Repository navigation
security hardening #778
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [ main, master ] | |
| pull_request: | |
| branches: [ main, master ] | |
| jobs: | |
| build: | |
| # we want to run ubuntu-latest but we'll pin to a specific version so workflow is reproducable | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - name: Set up JDK 17 | |
| uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0 | |
| with: | |
| java-version: 17 | |
| distribution: 'temurin' | |
| - name: Grant execute permission for gradlew | |
| run: chmod +x gradlew | |
| - name: Run all checks and tests | |
| run: ./gradlew compileTestJava publishToMavenLocal check | |
| - name: Upload test results | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| if: always() | |
| with: | |
| name: test-results | |
| path: build/test-results/test/ | |
| dependency-check: | |
| name: Dependency advisories (nonblocking) | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-24.04 | |
| # An unavailable advisory scan must not fail the main CI workflow either. | |
| continue-on-error: true | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up JDK 17 | |
| uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0 | |
| with: | |
| java-version: 17 | |
| distribution: 'temurin' | |
| - name: Check shipped dependencies | |
| id: dependencies | |
| # New advisories can affect unchanged dependencies, so findings are advisory. | |
| continue-on-error: true | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: ./gradlew checkDependencies --console=plain | |
| - name: Report dependency scan outcome | |
| if: always() | |
| env: | |
| SCAN_OUTCOME: ${{ steps.dependencies.outcome }} | |
| run: | | |
| echo '## Dependency advisories (nonblocking)' >> "$GITHUB_STEP_SUMMARY" | |
| if [ "$SCAN_OUTCOME" = 'success' ]; then | |
| echo 'No matching GitHub-reviewed advisories were found in shipped dependencies.' >> "$GITHUB_STEP_SUMMARY" | |
| else | |
| echo '::warning::Dependency scan found advisories or could not complete. Review the Check shipped dependencies step logs. This check does not block merging.' | |
| echo 'The scan found advisories or could not complete. Review the **Check shipped dependencies** step logs; this is not a clean scan.' >> "$GITHUB_STEP_SUMMARY" | |
| fi | |
| echo 'This is an advisory check of the full shipped dependency graph, not just dependencies changed by this PR. It does not block merging.' >> "$GITHUB_STEP_SUMMARY" |