mirror of
https://github.com/arsvendg/Stirling-PDF.git
synced 2026-07-14 18:44:05 +02:00
762 lines
30 KiB
YAML
762 lines
30 KiB
YAML
name: Build and Test Workflow
|
||
|
||
on:
|
||
pull_request:
|
||
branches: ["main"]
|
||
merge_group:
|
||
branches: ["main"]
|
||
workflow_dispatch:
|
||
|
||
# cancel in-progress jobs if a new job is triggered
|
||
# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
|
||
# or a pull request is updated.
|
||
# It helps to save resources and time by ensuring that only the latest commit is built and tested
|
||
# This is particularly useful for long-running jobs that may take a while to complete.
|
||
# The `group` is set to a combination of the workflow name, event name, and branch name.
|
||
# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
|
||
# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
|
||
concurrency:
|
||
group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref_name || github.ref }}
|
||
cancel-in-progress: true
|
||
|
||
permissions:
|
||
contents: read
|
||
|
||
jobs:
|
||
files-changed:
|
||
name: detect what files changed
|
||
runs-on: ubuntu-latest
|
||
timeout-minutes: 3
|
||
outputs:
|
||
build: ${{ steps.changes.outputs.build }}
|
||
project: ${{ steps.changes.outputs.project }}
|
||
openapi: ${{ steps.changes.outputs.openapi }}
|
||
frontend: ${{ steps.changes.outputs.frontend }}
|
||
docker-base: ${{ steps.changes.outputs.docker-base }}
|
||
steps:
|
||
- name: Harden the runner (Audit all outbound calls)
|
||
uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
|
||
with:
|
||
egress-policy: audit
|
||
- name: Checkout repository
|
||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||
|
||
- name: Check for file changes
|
||
uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
|
||
id: changes
|
||
with:
|
||
filters: .github/config/.files.yaml
|
||
|
||
build:
|
||
runs-on: ubuntu-latest
|
||
permissions:
|
||
actions: read
|
||
security-events: write
|
||
pull-requests: write
|
||
strategy:
|
||
fail-fast: false
|
||
matrix:
|
||
jdk-version: [21, 25]
|
||
spring-security: [true, false]
|
||
steps:
|
||
- name: Harden Runner
|
||
uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
|
||
with:
|
||
egress-policy: audit
|
||
- name: Checkout repository
|
||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||
|
||
- name: Set up JDK ${{ matrix.jdk-version }}
|
||
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
|
||
with:
|
||
java-version: ${{ matrix.jdk-version }}
|
||
distribution: "temurin"
|
||
|
||
- name: Cache Gradle dependency artifacts
|
||
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
|
||
with:
|
||
path: |
|
||
~/.gradle/wrapper
|
||
~/.gradle/caches/modules-2/files-2.1
|
||
~/.gradle/caches/modules-2/metadata-2.*
|
||
key: gradle-deps-${{ runner.os }}-jdk-${{ matrix.jdk-version }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
|
||
|
||
- name: Setup Gradle
|
||
uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
|
||
with:
|
||
gradle-version: 9.3.1
|
||
cache-disabled: true
|
||
|
||
- name: Install Task
|
||
uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
|
||
- name: Check Java formatting (Spotless)
|
||
if: matrix.jdk-version == 25 && matrix.spring-security == false
|
||
id: spotless-check
|
||
run: task backend:format:check
|
||
continue-on-error: true
|
||
env:
|
||
MAVEN_USER: ${{ secrets.MAVEN_USER }}
|
||
MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
|
||
MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
|
||
|
||
- name: Comment on Java formatting failure
|
||
# Only post a comment on PRs. github-script's PR helpers need an
|
||
# issue/PR number, which doesn't exist on merge_group runs.
|
||
if: steps.spotless-check.outcome == 'failure' && github.event_name == 'pull_request'
|
||
continue-on-error: true
|
||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
|
||
with:
|
||
script: |
|
||
const marker = '<!-- java-formatting-check -->';
|
||
const body = [
|
||
marker,
|
||
'### Java Formatting Check Failed',
|
||
'',
|
||
'Your code has formatting issues. Run the following command to fix them:',
|
||
'',
|
||
'```bash',
|
||
'task backend:format',
|
||
'```',
|
||
'',
|
||
'Then commit and push the changes.',
|
||
].join('\n');
|
||
const { data: comments } = await github.rest.issues.listComments({
|
||
owner: context.repo.owner,
|
||
repo: context.repo.repo,
|
||
issue_number: context.issue.number,
|
||
});
|
||
const existing = comments.find(c => c.body.includes(marker));
|
||
if (existing) {
|
||
await github.rest.issues.updateComment({
|
||
owner: context.repo.owner,
|
||
repo: context.repo.repo,
|
||
comment_id: existing.id,
|
||
body,
|
||
});
|
||
} else {
|
||
await github.rest.issues.createComment({
|
||
owner: context.repo.owner,
|
||
repo: context.repo.repo,
|
||
issue_number: context.issue.number,
|
||
body,
|
||
});
|
||
}
|
||
|
||
- name: Fail if Java formatting issues found
|
||
if: steps.spotless-check.outcome == 'failure'
|
||
run: |
|
||
echo "============================================"
|
||
echo " Java Formatting Check Failed"
|
||
echo "============================================"
|
||
echo ""
|
||
echo "Your code has formatting issues."
|
||
echo "Run the following command to fix them:"
|
||
echo ""
|
||
echo " task backend:format"
|
||
echo ""
|
||
echo "Then commit and push the changes."
|
||
echo "============================================"
|
||
exit 1
|
||
|
||
- name: Build with Gradle and spring security ${{ matrix.spring-security }}
|
||
run: task backend:build:ci
|
||
env:
|
||
MAVEN_USER: ${{ secrets.MAVEN_USER }}
|
||
MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
|
||
MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
|
||
DISABLE_ADDITIONAL_FEATURES: ${{ matrix.spring-security }}
|
||
|
||
- name: Check Test Reports Exist
|
||
if: always()
|
||
run: |
|
||
declare -a dirs=(
|
||
"app/core/build/reports/tests/"
|
||
"app/core/build/test-results/"
|
||
"app/common/build/reports/tests/"
|
||
"app/common/build/test-results/"
|
||
"app/proprietary/build/reports/tests/"
|
||
"app/proprietary/build/test-results/"
|
||
)
|
||
for dir in "${dirs[@]}"; do
|
||
if [ ! -d "$dir" ]; then
|
||
echo "Missing $dir"
|
||
exit 1
|
||
fi
|
||
done
|
||
|
||
- name: Upload Test Reports
|
||
if: always()
|
||
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
|
||
with:
|
||
name: test-reports-jdk-${{ matrix.jdk-version }}-spring-security-${{ matrix.spring-security }}
|
||
path: |
|
||
app/**/build/reports/jacoco/test
|
||
app/**/build/reports/tests/
|
||
app/**/build/test-results/
|
||
app/**/build/reports/problems/
|
||
build/reports/problems/
|
||
retention-days: 3
|
||
if-no-files-found: warn
|
||
|
||
- name: Add coverage to PR with spring security ${{ matrix.spring-security }} and JDK ${{ matrix.jdk-version }}
|
||
# The action only supports the pull_request event (it posts a PR comment),
|
||
# so skip it for merge_group runs and workflow_dispatch.
|
||
if: github.event_name == 'pull_request'
|
||
id: jacoco
|
||
uses: madrapps/jacoco-report@50d3aff4548aa991e6753342d9ba291084e63848 # v1.7.2
|
||
with:
|
||
paths: |
|
||
${{ github.workspace }}/**/build/reports/jacoco/test/jacocoTestReport.xml
|
||
token: ${{ secrets.GITHUB_TOKEN }}
|
||
min-coverage-overall: 10
|
||
min-coverage-changed-files: 0
|
||
comment-type: summary
|
||
|
||
check-generateOpenApiDocs:
|
||
if: needs.files-changed.outputs.openapi == 'true'
|
||
needs: [files-changed]
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- name: Harden Runner
|
||
uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
|
||
with:
|
||
egress-policy: audit
|
||
|
||
- name: Checkout repository
|
||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||
|
||
- name: Set up JDK 25
|
||
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
|
||
with:
|
||
java-version: "25"
|
||
distribution: "temurin"
|
||
|
||
- name: Cache Gradle dependency artifacts
|
||
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
|
||
with:
|
||
path: |
|
||
~/.gradle/wrapper
|
||
~/.gradle/caches/modules-2/files-2.1
|
||
~/.gradle/caches/modules-2/metadata-2.*
|
||
key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
|
||
|
||
- name: Setup Gradle
|
||
uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
|
||
with:
|
||
gradle-version: 9.3.1
|
||
cache-disabled: true
|
||
|
||
- name: Install Task
|
||
uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
|
||
- name: Generate OpenAPI documentation
|
||
run: task backend:swagger
|
||
env:
|
||
MAVEN_USER: ${{ secrets.MAVEN_USER }}
|
||
MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
|
||
MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
|
||
DISABLE_ADDITIONAL_FEATURES: true
|
||
|
||
- name: Upload OpenAPI Documentation
|
||
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
|
||
with:
|
||
name: openapi-docs
|
||
path: ./SwaggerDoc.json
|
||
|
||
frontend-validation:
|
||
if: needs.files-changed.outputs.frontend == 'true'
|
||
needs: files-changed
|
||
runs-on: ubuntu-latest
|
||
permissions:
|
||
contents: read
|
||
pull-requests: write
|
||
steps:
|
||
- name: Harden Runner
|
||
uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
|
||
with:
|
||
egress-policy: audit
|
||
- name: Checkout repository
|
||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||
- name: Set up Node.js
|
||
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
|
||
with:
|
||
node-version: "22"
|
||
cache: "npm"
|
||
cache-dependency-path: frontend/package-lock.json
|
||
- name: Install Task
|
||
uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
|
||
- name: Quality-check frontend
|
||
id: frontend-check
|
||
run: task frontend:check:all
|
||
continue-on-error: true
|
||
- name: Comment on frontend check failure
|
||
# Only post a comment on PRs. github-script's PR helpers need an
|
||
# issue/PR number, which doesn't exist on merge_group runs.
|
||
if: steps.frontend-check.outcome == 'failure' && github.event_name == 'pull_request'
|
||
continue-on-error: true
|
||
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
|
||
with:
|
||
script: |
|
||
const marker = '<!-- frontend-check -->';
|
||
const body = [
|
||
marker,
|
||
'### Frontend Check Failed',
|
||
'',
|
||
'There are issues with your frontend code that will need to be fixed before they can be merged in.',
|
||
'',
|
||
'Run `task frontend:fix` to auto-fix what can be fixed automatically, then run `task frontend:check:all` to see what still needs fixing manually.',
|
||
].join('\n');
|
||
const { data: comments } = await github.rest.issues.listComments({
|
||
owner: context.repo.owner,
|
||
repo: context.repo.repo,
|
||
issue_number: context.issue.number,
|
||
});
|
||
const existing = comments.find(c => c.body.includes(marker));
|
||
if (existing) {
|
||
await github.rest.issues.updateComment({
|
||
owner: context.repo.owner,
|
||
repo: context.repo.repo,
|
||
comment_id: existing.id,
|
||
body,
|
||
});
|
||
} else {
|
||
await github.rest.issues.createComment({
|
||
owner: context.repo.owner,
|
||
repo: context.repo.repo,
|
||
issue_number: context.issue.number,
|
||
body,
|
||
});
|
||
}
|
||
- name: Fail if frontend check failed
|
||
if: steps.frontend-check.outcome == 'failure'
|
||
run: |
|
||
echo "============================================"
|
||
echo " Frontend Check Failed"
|
||
echo "============================================"
|
||
echo ""
|
||
echo "There are issues with your frontend code that"
|
||
echo "will need to be fixed before they can be merged in."
|
||
echo ""
|
||
echo "Run 'task frontend:fix' to auto-fix what can be"
|
||
echo "fixed automatically, then run 'task frontend:check:all'"
|
||
echo "to see what still needs fixing manually."
|
||
echo "============================================"
|
||
exit 1
|
||
- name: Upload frontend build artifacts
|
||
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
|
||
with:
|
||
name: frontend-build
|
||
path: frontend/dist/
|
||
retention-days: 3
|
||
|
||
playwright-e2e:
|
||
# Backend-free stubbed suite — fast, no Spring Boot required.
|
||
if: needs.files-changed.outputs.frontend == 'true'
|
||
needs: files-changed
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- name: Harden Runner
|
||
uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
|
||
with:
|
||
egress-policy: audit
|
||
- name: Checkout repository
|
||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||
- name: Set up Node.js
|
||
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
|
||
with:
|
||
node-version: "22"
|
||
cache: "npm"
|
||
cache-dependency-path: frontend/package-lock.json
|
||
- name: Install Task
|
||
uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
|
||
- name: Install Playwright (chromium only)
|
||
run: task frontend:test:e2e:install -- chromium
|
||
- name: Run stubbed E2E tests (chromium)
|
||
run: task frontend:test:e2e -- --project=stubbed --workers=3
|
||
- name: Upload Playwright report
|
||
if: always()
|
||
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
|
||
with:
|
||
name: playwright-report-stubbed-${{ github.run_id }}
|
||
path: frontend/playwright-report/
|
||
retention-days: 7
|
||
|
||
playwright-e2e-live:
|
||
# Live-backend suite — boots Spring Boot and runs auth + real tool round-trips.
|
||
if: needs.files-changed.outputs.frontend == 'true'
|
||
needs: files-changed
|
||
runs-on: ubuntu-latest
|
||
timeout-minutes: 30
|
||
steps:
|
||
- name: Harden Runner
|
||
uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
|
||
with:
|
||
egress-policy: audit
|
||
- name: Checkout repository
|
||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||
- name: Set up JDK 25
|
||
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
|
||
with:
|
||
java-version: "25"
|
||
distribution: "temurin"
|
||
- name: Set up Node.js
|
||
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
|
||
with:
|
||
node-version: "22"
|
||
cache: "npm"
|
||
cache-dependency-path: frontend/package-lock.json
|
||
- name: Install Task
|
||
uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
|
||
- name: Install Playwright (chromium only)
|
||
run: task frontend:test:e2e:install -- chromium
|
||
- name: Start Spring Boot backend (background)
|
||
env:
|
||
# Suppress the analytics opt-in modal that fires on first admin login when
|
||
# enableAnalytics is null (see Onboarding.tsx). The modal renders a Mantine
|
||
# overlay that intercepts pointer events on every tool page until dismissed,
|
||
# which causes every "click run button" assertion in the live suite to fail.
|
||
SYSTEM_ENABLEANALYTICS: "false"
|
||
# NOTE: SECURITY_INITIALLOGIN_USERNAME/PASSWORD are intentionally NOT set.
|
||
# The live-setup project's bootstrap spec performs the real first-login
|
||
# flow against the backend's default admin/stirling user, exercising the
|
||
# forced-password-change UI and leaving the DB at admin/adminadmin for
|
||
# the rest of the live suite. This is both real coverage of the first-
|
||
# login flow and a stronger seed than env-var-driven user creation.
|
||
run: |
|
||
nohup ./gradlew :stirling-pdf:bootRun > /tmp/backend.log 2>&1 &
|
||
echo $! > /tmp/backend.pid
|
||
- name: Wait for backend to become ready
|
||
run: |
|
||
start=$SECONDS
|
||
# 300 iterations × 2s = 10 minute ceiling
|
||
for i in $(seq 1 300); do
|
||
if curl -fsS http://localhost:8080/api/v1/info/status >/dev/null 2>&1; then
|
||
echo "Backend up after $((SECONDS - start))s"
|
||
exit 0
|
||
fi
|
||
sleep 2
|
||
done
|
||
echo "Backend did not become ready in $((SECONDS - start))s"
|
||
tail -200 /tmp/backend.log || true
|
||
exit 1
|
||
- name: Run live E2E tests (chromium)
|
||
id: live-tests
|
||
run: task frontend:test:e2e -- --project=live
|
||
- name: Print backend log on failure
|
||
if: failure() && steps.live-tests.conclusion == 'failure'
|
||
run: |
|
||
echo "::group::Spring Boot backend log (last 500 lines)"
|
||
tail -500 /tmp/backend.log || echo "no backend log found"
|
||
echo "::endgroup::"
|
||
- name: Stop backend
|
||
if: always()
|
||
run: |
|
||
if [ -f /tmp/backend.pid ]; then
|
||
kill "$(cat /tmp/backend.pid)" 2>/dev/null || true
|
||
fi
|
||
- name: Upload backend log
|
||
if: always()
|
||
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
|
||
with:
|
||
name: backend-log-live-${{ github.run_id }}
|
||
path: /tmp/backend.log
|
||
retention-days: 7
|
||
- name: Upload Playwright report
|
||
if: always()
|
||
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
|
||
with:
|
||
name: playwright-report-live-${{ github.run_id }}
|
||
path: frontend/playwright-report/
|
||
retention-days: 7
|
||
|
||
check-licence:
|
||
if: needs.files-changed.outputs.build == 'true'
|
||
needs: [files-changed, build]
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- name: Harden Runner
|
||
uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
|
||
with:
|
||
egress-policy: audit
|
||
|
||
- name: Checkout repository
|
||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||
|
||
- name: Set up JDK 25
|
||
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
|
||
with:
|
||
java-version: "25"
|
||
distribution: "temurin"
|
||
|
||
- name: Cache Gradle dependency artifacts
|
||
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
|
||
with:
|
||
path: |
|
||
~/.gradle/wrapper
|
||
~/.gradle/caches/modules-2/files-2.1
|
||
~/.gradle/caches/modules-2/metadata-2.*
|
||
key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
|
||
|
||
- name: Setup Gradle
|
||
uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
|
||
with:
|
||
gradle-version: 9.3.1
|
||
cache-disabled: true
|
||
|
||
- name: Install Task
|
||
uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
|
||
- name: Check licenses for compatibility
|
||
run: task backend:licenses:check
|
||
env:
|
||
MAVEN_USER: ${{ secrets.MAVEN_USER }}
|
||
MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
|
||
MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
|
||
|
||
- name: FAILED - check the licenses for compatibility
|
||
if: failure()
|
||
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
|
||
with:
|
||
name: dependencies-without-allowed-license.json
|
||
path: build/reports/dependency-license/dependencies-without-allowed-license.json
|
||
retention-days: 3
|
||
|
||
docker-compose-tests:
|
||
if: needs.files-changed.outputs.project == 'true'
|
||
needs: files-changed
|
||
# if: github.event_name == 'push' && github.ref == 'refs/heads/main' ||
|
||
# (github.event_name == 'pull_request' &&
|
||
# contains(github.event.pull_request.labels.*.name, 'licenses') == false &&
|
||
# (
|
||
# contains(github.event.pull_request.labels.*.name, 'Front End') ||
|
||
# contains(github.event.pull_request.labels.*.name, 'Java') ||
|
||
# contains(github.event.pull_request.labels.*.name, 'Back End') ||
|
||
# contains(github.event.pull_request.labels.*.name, 'Security') ||
|
||
# contains(github.event.pull_request.labels.*.name, 'API') ||
|
||
# contains(github.event.pull_request.labels.*.name, 'Docker') ||
|
||
# contains(github.event.pull_request.labels.*.name, 'Test')
|
||
# )
|
||
# )
|
||
|
||
runs-on: ubuntu-latest
|
||
permissions:
|
||
actions: write
|
||
contents: read
|
||
checks: write
|
||
|
||
steps:
|
||
- name: Harden Runner
|
||
uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
|
||
with:
|
||
egress-policy: audit
|
||
|
||
- name: Checkout Repository
|
||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||
|
||
- name: Set up JDK 25
|
||
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
|
||
with:
|
||
java-version: "25"
|
||
distribution: "temurin"
|
||
|
||
- name: Cache Gradle dependency artifacts
|
||
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
|
||
with:
|
||
path: |
|
||
~/.gradle/wrapper
|
||
~/.gradle/caches/modules-2/files-2.1
|
||
~/.gradle/caches/modules-2/metadata-2.*
|
||
key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
|
||
|
||
- name: Setup Gradle
|
||
uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
|
||
with:
|
||
gradle-version: 9.3.1
|
||
cache-disabled: true
|
||
|
||
- name: Set up Docker Buildx
|
||
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
|
||
|
||
# Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for docker buildx type=gha cache backend.
|
||
- name: Expose GitHub runtime for Buildx cache
|
||
uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4.0.0
|
||
|
||
- name: Install Docker Compose
|
||
run: |
|
||
sudo curl -SL "https://github.com/docker/compose/releases/download/v2.39.4/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
|
||
sudo chmod +x /usr/local/bin/docker-compose
|
||
|
||
- name: Set up Python
|
||
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
|
||
with:
|
||
python-version: "3.12"
|
||
cache: "pip" # caching pip dependencies
|
||
cache-dependency-path: ./testing/cucumber/requirements.txt
|
||
|
||
- name: Pip requirements
|
||
run: |
|
||
pip install --require-hashes --only-binary=:all: -r ./testing/cucumber/requirements.txt
|
||
|
||
- name: Run Docker Compose Tests
|
||
run: |
|
||
chmod +x ./testing/test_webpages.sh
|
||
chmod +x ./testing/test.sh
|
||
chmod +x ./testing/test_disabledEndpoints.sh
|
||
./testing/test.sh
|
||
env:
|
||
MAVEN_USER: ${{ secrets.MAVEN_USER }}
|
||
MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
|
||
MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
|
||
DOCKER_BASE_CHANGED: ${{ needs.files-changed.outputs.docker-base }}
|
||
|
||
- name: Upload Cucumber Report
|
||
if: always()
|
||
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
|
||
with:
|
||
name: cucumber-report
|
||
path: testing/cucumber/report.html
|
||
retention-days: 7
|
||
if-no-files-found: warn
|
||
|
||
- name: Upload Test Reports
|
||
if: always()
|
||
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
|
||
with:
|
||
name: docker-compose-test-reports
|
||
path: testing/reports/
|
||
retention-days: 7
|
||
if-no-files-found: warn
|
||
|
||
- name: Cucumber Test Report
|
||
if: always()
|
||
uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
|
||
with:
|
||
name: Cucumber Tests
|
||
path: testing/cucumber/junit/*.xml
|
||
reporter: java-junit
|
||
fail-on-error: false
|
||
|
||
test-build-docker-images:
|
||
if: github.event_name == 'pull_request' && needs.files-changed.outputs.project == 'true'
|
||
needs: [files-changed, build, check-generateOpenApiDocs, check-licence]
|
||
runs-on: ubuntu-latest
|
||
strategy:
|
||
fail-fast: false
|
||
matrix:
|
||
include:
|
||
- docker-rev: docker/embedded/Dockerfile
|
||
artifact-suffix: Dockerfile
|
||
cache-scope: stirling-pdf-latest
|
||
- docker-rev: docker/embedded/Dockerfile.ultra-lite
|
||
artifact-suffix: Dockerfile.ultra-lite
|
||
cache-scope: stirling-pdf-ultra-lite
|
||
- docker-rev: docker/embedded/Dockerfile.fat
|
||
artifact-suffix: Dockerfile.fat
|
||
cache-scope: stirling-pdf-fat
|
||
steps:
|
||
- name: Harden Runner
|
||
uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
|
||
with:
|
||
egress-policy: audit
|
||
|
||
- name: Checkout Repository
|
||
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||
|
||
- name: Login to GitHub Container Registry
|
||
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
|
||
with:
|
||
registry: ghcr.io
|
||
username: ${{ github.actor }}
|
||
password: ${{ github.token }}
|
||
|
||
- name: Convert repository owner to lowercase
|
||
id: repoowner
|
||
run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
|
||
|
||
- name: Free disk space on runner
|
||
run: |
|
||
echo "Disk space before cleanup:" && df -h
|
||
sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android /usr/local/share/boost
|
||
docker system prune -af || true
|
||
echo "Disk space after cleanup:" && df -h
|
||
|
||
- name: Set up JDK 25
|
||
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
|
||
with:
|
||
java-version: "25"
|
||
distribution: "temurin"
|
||
|
||
- name: Cache Gradle dependency artifacts
|
||
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
|
||
with:
|
||
path: |
|
||
~/.gradle/wrapper
|
||
~/.gradle/caches/modules-2/files-2.1
|
||
~/.gradle/caches/modules-2/metadata-2.*
|
||
key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
|
||
|
||
- name: Setup Gradle
|
||
uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
|
||
with:
|
||
gradle-version: 9.3.1
|
||
cache-disabled: true
|
||
|
||
- name: Install Task
|
||
uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
|
||
- name: Build application
|
||
run: task backend:build
|
||
env:
|
||
MAVEN_USER: ${{ secrets.MAVEN_USER }}
|
||
MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
|
||
MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
|
||
DISABLE_ADDITIONAL_FEATURES: true
|
||
STIRLING_PDF_DESKTOP_UI: false
|
||
|
||
- name: Set up QEMU
|
||
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
|
||
|
||
- name: Set up Docker Buildx
|
||
id: buildx
|
||
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
|
||
|
||
- name: Build base image locally (PR base change only)
|
||
if: github.event_name == 'pull_request' && needs.files-changed.outputs.docker-base == 'true'
|
||
run: |
|
||
docker build -t stirling-pdf-base:pr-test -f docker/base/Dockerfile docker/base
|
||
|
||
- name: Set base image and platform for this build
|
||
id: build-params
|
||
run: |
|
||
if [ "${{ github.event_name }}" == "pull_request" ] && [ "${{ needs.files-changed.outputs.docker-base }}" == "true" ]; then
|
||
echo "base_image=stirling-pdf-base:pr-test" >> $GITHUB_OUTPUT
|
||
echo "platforms=linux/amd64" >> $GITHUB_OUTPUT
|
||
else
|
||
echo "base_image=stirlingtools/stirling-pdf-base:latest" >> $GITHUB_OUTPUT
|
||
echo "platforms=linux/amd64,linux/arm64/v8" >> $GITHUB_OUTPUT
|
||
fi
|
||
|
||
- name: Build ${{ matrix.docker-rev }}
|
||
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
|
||
with:
|
||
builder: ${{ steps.buildx.outputs.name }}
|
||
context: .
|
||
file: ./${{ matrix.docker-rev }}
|
||
push: false
|
||
cache-from: type=gha,scope=${{ matrix.cache-scope }}
|
||
cache-to: type=gha,mode=max,scope=${{ matrix.cache-scope }}
|
||
platforms: ${{ steps.build-params.outputs.platforms }}
|
||
build-args: |
|
||
BASE_IMAGE=${{ steps.build-params.outputs.base_image }}
|
||
provenance: true
|
||
sbom: true
|
||
|
||
- name: Upload Reports
|
||
if: always()
|
||
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
|
||
with:
|
||
name: reports-docker-${{ matrix.artifact-suffix }}
|
||
path: |
|
||
build/reports/tests/
|
||
build/test-results/
|
||
build/reports/problems/
|
||
retention-days: 3
|
||
if-no-files-found: warn
|