Skip to content

Commit b6d8538

Browse files
purejavapurejava
committed
Fix GitHub workflow to release to Maven Central
Configure dependabot for Gradle Update codeql-analysis.yml for Gradle Create codeql-analysis.init.gradle
1 parent 4fdab43 commit b6d8538

File tree

6 files changed

+160
-50
lines changed

6 files changed

+160
-50
lines changed

‎.github/dependabot.yml‎

Lines changed: 1 addition & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,12 @@
11
version: 2
22
updates:
3-
- package-ecosystem: "maven"
3+
- package-ecosystem: "gradle"
44
directory: "/"
55
schedule:
66
interval: "weekly"
77
day: "saturday"
88
time: "06:00"
99
timezone: "Etc/UTC"
10-
groups:
11-
java-test-dependencies:
12-
patterns:
13-
- "org.junit.jupiter:*"
14-
maven-build-plugins:
15-
patterns:
16-
- "org.apache.maven.plugins:*"
17-
- "org.sonatype.plugins:*"
18-
java-production-dependencies:
19-
patterns:
20-
- "*"
21-
exclude-patterns:
22-
- "org.openjfx:*"
23-
- "org.apache.maven.plugins:*"
24-
- "org.junit.jupiter:*"
25-
- "org.sonatype.plugins:*"
2610

2711
- package-ecosystem: "github-actions"
2812
directory: "/" # even for `.github/workflows`

‎.github/workflows/codeql-analysis.init.gradle‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
/*
2+
* Copyright 2020 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
allprojects {
18+
tasks.withType(JavaCompile).configureEach {
19+
outputs.doNotCacheIf("CodeQL scanning", { true })
20+
}
21+
}

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 99 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -8,30 +8,105 @@ on:
88
schedule:
99
- cron: '34 10 * * 4'
1010

11+
permissions: {}
12+
1113
jobs:
12-
analyse:
13-
name: Analyse
14+
CodeQL-Build:
15+
permissions:
16+
actions: read # for github/codeql-action/init to get workflow details
17+
contents: read # for actions/checkout to fetch code
18+
security-events: write # for github/codeql-action/analyze to upload SARIF results
1419
runs-on: ubuntu-latest
15-
if: "!contains(github.event.head_commit.message, '[ci skip]') && !contains(github.event.head_commit.message, '[skip ci]')"
20+
21+
strategy:
22+
fail-fast: false
23+
matrix:
24+
# Override automatic language detection by changing the below list
25+
# Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
26+
language: ['java', 'javascript']
27+
# Learn more...
28+
# https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
29+
1630
steps:
17-
- uses: actions/checkout@v4
18-
with:
19-
fetch-depth: 2
20-
- uses: actions/setup-java@v4
21-
with:
22-
distribution: 'temurin'
23-
java-version: '17'
24-
- uses: actions/cache@v4
25-
with:
26-
path: ~/.m2/repository
27-
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
28-
restore-keys: |
29-
${{ runner.os }}-maven-
30-
- name: Initialize CodeQL
31-
uses: github/codeql-action/init@v3
32-
with:
33-
languages: java
34-
- name: Build
35-
run: mvn -B compile
36-
- name: Perform CodeQL Analysis
37-
uses: github/codeql-action/analyze@v3
31+
- name: Checkout repository
32+
uses: actions/checkout@v4
33+
# Checkout must run before the caching key is computed using the `hashFiles` method
34+
35+
- name: Cache Gradle Modules
36+
uses: actions/cache@v4
37+
with:
38+
path: |
39+
~/.gradle/caches/modules-2/
40+
~/.gradle/caches/build-cache-1/
41+
~/.gradle/caches/signatures/
42+
~/.gradle/caches/keyrings/
43+
key: ${{ runner.os }}-gradle-cache-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }}
44+
if: ${{ matrix.language == 'java' }}
45+
46+
- name: Disable checksum offloading
47+
# See: https://github.com/actions/virtual-environments/issues/1187#issuecomment-686735760
48+
run: sudo ethtool -K eth0 tx off rx off
49+
50+
# Install and setup JDK 17
51+
- name: Setup JDK 17
52+
uses: actions/setup-java@v4
53+
with:
54+
distribution: temurin
55+
java-version: 17
56+
57+
# Initializes the CodeQL tools for scanning.
58+
- name: Initialize CodeQL
59+
uses: github/codeql-action/init@v3
60+
with:
61+
languages: ${{ matrix.language }}
62+
tools: latest
63+
# If you wish to specify custom queries, you can do so here or in a config file.
64+
# By default, queries listed here will override any specified in a config file.
65+
# Prefix the list here with "+" to use these queries and those in the config file.
66+
# queries: ./path/to/local/query, your-org/your-repo/queries@main
67+
68+
- name: Compile with Gradle with Build Scan
69+
if: ${{ matrix.language == 'java' && github.repository_owner == 'gradle' }}
70+
run: ./gradlew --init-script .github/workflows/codeql-analysis.init.gradle -DcacheNode=us -S testClasses -Dhttp.keepAlive=false
71+
env:
72+
# Set the DEVELOCITY_ACCESS_KEY so that Gradle Build Scans are generated
73+
DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
74+
# Potential stop-gap solution for ReadTimeout issues with the Gradle Build Cache
75+
# https://gradle.slack.com/archives/CHDLT99C6/p1636477584059200
76+
GRADLE_OPTS: -Dhttp.keepAlive=false
77+
ORG_GRADLE_PROJECT_signingKey: ${{ secrets.GPG_PRIVATE_KEY }}
78+
ORG_GRADLE_PROJECT_signingKeyId: ${{ secrets.GPG_PRIVATE_KEY_ID }}
79+
ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.GPG_PASSPHRASE }}
80+
ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.NEXUS_USERNAME }}
81+
ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.NEXUS_PASSWORD }}
82+
83+
- name: Compile with Gradle without Build Scan
84+
if: ${{ matrix.language == 'java' && github.repository_owner != 'gradle' }}
85+
run: ./gradlew --init-script .github/workflows/codeql-analysis.init.gradle -S testClasses
86+
87+
- name: Cleanup Gradle Daemons
88+
run: ./gradlew --stop
89+
if: ${{ matrix.language == 'java' }}
90+
91+
# ℹ️ Command-line programs to run using the OS shell.
92+
# 📚 https://git.io/JvXDl
93+
94+
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
95+
# and modify them (or add more) to build your code if your project
96+
# uses a compiled language
97+
98+
#- run: |
99+
# make bootstrap
100+
# make release
101+
102+
- name: Perform CodeQL Analysis
103+
uses: github/codeql-action/analyze@v3
104+
with:
105+
config-file: ./.github/codeql/codeql-config.yml
106+
107+
- name: Cleanup Gradle Cache
108+
# Cleans up the Gradle caches before being cached
109+
run: |
110+
rm -f ~/.gradle/caches/modules-2/modules-2.lock
111+
rm -f ~/.gradle/caches/modules-2/gc.properties
112+
if: ${{ matrix.language == 'java' }}

‎.github/workflows/release_to_maven.yml‎

Lines changed: 27 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,51 @@
11
name: Publish to Maven Central
2+
23
on:
34
workflow_dispatch:
45
inputs:
56
tag:
67
description: 'Tag'
78
required: true
89
default: '0.0.0'
10+
sonatypeUsername:
11+
description: 'Sonatype username'
12+
type: string
13+
required: true
14+
sonatypePassword:
15+
description: 'Sonatype password'
16+
type: string
17+
required: true
18+
919
jobs:
1020
publish:
1121
runs-on: ubuntu-latest
22+
1223
steps:
1324
- uses: actions/checkout@v4
14-
- name: Import GPG key
25+
26+
- name: Setup GPG key information
1527
run: |
16-
echo "$GPG_SIGNING_KEY_PW" | gpg --batch --import --yes --passphrase-fd 0 <(echo -n "$GPG_SIGNING_KEY" | base64 --decode)
1728
mkdir -p ~/.gradle
18-
echo -n "signing.gnupg.passphrase=${GPG_SIGNING_KEY_PW}" >> ~/.gradle/gradle.properties
29+
echo "signing.gnupg.homeDir=/home/runner/.gnupg" >> ~/.gradle/gradle.properties
30+
echo "signing.gnupg.executable=gpg" >> ~/.gradle/gradle.properties
31+
echo "signing.gnupg.keyName=ABC48776" >> ~/.gradle/gradle.properties
32+
echo "signing.gnupg.passphrase=${GPG_SIGNING_KEY_PW}" >> ~/.gradle/gradle.properties
1933
env:
20-
GPG_SIGNING_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
2134
GPG_SIGNING_KEY_PW: ${{ secrets.GPG_PASSPHRASE }}
35+
2236
- name: Set up Java
2337
uses: actions/setup-java@v4
2438
with:
2539
java-version: '17'
2640
distribution: 'temurin'
41+
42+
- name: Setup Gradle
43+
uses: gradle/actions/setup-gradle@v4
44+
2745
- name: Publish package
28-
run: gradle publishToSonatype closeSonatypeStagingRepository
46+
run: ./gradlew publishToSonatype closeSonatypeStagingRepository -PsonatypeUsername=2tezCY9e -PsonatypePassword=RE4rqMPUlTCY2ZWXE1PA1jzCBh9HBdVYoGPUlDos2DNh
2947
env:
30-
ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.NEXUS_USERNAME }}
31-
ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.NEXUS_PASSWORD }}
48+
SONATYPE_USERNAME: ${{ inputs.sonatypeUsername }}
49+
SONATYPE_PASSWORD: ${{ inputs.sonatypePassword }}
50+
GPG_SIGNING_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
51+
GPG_SIGNING_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

‎build.gradle‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,10 @@ publishing {
6464
developerConnection = 'scm:git:ssh://github.com/purejava/keepassxc-proxy-access.git'
6565
url = 'https://github.com/purejava/keepassxc-proxy-access/tree/main'
6666
}
67+
issueManagement {
68+
system = 'GitHub Issues'
69+
url = 'https://github.com/purejava/keepassxc-proxy-access/issues'
70+
}
6771
}
6872
}
6973
}
@@ -82,6 +86,8 @@ nexusPublishing {
8286

8387
if (!version.toString().endsWith("-SNAPSHOT")) {
8488
signing {
89+
useGpgCmd()
90+
sign configurations.runtimeElements
8591
sign publishing.publications.mavenJava
8692
}
8793
}

‎gradle.properties‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ org.gradle.configuration-cache=false
55
org.gradle.parallel=true
66
org.gradle.caching=true
77

8-
signing.keyId=ABC48776
9-
signing.secretKeyRingFile=/Users/ralph/.gnupg/secring.gpg
8+
signing.gnupg.executable=/usr/local/bin/gpg
9+
signing.gnupg.homeDir=/Users/ralph/.gnupg
10+
signing.gnupg.keyName=ABC48776
11+
signing.gnupg.passphrase=
1012

13+
sonatypeUsername=
14+
sonatypePassword=

0 commit comments

Comments
 (0)