Actions Workflows (#68)
The goal is to have a similar structure for all PMD projects. This build-tools is the simplest one. Improvements: - We don't rely anymore on shell scripts and encrypted secrets that are committed. Instead, all secrets are configured on GitHub and are injected via environment variables. - The main build.yml build can run also on forks, as it doesn't need any secrets. - The two new workflows "publish-snapshot" and "publish-release" run after the "build" workflow and have access to the secrets. - The build-tools will now be built only on linux, as there isn't be any os dependant functionality, that needs to be tested. Refs pmd/pmd#4328
2 parents 5f84973 + 8f36e74 commit 48035cc

File tree

5 files changed

+233
-61
lines changed

5 files changed

+233
-61
lines changed

‎.github/workflows/build.yml‎

Lines changed: 41 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -1,60 +1,55 @@
1-
name: build
1+
name: Build
22

33
on:
4+
pull_request:
5+
merge_group:
46
push:
57
branches:
6-
- main
8+
- '**'
9+
# don't run on dependabot branches. Dependabot will create pull requests, which will then be run instead
10+
- '!dependabot/**'
711
tags:
812
- '**'
9-
pull_request:
13+
workflow_dispatch:
1014
schedule:
1115
# build it monthly: At 04:15 on day-of-month 1.
1216
- cron: '15 4 1 * *'
1317
# for testing the event "schedule": run every 15 minutes starting from minute 5 through 59 (0, 15, 30, 45)
1418
#- cron: '0/15 * * * *'
15-
workflow_dispatch:
19+
20+
# if another commit is added to the same branch or PR (same github.ref),
21+
# then cancel already running jobs and start a new build.
22+
concurrency:
23+
group: ${{ github.workflow }}-${{ github.ref }}
24+
cancel-in-progress: true
25+
26+
permissions:
27+
contents: read # to fetch code (actions/checkout)
28+
29+
env:
30+
LANG: 'en_US.UTF-8'
1631

1732
jobs:
18-
build:
19-
runs-on: ${{ matrix.os }}
20-
continue-on-error: false
21-
strategy:
22-
matrix:
23-
os: [ ubuntu-latest, windows-latest, macos-latest ]
24-
if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }}
33+
compile:
34+
runs-on: ubuntu-latest
35+
timeout-minutes: 10
36+
defaults:
37+
run:
38+
shell: bash
2539
steps:
26-
- uses: actions/checkout@v4
27-
- uses: actions/cache@v4
28-
with:
29-
path: |
30-
~/.m2/repository
31-
~/.cache
32-
key: ${{ runner.os }}-${{ hashFiles('**/pom.xml') }}
33-
restore-keys: |
34-
${{ runner.os }}-
35-
- name: Set up Ruby 3.3
36-
uses: ruby/setup-ruby@v1
37-
with:
38-
ruby-version: 3.3
39-
- name: Setup Environment
40-
shell: bash
41-
run: |
42-
echo "LANG=en_US.UTF-8" >> $GITHUB_ENV
43-
echo "MAVEN_OPTS=-Daether.connector.http.connectionMaxTtl=180 -DautoReleaseAfterClose=true" >> $GITHUB_ENV
44-
echo "PMD_CI_SCRIPTS_URL=https://raw.githubusercontent.com/pmd/build-tools/main/scripts" >> $GITHUB_ENV
45-
- name: Check Environment
46-
shell: bash
47-
run: |
48-
f=check-environment.sh; \
49-
mkdir -p .ci && \
50-
( [ -e .ci/$f ] || curl -sSL "${PMD_CI_SCRIPTS_URL}/$f" > ".ci/$f" ) && \
51-
chmod 755 .ci/$f && \
52-
.ci/$f
53-
- name: Build
54-
run: .ci/build.sh
55-
shell: bash
56-
env:
57-
PMD_CI_SECRET_PASSPHRASE: ${{ secrets.PMD_CI_SECRET_PASSPHRASE }}
58-
PMD_CI_GPG_PRIVATE_KEY: ${{ secrets.PMD_CI_GPG_PRIVATE_KEY }}
59-
MAVEN_GPG_PASSPHRASE: ${{ secrets.PMD_CI_GPG_PASSPHRASE }}
60-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
40+
- uses: actions/checkout@v4
41+
- uses: actions/setup-java@v4
42+
with:
43+
distribution: 'temurin'
44+
java-version: '11'
45+
cache: 'maven'
46+
- name: Build with Maven
47+
run: |
48+
./mvnw --show-version --errors --batch-mode \
49+
verify
50+
- uses: actions/upload-artifact@v4
51+
with:
52+
name: compile-artifact
53+
if-no-files-found: error
54+
path: |
55+
target/

‎.github/workflows/publish-release.yml‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
name: Publish Release
2+
3+
on:
4+
workflow_run:
5+
workflows: [Build]
6+
types:
7+
- completed
8+
branches:
9+
- 'releases/**'
10+
11+
permissions:
12+
contents: read # to fetch code (actions/checkout)
13+
14+
env:
15+
LANG: 'en_US.UTF-8'
16+
17+
jobs:
18+
check-version:
19+
# only run in the official pmd/build-tools repo, where we have access to the secrets and not on forks
20+
# and only run for _successful_ push workflow runs on tags "releases/**".
21+
if: ${{ github.repository == 'pmd/build-tools'
22+
&& github.event.workflow_run.event == 'push'
23+
&& startsWith('releases/', github.event.workflow_run.head_branch)
24+
&& github.event.workflow_run.conclusion == 'success' }}
25+
runs-on: ubuntu-latest
26+
timeout-minutes: 10
27+
defaults:
28+
run:
29+
shell: bash
30+
outputs:
31+
VERSION: ${{ steps.version.outputs.VERSION }}
32+
steps:
33+
- uses: actions/checkout@v4
34+
with:
35+
ref: ${{ github.event.workflow_run.head_branch }}
36+
- uses: actions/setup-java@v4
37+
with:
38+
distribution: 'temurin'
39+
java-version: '11'
40+
cache: 'maven'
41+
- name: Determine Version
42+
id: version
43+
env:
44+
REF: ${{ github.event.workflow_run.head_branch }}
45+
run: |
46+
if ! git show-ref --exists "refs/tags/$REF"; then
47+
echo "::error ::Tag $REF does not exist, aborting."
48+
exit 1
49+
fi
50+
51+
VERSION=$(./mvnw --batch-mode --no-transfer-progress help:evaluate -Dexpression=project.version -q -DforceStdout)
52+
echo "Determined VERSION=$VERSION"
53+
if [[ "$VERSION" = *-SNAPSHOT ]]; then
54+
echo "::error ::VERSION=$VERSION is a snapshot version, aborting."
55+
exit 1
56+
fi
57+
echo "VERSION=$VERSION" >> "$GITHUB_OUTPUT"
58+
59+
deploy-to-maven-central:
60+
needs: check-version
61+
# use environment maven-central, where secrets are configured for OSSRH_*
62+
environment:
63+
name: maven-central
64+
url: https://repo.maven.apache.org/maven2/net/sourceforge/pmd/pmd-build-tools-config/
65+
runs-on: ubuntu-latest
66+
timeout-minutes: 20
67+
defaults:
68+
run:
69+
shell: bash
70+
steps:
71+
- uses: actions/checkout@v4
72+
with:
73+
ref: ${{ github.event.workflow_run.head_branch }}
74+
- uses: actions/setup-java@v4
75+
with:
76+
distribution: 'temurin'
77+
java-version: '11'
78+
cache: 'maven'
79+
server-id: ossrh
80+
server-username: MAVEN_USERNAME
81+
server-password: MAVEN_PASSWORD
82+
gpg-passphrase: MAVEN_GPG_PASSPHRASE
83+
gpg-private-key: ${{ secrets.PMD_CI_GPG_PRIVATE_KEY }}
84+
- name: Build and Publish
85+
env:
86+
MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}
87+
MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }}
88+
MAVEN_GPG_PASSPHRASE: ${{ secrets.PMD_CI_GPG_PASSPHRASE }}
89+
run: |
90+
./mvnw --show-version --errors --batch-mode \
91+
-Psign \
92+
deploy

‎.github/workflows/publish-snapshot.yml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
name: Publish Snapshot
2+
3+
on:
4+
workflow_run:
5+
workflows: [Build]
6+
types:
7+
- completed
8+
branches:
9+
- main
10+
11+
permissions:
12+
contents: read # to fetch code (actions/checkout)
13+
14+
env:
15+
LANG: 'en_US.UTF-8'
16+
17+
jobs:
18+
check-version:
19+
# only run in the official pmd/build-tools repo, where we have access to the secrets and not on forks
20+
# and only run for _successful_ push workflow runs on branch "main".
21+
if: ${{ github.repository == 'pmd/build-tools'
22+
&& github.event.workflow_run.event == 'push'
23+
&& github.event.workflow_run.head_branch == 'main'
24+
&& github.event.workflow_run.conclusion == 'success' }}
25+
runs-on: ubuntu-latest
26+
timeout-minutes: 10
27+
defaults:
28+
run:
29+
shell: bash
30+
outputs:
31+
VERSION: ${{ steps.version.outputs.VERSION }}
32+
steps:
33+
- uses: actions/checkout@v4
34+
with:
35+
ref: main
36+
- uses: actions/setup-java@v4
37+
with:
38+
distribution: 'temurin'
39+
java-version: '11'
40+
cache: 'maven'
41+
- name: Determine Version
42+
id: version
43+
run: |
44+
VERSION=$(./mvnw --batch-mode --no-transfer-progress help:evaluate -Dexpression=project.version -q -DforceStdout)
45+
echo "Determined VERSION=$VERSION"
46+
if [[ "$VERSION" != *-SNAPSHOT ]]; then
47+
echo "::error ::VERSION=$VERSION is not a snapshot version, aborting."
48+
exit 1
49+
fi
50+
echo "VERSION=$VERSION" >> "$GITHUB_OUTPUT"
51+
52+
deploy-to-maven-central:
53+
needs: check-version
54+
# use environment maven-central, where secrets are configured for OSSRH_*
55+
environment:
56+
name: maven-central
57+
url: https://oss.sonatype.org/content/repositories/snapshots/net/sourceforge/pmd/pmd-build-tools-config/
58+
runs-on: ubuntu-latest
59+
timeout-minutes: 20
60+
defaults:
61+
run:
62+
shell: bash
63+
steps:
64+
- uses: actions/checkout@v4
65+
with:
66+
ref: main
67+
- uses: actions/setup-java@v4
68+
with:
69+
distribution: 'temurin'
70+
java-version: '11'
71+
cache: 'maven'
72+
server-id: ossrh
73+
server-username: MAVEN_USERNAME
74+
server-password: MAVEN_PASSWORD
75+
gpg-passphrase: MAVEN_GPG_PASSPHRASE
76+
gpg-private-key: ${{ secrets.PMD_CI_GPG_PRIVATE_KEY }}
77+
- name: Build and Publish
78+
env:
79+
MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}
80+
MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }}
81+
MAVEN_GPG_PASSPHRASE: ${{ secrets.PMD_CI_GPG_PASSPHRASE }}
82+
run: |
83+
./mvnw --show-version --errors --batch-mode \
84+
-Psign \
85+
deploy

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,7 @@
172172
<pushChanges>true</pushChanges>
173173
<localCheckout>true</localCheckout>
174174
<autoVersionSubmodules>true</autoVersionSubmodules>
175-
<tagNameFormat>@{project.version}</tagNameFormat>
175+
<tagNameFormat>releases/@{project.version}</tagNameFormat>
176176
<goals>deploy</goals>
177177
</configuration>
178178
</plugin>

‎release-howto.md‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,27 @@
1-
Release Howto for pmd-build
2-
============================
1+
# Release Howto for pmd-build
2+
3+
## Step by step
34

4-
Step by step
5-
-------------
65
1. Checkout main branch:
76

8-
``` shell
9-
git clone https://github.com/pmd/build-tools.git
10-
cd build-tools
11-
```
7+
``` shell
8+
git clone https://github.com/pmd/build-tools.git
9+
cd build-tools
10+
```
1211

13-
2. Prepare the release (creates a new release tag).
12+
2. Prepare the release (creates a new release tag named "releases/x").
1413
This will be done for you: http://maven.apache.org/plugins/maven-release-plugin/examples/prepare-release.html
1514
Maven will ask you about the release version, the tag name and the new version. You can simply hit enter,
1615
to use the default values.
1716

18-
``` shell
19-
./mvnw release:clean
20-
./mvnw release:prepare
21-
```
17+
``` shell
18+
./mvnw release:clean
19+
./mvnw release:prepare
20+
```
2221

2322
3. Wait, until release is ready. The maven plugin will directly push the tag. The tag will be
24-
built by [Github Actions](https://github.com/pmd/build-tools/actions?query=workflow%3Abuild).
23+
built by GitHub Actions workflow [Build](https://github.com/pmd/build-tools/actions/workflows/build.yml)
24+
followed by workflow [Publish Release](https://github.com/pmd/build-tools/actions/workflows/publish-release.yml).
2525
After it is done, the new release
2626
should be available under <https://repo.maven.apache.org/maven2/net/sourceforge/pmd/pmd-build-tools-config/>.
2727

0 commit comments

Comments
 (0)