From f9b87a0032a28c5633af3b6b34b782e730712a64 Mon Sep 17 00:00:00 2001 From: Antony Stubbs Date: Sat, 11 Apr 2026 03:58:16 +1200 Subject: [PATCH] build: Modernise CI workflows and unblock local Maven build Bring CI tooling and the build configuration up to date so the project builds cleanly on current JDK 17 patches and so workflow regressions are caught automatically. Workflows: - Add an actionlint job to ci.yml that gates the test job, so broken workflow YAML can never reach master again - Bump Java matrix from [17, 18] (18 is EOL) to [17, 21] (LTS) - Pin every action to a full commit SHA with a trailing version comment for supply chain safety; Dependabot keeps the SHA + comment in sync - Update all actions to current latest: checkout v6.0.2, cache v5.0.4, setup-java v5.2.0, cancel-workflow-action 0.13.1, release-drafter v7.2.0 (release-drafter v5 used Node 16 and could no longer run on GH runners) - Remove the broken publish_snapshot_github job from release.yml: it had a missing job dependency, a malformed shell command, and a YAML indentation error and could never have executed - Note in dependabot.yml that actions are SHA-pinned Build: - Bump Lombok 1.18.24 -> 1.18.34 to fix a JCImport.qualid NoSuchFieldError on JDK 17.0.7+ - Merge two duplicate maven-jar-plugin entries in pluginManagement: the second declaration silently dropped the 3.2.2 version pin and let Maven resolve to 3.4.1, which is stricter and rejected the redundant unclassified jar execution - Remove the redundant explicit jar goal binding (the default execution already binds it) Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/dependabot.yml | 2 ++ .github/workflows/ci.yml | 38 +++++++++++++++++---------- .github/workflows/release-drafter.yml | 2 +- .github/workflows/release.yml | 27 +++---------------- pom.xml | 30 +++++++-------------- 5 files changed, 39 insertions(+), 60 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b76b8957..1680201f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -8,3 +8,5 @@ updates: directory: "/" schedule: interval: "daily" + # Actions are pinned to SHAs for supply chain security; Dependabot + # updates the SHA and the trailing version comment together. diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e355ff9c..9b3bccf3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,29 +9,39 @@ on: - master jobs: + actionlint: + name: 'Lint workflows' + runs-on: ubuntu-latest + steps: + - name: 'Check out repository' + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: 'Run actionlint' + uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2.1.2 + test: name: "JDK ${{ matrix.java }}" + needs: actionlint strategy: matrix: - java: [ 17, 18 ] + java: [ 17, 21 ] runs-on: ubuntu-latest steps: # Cancel any previous runs for the same branch that are still running. - name: 'Cancel previous runs' - uses: styfle/cancel-workflow-action@0.10.0 + uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1 with: access_token: ${{ github.token }} - name: 'Check out repository' - uses: actions/checkout@v3 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: 'Cache local Maven repository' - uses: actions/cache@v3 + uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 with: path: ~/.m2/repository key: maven-${{ hashFiles('**/pom.xml') }} restore-keys: | maven-${{ hashFiles('**/pom.xml') }} - name: 'Set up JDK ${{ matrix.java }}' - uses: actions/setup-java@v3 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: java-version: ${{ matrix.java }} distribution: 'zulu' @@ -49,9 +59,9 @@ jobs: runs-on: ubuntu-latest steps: - name: 'Check out repository' - uses: actions/checkout@v3 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: 'Cache local Maven repository' - uses: actions/cache@v3 + uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 with: path: ~/.m2/repository key: maven-${{ hashFiles('**/pom.xml') }} @@ -59,7 +69,7 @@ jobs: maven- # setup maven settings.xml - name: 'Set up Maven settings.xml for Package Cloud' - uses: actions/setup-java@v3 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: java-version: 17 distribution: 'zulu' @@ -78,9 +88,9 @@ jobs: runs-on: ubuntu-latest steps: - name: 'Check out repository' - uses: actions/checkout@v3 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: 'Cache local Maven repository' - uses: actions/cache@v3 + uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 with: path: ~/.m2/repository key: maven-${{ hashFiles('**/pom.xml') }} @@ -88,7 +98,7 @@ jobs: maven- # setup maven settings.xml - name: 'Set up Maven settings.xml for GitHub' - uses: actions/setup-java@v3 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: java-version: 17 distribution: 'zulu' @@ -108,16 +118,16 @@ jobs: # runs-on: ubuntu-latest # steps: # - name: 'Check out repository' -# uses: actions/checkout@v3 +# uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # - name: 'Cache local Maven repository' -# uses: actions/cache@v3 +# uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 # with: # path: ~/.m2/repository # key: maven-${{ hashFiles('**/pom.xml') }} # restore-keys: | # maven- # - name: 'Set up JDK 11' -# uses: actions/setup-java@v3 +# uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 # with: # java-version: 11 # distribution: 'zulu' diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml index d96e8569..21029629 100644 --- a/.github/workflows/release-drafter.yml +++ b/.github/workflows/release-drafter.yml @@ -20,7 +20,7 @@ jobs: # echo "GHE_HOST=${GITHUB_SERVER_URL##https:\/\/}" >> $GITHUB_ENV # Drafts your next Release notes as Pull Requests are merged into "master" - - uses: release-drafter/release-drafter@v5 + - uses: release-drafter/release-drafter@5de93583980a40bd78603b6dfdcda5b4df377b32 # v7.2.0 # (Optional) specify config name to use, relative to .github/. Default: release-drafter.yml # with: # config-name: my-config.yml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 763f20f9..7d624379 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,12 +21,12 @@ jobs: steps: - name: Checkout Source Code - uses: actions/checkout@v2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # with: # ref: ${{ github.event.inputs.branch }} - name: Cache local Maven repository - uses: actions/cache@v2 + uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 with: path: ~/.m2/repository key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} @@ -34,7 +34,7 @@ jobs: ${{ runner.os }}-maven- - name: Set up JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: java-version: 17 distribution: zulu @@ -63,24 +63,3 @@ jobs: access-token: ${{ secrets.GITHUB_TOKEN }} # https # ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }} # ssh - not used - - # https://docs.github.com/en/actions/publishing-packages/publishing-java-packages-with-maven - publish_snapshot_github: - name: 'Publish snapshot to GitHub Packages' - needs: test - if: github.event_name == 'push' && github.repository == 'astubbs/truth-generator' - runs-on: ubuntu-latest - steps: - - run: | - releaseVersion=grep scm.tag= | cut -d= -f2 - echo $releaseVersion - - name: 'Check out repository' - uses: actions/checkout@v3 - with: - ref: ${{ releaseVersion }} - - name: Publish package - run: mvn --batch-mode deploy -DskipTests=true -Pgithub-deploy -P!package-cloud-deploy - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # As settings.xml gets merged by the tool, we have to include bindings to all variables present - as added above - PACKAGE_CLOUD_TOKEN: ${{ secrets.PACKAGE_CLOUD_TOKEN }} \ No newline at end of file diff --git a/pom.xml b/pom.xml index 5e7b0e40..ad200666 100644 --- a/pom.xml +++ b/pom.xml @@ -251,7 +251,7 @@ org.projectlombok lombok - 1.18.24 + 1.18.34 uk.co.jemos.podam @@ -287,16 +287,6 @@ 17 - - maven-jar-plugin - - - - jar - - - - org.apache.maven.plugins maven-surefire-plugin @@ -323,6 +313,14 @@ maven-jar-plugin 3.2.2 + + + default-test-jar + + test-jar + + + org.apache.maven.plugins @@ -379,16 +377,6 @@ @{project.version} - - maven-jar-plugin - - - - test-jar - - - -