mirror of
https://github.com/eclipse-sailing-analytics/sailing-analytics.git
synced 2026-11-03 09:39:38 +00:00
Axel Uhl
180b05e065
A maintainer reviews a fork PR's exact SHA, then pushes a tag at that SHA: '*-reviewed-for-compile' runs a compile-only build with NO secrets (cheap sanity check), '*-reviewed-for-build' runs the full build with tests and secrets. A tag push is a trusted push event in the base repo, so it receives secrets — the only way to run secret-bearing validation on fork-authored code. - push trigger: keep branches: ['**'] (required so the new tags: filter does not silently disable branch triggers) and add the two reviewed-tag families. - build job: a 'Determine build mode' step computes skip_tests (true for a -for-compile tag or a workflow_dispatch skip_tests=true) and exposes it as a job output. The five test-runtime secrets resolve to '' when skip_tests is true, so their values never enter the environment on a compile-only run; -t is passed on the same flag. Test Reports step is skipped when tests are. - build-gate (required check): green only for a genuine full build with tests, or a trivial-change skip; a compile-only success fails it. This also fixes a pre-existing bug where a skip_tests=true dispatch satisfied the gate. - compile-gate (new, advisory): green whenever the build compiled, regardless of tests, giving -for-compile runs a distinct check without touching the required build-gate. Assisted-By: Claude Opus 4.8
327 lines
16 KiB
YAML
327 lines
16 KiB
YAML
name: release
|
|
on:
|
|
push:
|
|
# NOTE: introducing a "tags:" filter makes GitHub treat any Git ref kind that
|
|
# is NOT filtered as "undefined", and the workflow then stops running for it.
|
|
# So branches MUST be listed explicitly here; without "branches: ['**']" the
|
|
# tag filter below would silently disable all branch-push builds. '**' (not
|
|
# '*') is required to match branch names containing slashes (e.g. releases/x).
|
|
branches:
|
|
- '**'
|
|
# Reviewed-fork-PR tags. A maintainer fetches a fork PR head, reviews the
|
|
# exact SHA, then pushes one of these tags at that SHA. Because a tag push is
|
|
# a push event in this (base) repo, the run executes in trusted context WITH
|
|
# secrets — the only way to run secret-bearing validation on fork-authored
|
|
# code. '*-reviewed-for-compile' runs a compile-only build with NO secrets
|
|
# (cheap sanity check); '*-reviewed-for-build' runs the full build with tests
|
|
# and secrets. Safety rests on the maintainer having read that exact SHA
|
|
# before pushing the tag. See the "Determine build mode" step below.
|
|
tags:
|
|
- '*-reviewed-for-compile'
|
|
- '*-reviewed-for-build'
|
|
# paths-ignore is not evaluated for tag pushes (GitHub rule), so it only
|
|
# scopes branch pushes, exactly as before.
|
|
paths-ignore:
|
|
- 'wiki/**'
|
|
- '.github/workflows/*'
|
|
- '**/*.md'
|
|
- 'README.md'
|
|
- 'docs/**'
|
|
workflow_dispatch:
|
|
inputs:
|
|
skip_tests:
|
|
description: Skip tests (set to "true" to skip all tests)
|
|
default: 'false'
|
|
local_target_platform:
|
|
description: Build with a local target platform (set to "true" to use local target platform)
|
|
default: 'false'
|
|
runner_cpus:
|
|
description: Empty means ubuntu-latest, usually 4 CPUs with little disk/memory, but if you have runners named ubuntu-latest-Xcpu, it can be 4, 8, 16, and 64 as well, using, e.g., ubuntu-latest-16cpu; default is ubuntu-latest
|
|
default: ''
|
|
firefox_version:
|
|
description: Version to use for Selenium tests; default is 137.0, but could, e.g., be "141.0" or "latest"
|
|
default: '140.0'
|
|
|
|
jobs:
|
|
# The "changes" job will cause the "build" job to get skipped for trivial changes
|
|
changes:
|
|
permissions: {}
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
should_run: ${{ steps.filter.outputs.code }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- id: filter
|
|
uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
|
|
with:
|
|
# Under the default 'some' quantifier a negated rule still counts as a
|
|
# match (picomatch treats '!README.md' as "anything but README.md"),
|
|
# so a changed README.md would set code=true. 'some-with-excludes'
|
|
# (v4+) makes the '!' rules act as real exclusions: code is true only
|
|
# when a changed file matches the positive '**' rule AND none of the
|
|
# excludes.
|
|
predicate-quantifier: 'some-with-excludes'
|
|
filters: |
|
|
code:
|
|
- '**'
|
|
- '!wiki/**'
|
|
- '!.github/workflows/*'
|
|
- '!**/*.md'
|
|
- '!README.md'
|
|
- '!docs/**'
|
|
|
|
build:
|
|
needs: changes
|
|
if: ${{ needs.changes.outputs.should_run == 'true' || github.event_name == 'workflow_dispatch' }}
|
|
permissions:
|
|
contents: write
|
|
checks: write
|
|
actions: read
|
|
runs-on: ${{ github.event.inputs.runner_cpus != '' && format('ubuntu-latest-{0}cpu', github.event.inputs.runner_cpus) || 'ubuntu-latest' }}
|
|
outputs:
|
|
skip_tests: ${{ steps.mode.outputs.skip_tests }}
|
|
steps:
|
|
- name: Determine build mode
|
|
id: mode
|
|
shell: bash
|
|
# skip_tests=true means "compile only, no tests, no secrets". It is true
|
|
# for a workflow_dispatch with skip_tests=true, OR for a push of a
|
|
# *-reviewed-for-compile tag. Everything else (branches, *-reviewed-for-build
|
|
# tags) runs the full build with tests and secrets.
|
|
run: |
|
|
skip=false
|
|
if [[ "${{ github.event.inputs.skip_tests }}" == "true" ]]; then skip=true; fi
|
|
if [[ "${{ github.ref }}" == refs/tags/*-reviewed-for-compile ]]; then skip=true; fi
|
|
echo "skip_tests=$skip" >> "$GITHUB_OUTPUT"
|
|
- name: Free Disk Space (Ubuntu)
|
|
uses: jlumbroso/free-disk-space@v1.3.1
|
|
with:
|
|
# this might remove tools that are actually needed,
|
|
# if set to "true" but frees about 6 GB
|
|
tool-cache: false
|
|
# all of these default to true, but feel free to set to
|
|
# "false" if necessary for your workflow
|
|
android: false
|
|
dotnet: true
|
|
haskell: true
|
|
large-packages: true
|
|
docker-images: false
|
|
swap-storage: true
|
|
- name: Allocate swap space
|
|
shell: bash
|
|
run: |
|
|
sudo dd if=/dev/zero of=/mnt/large-swapfile bs=1G count=30
|
|
sudo chmod 600 /mnt/large-swapfile
|
|
sudo mkswap /mnt/large-swapfile
|
|
sudo chown root:root /mnt/large-swapfile
|
|
sudo swapon /mnt/large-swapfile
|
|
- name: Create TMP space under /mnt/tmp
|
|
shell: bash
|
|
run: |
|
|
sudo mkdir /mnt/tmp
|
|
sudo chmod 777 /mnt/tmp
|
|
- name: Collect Workflow Telemetry
|
|
uses: catchpoint/workflow-telemetry-action@94c3c3d9567a0205de6da68a76c428ce4e769af1 # v2.0.0
|
|
with:
|
|
comment_on_pr: false
|
|
- name: Setup firefox
|
|
id: setup-firefox
|
|
uses: browser-actions/setup-firefox@5914774dda97099441f02628f8d46411fcfbd208 # v1.7.0
|
|
with:
|
|
firefox-version: ${{ github.event.inputs.firefox_version == '' && '140.0' || github.event.inputs.firefox_version }}
|
|
- run: |
|
|
echo Installed firefox versions: ${{ steps.setup-firefox.outputs.firefox-version }}
|
|
${{ steps.setup-firefox.outputs.firefox-path }} --version
|
|
- name: Check out the repository to the runner
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: '500'
|
|
- name: Install JDK 8
|
|
uses: actions/setup-java@v4
|
|
with:
|
|
distribution: 'temurin' # See 'Supported distributions' for available options
|
|
java-version: '8'
|
|
mvn-toolchain-id: 'JavaSE-1.8'
|
|
- name: Install JDK 17
|
|
uses: actions/setup-java@v4
|
|
with:
|
|
distribution: 'temurin' # See 'Supported distributions' for available options
|
|
java-version: '17'
|
|
mvn-toolchain-id: 'JavaSE-17'
|
|
- name: Install JDK 25
|
|
uses: actions/setup-java@v4
|
|
with:
|
|
distribution: 'temurin' # See 'Supported distributions' for available options
|
|
java-version: '25'
|
|
mvn-toolchain-id: 'JavaSE-25'
|
|
- name: Setup Android SDK
|
|
uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3.2.2
|
|
with:
|
|
log-accepted-android-sdk-licenses: 'false'
|
|
cmdline-tools-version: 9123335 # This corresponds to human-friendly version number 8.0
|
|
- name: Start MongoDB
|
|
uses: supercharge/mongodb-github-action@315db7fe45ac2880b7758f1933e6e5d59afd5e94 #v1.12.1
|
|
with:
|
|
mongodb-version: 7.0
|
|
- name: Start RabbitMQ
|
|
uses: Namoshek/rabbitmq-github-action@80a182e44c7f60bc3417a8689d6a24fe9d08b27b #v1.2.0
|
|
with:
|
|
version: '3.8.9'
|
|
ports: '5672:5672'
|
|
- shell: bash
|
|
env: # Or as an environment variable
|
|
TMP: /mnt/tmp
|
|
# These five are consumed only at TEST runtime. For a compile-only run
|
|
# (skip_tests) they resolve to '' so the real secret values are never
|
|
# placed in the process environment where reviewed-but-fork-authored
|
|
# code could read them. The full build (skip_tests false) gets them all.
|
|
AWS_S3_TEST_S3ACCESSID: ${{ steps.mode.outputs.skip_tests == 'true' && '' || secrets.AWS_S3_TEST_S3ACCESSID }}
|
|
AWS_S3_TEST_S3ACCESSKEY: ${{ steps.mode.outputs.skip_tests == 'true' && '' || secrets.AWS_S3_TEST_S3ACCESSKEY }}
|
|
GEONAMES_ORG_USERNAMES: ${{ steps.mode.outputs.skip_tests == 'true' && '' || secrets.GEONAMES_ORG_USERNAMES }}
|
|
GOOGLE_MAPS_AUTHENTICATION_PARAMS: ${{ steps.mode.outputs.skip_tests == 'true' && '' || secrets.GOOGLE_MAPS_AUTHENTICATION_PARAMS }}
|
|
POLAR_DATA_BASE_URL: ${{ vars.POLAR_DATA_BASE_URL }}
|
|
POLAR_DATA_BEARER_TOKEN: ${{ steps.mode.outputs.skip_tests == 'true' && '' || secrets.POLAR_DATA_BEARER_TOKEN }}
|
|
APP_PARAMETERS: "-Daws.region=eu-west-1"
|
|
JAVA8_HOME: ${{env.JAVA_HOME_8_X64}}
|
|
JAVA17_HOME: ${{env.JAVA_HOME_17_X64}}
|
|
run: |
|
|
./configuration/buildAndUpdateProduct.sh -x ${{ github.event.inputs.runner_cpus == '' && '4' || github.event.inputs.runner_cpus }} ${{ steps.mode.outputs.skip_tests == 'true' && '-t' || '' }} ${{ github.event.inputs.local_target_platform == 'true' && '-v' || '' }} build 2>&1
|
|
- name: show disk stats
|
|
if: always()
|
|
run: df -h
|
|
- name: Upload build log
|
|
uses: actions/upload-artifact@v4
|
|
if: always()
|
|
with:
|
|
name: build.log
|
|
path: build.log
|
|
retention-days: 90
|
|
- name: Collect Test Reports
|
|
uses: dorny/test-reporter@a6ddd83ac95ff4586f5d3aceeb314d9a1841db95 # v3.0.0
|
|
# Skip for compile-only runs: no tests ran, so there are no TEST-*.xml
|
|
# and fail-on-error would otherwise error on zero matches.
|
|
if: ${{ always() && steps.mode.outputs.skip_tests != 'true' }}
|
|
with:
|
|
name: Maven Tests
|
|
path: '**/TEST-*.xml'
|
|
max-annotations: '1'
|
|
list-suites: failed
|
|
list-tests: failed
|
|
reporter: java-junit
|
|
fail-on-error: true
|
|
- name: Build Release
|
|
if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/docker-24' || github.ref == 'refs/heads/docker-25' || startsWith(github.ref, 'refs/heads/releases/') }}
|
|
shell: bash
|
|
run: |
|
|
./configuration/buildAndUpdateProduct.sh -u -L ${{ github.event.inputs.skip_tests == 'true' && '-n untested' || '' }} release
|
|
- name: Determine release name
|
|
run: |
|
|
echo "SIMPLE_VERSION_INFO=$( basename dist/* )" >>${GITHUB_ENV}
|
|
- name: Upload test results
|
|
uses: actions/upload-artifact@v4
|
|
if: always()
|
|
with:
|
|
name: test-results
|
|
path: |
|
|
**/surefire-reports/**
|
|
retention-days: 90
|
|
- name: Upload distribution artifact
|
|
uses: actions/upload-artifact@v4
|
|
if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/docker-24' || github.ref == 'refs/heads/docker-25' || startsWith(github.ref, 'refs/heads/releases/') }}
|
|
with:
|
|
name: ${{ env.SIMPLE_VERSION_INFO }}
|
|
path: dist/**/*
|
|
retention-days: 90
|
|
- name: Create Release
|
|
id: create_release
|
|
if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/docker-24' || github.ref == 'refs/heads/docker-25' || startsWith(github.ref, 'refs/heads/releases/') }}
|
|
uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
|
|
with:
|
|
tag_name: ${{ env.SIMPLE_VERSION_INFO }}
|
|
target_commitish: ${{ github.ref_name }}
|
|
name: ${{ env.SIMPLE_VERSION_INFO }}
|
|
draft: false
|
|
prerelease: false
|
|
- name: Upload Release Asset tar.gz
|
|
id: upload-release-asset-tar-gz
|
|
if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/docker-24' || github.ref == 'refs/heads/docker-25' || startsWith(github.ref, 'refs/heads/releases/') }}
|
|
uses: actions/upload-release-asset@v1
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
with:
|
|
upload_url: ${{ steps.create_release.outputs.upload_url }} # This pulls from the CREATE RELEASE step above, referencing it's ID to get its outputs object, which include a `upload_url`. See this blog post for more info: https://jasonet.co/posts/new-features-of-github-actions/#passing-data-to-future-steps
|
|
asset_path: ./dist/${{ env.SIMPLE_VERSION_INFO }}/${{ env.SIMPLE_VERSION_INFO }}.tar.gz
|
|
asset_name: ${{ env.SIMPLE_VERSION_INFO }}.tar.gz
|
|
asset_content_type: application/x-tar
|
|
- name: Upload Release Asset release_notes.txt
|
|
id: upload-release-asset-release-notes-txt
|
|
if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/docker-24' || github.ref == 'refs/heads/docker-25' || startsWith(github.ref, 'refs/heads/releases/') }}
|
|
uses: actions/upload-release-asset@v1
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
with:
|
|
upload_url: ${{ steps.create_release.outputs.upload_url }} # This pulls from the CREATE RELEASE step above, referencing it's ID to get its outputs object, which include a `upload_url`. See this blog post for more info: https://jasonet.co/posts/new-features-of-github-actions/#passing-data-to-future-steps
|
|
asset_path: ./dist/${{ env.SIMPLE_VERSION_INFO }}/release-notes.txt
|
|
asset_name: release-notes.txt
|
|
asset_content_type: text/plain
|
|
- name: Trigger CI job
|
|
env:
|
|
CI_JOB_USERNAME: ${{ vars.CI_JOB_USERNAME }}
|
|
CI_JOB_PASSWORD: ${{ secrets.CI_JOB_PASSWORD }}
|
|
CI_JOB_TOKEN: ${{ secrets.CI_JOB_TOKEN }}
|
|
if: ${{ always() && env.CI_JOB_USERNAME != '' && env.CI_JOB_PASSWORD != '' && env.CI_JOB_TOKEN != '' }}
|
|
shell: bash
|
|
run: |
|
|
if [[ "${{ github.ref }}" =~ refs/heads/releases/.* ]]; then
|
|
JOB=$( echo "${{ github.ref }}" | sed -e 's/^refs\/heads\/releases\///' )
|
|
else
|
|
JOB=$( echo "${{ github.ref }}" | sed -e 's/^refs\/heads\///' )
|
|
fi
|
|
echo "Identified CI job: ${JOB}"
|
|
curl -u "${{ vars.CI_JOB_USERNAME }}:${{ secrets.CI_JOB_PASSWORD}}" ${{ vars.CI_BASE_URL }}/job/${JOB}/build?token=${{ secrets.CI_JOB_TOKEN }}
|
|
|
|
# build-gate is the REQUIRED status check in branch protection. It must go
|
|
# green ONLY for a genuine full build (tests actually ran) or a legitimate
|
|
# trivial-change skip. A compile-only run (skip_tests true, e.g. a
|
|
# *-reviewed-for-compile tag or a workflow_dispatch with skip_tests=true) must
|
|
# NOT satisfy it — so those cannot qualify a PR for merge.
|
|
build-gate:
|
|
permissions: {}
|
|
needs: [changes, build]
|
|
if: always()
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- run: |
|
|
if [[ "${{ needs.build.result }}" == "success" && "${{ needs.build.outputs.skip_tests }}" != "true" ]]; then
|
|
echo "Full build with tests passed."
|
|
elif [[ "${{ needs.build.result }}" == "skipped" && "${{ needs.changes.outputs.should_run }}" == "false" ]]; then
|
|
echo "No relevant changes — skipping is OK."
|
|
elif [[ "${{ needs.build.result }}" == "success" && "${{ needs.build.outputs.skip_tests }}" == "true" ]]; then
|
|
echo "Compile-only build (tests skipped) does not satisfy the required check."
|
|
exit 1
|
|
else
|
|
echo "Build failed or was cancelled."
|
|
exit 1
|
|
fi
|
|
|
|
# compile-gate is an ADVISORY (non-required) check. It reflects only whether
|
|
# the build job compiled successfully, regardless of whether tests ran — a full
|
|
# build implies compilation succeeded. It gives *-reviewed-for-compile runs a
|
|
# distinct green/red on the PR without touching the required build-gate check.
|
|
compile-gate:
|
|
permissions: {}
|
|
needs: [changes, build]
|
|
if: always()
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- run: |
|
|
if [[ "${{ needs.build.result }}" == "success" ]]; then
|
|
echo "Compilation succeeded."
|
|
elif [[ "${{ needs.build.result }}" == "skipped" && "${{ needs.changes.outputs.should_run }}" == "false" ]]; then
|
|
echo "No relevant changes — nothing to compile."
|
|
else
|
|
echo "Compilation failed or was cancelled."
|
|
exit 1
|
|
fi
|
|
|