From 02fbb154212102df501eeddb04b3942829a38c53 Mon Sep 17 00:00:00 2001 From: Patrik Korytar Date: Thu, 3 Sep 2026 16:49:22 +0200 Subject: [PATCH 1/3] Integrate shared workflows --- .github/workflows/maven-build.yml | 77 ------------------------ .github/workflows/maven-mend-pr.yml | 34 +++++++++++ .github/workflows/maven-mend.yml | 37 ++++++++++++ .github/workflows/maven-pr.yml | 16 +++++ .github/workflows/maven-release.yml | 25 ++++++++ .github/workflows/maven-set-version.yml | 25 ++++++++ .github/workflows/maven-snapshot.yml | 18 ++++++ .github/workflows/validate-gh-action.yml | 11 ++++ pom.xml | 11 +++- 9 files changed, 176 insertions(+), 78 deletions(-) delete mode 100644 .github/workflows/maven-build.yml create mode 100644 .github/workflows/maven-mend-pr.yml create mode 100644 .github/workflows/maven-mend.yml create mode 100644 .github/workflows/maven-pr.yml create mode 100644 .github/workflows/maven-release.yml create mode 100644 .github/workflows/maven-set-version.yml create mode 100644 .github/workflows/maven-snapshot.yml create mode 100644 .github/workflows/validate-gh-action.yml diff --git a/.github/workflows/maven-build.yml b/.github/workflows/maven-build.yml deleted file mode 100644 index 18fb9b4f8..000000000 --- a/.github/workflows/maven-build.yml +++ /dev/null @@ -1,77 +0,0 @@ -# -# Copyright (C) 2013 Red Hat, Inc. (https://github.com/Commonjava/galley) -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# - -name: build on maven - -on: - watch: - types: [started] - pull_request: - types: [opened, reopened, edited, synchronize, ready_for_review] - push: - branches: - - master - # We should only let the source code files to trigger the push action - # to avoid meaningless snapshot pushing to sonatype - paths: - - 'api/**' - - 'caches/**' - - 'cdi-embedder/**' - - 'core/**' - - 'maven/**' - - 'testing/**' - - 'transports/**' - - 'pom.xml' - - workflow_dispatch: - -jobs: - build: - name: Build with maven - runs-on: ubuntu-latest - env: - MAVEN_OPTS: "-Xmx4096m -Xms2048m -XX:MaxMetaspaceSize=4096m -Xss8m" - steps: - - uses: actions/checkout@v7 - - - name: Set up JDK - uses: actions/setup-java@v5 - with: - java-version: '11' - distribution: 'temurin' - architecture: x64 - - - uses: s4u/maven-settings-action@v4.0.0 - with: - sonatypeSnapshots: true - - - name: Build the Maven verify phase - run: mvn -B -V clean verify -Prun-its -Pci - - - - uses: s4u/maven-settings-action@v4.0.0 - if: ${{ github.event_name == 'push' }} - with: - servers: | - [{ - "id": "central-portal-snapshots", - "username": "${{ secrets.SONATYPE_BOT_USERNAME }}", - "password": "${{ secrets.SONATYPE_BOT_TOKEN }}" - }] - - - name: Deploy the artifact - if: ${{ github.event_name == 'push' }} - run: mvn help:effective-settings -B -V clean deploy -e diff --git a/.github/workflows/maven-mend-pr.yml b/.github/workflows/maven-mend-pr.yml new file mode 100644 index 000000000..cd2dcd3f8 --- /dev/null +++ b/.github/workflows/maven-mend-pr.yml @@ -0,0 +1,34 @@ +name: Mend CLI scan for Maven PR + +on: + workflow_run: # zizmor: ignore[dangerous-triggers] + workflows: ["Java CI with Maven"] + types: [completed] + +permissions: + contents: read + actions: read + checks: write + pull-requests: write + security-events: write + +concurrency: + group: mend-scan-${{ github.event.workflow_run.pull_requests[0].number || github.event.workflow_run.head_sha }} + cancel-in-progress: true + +jobs: + scan: + if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request' + uses: project-ncl/shared-github-actions/.github/workflows/mend-ci.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23 + with: + project_name: "Commonjava/galley" + SCA: true + SAST: true + triggering_run_id: ${{ github.event.workflow_run.id }} + pr_feedback: true + secrets: + MEND_URL: ${{ secrets.MEND_URL }} + MEND_USER_KEY: ${{ secrets.MEND_USER_KEY }} + MEND_EMAIL: ${{ secrets.MEND_EMAIL }} + MEND_ORGNAME: ${{ secrets.MEND_ORGNAME }} + MEND_PRODUCTNAME: ${{ secrets.MEND_PRODUCTNAME }} diff --git a/.github/workflows/maven-mend.yml b/.github/workflows/maven-mend.yml new file mode 100644 index 000000000..cfa911f41 --- /dev/null +++ b/.github/workflows/maven-mend.yml @@ -0,0 +1,37 @@ +name: Mend CLI scan for Maven + +on: + push: + branches: + - master + schedule: + - cron: "0 22 * * 0" + +permissions: + contents: read + actions: read + checks: write + pull-requests: write + security-events: write + +jobs: + build: + uses: project-ncl/shared-github-actions/.github/workflows/maven-ci.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23 + with: + java_version: "11" + build_command: "MAVEN_OPTS='-Xmx4096m -Xms2048m -XX:MaxMetaspaceSize=4096m -Xss8m' mvn -B -V clean verify" + upload_artifacts: true + + call-mend-ci: + needs: build + uses: project-ncl/shared-github-actions/.github/workflows/mend-ci.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23 + with: + project_name: "Commonjava/galley" + SCA: true + SAST: true + secrets: + MEND_URL: ${{ secrets.MEND_URL }} + MEND_USER_KEY: ${{ secrets.MEND_USER_KEY }} + MEND_EMAIL: ${{ secrets.MEND_EMAIL }} + MEND_ORGNAME: ${{ secrets.MEND_ORGNAME }} + MEND_PRODUCTNAME: ${{ secrets.MEND_PRODUCTNAME }} diff --git a/.github/workflows/maven-pr.yml b/.github/workflows/maven-pr.yml new file mode 100644 index 000000000..925a66c17 --- /dev/null +++ b/.github/workflows/maven-pr.yml @@ -0,0 +1,16 @@ +name: Java CI with Maven + +permissions: + contents: read + +on: + pull_request: + branches: ["*"] + +jobs: + call-maven-ci: + uses: project-ncl/shared-github-actions/.github/workflows/maven-ci.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23 + with: + java_version: "11" + build_command: "MAVEN_OPTS='-Xmx4096m -Xms2048m -XX:MaxMetaspaceSize=4096m -Xss8m' mvn -B -V clean verify" + upload_artifacts: true diff --git a/.github/workflows/maven-release.yml b/.github/workflows/maven-release.yml new file mode 100644 index 000000000..fc51dce0c --- /dev/null +++ b/.github/workflows/maven-release.yml @@ -0,0 +1,25 @@ +name: "0 Central Release Job" # Adding the 0 so that it's on top of the list of github actions +on: + workflow_dispatch: # Manual trigger so you don't release on every push + inputs: + ref_to_release: + description: "[Optional] Branch or commit to release. Default: Github default branch" + required: false + type: string + # default has to be a static string, no variables allowed + default: "" + +jobs: + call-release-job: + permissions: + contents: write # needed to push commit and tag back to the repository + uses: project-ncl/shared-github-actions/.github/workflows/maven-release.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23 + with: + java_version: "11" + ref_to_release: ${{ inputs.ref_to_release }} + release_command: 'mvn -B -V release:prepare release:perform -DlocalCheckout=true -DpushChanges=false' + secrets: + SONATYPE_USERNAME: ${{ secrets.SONATYPE_BOT_USERNAME }} + SONATYPE_PASSWORD: ${{ secrets.SONATYPE_BOT_TOKEN }} + GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} + GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} diff --git a/.github/workflows/maven-set-version.yml b/.github/workflows/maven-set-version.yml new file mode 100644 index 000000000..57231e755 --- /dev/null +++ b/.github/workflows/maven-set-version.yml @@ -0,0 +1,25 @@ +name: "0 Maven Set Version Job" # Adding the 0 so that it's on top of the list of github actions +on: + workflow_dispatch: # Manual trigger + inputs: + new_version: + description: "[Required] Version to set" + required: true + type: string + + ref_for_version: + description: "[Optional] Branch or commit to change version. Default: Github default branch" + required: false + type: string + # default has to be a static string, no variables allowed + default: "" + +jobs: + call-maven-set-version-job: + permissions: + contents: write # needed to push commit and tag back to the repository + uses: project-ncl/shared-github-actions/.github/workflows/maven-set-version.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23 + with: + java_version: "11" + new_version: ${{ inputs.new_version }} + ref_for_version: ${{ inputs.ref_for_version }} diff --git a/.github/workflows/maven-snapshot.yml b/.github/workflows/maven-snapshot.yml new file mode 100644 index 000000000..d637b9e80 --- /dev/null +++ b/.github/workflows/maven-snapshot.yml @@ -0,0 +1,18 @@ +name: Build snapshot version and upload to Maven Central + +on: + push: + branches: ["master"] + +permissions: {} + +jobs: + call-snapshot-job: + uses: project-ncl/shared-github-actions/.github/workflows/maven-snapshot.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23 + with: + java_version: "11" + project_name: "Commonjava/galley" + snapshot_deploy_command: "mvn help:effective-settings -B -V clean deploy -e" + secrets: + SONATYPE_USERNAME: ${{ secrets.SONATYPE_BOT_USERNAME }} + SONATYPE_PASSWORD: ${{ secrets.SONATYPE_BOT_TOKEN }} diff --git a/.github/workflows/validate-gh-action.yml b/.github/workflows/validate-gh-action.yml new file mode 100644 index 000000000..994137922 --- /dev/null +++ b/.github/workflows/validate-gh-action.yml @@ -0,0 +1,11 @@ +name: Validate GitHub Actions Workflows +permissions: {} + +on: + pull_request: + paths: + - ".github/workflows/*.yml" + +jobs: + validate: + uses: project-ncl/shared-github-actions/.github/workflows/validate-gh-action.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23 diff --git a/pom.xml b/pom.xml index 815487a4d..88d01a253 100644 --- a/pom.xml +++ b/pom.xml @@ -22,7 +22,7 @@ org.commonjava commonjava - 21 + 22 org.commonjava.maven.galley @@ -399,4 +399,13 @@ + + + + sonatype-snapshots + https://central.sonatype.com/repository/maven-snapshots/ + false + true + + From 7ae21eccf35e34e4fe0187c66e671b02ab9ec7ad Mon Sep 17 00:00:00 2001 From: Patrik Korytar Date: Thu, 3 Sep 2026 16:50:12 +0200 Subject: [PATCH 2/3] Update dependabot to match shared workflows one --- .github/dependabot.yml | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f70fe33d3..0acc664c4 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -8,12 +8,22 @@ updates: directory: "/" # Location of package manifests schedule: interval: "weekly" - ignore: - - dependency-name: "*" - update-types: ["version-update:semver-major"] - + # wait after a new release till we create a PR, to reduce risk of pulling + # a compromised new version + cooldown: + default-days: 7 + # Exclude our own repos from cooldown + # https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#cooldown- + exclude: + - "org.jboss.da:*" + - "org.jboss.pnc*:*" # match org.jboss.pnc:xyz and org.jboss.pnc.group:xyz + - "org.commonjava*:*" # match org.commonjava:xyz and org.commonjava.group:xyz - package-ecosystem: "github-actions" # Also update Github actions directory: "/" schedule: # Check for updates to GitHub Actions every week interval: "weekly" + # wait after a new release till we create a PR, to reduce risk of pulling + # a compromised new version + cooldown: + default-days: 7 From 2668c9a2291fd323c7b5dc7f96ccdacf4e4e5a4c Mon Sep 17 00:00:00 2001 From: Patrik Korytar Date: Thu, 3 Sep 2026 16:50:22 +0200 Subject: [PATCH 3/3] Add release.yml --- .github/release.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 .github/release.yml diff --git a/.github/release.yml b/.github/release.yml new file mode 100644 index 000000000..79c66ccaf --- /dev/null +++ b/.github/release.yml @@ -0,0 +1,15 @@ +# From https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes#creating-automatically-generated-release-notes-for-a-new-release +changelog: + categories: + - title: 🐛 Fixes / 🚀 Enhancements + labels: + - '*' + exclude: + labels: + - dependencies + - title: 👒 Project Dependencies + labels: + - java + - title: 👒 CI Dependencies + labels: + - github_actions