inteligr8/alfresco-transform-core
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-transform-core.git synced 2026-09-16 18:12:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

ACS-12080: Migrate ATS release to verified commits and GitHub App tokens (maven-release-slim) (#1321)

Browse Source 
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: gionn <71768+gionn@users.noreply.github.com>
This commit is contained in:
Dhaval Patel
2026-08-06 11:30:48 +05:30
committed by GitHub
co-authored by copilot-swe-agent[bot] gionn
parent 7e4eb8a5cb
commit b23826a338
22 changed files with 332 additions and 379 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ci.yml
+113 -45
View File
@@ -22,17 +22,16 @@ on:
- cron: '0 5 * * 1'
workflow_dispatch:
# NOTE: Secrets are intentionally NOT declared at the workflow (top) level.
# A workflow-level `env` exposes secrets to every job/step (including third-party
# actions). Secrets are scoped to the individual steps that need them instead.
env:
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
GIT_USERNAME: ${{ secrets.BOT_GITHUB_USERNAME }}
GIT_EMAIL: ${{ secrets.BOT_GITHUB_EMAIL }}
GIT_PASSWORD: ${{ secrets.BOT_GITHUB_TOKEN }}
GITHUB_ACTIONS_DEPLOY_TIMEOUT: 120
# Both variables are required to be set before the release process starts.
# As the release is triggered by a commit message with "[release]" keyword on a release branch,
# setting these variables to new values can be done in the same commit and will indicate the release and the dev versions in it.
RELEASE_VERSION: "5.4.5-A.3" # The version of the release (tag).
DEVELOPMENT_VERSION: "5.4.5-A.4-SNAPSHOT" # The version that will be set in pom files after the release (next dev version)
permissions:
contents: read
@@ -41,7 +40,7 @@ jobs:
pre_commit:
runs-on: ubuntu-latest
steps:
- uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v9.3.1
- uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v18.21.2
test_run_check:
name: "Test run check"
@@ -66,10 +65,17 @@ jobs:
- test_run_check
if: needs.test_run_check.outputs.tests == 'true' && github.event_name == 'pull_request'
steps:
- uses: actions/checkout@v4
- uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v9.3.1
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v9.3.1
- uses: Alfresco/ya-pmd-scan@v4.1.0
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.21.2
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
- uses: Alfresco/ya-pmd-scan@e817ecd9292844800451c42f07cdebdb14268cfa # v4.1.0
env:
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
with:
classpath-build-command: "mvn -ntp package -DskipTests"
@@ -81,16 +87,16 @@ jobs:
- test_run_check
if: needs.test_run_check.outputs.tests == 'true'
steps:
- uses: actions/checkout@v4
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v9.3.1
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v9.3.1
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.2
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
- name: "Login to Docker Hub"
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: "Login to Quay.io"
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
registry: quay.io
username: ${{ secrets.QUAY_USERNAME }}
@@ -100,14 +106,28 @@ jobs:
echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
sudo service docker restart
- name: "Clean-up SNAPSHOT artifacts"
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" | xargs -r -l rm -rf
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
- name: "Build"
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
env:
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
run: mvn -B -U -q clean install -DadditionalOption=-Xdoclint:none -DskipTests -Dmaven.javadoc.skip=true -Dmaven.wagon.http.pool=false -Pbase
- name: "Cache LibreOffice"
run: bash _ci/cache_artifacts.sh
- name: "Run tests"
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
env:
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
run: mvn -B -U clean deploy -DadditionalOption=-Xdoclint:none -Dmaven.javadoc.skip=true -Dmaven.wagon.http.pool=false -Pbase
all_tests_matrix:
@@ -140,16 +160,16 @@ jobs:
buildProfile: full-build
testProfile: aio-test
steps:
- uses: actions/checkout@v4
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v9.3.1
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v9.3.1
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.2
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
- name: "Login to Docker Hub"
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: "Login to Quay.io"
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
registry: quay.io
username: ${{ secrets.QUAY_USERNAME }}
@@ -159,14 +179,28 @@ jobs:
echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
sudo service docker restart
- name: "Clean-up SNAPSHOT artifacts"
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" | xargs -r -l rm -rf
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
- name: "Build local docker image"
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
env:
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
run: bash _ci/build.sh ${{ matrix.buildProfile }}
- name: "Cache LibreOffice"
run: bash _ci/cache_artifacts.sh
- name: "Run tests"
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
env:
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
run: bash _ci/test.sh ${{ matrix.testProfile }}
e2e_javaruntime_tests:
@@ -181,16 +215,16 @@ jobs:
matrix:
java: [ '21', '25' ]
steps:
- uses: actions/checkout@v4
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v9.3.1
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v9.3.1
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.2
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
- name: "Login to Docker Hub"
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: "Login to Quay.io"
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
registry: quay.io
username: ${{ secrets.QUAY_USERNAME }}
@@ -200,9 +234,16 @@ jobs:
echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
sudo service docker restart
- name: "Clean-up SNAPSHOT artifacts"
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" | xargs -r -l rm -rf
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
- name: "Build local docker image"
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
env:
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
run: bash _ci/build.sh full-build
- name: "Cache LibreOffice"
run: bash _ci/cache_artifacts.sh
@@ -212,6 +253,12 @@ jobs:
SMOKE_TESTS: true
SKIP_DEPLOY: true
JAVA_RUNTIME_VERSION: ${{ matrix.java }}
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
run: bash _ci/test.sh aio-test
release:
@@ -224,23 +271,32 @@ jobs:
github.event_name != 'pull_request' &&
(github.ref_name == 'master' || startsWith(github.ref_name, 'SP/') || startsWith(github.ref_name, 'HF/'))
steps:
- uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v9.3.1
- uses: actions/checkout@v4
- name: Generate app token
id: app-token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
persist-credentials: false
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v9.3.1
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v9.3.1
client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }}
private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }}
permission-contents: write
- uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.21.2
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
token: ${{ steps.app-token.outputs.token }}
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.2
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
with:
platforms: linux/amd64,linux/arm64
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
- name: "Login to Docker Hub"
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: "Login to Quay.io"
uses: docker/login-action@v3
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
registry: quay.io
username: ${{ secrets.QUAY_USERNAME }}
@@ -250,14 +306,26 @@ jobs:
echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
sudo service docker restart
- name: "Clean-up SNAPSHOT artifacts"
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" | xargs -r -l rm -rf
- uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@v9.3.1
run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
- uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@v18.21.2
with:
username: ${{ env.GIT_USERNAME }}
email: ${{ env.GIT_EMAIL }}
username: ${{ secrets.BOT_GITHUB_USERNAME }}
email: ${{ secrets.BOT_GITHUB_EMAIL }}
global: true
- name: "Cache LibreOffice"
run: bash _ci/cache_artifacts.sh
- name: "Release"
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
run: bash _ci/release.sh
uses: Alfresco/alfresco-build-tools/.github/actions/maven-release-slim@v18.21.2
env:
NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
with:
token: ${{ steps.app-token.outputs.token }}
release-version: ${{ env.RELEASE_VERSION }}
development-version: ${{ env.DEVELOPMENT_VERSION }}
maven-args: "-DskipTests -Dmaven.javadoc.skip=true -DadditionalOption=-Xdoclint:none -Dmaven.wagon.http.pool=false"
.github/workflows/precommit_formatter.yml
+2 -18
View File
@@ -16,22 +16,6 @@ jobs:
contents: write
if: contains(github.event.head_commit.message, '[reformat code]')
steps:
- uses: actions/checkout@v4
- name: Set up Python ${{ inputs.python-version }}
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
- uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v18.21.2
with:
python-version: "3.9"
- uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
continue-on-error: true
with:
extra_args: --all-files
- name: Update secrets baseline
run: pip install detect-secrets && detect-secrets scan --baseline .secrets.baseline
- uses: Alfresco/alfresco-build-tools/.github/actions/git-commit-changes@v8.26.0
with:
username: ${{ secrets.BOT_GITHUB_USERNAME }}
add-options: -u
commit-message: "Apply Pre-Commit code formatting"
skip-if-no-changes: true
- name: Push changes
run: git push
auto-commit: "true"