Skip to content

Commit 53f418e

Browse files
yrodierebeikov
authored and
marko-bekhta
committed
Rework/simplify GH Actions jobs
* Use `pull_request` instead of `pull_request_target` * Move Develocity build scan publishing for untrusted code to a separate workflow * Split caches between trusted and untrusted code * Update secrets to use "Develocity" name instead of "Gradle Enterprise" Co-Authored-By: Christian Beikov <christian.beikov@gmail.com>
1 parent 856b1ac commit 53f418e

File tree

2 files changed

+100
-43
lines changed

2 files changed

+100
-43
lines changed

‎.github/workflows/ci-report.yml

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
name: GH Actions CI reporting
2+
3+
on:
4+
workflow_run:
5+
workflows: [ "GH Actions CI" ]
6+
types: [ completed ]
7+
8+
defaults:
9+
run:
10+
shell: bash
11+
12+
env:
13+
MAVEN_ARGS: "-e -B --settings .github/mvn-settings.xml --fail-at-end"
14+
15+
jobs:
16+
publish-build-scans:
17+
name: Publish Develocity build scans
18+
if: github.repository == 'hibernate/hibernate-search' && github.event.workflow_run.conclusion != 'cancelled'
19+
runs-on: ubuntu-latest
20+
steps:
21+
# Checkout target branch which has trusted code
22+
- name: Check out target branch
23+
uses: actions/checkout@v4
24+
with:
25+
persist-credentials: false
26+
ref: ${{ github.ref }}
27+
- name: Set up Java ${{ matrix.os.java.version }}
28+
uses: actions/setup-java@v4
29+
with:
30+
java-version: ${{ matrix.os.java.version }}
31+
distribution: temurin
32+
# https://github.com/actions/cache/blob/main/examples.md#java---maven
33+
- name: Cache local Maven repository
34+
uses: actions/cache@v4
35+
with:
36+
path: ~/.m2/repository
37+
# use a different key than workflows running untrusted code
38+
key: trusted-${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
39+
restore-keys: |
40+
trusted-${{ runner.os }}-maven-
41+
- name: Set up Maven
42+
run: ./mvnw -v
43+
- name: Download GitHub Actions artifacts for the Develocity build scans
44+
id: downloadBuildScan
45+
uses: actions/download-artifact@v4
46+
with:
47+
pattern: build-scan-data-*
48+
github-token: ${{ github.token }}
49+
repository: ${{ github.repository }}
50+
run-id: ${{ github.event.workflow_run.id }}
51+
path: /tmp/downloaded-build-scan-data/
52+
# Don't fail the build if there are no matching artifacts
53+
continue-on-error: true
54+
- name: Publish Develocity build scans for previous builds
55+
if: ${{ steps.downloadBuildScan.outcome != 'failure'}}
56+
run: |
57+
shopt -s nullglob # Don't run the loop below if there are no artifacts
58+
status=0
59+
for build_scan_data_directory in /tmp/downloaded-build-scan-data/*
60+
do
61+
rm -rf ~/.m2/.develocity/build-scan-data
62+
mkdir -p ~/.m2/.develocity/build-scan-data
63+
tar -xzf "$build_scan_data_directory/build-scan-data.tgz" -C ~/.m2/.develocity/build-scan-data \
64+
&& ./mvnw $MAVEN_ARGS develocity:build-scan-publish-previous || status=1
65+
done
66+
exit $status
67+
env:
68+
DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY_PR }}

‎.github/workflows/build.yml renamed to ‎.github/workflows/ci.yml

Lines changed: 32 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
# See https://docs.github.com/en/actions
1010
# for more information about GitHub actions.
1111

12-
name: GitHub Actions Build
12+
name: GH Actions CI
1313

1414
on:
1515
push:
@@ -24,9 +24,7 @@ on:
2424
- '!wip/**/dependency-update/**'
2525
tags:
2626
- '**'
27-
# WARNING: Using pull_request_target to access secrets, but we check out the merge commit.
28-
# See checkout action for details.
29-
pull_request_target:
27+
pull_request:
3028
types: [opened, synchronize, reopened, ready_for_review]
3129
branches:
3230
# Pattern order matters: the last matching inclusion/exclusion wins
@@ -44,7 +42,7 @@ on:
4442

4543
concurrency:
4644
group: "workflow = ${{ github.workflow }}, ref = ${{ github.event.ref }}, pr = ${{ github.event.pull_request.id }}"
47-
cancel-in-progress: ${{ github.event_name == 'pull_request_target' || github.repository != 'hibernate/hibernate-search' }}
45+
cancel-in-progress: ${{ github.event_name == 'pull_request' || github.repository != 'hibernate/hibernate-search' }}
4846

4947
defaults:
5048
run:
@@ -90,21 +88,9 @@ jobs:
9088
- name: Support longpaths on Windows
9189
if: "startsWith(matrix.os.runs-on, 'windows')"
9290
run: git config --global core.longpaths true
93-
- name: Check out commit already pushed to branch
94-
if: "! github.event.pull_request.number"
95-
uses: actions/checkout@v4
96-
- name: Check out PR head
97-
uses: actions/checkout@v4
98-
if: github.event.pull_request.number
91+
- uses: actions/checkout@v4
9992
with:
100-
# WARNING: This is potentially dangerous since we're checking out unreviewed code,
101-
# and since we're using the pull_request_target event we can use secrets.
102-
# Thus, we must be extra careful to never expose secrets to steps that execute this code,
103-
# and to strictly limit our of secrets to those that only pose minor security threads.
104-
# This means in particular we won't expose Develocity credentials to the main maven executions,
105-
# but instead will execute maven a third time just to push build scans to Develocity;
106-
# see below.
107-
ref: "refs/pull/${{ github.event.pull_request.number }}/head"
93+
persist-credentials: false
10894
# Fetch the whole history to make sure that gitflow incremental builder
10995
# can find the base commit.
11096
fetch-depth: 0
@@ -118,9 +104,10 @@ jobs:
118104
uses: actions/cache@v4
119105
with:
120106
path: ~/.m2/repository
121-
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
107+
# use a different key than workflows running in trusted mode
108+
key: ${{ github.event_name == 'push' && 'trusted' || 'untrusted' }}-${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
122109
restore-keys: |
123-
${{ runner.os }}-maven-
110+
${{ github.event_name == 'push' && 'trusted' || 'untrusted' }}-${{ runner.os }}-maven-
124111
- name: Set up Maven
125112
run: ./mvnw -v
126113
- name: Docker cleanup
@@ -131,35 +118,37 @@ jobs:
131118
./mvnw $MAVEN_ARGS ${{ matrix.os.maven.args }} clean install \
132119
-Pjqassistant -Pdist -Pci-build -DskipITs
133120
env:
134-
# WARNING: exposes secrets, so must only be passed to a step that doesn't run unapproved code.
135-
DEVELOCITY_ACCESS_KEY: "${{ github.event_name == 'push' && secrets.GRADLE_ENTERPRISE_ACCESS_KEY || '' }}"
136-
- name: Publish Develocity build scan for previous build (pull request)
137-
# Don't fail a build if publishing fails
138-
continue-on-error: true
139-
if: "${{ !cancelled() && github.event_name == 'pull_request_target' && github.repository == 'hibernate/hibernate-search' }}"
140-
run: |
141-
./mvnw $MAVEN_ARGS develocity:build-scan-publish-previous
142-
env:
143-
# WARNING: exposes secrets, so must only be passed to a step that doesn't run unapproved code.
144-
DEVELOCITY_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY_PR }}
121+
DEVELOCITY_ACCESS_KEY: "${{ secrets.DEVELOCITY_ACCESS_KEY || '' }}"
122+
# For jobs running on 'pull_request', tar and upload build scan data.
123+
# The actual publishing must be done in a separate job (see ci-report.yml).
124+
# We don't write to the remote cache as that would be unsafe.
125+
- name: Tar build scan content pushed to subsequent jobs
126+
if: "${{ github.event_name == 'pull_request' && !cancelled() }}"
127+
run: tar -czf build-scan-data.tgz -C ~/.m2/.develocity/build-scan-data .
128+
- name: Upload GitHub Actions artifact for the Develocity build scan
129+
uses: actions/upload-artifact@v4
130+
if: "${{ github.event_name == 'pull_request' && !cancelled() }}"
131+
with:
132+
name: build-scan-data-initial-${{ matrix.os.name }}
133+
path: build-scan-data.tgz
145134

146135
- name: Run integration tests in the default environment
147136
run: |
148137
./mvnw $MAVEN_ARGS ${{ matrix.os.maven.args }} clean verify \
149138
-Pskip-checks \
150139
${{ github.event.pull_request.base.ref && format('-Dincremental -Dgib.referenceBranch=refs/remotes/origin/{0}', github.event.pull_request.base.ref) || '' }}
151140
env:
152-
# WARNING: exposes secrets, so must only be passed to a step that doesn't run unapproved code.
153-
DEVELOCITY_ACCESS_KEY: "${{ github.event_name == 'push' && secrets.GRADLE_ENTERPRISE_ACCESS_KEY || '' }}"
154-
- name: Publish Develocity build scan for previous build (pull request)
155-
# Don't fail a build if publishing fails
156-
continue-on-error: true
157-
if: "${{ !cancelled() && github.event_name == 'pull_request_target' && github.repository == 'hibernate/hibernate-search' }}"
158-
run: |
159-
./mvnw $MAVEN_ARGS develocity:build-scan-publish-previous
160-
env:
161-
# WARNING: exposes secrets, so must only be passed to a step that doesn't run unapproved code.
162-
DEVELOCITY_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY_PR }}
141+
DEVELOCITY_ACCESS_KEY: "${{ secrets.DEVELOCITY_ACCESS_KEY || '' }}"
142+
# Same as above, but for the build scan of the latest Maven run.
143+
- name: Tar build scan content pushed to subsequent jobs
144+
if: "${{ github.event_name == 'pull_request' && !cancelled() }}"
145+
run: tar -czf build-scan-data.tgz -C ~/.m2/.develocity/build-scan-data .
146+
- name: Upload GitHub Actions artifact for the Develocity build scan
147+
uses: actions/upload-artifact@v4
148+
if: "${{ github.event_name == 'pull_request' && !cancelled() }}"
149+
with:
150+
name: build-scan-data-integrationtest-${{ matrix.os.name }}
151+
path: build-scan-data.tgz
163152

164153
- name: Docker cleanup
165154
run: ./ci/docker-cleanup.sh

0 commit comments

Comments
 (0)