feature: add CI workflow and security policy - #82
amitmanchella-cog wants to merge 1 commit into
Conversation
Co-Authored-By: Amit Manchella <amit.manchella@cognition.ai>
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| cache: maven | ||
|
|
||
| - name: Build and test | ||
| run: ./mvnw -B verify |
There was a problem hiding this comment.
🟡 CI skips application compilation and tests
./mvnw -B verify reports success without compiling application sources or running tests. The pom packaging omits both phases from Maven's default lifecycle. Broken application changes can pass CI.
Learn more
Maven binds compilation and test execution to the default lifecycle only for artifact packaging such as jar. This project declares pom packaging, which represents an aggregator or parent project and has no Java compile or test bindings. The workflow therefore validates dependency resolution and the configured Spring Boot goal, but not src/main/java or any future src/test/java files.
Example: A pull request can introduce invalid syntax in TopicController.java. The new CI job still exits successfully because Maven never invokes maven-compiler-plugin for this project.
Recommended fix: Change the project packaging to jar so ./mvnw -B verify exercises the normal Java lifecycle, or run a build command that explicitly compiles and tests the application. Verify the corrected workflow fails for an intentionally uncompilable source change.
Was this helpful? React with 👍 or 👎 to provide feedback.
There was a problem hiding this comment.
Confirmed and already called out in the PR description: <packaging>pom</packaging> is pre-existing in pom.xml, so verify only runs the Spring Boot repackage goal. Changing the packaging to jar is a build-config change outside this PR's scope (CI workflow + SECURITY.md), so I've left it as-is and flagged it to the requester as a follow-up decision.
1 participant
Summary
Adds a GitHub Actions CI workflow and a security policy. Both files are new — the repo had no
.github/workflows/directory and no existingSECURITY.md..github/workflows/ci.ymlpushandpull_requesttomaster(the repo's default branch).actions/checkout@v4+actions/setup-java@v4(distribution: temurin,java-version: '8',cache: maven)../mvnw -B verify.pom.xmldeclares<java.version>1.8</java.version>(Spring Boot parent2.0.2.RELEASE), andbuild.gradlealso declaressourceCompatibility = 1.8. Maven is used since the repo ships a Maven wrapper (mvnw,.mvn/wrapper); the Gradle wrapper (Gradle 4.6) is present but is not used by CI.mvnwis now marked executable (100644→100755) so./mvnwruns on the GitHub runner without achmodstep.SECURITY.md(new): Supported Versions table (master/ 0.1.0 supported) and a Reporting a Vulnerability section pointing to GitHub Security Advisories (Security tab → "Report a vulnerability"), asking that no public issues be opened, with a 5-business-day response target.Local verification
Ran the exact CI command locally with Temurin-equivalent OpenJDK 8 (
openjdk 1.8.0_502):Caveat worth knowing (pre-existing, not changed here):
pom.xmlhas<packaging>pom</packaging>, so Maven's default lifecycle does not compilesrc/main/javaor run tests —verifyonly runs the Spring Bootrepackagegoal. The build therefore passes trivially. Switching to<packaging>jar</packaging>would make CI actually compile the sources, but that's out of scope for this PR.Devin-Org: engineering
Link to Devin session: https://app.devin.ai/sessions/f4c21c2035fb40b3ae7ac5024903cef3
Open in Devin Desktop: https://app.devin.ai/desktop/session/f4c21c2035fb40b3ae7ac5024903cef3?variant=devin
Requested by: @amitmanchella-cog