136 lines
4.8 KiB
YAML
136 lines
4.8 KiB
YAML
# Copyright 2026 Kingsrook, LLC
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
name: Build and prerelease
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [main]
|
|
tags: ['v*']
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
verify:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
defaults:
|
|
run:
|
|
working-directory: qbit-printing
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
path: qbit-printing
|
|
persist-credentials: false
|
|
- name: Check out reviewed protocol fixtures
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
repository: QRun-IO/qqq-print-protocol
|
|
ref: a26c18c90c7d6102bbe26eb50cbb90fcd1bd46e3
|
|
path: qqq-print-protocol
|
|
persist-credentials: false
|
|
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
|
|
with:
|
|
distribution: temurin
|
|
java-version: '21'
|
|
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
|
|
with:
|
|
node-version: '24'
|
|
package-manager-cache: false
|
|
- name: Restore locked Pyright
|
|
run: npm ci --ignore-scripts --no-audit --no-fund
|
|
- name: Set up uv
|
|
uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
|
|
with:
|
|
version: '0.13.6'
|
|
enable-cache: false
|
|
- name: Restore locked Python tools
|
|
run: uv sync --locked
|
|
- name: Verify script quality gates and rejection paths
|
|
run: |
|
|
uv run --locked --no-sync python .github/scripts/test-script-quality.py
|
|
uv run --locked --no-sync python .github/scripts/check-script-quality.py
|
|
- name: Verify owned source notices and rejection paths
|
|
run: |
|
|
python3 .github/scripts/test-source-headers.py
|
|
python3 .github/scripts/check-source-headers.py
|
|
- name: Checkstyle, unit tests and HTTP contract tests
|
|
run: bash ./mvnw --batch-mode --no-transfer-progress -Pui-demo verify
|
|
- name: Prepare JAR, POM and checksums
|
|
shell: bash
|
|
run: |
|
|
version=$(python3 -c 'import xml.etree.ElementTree as E; print(E.parse("pom.xml").getroot().find("{http://maven.apache.org/POM/4.0.0}version").text)')
|
|
if [[ "$GITHUB_REF_TYPE" == tag && "$GITHUB_REF_NAME" != "v$version" ]]; then
|
|
echo 'Tag does not match pom.xml version.' >&2
|
|
exit 1
|
|
fi
|
|
mkdir -p dist
|
|
cp "target/qbit-printing-$version.jar" dist/
|
|
cp pom.xml "dist/qbit-printing-$version.pom"
|
|
(cd dist && sha256sum ./*.jar ./*.pom > SHA256SUMS)
|
|
- uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
|
|
with:
|
|
name: qbit-printing-package
|
|
path: qbit-printing/dist/*
|
|
if-no-files-found: error
|
|
- name: Retain test evidence
|
|
if: always()
|
|
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
|
|
with:
|
|
name: test-evidence
|
|
path: |
|
|
qbit-printing/target/surefire-reports/
|
|
qbit-printing/target/checkstyle-result.xml
|
|
if-no-files-found: ignore
|
|
|
|
release-security:
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
uses: ./.github/workflows/security.yml
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
|
|
release-codeql:
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
uses: ./.github/workflows/codeql.yml
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
|
|
release:
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
needs: [verify, release-security, release-codeql]
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: write
|
|
id-token: write
|
|
attestations: write
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
- uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
|
|
with:
|
|
name: qbit-printing-package
|
|
path: dist
|
|
- name: Verify packaged checksums
|
|
working-directory: dist
|
|
run: sha256sum --check --strict SHA256SUMS
|
|
- name: Attest verified release artifacts
|
|
uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
|
|
with:
|
|
subject-path: dist/*
|
|
- name: Publish tested GitHub release artifacts
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
shell: bash
|
|
run: |
|
|
prerelease=()
|
|
if [[ "$GITHUB_REF_NAME" == *-* ]]; then prerelease+=(--prerelease); fi
|
|
gh release create "$GITHUB_REF_NAME" dist/*.jar dist/*.pom dist/SHA256SUMS \
|
|
--verify-tag --title "$GITHUB_REF_NAME" --notes-file CHANGELOG.md "${prerelease[@]}"
|