2
0

continuous-integration-workflow.yml 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279
  1. name: CI
  2. on:
  3. push:
  4. branches-ignore:
  5. - "dependabot/**"
  6. schedule:
  7. - cron: '0 10 * * *' # Once per day at 10am UTC
  8. workflow_dispatch: # Manual trigger
  9. env:
  10. SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  11. DEVELOCITY_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_SECRET_ACCESS_KEY }}
  12. COMMIT_OWNER: ${{ github.event.pusher.name }}
  13. COMMIT_SHA: ${{ github.sha }}
  14. STRUCTURE101_LICENSEID: ${{ secrets.STRUCTURE101_LICENSEID }}
  15. ARTIFACTORY_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }}
  16. ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
  17. permissions:
  18. contents: read
  19. jobs:
  20. prerequisites:
  21. name: Pre-requisites for building
  22. runs-on: ubuntu-latest
  23. if: ${{ github.repository == 'spring-projects/spring-security' }}
  24. outputs:
  25. runjobs: ${{ steps.continue.outputs.runjobs }}
  26. project_version: ${{ steps.continue.outputs.project_version }}
  27. steps:
  28. - uses: actions/checkout@v4
  29. - id: continue
  30. name: Determine if should continue
  31. run: |
  32. # Run jobs if in upstream repository
  33. echo "runjobs=true" >>$GITHUB_OUTPUT
  34. # Extract version from gradle.properties
  35. version=$(cat gradle.properties | grep "version=" | awk -F'=' '{print $2}')
  36. echo "project_version=$version" >>$GITHUB_OUTPUT
  37. build_jdk_11:
  38. name: Build JDK 11
  39. needs: [prerequisites]
  40. strategy:
  41. matrix:
  42. os: [ubuntu-latest, windows-latest]
  43. runs-on: ${{ matrix.os }}
  44. if: needs.prerequisites.outputs.runjobs
  45. steps:
  46. - uses: actions/checkout@v4
  47. - name: Set up JDK 11
  48. uses: actions/setup-java@v4
  49. with:
  50. java-version: '11'
  51. distribution: 'adopt'
  52. cache: 'gradle'
  53. - name: Set up Gradle
  54. uses: gradle/gradle-build-action@v3
  55. - name: Set up gradle user name
  56. run: echo 'systemProp.user.name=spring-builds+github' >> gradle.properties
  57. - name: Build with Gradle
  58. run: ./gradlew clean build --continue -PartifactoryUsername="$ARTIFACTORY_USERNAME" -PartifactoryPassword="$ARTIFACTORY_PASSWORD"
  59. snapshot_tests:
  60. name: Test against snapshots
  61. needs: [prerequisites]
  62. runs-on: ubuntu-latest
  63. if: needs.prerequisites.outputs.runjobs
  64. steps:
  65. - uses: actions/checkout@v4
  66. - name: Set up gradle
  67. uses: spring-io/spring-gradle-build-action@v2
  68. with:
  69. java-version: '11'
  70. distribution: 'adopt'
  71. - name: Snapshot Tests
  72. run: ./gradlew test --refresh-dependencies -PartifactoryUsername="$ARTIFACTORY_USERNAME" -PartifactoryPassword="$ARTIFACTORY_PASSWORD" -PforceMavenRepositories=snapshot -PisOverrideVersionCatalog -PspringFrameworkVersion='5.+' -PreactorVersion='2020.0.+' -PspringDataVersion='2021.2.+' -PlocksDisabled --stacktrace
  73. check_samples:
  74. name: Check Samples project
  75. needs: [prerequisites]
  76. runs-on: ubuntu-latest
  77. if: needs.prerequisites.outputs.runjobs
  78. steps:
  79. - uses: actions/checkout@v4
  80. - name: Set up gradle
  81. uses: spring-io/spring-gradle-build-action@v2
  82. with:
  83. java-version: '11'
  84. distribution: 'adopt'
  85. - name: Check samples project
  86. env:
  87. LOCAL_REPOSITORY_PATH: ${{ github.workspace }}/build/publications/repos
  88. SAMPLES_DIR: ../spring-security-samples
  89. VERSION: ${{ needs.prerequisites.outputs.project_version }}
  90. run: |
  91. ./gradlew publishMavenJavaPublicationToLocalRepository
  92. ./gradlew cloneSamples -PcloneOutputDirectory="$SAMPLES_DIR"
  93. ./gradlew --project-dir "$SAMPLES_DIR" --init-script spring-security-ci.gradle -PlocalRepositoryPath="$LOCAL_REPOSITORY_PATH" -PspringSecurityVersion="$VERSION" :runAllTests
  94. check_tangles:
  95. name: Check for Package Tangles
  96. needs: [ prerequisites ]
  97. runs-on: ubuntu-latest
  98. if: needs.prerequisites.outputs.runjobs
  99. steps:
  100. - uses: actions/checkout@v4
  101. - name: Set up gradle
  102. uses: spring-io/spring-gradle-build-action@v2
  103. with:
  104. java-version: '11'
  105. distribution: 'adopt'
  106. - name: Check for package tangles
  107. run: ./gradlew check s101 -Ps101.licenseId="$STRUCTURE101_LICENSEID" --stacktrace
  108. deploy_artifacts:
  109. name: Deploy Artifacts
  110. needs: [build_jdk_11, snapshot_tests, check_samples, check_tangles]
  111. runs-on: ubuntu-latest
  112. steps:
  113. - uses: actions/checkout@v4
  114. - name: Set up gradle
  115. uses: spring-io/spring-gradle-build-action@v2
  116. with:
  117. java-version: '11'
  118. distribution: 'adopt'
  119. - name: Deploy artifacts
  120. run: ./gradlew publishArtifacts finalizeDeployArtifacts -PossrhUsername="$OSSRH_TOKEN_USERNAME" -PossrhPassword="$OSSRH_TOKEN_PASSWORD" -PartifactoryUsername="$ARTIFACTORY_USERNAME" -PartifactoryPassword="$ARTIFACTORY_PASSWORD" --stacktrace
  121. env:
  122. ORG_GRADLE_PROJECT_signingKey: ${{ secrets.GPG_PRIVATE_KEY }}
  123. ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.GPG_PASSPHRASE }}
  124. OSSRH_TOKEN_USERNAME: ${{ secrets.OSSRH_S01_TOKEN_USERNAME }}
  125. OSSRH_TOKEN_PASSWORD: ${{ secrets.OSSRH_S01_TOKEN_PASSWORD }}
  126. ARTIFACTORY_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }}
  127. ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
  128. deploy_docs:
  129. name: Deploy Docs
  130. needs: [build_jdk_11, snapshot_tests, check_samples, check_tangles]
  131. runs-on: ubuntu-latest
  132. steps:
  133. - uses: actions/checkout@v4
  134. - name: Set up gradle
  135. uses: spring-io/spring-gradle-build-action@v2
  136. with:
  137. java-version: '11'
  138. distribution: 'adopt'
  139. - name: Deploy Docs
  140. run: ./gradlew deployDocs -PdeployDocsSshKey="$DOCS_SSH_KEY" -PdeployDocsSshUsername="$DOCS_USERNAME" -PdeployDocsHost="$DOCS_HOST" --stacktrace
  141. env:
  142. DOCS_USERNAME: ${{ secrets.DOCS_USERNAME }}
  143. DOCS_SSH_KEY: ${{ secrets.DOCS_SSH_KEY }}
  144. DOCS_HOST: ${{ secrets.DOCS_HOST }}
  145. deploy_schema:
  146. name: Deploy Schema
  147. needs: [build_jdk_11, snapshot_tests, check_samples, check_tangles]
  148. runs-on: ubuntu-latest
  149. steps:
  150. - uses: actions/checkout@v4
  151. - name: Set up gradle
  152. uses: spring-io/spring-gradle-build-action@v2
  153. with:
  154. java-version: '11'
  155. distribution: 'adopt'
  156. - name: Deploy Schema
  157. run: ./gradlew deploySchema -PdeployDocsSshKey="$DOCS_SSH_KEY" -PdeployDocsSshUsername="$DOCS_USERNAME" -PdeployDocsHost="$DOCS_HOST" --stacktrace --info
  158. env:
  159. DOCS_USERNAME: ${{ secrets.DOCS_USERNAME }}
  160. DOCS_SSH_KEY: ${{ secrets.DOCS_SSH_KEY }}
  161. DOCS_HOST: ${{ secrets.DOCS_HOST }}
  162. perform_release:
  163. name: Perform release
  164. needs: [prerequisites, deploy_artifacts, deploy_docs, deploy_schema]
  165. runs-on: ubuntu-latest
  166. permissions:
  167. contents: write
  168. timeout-minutes: 90
  169. if: ${{ !endsWith(needs.prerequisites.outputs.project_version, '-SNAPSHOT') }}
  170. env:
  171. REPO: ${{ github.repository }}
  172. BRANCH: ${{ github.ref_name }}
  173. TOKEN: ${{ github.token }}
  174. VERSION: ${{ needs.prerequisites.outputs.project_version }}
  175. steps:
  176. - uses: actions/checkout@v4
  177. with:
  178. token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
  179. - name: Set up gradle
  180. uses: spring-io/spring-gradle-build-action@v2
  181. with:
  182. java-version: '11'
  183. distribution: 'adopt'
  184. - name: Wait for Artifactory Artifacts
  185. if: ${{ contains(needs.prerequisites.outputs.project_version, '-RC') || contains(needs.prerequisites.outputs.project_version, '-M') }}
  186. run: |
  187. echo "Wait for artifacts of $REPO@$VERSION to appear on Artifactory."
  188. until curl -f -s https://repo.spring.io/artifactory/milestone/org/springframework/security/spring-security-core/$VERSION/ > /dev/null
  189. do
  190. sleep 30
  191. echo "."
  192. done
  193. echo "Artifacts for $REPO@$VERSION have been released to Artifactory."
  194. - name: Wait for Maven Central Artifacts
  195. if: ${{ !contains(needs.prerequisites.outputs.project_version, '-RC') && !contains(needs.prerequisites.outputs.project_version, '-M') }}
  196. run: |
  197. echo "Wait for artifacts of $REPO@$VERSION to appear on Maven Central."
  198. until curl -f -s https://repo1.maven.org/maven2/org/springframework/security/spring-security-core/$VERSION/ > /dev/null
  199. do
  200. sleep 30
  201. echo "."
  202. done
  203. echo "Artifacts for $REPO@$VERSION have been released to Maven Central."
  204. - name: Create GitHub Release
  205. run: |
  206. echo "Tagging and publishing $REPO@$VERSION release on GitHub."
  207. ./gradlew createGitHubRelease -PnextVersion=$VERSION -Pbranch=$BRANCH -PcreateRelease=true -PgitHubAccessToken=$TOKEN
  208. - name: Announce Release on Slack
  209. id: spring-security-announcing
  210. uses: slackapi/slack-github-action@v1.26.0
  211. with:
  212. payload: |
  213. {
  214. "text": "spring-security-announcing `${{ env.VERSION }}` is available now",
  215. "blocks": [
  216. {
  217. "type": "section",
  218. "text": {
  219. "type": "mrkdwn",
  220. "text": "spring-security-announcing `${{ env.VERSION }}` is available now"
  221. }
  222. }
  223. ]
  224. }
  225. env:
  226. SLACK_WEBHOOK_URL: ${{ secrets.SPRING_RELEASE_SLACK_WEBHOOK_URL }}
  227. SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
  228. - name: Setup git config
  229. run: |
  230. git config user.name 'github-actions[bot]'
  231. git config user.email 'github-actions[bot]@users.noreply.github.com'
  232. - name: Update to next Snapshot Version
  233. run: |
  234. echo "Updating $REPO@$VERSION to next snapshot version."
  235. ./gradlew :updateToSnapshotVersion
  236. git commit -am "Next development version"
  237. git push
  238. perform_post_release:
  239. name: Perform post-release
  240. needs: [prerequisites, deploy_artifacts, deploy_docs, deploy_schema]
  241. runs-on: ubuntu-latest
  242. permissions:
  243. contents: read
  244. issues: write
  245. timeout-minutes: 90
  246. if: ${{ endsWith(needs.prerequisites.outputs.project_version, '-SNAPSHOT') }}
  247. env:
  248. TOKEN: ${{ github.token }}
  249. VERSION: ${{ needs.prerequisites.outputs.project_version }}
  250. steps:
  251. - uses: actions/checkout@v4
  252. - name: Set up gradle
  253. uses: spring-io/spring-gradle-build-action@v2
  254. with:
  255. java-version: '11'
  256. distribution: 'adopt'
  257. - name: Schedule next release (if not already scheduled)
  258. run: ./gradlew scheduleNextRelease -PnextVersion=$VERSION -PgitHubAccessToken=$TOKEN
  259. notify_result:
  260. name: Check for failures
  261. needs: [perform_release, perform_post_release]
  262. if: failure()
  263. runs-on: ubuntu-latest
  264. permissions:
  265. actions: read
  266. steps:
  267. - name: Send Slack message
  268. # Workaround while waiting for Gamesight/slack-workflow-status#38 to be fixed
  269. # See https://github.com/Gamesight/slack-workflow-status/issues/38
  270. uses: sjohnr/slack-workflow-status@v1-beta
  271. with:
  272. repo_token: ${{ secrets.GITHUB_TOKEN }}
  273. slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}
  274. channel: '#spring-security-ci'
  275. name: 'CI Notifier'