-
-
Notifications
You must be signed in to change notification settings - Fork 0
151 lines (133 loc) · 4.13 KB
/
dev-commit-stage.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
name: Commit Stage 🤖
on:
push:
branches: [ feature/*, develop ]
pull_request:
branches: [ main, develop ]
env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
VERSION: ${{ github.sha }}
CI: CI
NATIVE_IMAGE_ENABLED: enabled
CI_GITHUB_TOKEN: ${{ secrets.CI_GITHUB_TOKEN }}
NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
permissions:
# required for all workflows
security-events: write
packages: write
contents: write
issues: write
pull-requests: write
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
validation:
name: Validation 👀
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Check Project Integrity
uses: ./.github/actions/analysis/check
build:
name: Build and Test 🧪
needs: [ validation ]
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
steps:
- name: 🔍 CI_GITHUB_TOKEN
if: env.CI_GITHUB_TOKEN == ''
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: echo "CI_GITHUB_TOKEN=${GITHUB_TOKEN}" >> $GITHUB_ENV
- name: Checkout source code
uses: actions/checkout@v4
- name: Install Java Tools & Dependencies
uses: ./.github/actions/install/java
with:
java-version: 21
gradle-encription-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
gradle-arguments: build --scan --no-daemon --stacktrace
github_token: ${{ env.CI_GITHUB_TOKEN }}
- name: Source code vulnerability scanning
uses: aquasecurity/[email protected]
with:
scan-type: 'fs'
ignore-unfixed: true
format: 'sarif'
output: 'trivy-results.sarif'
severity: 'CRITICAL'
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: 'trivy-results.sarif'
category: source-code
code-coverage:
name: Code Coverage 📊
needs: [ build ]
runs-on: ubuntu-latest
steps:
- name: Checkout source code
uses: actions/checkout@v4
with:
token: ${{ env.CI_GITHUB_TOKEN }}
- name: Install Java Tools & Dependencies
uses: ./.github/actions/install/java
with:
java-version: 21
gradle-encription-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
- name: Install Tools & Dependencies
uses: ./.github/actions/install/node
- name: Run Code Coverage
run: |
./gradlew koverXmlReport --no-daemon --stacktrace
- name: Upload coverage reports
uses: codecov/codecov-action@v4
with:
token: ${{ secrets.CODECOV_TOKEN }}
files: build/reports/kover/report.xml
fail_ci_if_error: true # optional (default = false)
verbose: true # optional (default = false)
static-analysis-security:
name: 🔮 Static analysis and 🔒Security Checks
needs: [ validation ]
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
steps:
- name: 🔄 Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Static Analysis Security
uses: ./.github/actions/analysis/security
with:
gradle-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
package:
name: Package and Publish 📦
needs: [ build ]
runs-on: ubuntu-latest
permissions: write-all
steps:
- name: Checkout source code
uses: actions/checkout@v4
- name: Package docker image
uses: ./.github/actions/docker
with:
deliver: false
registry: ${{ env.REGISTRY }}
image_name: ${{ env.IMAGE_NAME }}
version: ${{ github.sha }}
ci_github_token: ${{ env.CI_GITHUB_TOKEN }}
docker_username: ${{ secrets.DOCKER_USERNAME }}
docker_password: ${{ secrets.DOCKER_PASSWORD }}
gradle-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}