GH Actions CI reporting #11562
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: GH Actions CI reporting | |
| on: | |
| workflow_run: | |
| workflows: [ "GH Actions CI" ] | |
| types: [ completed ] | |
| defaults: | |
| run: | |
| shell: bash | |
| permissions: { } # none, jobs are defining their own if they need any | |
| env: | |
| COMMON_GRADLE_ARGS: "-Igradle/init.gradle" | |
| MIRROR_MAVEN_CENTRAL_URL: "https://maven-central.storage-download.googleapis.com/maven2/" | |
| MIRROR_MAVEN_CENTRAL_FALLBACK: "true" | |
| jobs: | |
| publish-build-scans: | |
| name: Publish Develocity build scans | |
| if: github.repository == 'hibernate/hibernate-orm' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| pull-requests: read | |
| steps: | |
| - name: Determine the branch for which the original action was triggered | |
| id: determine_branch_ref | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| GH_EVENT: ${{ github.event.workflow_run.event }} | |
| FORK_OWNER: ${{ github.event.workflow_run.head_repository.owner.login }} | |
| REPO_OWNER: ${{ github.event.workflow_run.repository.owner.login }} | |
| REPO_FULL_NAME: ${{ github.event.workflow_run.repository.full_name }} | |
| HEAD_BRANCH_NAME: ${{ github.event.workflow_run.head_branch }} | |
| run: | | |
| BRANCH_NAME="$HEAD_BRANCH_NAME" | |
| if [ "$GH_EVENT" == "pull_request" ]; then | |
| if [ "$FORK_OWNER" != "$REPO_OWNER" ]; then | |
| BRANCH_NAME="$FORK_OWNER:$BRANCH_NAME" | |
| fi | |
| GH_RESPONSE=$(gh pr view "$BRANCH_NAME" --repo "$REPO_FULL_NAME" --json baseRefName) | |
| TARGET_BRANCH=$(echo "$GH_RESPONSE" | jq -r '.baseRefName') | |
| echo "::notice::PR target branch: $TARGET_BRANCH" | |
| echo "original_branch_ref=$TARGET_BRANCH" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "::notice::Push event, using head branch: $BRANCH_NAME" | |
| echo "original_branch_ref=$BRANCH_NAME" >> "$GITHUB_OUTPUT" | |
| fi | |
| # Checkout the target branch so that the Develocity plugin version matches | |
| # the one that was used to produce the build scan data. | |
| - name: Check out target branch | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| ref: ${{ steps.determine_branch_ref.outputs.original_branch_ref }} | |
| - name: Set up JDK | |
| uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 | |
| with: | |
| distribution: 'temurin' | |
| java-version: '25' | |
| - name: Generate cache key | |
| id: cache-key | |
| env: | |
| CURRENT_BRANCH: ${{ github.repository != 'hibernate/hibernate-orm' && 'fork' || steps.determine_branch_ref.outputs.original_branch_ref || github.ref_name }} | |
| run: | | |
| CURRENT_MONTH=$(/bin/date -u "+%Y-%m") | |
| CURRENT_DAY=$(/bin/date -u "+%d") | |
| ROOT_CACHE_KEY="buildtool-cache" | |
| { | |
| echo "buildtool-monthly-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}" | |
| echo "buildtool-monthly-branch-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}" | |
| echo "buildtool-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}-${CURRENT_DAY}" | |
| }>> "$GITHUB_OUTPUT" | |
| - name: Restore Maven/Gradle Dependency/Dist Caches | |
| uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: | | |
| ~/.m2/repository/ | |
| ~/.m2/wrapper/ | |
| ~/.gradle/caches/modules-2 | |
| ~/.gradle/wrapper/ | |
| key: ${{ steps.cache-key.outputs.buildtool-cache-key }} | |
| restore-keys: | | |
| ${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}- | |
| ${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}- | |
| - name: Download GitHub Actions artifacts for the Develocity build scans | |
| id: downloadBuildScan | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: build-scan-data-* | |
| github-token: ${{ github.token }} | |
| repository: ${{ github.repository }} | |
| run-id: ${{ github.event.workflow_run.id }} | |
| path: /tmp/downloaded-build-scan-data/ | |
| # Don't fail the build if there are no matching artifacts | |
| continue-on-error: true | |
| - name: Publish Develocity build scans for previous builds | |
| if: ${{ steps.downloadBuildScan.outcome != 'failure'}} | |
| run: | | |
| shopt -s nullglob # Don't run the loop below if there are no artifacts | |
| read -ra common_gradle_args <<< "$COMMON_GRADLE_ARGS" | |
| published=0 | |
| failed=0 | |
| mkdir -p ~/.gradle/ | |
| for build_scan_data_directory in /tmp/downloaded-build-scan-data/* | |
| do | |
| rm -rf ~/.gradle/build-scan-data | |
| mv "$build_scan_data_directory" ~/.gradle/build-scan-data | |
| if ./gradlew "${common_gradle_args[@]}" --no-build-cache buildScanPublishPrevious; then | |
| published=$((published + 1)) | |
| else | |
| echo "::warning::Failed to publish build scan from $(basename "$build_scan_data_directory")" | |
| failed=$((failed + 1)) | |
| fi | |
| done | |
| echo "Published $published build scan(s), $failed failed" | |
| env: | |
| DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY_PR }} | |
| publish-sonar-scans: | |
| name: Publish Sonar scan | |
| if: github.repository == 'hibernate/hibernate-orm' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| pull-requests: read | |
| steps: | |
| - name: Determine the Branch Reference for which the original action was triggered | |
| id: determine_branch_ref | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| GH_EVENT: ${{ github.event.workflow_run.event }} | |
| FORK_OWNER: ${{ github.event.workflow_run.head_repository.owner.login }} | |
| REPO_OWNER: ${{ github.event.workflow_run.repository.owner.login }} | |
| REPO_FULL_NAME: ${{ github.event.workflow_run.repository.full_name }} | |
| HEAD_BRANCH_NAME: ${{ github.event.workflow_run.head_branch }} | |
| run: | | |
| BRANCH_NAME="$HEAD_BRANCH_NAME" | |
| if [ "$GH_EVENT" == "pull_request" ]; then | |
| echo "::notice::Triggering workflow was executed for a pull request" | |
| if [ "$FORK_OWNER" != "$REPO_OWNER" ]; then | |
| BRANCH_NAME="$FORK_OWNER:$BRANCH_NAME" | |
| fi | |
| GH_RESPONSE=$(gh pr view "$BRANCH_NAME" --repo "$REPO_FULL_NAME" --json number,baseRefName) | |
| TARGET_BRANCH=$(echo "$GH_RESPONSE" | jq -r '.baseRefName') | |
| PR_ID=$(echo "$GH_RESPONSE" | jq -r '.number') | |
| echo "::notice::PR found. Target branch is: $TARGET_BRANCH" | |
| echo "::notice:: Pull Request number is: $PR_ID" | |
| echo "::notice:: Branch to merge is: $BRANCH_NAME" | |
| { | |
| echo "original_branch_ref=$TARGET_BRANCH" | |
| echo "pr_id=$PR_ID" | |
| echo "branch_to_merge=$BRANCH_NAME" | |
| } >> "$GITHUB_OUTPUT" | |
| else | |
| echo "::notice::Triggering workflow was executed for a push event? Using the head_branch value." | |
| echo "original_branch_ref=$BRANCH_NAME" >> "$GITHUB_OUTPUT" | |
| fi | |
| # Checkout target branch (from the main repository) | |
| - name: Check out target branch | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| # By default, a workflow that is triggered with on workflow_run would run on the main (default) branch. | |
| # Different branches might have different versions of Develocity, and we want to make sure | |
| # that we publish with the one that we built the scan with in the first place. | |
| ref: ${{ steps.determine_branch_ref.outputs.original_branch_ref }} | |
| fetch-depth: 0 | |
| # Note: we need to check out the code with all the changes so that we have the sources, | |
| # matching our compiled classes we'll pull from the build artifacts. | |
| # We won't be running any builds from the checked out code, | |
| # but we'll use the code to run the sonar scanner tool. | |
| # | |
| # Only needed if we are analysing the PR, | |
| # as otherwise the previous checkout already did the work. | |
| - name: Check out merged code (if PR) | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| GH_EVENT: ${{ github.event.workflow_run.event }} | |
| GH_PR_ID: ${{steps.determine_branch_ref.outputs.pr_id}} | |
| run: | | |
| if [ "$GH_EVENT" == "pull_request" ]; then | |
| gh pr checkout "$GH_PR_ID" | |
| fi | |
| # so we aren't tempted to run a Gradle command! | |
| rm -rf gradlew* | |
| - name: Set up Java 25 | |
| uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 | |
| with: | |
| java-version: 25 | |
| distribution: temurin | |
| - name: Download coverage reports | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: build-results-data | |
| github-token: ${{ github.token }} | |
| repository: ${{ github.repository }} | |
| run-id: ${{ github.event.workflow_run.id }} | |
| path: . | |
| merge-multiple: 'true' | |
| # Don't fail the build if there are no matching artifacts | |
| continue-on-error: true | |
| - name: Install Sonar CLI | |
| run: | | |
| SONAR_HASH="8fbfb1eb546b734a60fc3e537108f06e389a8ca124fbab3a16236a8a51edcc15" | |
| SONAR_SCANNER_VERSION="8.0.1.6346" | |
| export SONAR_SCANNER_HOME="$HOME/.sonar/sonar-scanner-$SONAR_SCANNER_VERSION" | |
| curl --create-dirs --fail -sSLo "$HOME/.sonar/sonar-scanner.zip" https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-$SONAR_SCANNER_VERSION.zip | |
| DOWNLOADED_HASH=$(sha256sum "$HOME/.sonar/sonar-scanner.zip" | awk '{print $1}') | |
| if [ "$DOWNLOADED_HASH" == "$SONAR_HASH" ]; then | |
| echo "Successfully verified the file checksum" | |
| else | |
| echo "Error: Failed the file checksum verification. Expected: $SONAR_HASH but got $DOWNLOADED_HASH instead" | |
| exit 1 | |
| fi | |
| unzip -o "$HOME/.sonar/sonar-scanner.zip" -d "$HOME/.sonar/" | |
| mv "$HOME/.sonar/sonar-scanner-$SONAR_SCANNER_VERSION"/* "$HOME/.sonar/" | |
| - name: Sonar Analysis | |
| env: | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | |
| GH_EVENT: ${{ github.event.workflow_run.event }} | |
| HEAD_BRANCH: ${{github.event.workflow_run.head_branch}} | |
| STEP_OUTPUT_BRANCH_TO_MERGE: ${{steps.determine_branch_ref.outputs.branch_to_merge}} | |
| STEP_OUTPUT_PR_ID: ${{steps.determine_branch_ref.outputs.pr_id}} | |
| STEP_OUTPUT_ORIGINAL_BRANCH_REF: ${{steps.determine_branch_ref.outputs.original_branch_ref}} | |
| run: | | |
| find . -name "*.exec" -type f | |
| EXTRA_ARGS=() | |
| if [ "$GH_EVENT" == "pull_request" ]; then | |
| echo "::notice::Triggering workflow was executed for a pull request" | |
| EXTRA_ARGS=( | |
| "-Dsonar.pullrequest.branch=$STEP_OUTPUT_BRANCH_TO_MERGE" | |
| "-Dsonar.pullrequest.key=$STEP_OUTPUT_PR_ID" | |
| "-Dsonar.pullrequest.base=$STEP_OUTPUT_ORIGINAL_BRANCH_REF" | |
| "-Dsonar.pullrequest.provider=GitHub" | |
| "-Dsonar.pullrequest.github.repository=hibernate/hibernate-orm" | |
| ) | |
| else | |
| EXTRA_ARGS=("-Dsonar.branch.name=$HEAD_BRANCH") | |
| fi | |
| "$HOME/.sonar/bin/sonar-scanner" "${EXTRA_ARGS[@]}" \ | |
| -Dsonar.host.url="https://sonarcloud.io" \ | |
| -Dsonar.organization="hibernate" \ | |
| -Dsonar.projectKey="hibernate_hibernate-orm" \ | |
| -Dsonar.java.libraries="$(pwd)/target/sonar-dependencies/*.jar" \ | |
| -Dsonar.coverage.jacoco.xmlReportPaths="$(pwd)/reporting/target/reports/jacoco/mergeCodeCoverageReport/mergeCodeCoverageReport.xml" |