Skip to content

Commit bf271da

Browse files
spannmspannm
committed
ci: consolidate CI matrix, fix workflow_dispatch, add CodeQL and dependency report
- Merge the four per-JDK CI workflows into one matrix build (ubuntu-latest/windows-latest x JDK 11/17/21) for full OS/JDK parity - Align all CI jobs on `clean verify` so integration tests run consistently across JDK versions. - Remove the invalid `branches` filter under `workflow_dispatch` in the Sonar workflow (that key only applies to push/pull_request triggers). - Add 'concurrency' (cancel superseded runs) and least-privilege `permissions: contents: read` to all workflows. - Bump actions/checkout and actions/setup-java to their current major versions (v7/v6). - Add scheduled CodeQL analysis and a dependency/plugin update report, mirroring the setup already in use in the ucanaccess project.
1 parent bb97b2e commit bf271da

8 files changed

Lines changed: 134 additions & 113 deletions

File tree

.github/workflows/ci_jdk11_ubuntu.yml renamed to .github/workflows/ci.yml

Lines changed: 28 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Build with JDK 11 on Ubuntu
1+
name: Build & Deploy
22

33
on:
44
push:
@@ -7,26 +7,37 @@ on:
77
pull_request:
88
branches:
99
- master
10-
workflow_dispatch:
11-
branches:
12-
- master
10+
workflow_dispatch: {}
11+
12+
# cancel superseded runs on the same branch/PR to save CI minutes.
13+
concurrency:
14+
group: ${{ github.workflow }}-${{ github.ref }}
15+
cancel-in-progress: true
16+
17+
permissions:
18+
contents: read
1319

1420
jobs:
1521

1622
build:
17-
runs-on: ubuntu-latest
23+
strategy:
24+
fail-fast: false
25+
matrix:
26+
os: [ubuntu-latest, windows-latest]
27+
java: ['11', '17', '21']
28+
runs-on: ${{ matrix.os }}
1829
steps:
19-
- uses: actions/checkout@v4
30+
- uses: actions/checkout@v7
2031

21-
- name: Set up JDK 11
22-
uses: actions/setup-java@v3
32+
- name: Set up JDK ${{ matrix.java }}
33+
uses: actions/setup-java@v6
2334
with:
24-
java-version: '11'
25-
distribution: 'temurin'
35+
java-version: ${{ matrix.java }}
36+
distribution: temurin
2637
cache: maven
2738

28-
- name: Build with Maven/JDK 11
29-
run: mvn --batch-mode --file pom.xml clean package
39+
- name: Build with Maven/JDK ${{ matrix.java }} on ${{ matrix.os }}
40+
run: mvn --batch-mode --file pom.xml clean verify
3041

3142
deploy:
3243
needs: build
@@ -37,10 +48,10 @@ jobs:
3748
contents: read
3849
packages: write
3950
steps:
40-
- uses: actions/checkout@v4
51+
- uses: actions/checkout@v7
4152

4253
- name: Set up Java for deployment to Sonatype snapshot repo
43-
uses: actions/setup-java@v3
54+
uses: actions/setup-java@v6
4455
with:
4556
java-version: '11'
4657
distribution: 'temurin'
@@ -54,16 +65,15 @@ jobs:
5465
- name: Deploy to Sonatype Central snapshot repo
5566
run: mvn --batch-mode --file pom.xml --activate-profiles fast deploy
5667
env:
57-
SONATYPE_CENTRAL_USERNAME: ${{ secrets.SONATYPE_CENTRAL_USERNAME }}
58-
SONATYPE_CENTRAL_PASSWORD: ${{ secrets.SONATYPE_CENTRAL_PASSWORD }}
68+
SONATYPE_CENTRAL_USERNAME: ${{ secrets.SONATYPE_CENTRAL_USERNAME }}
69+
SONATYPE_CENTRAL_PASSWORD: ${{ secrets.SONATYPE_CENTRAL_PASSWORD }}
5970

6071
- name: Set up Java for deployment to GitHub Packages
61-
uses: actions/setup-java@v3
72+
uses: actions/setup-java@v6
6273
with:
6374
java-version: '11'
6475
distribution: 'temurin'
6576
- name: Deploy snapshot to Github packages
6677
run: mvn --batch-mode --file pom.xml --activate-profiles fast,github-deploy-snapshot-package deploy
6778
env:
6879
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
69-

‎.github/workflows/ci_jdk11_win.yml‎

Lines changed: 0 additions & 29 deletions
This file was deleted.

‎.github/workflows/ci_jdk17_ubuntu.yml‎

Lines changed: 0 additions & 29 deletions
This file was deleted.

‎.github/workflows/ci_jdk21_ubuntu.yml‎

Lines changed: 0 additions & 29 deletions
This file was deleted.

‎.github/workflows/codeql.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
name: CodeQL
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
pull_request:
8+
branches:
9+
- master
10+
schedule:
11+
- cron: '30 3 * * 1'
12+
workflow_dispatch: {}
13+
14+
concurrency:
15+
group: ${{ github.workflow }}-${{ github.ref }}
16+
cancel-in-progress: true
17+
18+
permissions:
19+
contents: read
20+
21+
jobs:
22+
23+
analyze:
24+
name: Analyze (java-kotlin)
25+
runs-on: ubuntu-latest
26+
permissions:
27+
actions: read
28+
contents: read
29+
security-events: write
30+
31+
steps:
32+
- uses: actions/checkout@v7
33+
34+
- name: Set up JDK 17
35+
uses: actions/setup-java@v6
36+
with:
37+
java-version: '17'
38+
distribution: 'temurin'
39+
cache: maven
40+
41+
- name: Initialize CodeQL
42+
uses: github/codeql-action/init@v4
43+
with:
44+
languages: java-kotlin
45+
build-mode: manual
46+
47+
# Skip checkstyle/tests here: this build only needs to produce compiled
48+
# classes for CodeQL to analyze, not to enforce project lint rules.
49+
- name: Build for CodeQL analysis
50+
run: >
51+
mvn --batch-mode --file pom.xml
52+
-Dcheckstyle.skip=true
53+
-Dmaven.test.skip=true
54+
clean compile
55+
56+
- name: Perform CodeQL Analysis
57+
uses: github/codeql-action/analyze@v4
58+
with:
59+
category: "/language:java-kotlin"

‎.github/workflows/dependency-report.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Dependency Report
2+
3+
on:
4+
schedule:
5+
- cron: '0 6 * * 1'
6+
workflow_dispatch: {}
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
13+
report:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- uses: actions/checkout@v7
17+
18+
- name: Set up JDK 17
19+
uses: actions/setup-java@v6
20+
with:
21+
java-version: '17'
22+
distribution: 'temurin'
23+
cache: maven
24+
25+
# Report-only: versions-maven-plugin never fails the build, it only prints
26+
# what's outdated. No pull requests, no issues - just a workflow summary.
27+
- name: Report outdated dependencies & plugins
28+
run: |
29+
{
30+
echo "## Outdated dependencies & plugins"
31+
echo
32+
echo '```text'
33+
mvn --batch-mode --file pom.xml versions:display-dependency-updates versions:display-plugin-updates
34+
echo '```'
35+
} >> "$GITHUB_STEP_SUMMARY"

‎.github/workflows/sonar_jdk17_ubuntu.yml‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,15 @@ on:
77
pull_request:
88
branches:
99
- master
10-
workflow_dispatch:
11-
branches:
12-
- master
10+
workflow_dispatch: {}
11+
12+
# cancel superseded runs on the same branch/PR to save CI minutes.
13+
concurrency:
14+
group: ${{ github.workflow }}-${{ github.ref }}
15+
cancel-in-progress: true
16+
17+
permissions:
18+
contents: read
1319

1420
jobs:
1521

@@ -18,13 +24,13 @@ jobs:
1824
# skip the analysis job for contributors/forks who lack the required sonar token
1925
if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
2026
steps:
21-
- uses: actions/checkout@v4
27+
- uses: actions/checkout@v7
2228
with:
2329
# disabling shallow clone is recommended for improving relevancy of reporting
2430
fetch-depth: 0
2531

2632
- name: Set up JDKs (17 for build, 21 for sonarcloud)
27-
uses: actions/setup-java@v4
33+
uses: actions/setup-java@v6
2834
with:
2935
java-version: |
3036
17
@@ -41,4 +47,3 @@ jobs:
4147
# bytecode remains java 17 compatible due to pom settings.
4248
export JAVA_HOME=$JAVA_HOME_21_X64
4349
mvn --batch-mode --file pom.xml --activate-profiles sonarcloud clean verify
44-

‎README.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,7 @@
33
<img src="https://img.shields.io/maven-central/last-update/io.github.spannm/jackcess?label=Updated&style=flat-square&color=blue" alt="Maven Central Last Update">
44
<a href="https://github.com/spannm/jackcess/stargazers"><img src="https://img.shields.io/github/stars/spannm/jackcess?logo=github&label=&logoColor=white&labelColor=555555&color=007ec6&style=flat-square" alt="GitHub Stars"></a>
55
<br>
6-
<a href="https://github.com/spannm/jackcess/actions/workflows/ci_jdk11_ubuntu.yml"><img src="https://img.shields.io/github/actions/workflow/status/spannm/jackcess/ci_jdk11_ubuntu.yml?label=Build%20(JDK%2011%20Linux)&style=flat-square" alt="GitHub Actions Workflow Status"></a>
7-
<a href="https://github.com/spannm/jackcess/actions/workflows/ci_jdk11_win.yml"><img src="https://img.shields.io/github/actions/workflow/status/spannm/jackcess/ci_jdk11_win.yml?label=Build%20(JDK%2011%20Win)&style=flat-square" alt="GitHub Actions Workflow Status"></a>
6+
<a href="https://github.com/spannm/jackcess/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/spannm/jackcess/ci.yml?label=Build%20(Linux%2FWin%2C%20JDK%2011%2F17%2F21)&style=flat-square" alt="GitHub Actions Workflow Status"></a>
87
<a href="https://javadoc.io/doc/io.github.spannm/jackcess"><img src="https://javadoc.io/badge2/io.github.spannm/jackcess/javadoc.svg?style=flat-square" alt="Javadoc"></a>
98
<a href="https://apidia.net/mvn/io.github.spannm/jackcess"><img src="https://apidia.net/mvn/io.github.spannm/jackcess/badge_flat_square.svg" alt="APIdia"></a>
109
</div>

0 commit comments

Comments
 (0)