This repository was archived by the owner on Feb 23, 2024. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 0
264 lines (243 loc) · 9.65 KB
/
Copy pathjava-tests.yml
File metadata and controls
264 lines (243 loc) · 9.65 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
name: Java (Maven) Tests
on:
workflow_call:
inputs:
# <---------------- GENERAL OPTIONS ---------------->
mvn-settings:
required: false
type: boolean
description: "If a maven-settings.xml is required this must be set to true along with the secret for its contents"
default: true
# <------------- CODE CLIMATE OPTIONS -------------->
cc-default-config:
required: false
type: boolean
description: "Set to false if you want to use your own .codeclimate.yml config"
default: true
cc-config-file:
required: false
type: string
description: "Set relative path to your own code climate configuration"
default: '.codeclimate.yml'
cc-info-threshold:
required: false
type: string
description: "Max number of INFO Code Climate findings allowed"
default: 0
cc-minor-threshold:
required: false
type: string
description: "Max number of MINOR Code Climate findings allowed"
default: 0
cc-major-threshold:
required: false
type: string
description: "Max number of MAJOR Code Climate findings allowed"
default: 0
cc-critical-threshold:
required: false
type: string
description: "Max number of CRITICAL Code Climate findings allowed"
default: 0
cc-blocker-threshold:
required: false
type: string
description: "Max number of BLOCKER Code Climate findings allowed"
default: 0
# <--------------- POLARIS OPTIONS ----------------->
polaris-url:
required: true
type: string
description: "Full url of the Polaris server instance"
polaris-project-name:
required: true
type: string
description: "The name of the project in Polaris"
polaris-low-threshold:
required: false
type: string
description: "Max number of LOW Polaris findings allowed"
default: 0
polaris-medium-threshold:
required: false
type: string
description: "Max number of MEDIUM Polaris findings allowed"
default: 0
polaris-high-threshold:
required: false
type: string
description: "Max number of HIGH Polaris findings allowed"
default: 0
polaris-critical-threshold:
required: false
type: string
description: "Max number of CRITICAL Polaris findings allowed"
default: 0
polaris-total-threshold:
required: false
type: string
description: "Max number of TOTAL Polaris findings allowed"
default: 0
# <-------------- UNIT-TEST OPTIONS ---------------->
gcp-sa-auth:
required: false
type: boolean
description: "If GCP authentication using a service account JSON key is required for any test set to true"
default: false
gcp-oidc-auth:
required: false
type: boolean
description: "If GCP authentication using OIDC is required for any test set to true"
default: false
unit-test-command:
required: false
type: string
description: "Override the unit test command with your own if required"
default: "./mvnw -s maven-settings.xml test --fail-at-end -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn -B"
secrets:
# <------------------ OIDC AUTH -------------------->
wip:
required: false
description: "The workfload identity provider to use for OIDC auth"
service-account:
required: false
description: "The service account to impersonate when using OIDC auth"
# <----------------- SA KEY AUTH ------------------->
service-account-key:
required: false
description: "The service account key to use for authentication"
# <------------------ MAVEN AUTH ------------------->
mvn-settings-file:
required: false
description: "If a maven settings file is required for build then add it here"
# <----------------- POLARIS AUTH ----------------->
polaris-access-token:
required: true
description: "A secret containing your Polaris access token"
outputs:
ref-slug:
description: "A URL sanitized version of the github ref"
value: ${{ jobs.code-quality.outputs.ref-slug }}
short-sha:
description: "Captures the short SHA for use in this or later workflow jobs"
value: ${{ jobs.code-quality.outputs.short-sha }}
jobs:
# <------------------- CODE QUALITY -------------------->
code-quality:
name: Code Quality
runs-on: ubuntu-latest
outputs:
short-sha: ${{ env.GITHUB_SHA_SHORT }}
ref-slug: ${{ env.GITHUB_REF_SLUG_URL }}
steps:
- name: Checkout
uses: actions/checkout@v2
- name: Slugify github variables
uses: rlespinasse/github-slug-action@v4
- name: Get Configuration
if: ${{ inputs.cc-default-config }}
run: |
echo "Fetching default configuration from erzz/workflows..."
curl -L --fail -o .codeclimate.yml https://raw.githubusercontent.com/erzz/workflows/main/.github/workflows/configs/.java-codeclimate.yml || exit 1
- name: Code Climate Standalone
uses: erzz/codeclimate-standalone@v0.0.3
with:
html_report: true
config_file: ${{ inputs.cc-config-file }}
info_threshold: ${{ inputs.cc-info-threshold }}
minor_threshold: ${{ inputs.cc-minor-threshold }}
major_threshold: ${{ inputs.cc-major-threshold }}
critical_threshold: ${{ inputs.cc-critical-threshold }}
blocker_threshold: ${{ inputs.cc-blocker-threshold }}
- name: Upload Code Climate Report
uses: actions/upload-artifact@v2
if: always()
with:
name: Code Climate Reports
path: |
codeclimate-report.json
codeclimate-report.html
# <------------------- SAST POLARIS -------------------->
sast:
name: Polaris SAST
runs-on: ubuntu-latest
env:
POLARIS_URL: ${{ inputs.polaris-url }}
POLARIS_ACCESS_TOKEN: ${{ secrets.polaris-access-token }}
PROJECT_NAME: ${{ inputs.polaris-project-name }}
steps:
- name: Checkout Source
uses: actions/checkout@v2
- name: Slugify github variables
uses: rlespinasse/github-slug-action@v4
- name: Include maven-settings.xml
if: ${{ inputs.mvn-settings }}
env:
# Hack to handle passing of strings with mixed quotes
FILE: ${{ secrets.mvn-settings-file }}
run: |
echo "Creating maven-settings.xml..."
echo "$FILE" > maven-settings.xml
- name: Polaris SAST Scan
env:
PROJECT_NAME: ${{ inputs.polaris-project-name }}
SEM_VER_REGEX: "^v[0-9]+\\.[0-9]+\\.[0-9]+$"
run: |
# Fetch the result analzer script
echo "Fetching Polaris Result Analyzer from erzz/workflows..."
curl -L --fail -o polaris-result-analyzer.py https://raw.githubusercontent.com/erzz/workflows/main/.github/workflows/utils/polaris-result-analyzer.py || exit 1
# Fetch the Polaris config
echo "Fetching polaris.yml from erzz/workflows..."
curl -L --fail -o polaris.yml https://raw.githubusercontent.com/erzz/workflows/main/.github/workflows/configs/polaris.yml || exit 1
# skip if running as part of a release commit
if (echo ${{ env.GITHUB_REF_SLUG }} | grep -Eq ${{ env.SEM_VER_REGEX }}); then
echo "Skipping this job as it was triggered from a release commit" && exit 0
fi
# else install and execute
wget -q "$POLARIS_URL/api/tools/polaris_cli-linux64.zip"
unzip -j polaris_cli-linux64.zip -d /tmp
/tmp/polaris -s $POLARIS_URL analyze -w
# Pass / Fail depending on the thresholds
python3 polaris-result-analyzer.py --max-total=${{ inputs.polaris-total-threshold }} --max-critical=${{ inputs.polaris-critical-threshold }} --max-high=${{ inputs.polaris-high-threshold }} --max-medium=${{ inputs.polaris-medium-threshold }} --max-low=${{ inputs.polaris-low-threshold }}
- name: Upload scan reports
if: always()
uses: actions/upload-artifact@v2.3.1
with:
name: Polaris SAST Reports
path: .synopsys/polaris/cli-scan.json
# <------------------- UNIT TESTS --------------------->
unit-tests:
name: Unit Tests
runs-on: ubuntu-latest
steps:
- name: Checkout the code
uses: actions/checkout@v2
- name: Authenticate to GCP (SA Key)
if: ${{ inputs.gcp-sa-auth }}
uses: google-github-actions/auth@v0
with:
credentials_json: ${{ secrets.service-account-key }}
- name: Authenticate to GCP (OIDC)
if: ${{ inputs.gcp-oidc-auth }}
uses: google-github-actions/auth@v0
with:
workload_identity_provider: ${{ secrets.wip }}
service_account: ${{ secrets.service-account }}
- name: Include maven-settings.xml
if: ${{ inputs.mvn-settings }}
env:
# Hack to handle passing of strings with mixed quotes
FILE: ${{ secrets.mvn-settings-file }}
run: |
echo "Creating maven-settings.xml..."
echo "$FILE" > maven-settings.xml
- name: Execute Unit Tests
run: ${{ inputs.unit-test-command }}
- name: Upload Unit Test Reports
uses: actions/upload-artifact@v2
if: always()
with:
name: Unit Test Reports
path: |
**/target/jacoco/reports/
**/target/surefire-reports/TEST-*.xml