yangtools/.github/workflows/clm-scan.yaml at e513fe17ea1f37b7b35fe1a50b00a39a055c2b5a · opendaylight/yangtools · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
---
# SPDX-License-Identifier: Apache-2.0
# SPDX-FileCopyrightText: 2026 The Linux Foundation

name: Gerrit Composed CLM Scan

# yamllint disable-line rule:truthy
on:
  workflow_dispatch:
    inputs:
      GERRIT_BRANCH:
        description: "Branch that change is against"
        required: true
        type: string
      GERRIT_CHANGE_ID:
        description: "The ID for the change"
        required: true
        type: string
      GERRIT_CHANGE_NUMBER:
        description: "The Gerrit number"
        required: true
        type: string
      GERRIT_CHANGE_URL:
        description: "URL to the change"
        required: true
        type: string
      GERRIT_EVENT_TYPE:
        description: "Type of Gerrit event"
        required: true
        type: string
      GERRIT_PATCHSET_NUMBER:
        description: "The patch number for the change"
        required: true
        type: string
      GERRIT_PATCHSET_REVISION:
        description: "The revision sha"
        required: true
        type: string
      GERRIT_PROJECT:
        description: "Project in Gerrit"
        required: true
        type: string
      GERRIT_REFSPEC:
        description: "Gerrit refspec of change"
        required: true
        type: string
  schedule:
    # Run weekly on Saturdays at 06:58 UTC
    - cron: "58 6 * * 6"

concurrency:
  # yamllint disable-line rule:line-length
  group: composed-clm-scan-${{ github.workflow }}-${{ github.event.inputs.GERRIT_BRANCH }}-${{ github.event.inputs.GERRIT_CHANGE_ID || github.run_id }}
  cancel-in-progress: true

jobs:
  notify:
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'workflow_dispatch' }}
    steps:
      - name: Notify job start
        # yamllint disable-line rule:line-length
        uses: lfit/gerrit-review-action@a5de1d5bf17c2603ae81544dc2a455017b454ec8 # v1.1.1
        with:
          host: ${{ vars.GERRIT_SERVER }}
          username: ${{ vars.GERRIT_SSH_USER }}
          key: ${{ secrets.GERRIT_SSH_PRIVKEY }}
          known_hosts: ${{ vars.GERRIT_KNOWN_HOSTS }}
          gerrit-change-number: ${{ inputs.GERRIT_CHANGE_NUMBER }}
          gerrit-patchset-number: ${{ inputs.GERRIT_PATCHSET_NUMBER }}
          vote-type: clear
          comment-only: true
      - name: Allow replication
        run: sleep 10s

  run-maven-clm:
    runs-on: ubuntu-latest
    if: ${{ always() && (needs.notify.result == 'success' || github.event_name == 'schedule') }}
    needs: [notify]
    steps:
      - name: Gerrit Checkout
        # yamllint disable-line rule:line-length
        uses: lfreleng-actions/checkout-gerrit-change-action@54d751e8bd167bc91f7d665dabe33fae87aaaa63 # v0.9
        with:
          gerrit-refspec: ${{ inputs.GERRIT_REFSPEC || 'refs/heads/master' }}
          gerrit-project: ${{ inputs.GERRIT_PROJECT || github.repository }}
          gerrit-url: ${{ vars.GERRIT_URL }}
          delay: "0s"

      - name: Setup Java
        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5.3.0
        with:
          distribution: temurin
          java-version: "21"

      - name: Setup Maven
        uses: stCarolas/setup-maven@d6af6abeda15e98926a57b5aa970a96bb37f97d1 # v5
        with:
          maven-version: "3.9.5"

      - name: Run Maven Nexus IQ Scan
        env:
          NEXUS_IQ_PASSWORD: ${{ secrets.NEXUS_IQ_PASSWORD }}
          MAVEN_OPTS: "--add-opens=java.base/java.util=ALL-UNNAMED"
        run: |
          # yamllint disable rule:line-length
          mvn clean install dependency:tree com.sonatype.clm:clm-maven-plugin:2.41.0-02:index \
            -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \
            -Dmaven.repo.local=/tmp/r \
            -Dorg.ops4j.pax.url.mvn.localRepository=/tmp/r \
            -DaltDeploymentRepository=staging::default::file:"${GITHUB_WORKSPACE}"/m2repo

  report-status:
    if: ${{ always() && github.event_name == 'workflow_dispatch' }}
    needs: [notify, run-maven-clm]
    runs-on: ubuntu-latest
    steps:
      - name: Get workflow conclusion
        # yamllint disable-line rule:line-length
        uses: im-open/workflow-conclusion@8eac7f17381a6917bc04fec3e2c92e70ebc37526 # v3.0.0
      - name: Report workflow conclusion
        # yamllint disable-line rule:line-length
        uses: lfit/gerrit-review-action@a5de1d5bf17c2603ae81544dc2a455017b454ec8 # v1.1.1
        with:
          host: ${{ vars.GERRIT_SERVER }}
          username: ${{ vars.GERRIT_SSH_USER }}
          key: ${{ secrets.GERRIT_SSH_PRIVKEY }}
          known_hosts: ${{ vars.GERRIT_KNOWN_HOSTS }}
          gerrit-change-number: ${{ inputs.GERRIT_CHANGE_NUMBER }}
          gerrit-patchset-number: ${{ inputs.GERRIT_PATCHSET_NUMBER }}
          vote-type: ${{ env.WORKFLOW_CONCLUSION }}
          comment-only: true