generated from finos/software-project-blueprint
-
Notifications
You must be signed in to change notification settings - Fork 29
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into update/zio-test-magnolia-2.1.7
- Loading branch information
Showing
3 changed files
with
129 additions
and
8 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,121 @@ | ||
| name: Scan External Contributions | ||
|
|
||
| env: | ||
| JDK_JAVA_OPTIONS: -XX:+PrintCommandLineFlags -Xss10M # JDK_JAVA_OPTIONS is _the_ env. variable to use for modern Java | ||
| JVM_OPTS: -XX:+PrintCommandLineFlags -Xss10M # for Java 8 only (sadly, it is not modern enough for JDK_JAVA_OPTIONS) | ||
| SonatypeUrl: "https://finos.sonatype.app/platform/" | ||
| SonatypeAppId: morphir-scala | ||
| SonatypeStage: "build" | ||
| SonatypeScanTarget: "." # depCache/coursier/v1/https/repo1.maven.org/maven2/ | ||
| ExcludeDirectory: " -D fileExcludes='*.class, **/website/, **/docs/, **/.*' " | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| # pull_request_target: | ||
| # branches: ["main", "release/**", "0.4.x"] | ||
|
|
||
|
|
||
| # cancel older runs of a pull request; | ||
| # this will not cancel anything for normal git pushes | ||
| concurrency: | ||
| group: cancel-old-pr-runs-${{ github.workflow }}-${{ github.head_ref || github.run_id }} | ||
| cancel-in-progress: true | ||
|
|
||
| jobs: | ||
| lint-and-prepare-artifacts: | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 30 | ||
| steps: | ||
| - name: Checkout source branch | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.sha }} | ||
| fetch-depth: 0 | ||
| - name: Setup Scala and Java | ||
| uses: actions/setup-java@v4 | ||
| with: | ||
| distribution: "temurin" | ||
| java-version: "17" | ||
| - name: Cache scala dependencies | ||
| uses: coursier/cache-action@v6 | ||
| - name: Setup proto and moon toolchains | ||
| uses: moonrepo/[email protected] | ||
| with: | ||
| auto-install: true | ||
|
|
||
| - name: Install tooling | ||
| run: | | ||
| ./build.sh install | ||
| - name: Lint code | ||
| run: ./build.sh lint | ||
| - name: Prepare Publish Artifacts | ||
| run: ./mill -i morphir.__.jvm.__.publishArtifacts + morphir.main.__.publishArtifacts | ||
|
|
||
| - name: Cache JVM build output | ||
| # when in master repo: all commits to main branch and all additional tags | ||
| uses: actions/cache/save@v4 | ||
| with: | ||
| path: | | ||
| out/morphir/**/jvm/ | ||
| out/morphir/build/ | ||
| key: ${{ runner.os }}-mill-jvm-${{ github.sha }}-${{ hashFiles('out') }} | ||
|
|
||
| ############### SONATYPE SCAN ############### | ||
| sonatype-scan: | ||
| needs: ["lint-and-prepare-artifacts"] | ||
| runs-on: ubuntu-latest | ||
| environment: "Scanning and Checks" | ||
| steps: | ||
| - name: Cache scala dependencies | ||
| uses: coursier/cache-action@v6 | ||
|
|
||
| - name: Get OUT cache | ||
| uses: actions/cache/restore@v4 | ||
| with: | ||
| path: out/ | ||
| key: ${{ runner.os }}-* | ||
|
|
||
| - name: Copy Cache for SCA Scan | ||
| run: | | ||
| mkdir depCache/ #Create local copy of cache for Sonatype Scanner | ||
| cp -r /home/runner/.cache/coursier/ depCache/ | ||
| # - name: Save resolvedIvyDeps.json | ||
| # run: ./mill show __.resolvedIvyDeps > depCache/resolvedIvyDeps.json | ||
|
|
||
| # - name: Upload Dependency Cache (optional) | ||
| # uses: actions/upload-artifact@v4 | ||
| # with: | ||
| # name: Dependency Cache | ||
| # path: depCache/ | ||
|
|
||
| - name: Sonatype Lifecycle SCA Scan | ||
| uses: sonatype-nexus-community/iq-github-action@main | ||
| with: | ||
| username: ${{ secrets.SONATYPE_USER }} | ||
| password: ${{ secrets.SONATYPE_PASSWORD }} | ||
| serverUrl: ${{ env.SonatypeUrl }} | ||
| applicationId: ${{ env.SonatypeAppId }} | ||
| stage: ${{ env.SonatypeStage }} | ||
| target: ${{ env.SonatypeScanTarget }} ${{ env.ExcludeDirectory }} | ||
|
|
||
| - name: Retrieve Sonatype SBOM (SPDX) | ||
| if: always() | ||
| run: | | ||
| mkdir reports/ | ||
| iqCredentials="${{ secrets.SONATYPE_USER }}:${{ secrets.SONATYPE_PASSWORD }}" | ||
| echo 'Get internal app ID for public ID: '$SonatypeAppId | ||
| res=$(curl -u $iqCredentials --location $SonatypeUrl'api/v2/applications?publicId='$SonatypeAppId) | ||
| IFS='"' read -a array <<< "$res" | ||
| echo 'Internal app ID: '${array[5]} | ||
| internalID=${array[5]} | ||
| curl -u $iqCredentials --location $SonatypeUrl'api/v2/spdx/'$internalID'/stages/'$SonatypeStage -H 'Accept: application/xml' > reports/$SonatypeAppId.spdx.json | ||
| echo 'Sonatype SBOM (SPDX): ' | ||
| cat reports/$SonatypeAppId.spdx.json | ||
| - name: Upload Sonatype SBOM (SPDX) | ||
| if: always() | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: ${{ env.SonatypeAppId }} Sonatype SBOM (SPDX) | ||
| path: reports/ | ||
| ############################################# |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters