Skip to content

Commit c2954d7

Browse files
patbaumgartnerpatbaumgartner
committed
Initial commit
0 parents  commit c2954d7

72 files changed

Lines changed: 7220 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/dependabot.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "maven"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"
7+
open-pull-requests-limit: 10
8+
9+
- package-ecosystem: "github-actions"
10+
directory: "/"
11+
schedule:
12+
interval: "weekly"
13+
open-pull-requests-limit: 10

‎.github/workflows/ci.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: CI
2+
3+
# Runs on every push to any branch and on all pull requests.
4+
# Builds and verifies the starter only; the sample application requires
5+
# external Embabel snapshot artifacts and an OpenAI API key, so it is
6+
# excluded from automated CI.
7+
8+
on:
9+
pull_request:
10+
push:
11+
branches: ['**']
12+
13+
concurrency:
14+
group: ${{ github.workflow }}-${{ github.ref }}
15+
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
16+
17+
permissions:
18+
contents: read
19+
20+
jobs:
21+
build:
22+
name: Build & Test (Java 21)
23+
runs-on: ubuntu-latest
24+
steps:
25+
- uses: actions/checkout@v4
26+
27+
- name: Set up JDK 21
28+
uses: actions/setup-java@v4
29+
with:
30+
distribution: temurin
31+
java-version: '21'
32+
cache: maven
33+
34+
- name: Install parent POM
35+
run: mvn -N install -q
36+
37+
- name: Build and verify starter
38+
run: mvn -B verify -pl embabel-workflow-visualizer-starter

‎.github/workflows/codeql.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
name: CodeQL
2+
3+
# Static security analysis via GitHub CodeQL.
4+
# Runs on push/PR to main and weekly to catch newly-published CVEs.
5+
# Only the starter module is analysed; the sample application is excluded
6+
# because it requires external Embabel snapshot artifacts.
7+
8+
on:
9+
push:
10+
branches: [main]
11+
pull_request:
12+
branches: [main]
13+
schedule:
14+
- cron: '0 9 * * 1'
15+
16+
permissions:
17+
contents: read
18+
security-events: write
19+
actions: read
20+
21+
jobs:
22+
analyze:
23+
name: Analyze Java (CodeQL)
24+
runs-on: ubuntu-latest
25+
steps:
26+
- uses: actions/checkout@v4
27+
28+
- name: Set up JDK 21
29+
uses: actions/setup-java@v4
30+
with:
31+
distribution: temurin
32+
java-version: '21'
33+
cache: maven
34+
35+
- name: Initialize CodeQL
36+
uses: github/codeql-action/init@v3
37+
with:
38+
languages: java
39+
queries: security-extended
40+
41+
- name: Install parent POM
42+
run: mvn -N install -q
43+
44+
- name: Build starter for CodeQL
45+
run: mvn -B -DskipTests compile -pl embabel-workflow-visualizer-starter
46+
47+
- name: Perform CodeQL analysis
48+
uses: github/codeql-action/analyze@v3
49+
with:
50+
category: /language:java

‎.github/workflows/dependency-review.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: Dependency Review
2+
3+
# Scans new dependencies introduced in pull requests for known vulnerabilities
4+
# and license issues. Fails the PR if HIGH or CRITICAL severity findings are present.
5+
# Requires GitHub Advanced Security (free for public repositories).
6+
7+
on:
8+
pull_request:
9+
10+
permissions:
11+
contents: read
12+
pull-requests: write # allow posting review comments on the PR
13+
14+
jobs:
15+
dependency-review:
16+
name: Dependency Review
17+
runs-on: ubuntu-latest
18+
steps:
19+
- uses: actions/checkout@v4
20+
21+
- name: Dependency Review
22+
uses: actions/dependency-review-action@v4
23+
with:
24+
fail-on-severity: high
25+
comment-summary-in-pr: always

‎.github/workflows/release.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: Release
2+
3+
# Triggered by pushing a semver tag: v1.2.3
4+
#
5+
# Steps:
6+
# 1. Validate the tag matches the POM version (prevents accidental mismatches).
7+
# 2. Deploy the starter jar, sources jar, and javadoc jar to GitHub Packages.
8+
# 3. Create a GitHub Release with auto-generated notes and the jars attached.
9+
#
10+
# Release workflow for maintainers:
11+
# mvn versions:set -DnewVersion=1.0.0 -DgenerateBackupPoms=false
12+
# git commit -am "Release 1.0.0" && git tag v1.0.0 && git push --tags
13+
# mvn versions:set -DnewVersion=1.1.0-SNAPSHOT -DgenerateBackupPoms=false
14+
# git commit -am "Prepare 1.1.0-SNAPSHOT" && git push
15+
16+
on:
17+
push:
18+
tags:
19+
- 'v[0-9]+.[0-9]+.[0-9]+'
20+
21+
permissions:
22+
contents: write # create GitHub release and upload assets
23+
packages: write # publish to GitHub Packages
24+
25+
jobs:
26+
release:
27+
name: Release (Java 21)
28+
runs-on: ubuntu-latest
29+
steps:
30+
- uses: actions/checkout@v4
31+
32+
- name: Set up JDK 21
33+
uses: actions/setup-java@v4
34+
with:
35+
distribution: temurin
36+
java-version: '21'
37+
cache: maven
38+
server-id: github
39+
server-username: GITHUB_ACTOR
40+
server-password: GITHUB_TOKEN
41+
42+
- name: Validate tag matches POM version
43+
run: |
44+
TAG_VERSION="${GITHUB_REF_NAME#v}"
45+
POM_VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
46+
if [ "$POM_VERSION" != "$TAG_VERSION" ]; then
47+
echo "::error::Tag $GITHUB_REF_NAME expects version $TAG_VERSION but POM has $POM_VERSION"
48+
exit 1
49+
fi
50+
echo "Releasing version $POM_VERSION"
51+
52+
- name: Deploy to GitHub Packages
53+
run: mvn -B -DskipTests deploy
54+
env:
55+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
56+
57+
- name: Create GitHub Release
58+
uses: softprops/action-gh-release@v2
59+
with:
60+
generate_release_notes: true
61+
files: |
62+
embabel-workflow-visualizer-starter/target/embabel-workflow-visualizer-starter-*.jar
63+
embabel-workflow-visualizer-starter/target/embabel-workflow-visualizer-starter-*-sources.jar
64+
embabel-workflow-visualizer-starter/target/embabel-workflow-visualizer-starter-*-javadoc.jar

‎.github/workflows/scorecards.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: Scorecards
2+
3+
# OSSF Scorecard assesses the security posture of the repository by checking
4+
# branch protection, dependency pinning, code review practices, and more.
5+
# Results are published to GitHub Security tab and the Scorecard badge.
6+
# Runs weekly and on every push to the default branch.
7+
8+
on:
9+
branch_protection_rule:
10+
schedule:
11+
- cron: '30 5 * * 1'
12+
push:
13+
branches: [main]
14+
15+
permissions: read-all
16+
17+
jobs:
18+
analysis:
19+
name: Scorecard Analysis
20+
runs-on: ubuntu-latest
21+
permissions:
22+
security-events: write
23+
id-token: write # required for scorecard token signing
24+
actions: read
25+
contents: read
26+
steps:
27+
- uses: actions/checkout@v4
28+
with:
29+
persist-credentials: false
30+
31+
- name: Run Scorecard analysis
32+
uses: ossf/scorecard-action@v2.4.0
33+
with:
34+
results_file: results.sarif
35+
results_format: sarif
36+
publish_results: true
37+
38+
- name: Upload results to GitHub Security tab
39+
uses: github/codeql-action/upload-sarif@v3
40+
with:
41+
sarif_file: results.sarif

‎.github/workflows/snapshot.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
name: Publish Snapshot
2+
3+
# Publishes a -SNAPSHOT build to GitHub Packages on every push to main.
4+
# Only the starter library is deployed; the sample application is skipped
5+
# via <maven.deploy.skip>true</maven.deploy.skip> in its POM.
6+
#
7+
# Consumers can resolve snapshots by adding to their build:
8+
# repository: https://maven.pkg.github.com/patbaumgartner/embabel-workflow-visualizer
9+
# (requires a GitHub PAT with read:packages scope)
10+
11+
on:
12+
push:
13+
branches: [main]
14+
15+
permissions:
16+
contents: read
17+
packages: write
18+
19+
jobs:
20+
publish:
21+
name: Deploy Snapshot (Java 21)
22+
runs-on: ubuntu-latest
23+
steps:
24+
- uses: actions/checkout@v4
25+
26+
- name: Set up JDK 21
27+
uses: actions/setup-java@v4
28+
with:
29+
distribution: temurin
30+
java-version: '21'
31+
cache: maven
32+
# Writes ~/.m2/settings.xml with <server id="github"> credentials
33+
# so that mvn deploy can authenticate with GitHub Packages.
34+
server-id: github
35+
server-username: GITHUB_ACTOR
36+
server-password: GITHUB_TOKEN
37+
38+
- name: Guard — only deploy snapshots
39+
run: |
40+
VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
41+
if [[ "$VERSION" != *-SNAPSHOT ]]; then
42+
echo "::notice::Skipping deploy — '$VERSION' is not a -SNAPSHOT version."
43+
exit 0
44+
fi
45+
echo "Deploying snapshot $VERSION"
46+
47+
- name: Deploy
48+
run: mvn -B -DskipTests deploy
49+
env:
50+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
/target/
2+
**/target/

0 commit comments

Comments
 (0)