ci(deps): bump github/codeql-action/analyze from 4.37.8 to 4.37.9 #189
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # Every pull request runs the same full build as main: both modules, all tests, | |
| # the formatting check, and the coverage gate. A pull request that is verified | |
| # less strictly than the branch it targets is not verified. | |
| # | |
| # `push` is limited to main because a pull request from a branch in this | |
| # repository already triggers the `pull_request` build; running both would | |
| # verify every such branch twice over. | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| permissions: | |
| contents: read | |
| jobs: | |
| build: | |
| name: Build & Test (Java ${{ matrix.java }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # 21 is the baseline the artifact targets; 25 is the current LTS that | |
| # consumers actually run on. | |
| java: ['21', '25'] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| # Nothing here pushes, so the job has no use for a credential that | |
| # every plugin and test in the build would otherwise be able to read | |
| # out of .git/config. | |
| persist-credentials: false | |
| - name: Set up JDK ${{ matrix.java }} | |
| uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 | |
| with: | |
| distribution: temurin | |
| java-version: ${{ matrix.java }} | |
| cache: maven | |
| - name: Build and verify | |
| # The sample application needs an API key present to start its context; | |
| # no test calls a model, so a placeholder is enough. | |
| run: ./mvnw -B --no-transfer-progress verify | |
| env: | |
| OPENAI_API_KEY: dummy | |
| - name: Upload test and coverage reports | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: reports-java-${{ matrix.java }} | |
| path: | | |
| **/target/surefire-reports/** | |
| **/target/site/jacoco/** | |
| retention-days: 7 | |
| if-no-files-found: ignore | |
| # The POM pins project.build.outputTimestamp so that anyone can rebuild a tag | |
| # and compare the result against Maven Central. That promise is only worth | |
| # making if something checks it, so the starter is built twice here and the | |
| # published jars are compared byte for byte. One JDK only: reproducibility is | |
| # a claim about rebuilding the same source with the same toolchain, and javac | |
| # is not obliged to emit identical bytecode across major versions. | |
| reproducible: | |
| name: Reproducible build | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up JDK 21 | |
| uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 | |
| with: | |
| distribution: temurin | |
| java-version: '21' | |
| cache: maven | |
| - name: Build the published artifacts twice and compare | |
| run: | | |
| set -euo pipefail | |
| checksums() { | |
| find embabel-workflow-visualizer-starter/target -maxdepth 1 -name '*.jar' \ | |
| -exec sha256sum {} + | sort -k2 | |
| } | |
| build() { | |
| ./mvnw -B --no-transfer-progress -pl embabel-workflow-visualizer-starter \ | |
| -DskipTests -Djacoco.skip=true clean package | |
| } | |
| build && checksums > "${RUNNER_TEMP}/first.sha256" | |
| build && checksums > "${RUNNER_TEMP}/second.sha256" | |
| if ! diff -u "${RUNNER_TEMP}/first.sha256" "${RUNNER_TEMP}/second.sha256"; then | |
| echo "::error::The published jars are not byte-for-byte reproducible. Something in the build is capturing the wall clock, the file order, or the build path." | |
| exit 1 | |
| fi | |
| cat "${RUNNER_TEMP}/first.sha256" |