From dfd1807c5c6ece9f39f576ba72b8e342969e3cdb Mon Sep 17 00:00:00 2001 From: Jeremy Bernard Date: Tue, 29 Sep 2026 17:44:46 +0200 Subject: [PATCH] ci: migrate to Github Actions --- .github/workflows/ci.yaml | 101 ++++++++++++++++++++++++ .github/workflows/promote-image.yaml | 37 +++++++++ Jenkinsfile | 4 - build.gradle | 13 ++- gradle.properties | 4 +- iexec-result-proxy-library/build.gradle | 8 +- release-please-config.json | 1 + 7 files changed, 151 insertions(+), 17 deletions(-) create mode 100644 .github/workflows/ci.yaml create mode 100644 .github/workflows/promote-image.yaml delete mode 100644 Jenkinsfile diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml new file mode 100644 index 0000000..d45aec8 --- /dev/null +++ b/.github/workflows/ci.yaml @@ -0,0 +1,101 @@ +name: CI + +on: + pull_request: + push: + branches: + - main + workflow_dispatch: + +# Granted per job rather than here, because the called workflows need scopes this one +# does not, and a called workflow can never hold more than its caller. +permissions: {} + +concurrency: + group: ci-${{ github.head_ref || github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + +jobs: + prepare: + name: Determine image tag + runs-on: ubuntu-latest + # Prevent execution on forks, which have no access to the registry secrets + if: github.repository_owner == 'iExecBlockchainComputing' + permissions: + contents: read # actions/checkout + outputs: + image_tag: ${{ steps.rules.outputs.image_tag }} + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - name: Apply branch and image tag rules + id: rules + env: + BRANCH: ${{ github.head_ref || github.ref_name }} + HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} + run: | + short_sha=$(echo "$HEAD_SHA" | cut -c1-8) + + # Production branches get dev- images, feature branches feature-. + # Release-please branches build no image: their code is covered by the + # dev- image CI builds on the merge to main, and promote-image.yaml + # promotes that image to the vX.Y.Z tag. + case "$BRANCH" in + main) echo "image_tag=dev-${short_sha}" | tee -a "$GITHUB_OUTPUT" ;; + feat/*|fix/*) echo "image_tag=feature-${short_sha}" | tee -a "$GITHUB_OUTPUT" ;; + release-please--*) : ;; + *) + echo "❌ Branch does not respect naming rules: $BRANCH" + echo "Expected one of: main, feat/*, fix/*, release-please--*" + exit 1 + ;; + esac + + build-and-test: + name: Build, test and analyse + needs: prepare + permissions: + contents: read # actions/checkout + actions: write # actions/upload-artifact + # java-build-v1.0.0 + uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/java-build.yml@230e504041b25d1e45dad1651ac29a9b9f827dd5 + with: + java-version: '21' + sonar: true + dockerhub-login: true + upload-jar: true + artifact-name: boot-jar + secrets: + dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }} + dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN_PULL_ONLY }} + sonar-token: ${{ secrets.SONAR_TOKEN }} + + build-image: + name: Build and push OCI image + needs: [prepare, build-and-test] + if: needs.prepare.outputs.image_tag != '' + permissions: + contents: read # actions/checkout + actions: write # actions/download-artifact + actions/upload-artifact (docker-image-tag) + security-events: write # codeql-action/upload-sarif, Trivy report on pull requests + pull-requests: write # peter-evans/create-or-update-comment, Hadolint report on pull requests + # docker-build-v3.7.0 + uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/docker-build.yml@fc54a889aaabffc2acf96451d54592a90d068af9 + with: + image-name: docker-regis.iex.ec/iexec-result-proxy + image-tag: ${{ needs.prepare.outputs.image_tag }} + registry: docker-regis.iex.ec + push: true + security-scan: false + security-report: 'sarif' + hadolint: true + platform: linux/amd64 + artifact-name: ${{ needs.build-and-test.outputs.artifact-name }} + artifact-path: build/libs + build-args: jar=${{ needs.build-and-test.outputs.jar-path }} + secrets: + dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }} + dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN_PULL_ONLY }} + username: ${{ secrets.NEXUS_USERNAME }} + password: ${{ secrets.NEXUS_PASSWORD }} diff --git a/.github/workflows/promote-image.yaml b/.github/workflows/promote-image.yaml new file mode 100644 index 0000000..9db552c --- /dev/null +++ b/.github/workflows/promote-image.yaml @@ -0,0 +1,37 @@ +name: Promote Image + +# Releasing does not rebuild anything. The image CI already built, tested and scanned +# for this commit is promoted to the release tag by copying its manifest, so the +# released artifact is byte for byte the one that passed the pipeline. A rebuild would +# not be equivalent: the Dockerfile runs `apt-get upgrade`, so the same source produces +# a different image whenever Ubuntu has moved on. +# The promotion itself is delegated to the docker-promote reusable workflow. + +on: + push: + tags: + - 'v*.*.*' + +permissions: {} + +concurrency: + group: promote-image-${{ github.ref_name }} + cancel-in-progress: false + +jobs: + promote-image: + name: Promote the tested image to the release tag + # Prevent execution on forks, which have no access to the registry secrets + if: github.repository_owner == 'iExecBlockchainComputing' + permissions: + contents: read + actions: read # look up the CI run that built the tagged commit + # docker-promote-v1.0.0 + uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/docker-promote.yml@23f97c518d217113e299e7c6a870a41422cd2163 + with: + image-name: docker-regis.iex.ec/iexec-result-proxy + registry: docker-regis.iex.ec + security-scan: false + secrets: + username: ${{ secrets.NEXUS_USERNAME }} + password: ${{ secrets.NEXUS_PASSWORD }} diff --git a/Jenkinsfile b/Jenkinsfile deleted file mode 100644 index c09c58e..0000000 --- a/Jenkinsfile +++ /dev/null @@ -1,4 +0,0 @@ -@Library('global-jenkins-library@support/2.7.4') _ -buildJavaProject( - shouldPublishJars: false, - shouldPublishDockerImages: true) diff --git a/build.gradle b/build.gradle index 6000a57..f3a42ad 100644 --- a/build.gradle +++ b/build.gradle @@ -1,7 +1,7 @@ plugins { id 'java' id 'io.freefair.lombok' version '8.14.4' - id 'org.springframework.boot' version '3.5.8' + id 'org.springframework.boot' version '3.5.16' id 'io.spring.dependency-management' version '1.1.7' id 'jacoco' id 'org.sonarqube' version '6.3.1.5724' @@ -9,15 +9,11 @@ plugins { } ext { - gitTag = 'git tag --points-at HEAD'.execute().text.trim() jjwtVersion = '0.11.5' } allprojects { - group = 'com.iexec.result-proxy' - if (gitTag.isEmpty()) { - version += '-NEXT-SNAPSHOT' - } + group = 'com.github.iExecBlockchainComputing' repositories { mavenLocal() mavenCentral() @@ -35,13 +31,14 @@ allprojects { tasks.withType(JavaCompile).configureEach { options.compilerArgs.add('-parameters') + options.compilerArgs.add('-Xlint:all') } } dependencies { // iexec - implementation "com.github.iexecblockchaincomputing:iexec-commons-poco:$iexecCommonsPocoVersion" - implementation "com.github.iexecblockchaincomputing:iexec-common:$iexecCommonVersion" + implementation "com.github.iExecBlockchainComputing:iexec-commons-poco:$iexecCommonsPocoVersion" + implementation "com.github.iExecBlockchainComputing:iexec-common:$iexecCommonVersion" // spring implementation 'org.springframework.boot:spring-boot-starter-actuator' diff --git a/gradle.properties b/gradle.properties index 917b3a8..07a8f44 100644 --- a/gradle.properties +++ b/gradle.properties @@ -1,7 +1,7 @@ # x-release-please-start-version version=9.2.0 # x-release-please-end -iexecCommonsPocoVersion=5.5.0 -iexecCommonVersion=9.3.0 +iexecCommonsPocoVersion=5.5.1 +iexecCommonVersion=9.3.1 mvnRepositoryUsername mvnRepositoryPassword diff --git a/iexec-result-proxy-library/build.gradle b/iexec-result-proxy-library/build.gradle index 1ad9abe..7ecc658 100644 --- a/iexec-result-proxy-library/build.gradle +++ b/iexec-result-proxy-library/build.gradle @@ -5,10 +5,12 @@ plugins { id 'maven-publish' } +group = 'com.github.iExecBlockchainComputing.iexec-result-proxy' + dependencies { - implementation platform('org.springframework.boot:spring-boot-dependencies:3.5.8') - implementation "com.github.iexecblockchaincomputing:iexec-commons-poco:$iexecCommonsPocoVersion" - implementation "com.github.iexecblockchaincomputing:iexec-common:$iexecCommonVersion" + implementation platform('org.springframework.boot:spring-boot-dependencies:3.5.16') + implementation "com.github.iExecBlockchainComputing:iexec-commons-poco:$iexecCommonsPocoVersion" + implementation "com.github.iExecBlockchainComputing:iexec-common:$iexecCommonVersion" } java { diff --git a/release-please-config.json b/release-please-config.json index 73248fb..9179368 100644 --- a/release-please-config.json +++ b/release-please-config.json @@ -1,5 +1,6 @@ { "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json", + "always-update": true, "draft-pull-request": true, "include-component-in-tag": false, "include-v-in-tag": true,