teaql-java/.github/workflows/ci.yml at main · teaql/teaql-java · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
name: CI

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]

jobs:
  build:
    name: Build and Test
    runs-on: ubuntu-latest
    timeout-minutes: 150
    permissions:
      contents: read
      actions: read
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'
          cache: maven
      - name: Build with Maven
        run: mvn -B install
      - name: Verify managed Jackson runtime versions
        run: bash scripts/verify-jackson-runtime-dependencies.sh
      - name: Validate error catalog
        run: |
          python3 -m unittest discover -v
          python3 tools/error_catalog.py validate errors/catalog.yml
      - name: SpotBugs Check
        # Generated examples are verified by the dedicated Example Gate. They
        # intentionally do not inherit the runtime's SpotBugs build plugin.
        run: mvn spotbugs:check -pl '!examples/conformance/lib,!examples/conformance'
      - name: Verify trusted snapshot selection policy
        run: node --test .github/scripts/select-odc-snapshot.test.cjs
      - name: Verify snapshot freshness policy
        run: bash .github/scripts/verify-odc-snapshot.test.sh
      - name: Select trusted NVD snapshot
        id: odc-snapshot
        uses: actions/github-script@v7
        with:
          script: |
            const select = require('./.github/scripts/select-odc-snapshot.cjs');
            await select({ github, context, core });
      - name: Download trusted NVD snapshot
        uses: actions/download-artifact@v4
        with:
          name: teaql-odc-v13.0.0-${{ runner.os }}
          path: ${{ runner.temp }}/teaql-odc-data
          github-token: ${{ github.token }}
          repository: ${{ github.repository }}
          run-id: ${{ steps.odc-snapshot.outputs.run_id }}
      - name: Verify NVD snapshot freshness
        run: bash .github/scripts/verify-odc-snapshot.sh "${{ runner.temp }}/teaql-odc-data"
      - name: OWASP Dependency Check
        run: >-
          mvn -B org.owasp:dependency-check-maven:13.0.0:check
          -DdataDirectory=${{ runner.temp }}/teaql-odc-data
          -DautoUpdate=false
          -DfailOnError=true
          -DfailBuildOnCVSS=7
          -Dformats=HTML,JSON
      - name: OWASP Dependency Check standalone generated examples
        run: |
          mvn -B -f examples/school-management/lib/pom.xml install -DskipTests
          for pom in \
            examples/school-management/lib/pom.xml \
            examples/school-management/pom.xml \
            examples/order-management/java-lib-core/lib/pom.xml; do
            mvn -B -f "$pom" org.owasp:dependency-check-maven:13.0.0:check \
              -DdataDirectory=${{ runner.temp }}/teaql-odc-data \
              -DautoUpdate=false -DfailOnError=true \
              -DfailBuildOnCVSS=7 -Dformats=HTML,JSON
          done
      - name: Retain Dependency Check reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: dependency-check-reports
          path: |
            **/target/dependency-check-report.html
            **/target/dependency-check-report.json
          if-no-files-found: warn
          retention-days: 30