Build Snapshot Worker #995
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Worker which is dispatched from build-snapshot-controller workflow. | |
| name: Build Snapshot Worker | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| build-zoo-handler: | |
| description: 'Build Zoo Handler Payload' | |
| required: true | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v2 | |
| - uses: actions/setup-java@v1 | |
| with: | |
| java-version: 1.8 | |
| - uses: jvalkeal/setup-maven@v1 | |
| with: | |
| maven-version: 3.6.3 | |
| - uses: jfrog/setup-jfrog-cli@v1 | |
| with: | |
| version: 1.46.4 | |
| env: | |
| JF_ARTIFACTORY_SPRING: ${{ secrets.JF_ARTIFACTORY_SPRING }} | |
| # cache maven .m2 | |
| - uses: actions/cache@v2 | |
| with: | |
| path: ~/.m2/repository | |
| key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-m2- | |
| # target deploy repos | |
| - name: Configure JFrog Cli | |
| run: | | |
| jfrog rt mvnc \ | |
| --server-id-resolve=repo.spring.io \ | |
| --server-id-deploy=repo.spring.io \ | |
| --repo-resolve-releases=libs-milestone \ | |
| --repo-resolve-snapshots=libs-snapshot \ | |
| --repo-deploy-releases=libs-release-local \ | |
| --repo-deploy-snapshots=libs-snapshot-local | |
| echo JFROG_CLI_BUILD_NAME=spring-cloud-dataflow-main >> $GITHUB_ENV | |
| echo JFROG_CLI_BUILD_NUMBER=$GITHUB_RUN_NUMBER >> $GITHUB_ENV | |
| # zoo extract and ensure | |
| - name: Extract Zoo Context Properties | |
| uses: jvalkeal/[email protected] | |
| with: | |
| dispatch-handler-extract-context-properties: true | |
| # build and publish to configured target | |
| - name: Build and Publish | |
| run: | | |
| jfrog rt mvn clean install \ | |
| -Pfull \ | |
| -U -B | |
| jfrog rt build-publish | |
| echo BUILD_ZOO_HANDLER_spring_cloud_dataflow_version=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout) >> $GITHUB_ENV | |
| echo BUILD_ZOO_HANDLER_spring_cloud_dataflow_buildname=spring-cloud-dataflow-main >> $GITHUB_ENV | |
| echo BUILD_ZOO_HANDLER_spring_cloud_dataflow_buildnumber=$GITHUB_RUN_NUMBER >> $GITHUB_ENV | |
| echo BUILD_ZOO_HANDLER_spring_cloud_skipper_version=$(mvn help:evaluate -Dexpression=spring-cloud-skipper.version -q -DforceStdout) >> $GITHUB_ENV | |
| echo BUILD_ZOO_HANDLER_spring_cloud_dataflow_version_nopostfix=$(echo '${parsedVersion.majorVersion}.${parsedVersion.minorVersion}.${parsedVersion.incrementalVersion}' | mvn build-helper:parse-version help:evaluate -q -DforceStdout) >> $GITHUB_ENV | |
| echo BUILD_ZOO_HANDLER_spring_cloud_dataflow_prerelease=$(echo '${parsedVersion.qualifier}' | mvn build-helper:parse-version help:evaluate -q -DforceStdout) >> $GITHUB_ENV | |
| # build and publish images via composite action | |
| - name: Build and Publish Images | |
| uses: ./.github/actions/build-images | |
| with: | |
| version: ${{ env.BUILD_ZOO_HANDLER_spring_cloud_dataflow_version }} | |
| dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| # zoo success | |
| - name: Notify Build Success Zoo Handler Controller | |
| uses: jvalkeal/[email protected] | |
| with: | |
| dispatch-handler-token: ${{ secrets.SCDF_ACCESS_TOKEN }} | |
| dispatch-handler-client-payload-data: > | |
| { | |
| "event": "build-succeed" | |
| } | |
| # zoo failure | |
| - name: Notify Build Failure Zoo Handler Controller | |
| if: ${{ failure() }} | |
| uses: jvalkeal/[email protected] | |
| with: | |
| dispatch-handler-token: ${{ secrets.SCDF_ACCESS_TOKEN }} | |
| dispatch-handler-client-payload-data: > | |
| { | |
| "event": "build-failed", | |
| "message": "spring-cloud-dataflow failed" | |
| } | |
| # clean m2 cache | |
| - name: Clean cache | |
| run: | | |
| find ~/.m2/repository -type d -name '*SNAPSHOT' | xargs rm -fr | |
| scan: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v2 | |
| - name: Run Trivy vulnerability scanner in repo mode | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| scan-type: 'fs' | |
| ignore-unfixed: true | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| severity: 'CRITICAL,HIGH' | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v2 | |
| with: | |
| sarif_file: 'trivy-results.sarif' | |
| - name: 'Scanned' | |
| shell: bash | |
| run: echo "::info ::Scanned" | |
| done: | |
| runs-on: ubuntu-latest | |
| needs: [ scan, build ] | |
| steps: | |
| - name: 'Done' | |
| shell: bash | |
| run: echo "::info ::Done" |