Skip to content

Commit 7479a52

Browse files
sebthomsebthom
authored
ci: update workflows (add codeql, use MacOS 15 runner, re-enable Linux) (#1347)
1 parent 4b0c1ab commit 7479a52

4 files changed

Lines changed: 120 additions & 14 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
1+
# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference
22
version: 2
33
updates:
44
- package-ecosystem: github-actions

‎.github/workflows/build.yml‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
1+
# https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax
22
name: Build
33

4-
on:
4+
on: # https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
55
push:
66
branches-ignore: # build all branches except:
77
- 'dependabot/**' # prevent GHA triggered twice (once for commit to the branch and once for opening/syncing the PR)
@@ -10,6 +10,7 @@ on:
1010
paths-ignore:
1111
- '**/*.md'
1212
- '.github/*.yml'
13+
- '.github/workflows/codeql.yml'
1314
- '.github/workflows/licensecheck.yml'
1415
- '**/.project'
1516
- '**/.settings/*.prefs'
@@ -20,14 +21,15 @@ on:
2021
paths-ignore:
2122
- '**/*.md'
2223
- '.github/*.yml'
24+
- '.github/workflows/codeql.yml'
2325
- '.github/workflows/licensecheck.yml'
2426
- '**/.project'
2527
- '**/.settings/*.prefs'
2628
- '.gitignore'
2729
- '.actrc'
2830
- 'Jenkinsfile'
2931
workflow_dispatch:
30-
# https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/
32+
# https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#workflow_dispatch
3133
inputs:
3234
additional_maven_args:
3335
description: 'Additional Maven Args'
@@ -63,9 +65,9 @@ jobs:
6365
fail-fast: false
6466
matrix:
6567
os: # https://github.com/actions/runner-images#available-images
66-
#- ubuntu-latest # TODO builds are extremely slow for no apparent reason and job currently times out after 15 minutes
67-
- macos-13 # Intel
68-
- macos-14 # ARM
68+
- ubuntu-latest
69+
- macos-15-intel # Intel
70+
- macos-latest # ARM
6971
- windows-latest
7072
runs-on: ${{ matrix.os }}
7173
timeout-minutes: 20
@@ -84,7 +86,7 @@ jobs:
8486
- name: Git Checkout
8587
uses: actions/checkout@v5 # https://github.com/actions/checkout
8688
with:
87-
fetch-depth: 0 # required to prevent tycho-p2-extras-plugin:compare-version-with-baseline potentially failing the build
89+
fetch-depth: 0 # required to prevent tycho-p2-extras-plugin:compare-version-with-baseline potentially failing the build
8890

8991

9092
- name: Configure fast APT repository mirror
@@ -165,7 +167,7 @@ jobs:
165167
timeout_minutes: 10
166168
shell: bash
167169
command: |
168-
set -eu
170+
set -euo pipefail
169171
170172
MAVEN_OPTS="${MAVEN_OPTS:-}"
171173
if [[ "${{ runner.os }}" == "Windows" ]]; then
@@ -191,7 +193,7 @@ jobs:
191193
--update-snapshots \
192194
--batch-mode \
193195
--show-version \
194-
-Dtycho.disableP2Mirrors=true \
196+
-Declipse.p2.mirrors=false \
195197
-Dsurefire.rerunFailingTestsCount=3 \
196198
$maven_args \
197199
${{ github.event.inputs.additional_maven_args }} \

‎.github/workflows/codeql.yml‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax
2+
name: CodeQL
3+
4+
on: # https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
5+
push:
6+
branches: [ "main" ]
7+
paths-ignore:
8+
- '**/*.md'
9+
- '.github/*.yml'
10+
- '.github/workflows/build.yml'
11+
- '.github/workflows/licensecheck.yml'
12+
- '**/.project'
13+
- '**/.settings/*.prefs'
14+
- '.gitignore'
15+
- '.actrc'
16+
- 'Jenkinsfile'
17+
pull_request:
18+
branches: [ "main" ]
19+
paths-ignore:
20+
- '**/*.md'
21+
- '.github/*.yml'
22+
- '.github/workflows/build.yml'
23+
- '.github/workflows/licensecheck.yml'
24+
- '**/.project'
25+
- '**/.settings/*.prefs'
26+
- '.gitignore'
27+
- '.actrc'
28+
- 'Jenkinsfile'
29+
workflow_dispatch:
30+
# https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#workflow_dispatch
31+
32+
33+
jobs:
34+
35+
###########################################################
36+
analyze:
37+
###########################################################
38+
39+
strategy:
40+
fail-fast: false
41+
matrix:
42+
include:
43+
# build-mode: https://github.com/github/codeql-action#build-modes
44+
- language: java-kotlin
45+
build-mode: none
46+
- language: javascript-typescript
47+
build-mode: none
48+
- language: python
49+
build-mode: none
50+
51+
name: Analyze (${{ matrix.language }})
52+
runs-on: ubuntu-latest
53+
permissions:
54+
# required for all workflows
55+
security-events: write
56+
57+
# required to fetch internal or private CodeQL packs
58+
packages: read
59+
60+
# only required for workflows in private repositories
61+
actions: read
62+
contents: read
63+
64+
timeout-minutes: 15
65+
66+
steps:
67+
- name: "Show: GitHub context"
68+
env:
69+
GITHUB_CONTEXT: ${{ toJSON(github) }}
70+
run: echo $GITHUB_CONTEXT
71+
72+
73+
- name: "Show: environment variables"
74+
run: env | sort
75+
76+
77+
- name: Git Checkout
78+
uses: actions/checkout@v5 # https://github.com/actions/checkout
79+
80+
81+
# CodeQL executes https://github.com/ferstl/depgraph-maven-plugin
82+
- name: "Install: JDK 25 for Maven ☕"
83+
uses: actions/setup-java@v5 # https://github.com/actions/setup-java
84+
if: ${{ matrix.language }} == 'java'
85+
with:
86+
distribution: temurin
87+
java-version: 25
88+
89+
90+
# https://docs.github.com/en/code-security/code-scanning
91+
- name: Initialize CodeQL
92+
uses: github/codeql-action/init@v4 # https://github.com/github/codeql-action
93+
with:
94+
languages: ${{ matrix.language }}
95+
# https://github.com/github/codeql-action#build-modes
96+
build-mode: ${{ matrix.build-mode }}
97+
# https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#using-queries-in-ql-packs
98+
queries: +security-and-quality
99+
100+
101+
- name: Perform CodeQL Analysis
102+
uses: github/codeql-action/analyze@v4 # https://github.com/github/codeql-action
103+
with:
104+
category: "/language:${{matrix.language}}"

‎.github/workflows/licensecheck.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
1-
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
1+
# https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax
22
name: License check
33

4-
on:
4+
on: # https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
55
push:
66
branches-ignore: # build all branches except:
77
- 'dependabot/**' # prevent GHA triggered twice (once for commit to the branch and once for opening/syncing the PR)
88
tags-ignore: # don't build tags
99
- '**'
1010
pull_request:
1111
workflow_dispatch:
12-
# https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/
12+
# https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#workflow_dispatch
1313
inputs:
1414
dash-iplab-token:
1515
description: "Gitlab Personal Access Token (https://gitlab.eclipse.org/-/user_settings/personal_access_tokens) with 'api'' scope for Automatic IP Team Review Requests via org.eclipse.dash:license-tool-plugin, see https://github.com/eclipse/dash-licenses#automatic-ip-team-review-requests"
@@ -125,7 +125,7 @@ jobs:
125125
--update-snapshots \
126126
--batch-mode \
127127
--show-version \
128-
-Dtycho.disableP2Mirrors=true \
128+
-Declipse.p2.mirrors=false \
129129
$maven_args \
130130
org.eclipse.dash:license-tool-plugin:license-check \
131131
-Dtycho.target.eager=true \

0 commit comments

Comments
 (0)