releng-reusable-workflows/.github/workflows/compose-make-merge.yaml at bc84fbfcef9274c499daae15f08f3d8d037b5930 · lfit/releng-reusable-workflows · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
---
# SPDX-License-Identifier: Apache-2.0
# SPDX-FileCopyrightText: 2025 The Linux Foundation

name: Compose Maven Merge

# yamllint disable-line rule:truthy
on:
  workflow_call:
    secrets:
      VAULT_MAPPING_JSON:
        required: true
      OP_SERVICE_ACCOUNT_TOKEN:
        required: true
    inputs:
      GERRIT_CHANGE_ID:
        description: "The ID for the change"
        required: false
        type: string
      GERRIT_BRANCH:
        description: "Branch that change is against"
        required: true
        type: string
      GERRIT_REFSPEC:
        description: "Gerrit refspec of change"
        required: false
        type: string
      JDK_VERSION:
        description: "OpenJDK version"
        required: false
        default: "17"
        type: string
      MVN_VERSION:
        description: "Maven version"
        required: false
        default: "3.8.2"
        type: string
      MAKE_TARGETS:
        description: "Make targets to pass to the make command"
        required: false
        default: "all"
        type: string

concurrency:
  # yamllint disable-line rule:line-length
  group: compose-make-merge-${{ github.workflow }}-${{ inputs.GERRIT_BRANCH }}-${{ inputs.GERRIT_CHANGE_ID || github.run_id }}
  cancel-in-progress: true

jobs:
  maven-merge:
    runs-on: ubuntu-latest
    steps:
      # Harden the runner used by this workflow
      # yamllint disable-line rule:line-length
      - uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: 'audit'

      # yamllint disable-line rule:line-length
      - uses: lfreleng-actions/checkout-gerrit-change-action@54d751e8bd167bc91f7d665dabe33fae87aaaa63 # v0.9
        with:
          gerrit-refspec: ${{ inputs.GERRIT_REFSPEC }}
          gerrit-url: ${{ vars.GERRIT_URL }}
          delay: "0s"

      - name: "Load project/repository credentials"
      # yamllint disable-line rule:line-length
        uses: lfreleng-actions/credential-load-action@fcffb251810f8464a44c7a69a3f3862d14ed9ead # v0.1.1
        with:
          vault_mapping_json: ${{ secrets.VAULT_MAPPING_JSON }}
          op_service_account_token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}

      - name: Run Maven
        # yamllint disable-line rule:line-length
        uses: lfreleng-actions/maven-make-build-action@8fcc45f031956d05aa98b90b572c1ac88b6d0627 # v0.1.1
        with:
          jdk-version: ${{ inputs.JDK_VERSION }}
          mvn-version: ${{ inputs.MVN_VERSION }}
          make-targets: ${{ inputs.MAKE_TARGETS }}
        env:                         # map secrets into env vars
          NEXUS_PASSWORD: ${{ env.CREDENTIAL }}