Skip to content

Commit beaa735

Browse files
Pil0tXiaPil0tXia
authored
[ISSUE #4720] Modernize CI license check and Enable Dependabot (#4827)
* Sync changes in #4719 * minor change * Only keep the artifact name * Run `sed -i 's/-[0-9].*\.jar//g'` * Run `sort known-dependencies.txt | uniq > known-dependencies-unique.txt` * Allow CI to run on branches with namespace in the branch name in forked repos * Correct typo and remove useless command * Use `sort -u -o` instead of `uniq` to remove duplicate artifacts with different version * Enlarge open-pull-requests-limit * minor: polish tips * Test apache/skywalking-eyes/dependency CI result * Fix 'unable to find version `0.6.0`' * See debug log to prove it works * skywalking-eyes/dependency doesn't support gradle, test basic actions/dependency-review-action * Add all denied licenses * Remove redundant check * Remove not included SPDX: ASL, RSAL * Add a useful printAllDependencyTrees task * Exampt safe artifact under multiple licenses * Exempt more safe artifacts (Looks like the last of them) * 'allow-dependencies-licenses' attribute only supports single-line text * Add a TODO comment * Add more file extensions for checkstyle * Resolve some checkstyle header violations * Add back apache/skywalking-eyes * Fix downloaded file didn't have a `.` * Disable Go deps update & Must pass CI before merge * No need to force up-to-date & Auto-approve only * Remove the slash at the end of the homepage url in Repo GitHub desc * Skip patch updates temporarily to reduce PR noise * Logback removed after be06ef7 * Accept patch update * Submit dependency graph * Follow https://github.com/gradle/actions/blob/main/docs/dependency-submission.md#usage-with-pull-requests-from-public-forked-repositories * try to sort dependency graph workflow exec seq * `workflow_run` event will only trigger a workflow run if the workflow file is on the default branch * Grant required permission of CodeQL * Attempt to fix 'No dependency graph files found to submit' * Attempt to fix 'No dependency graph files found to submit' try 2 * Attempt to fix 'No dependency graph files found to submit' try 3 * Attempt to fix 'No dependency graph files found to submit' try 4 * Try to check dependency-review * Only check bundled dependencies * Fix 'No snapshots were found for the head SHA' attempt 1 * Test runtimeClasspath dependencies * Revert "Test runtimeClasspath dependencies" This reverts commit 3de89a5. * Try to retry 1 hr wo wait for snapshot update * Test gradle/actions#196 (comment) * Add todo comments * Keep implementation and compileOnly for now * Keep runtimeOnly deps * [Breaking Change] Remove dependency-review-action and wait for its bugfix * Add checkDeniedLicense into CI * minor code optimization
1 parent 76035f6 commit beaa735

25 files changed

+375
-683
lines changed

Diff for: ‎.asf.yaml

+5-1
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,11 @@ github:
4343
protected_branches:
4444
master:
4545
required_status_checks:
46-
strict: true
46+
strict: false
47+
contexts:
48+
- dependency-review
49+
- Build (ubuntu-latest, 8, java)
50+
- Build (ubuntu-latest, 11, java)
4751
required_pull_request_reviews:
4852
dismiss_stale_reviews: true
4953
required_approving_review_count: 2

Diff for: ‎.github/dependabot.yml

+26-16
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,39 @@
11
#
2-
# Licensed to the Apache Software Foundation (ASF) under one
3-
# or more contributor license agreements. See the NOTICE file
4-
# distributed with this work for additional information
5-
# regarding copyright ownership. The ASF licenses this file
6-
# to you under the Apache License, Version 2.0 (the
7-
# "License"); you may not use this file except in compliance
8-
# with the License. You may obtain a copy of the License at
2+
# Licensed to the Apache Software Foundation (ASF) under one or more
3+
# contributor license agreements. See the NOTICE file distributed with
4+
# this work for additional information regarding copyright ownership.
5+
# The ASF licenses this file to You under the Apache License, Version 2.0
6+
# (the "License"); you may not use this file except in compliance with
7+
# the License. You may obtain a copy of the License at
98
#
10-
# http://www.apache.org/licenses/LICENSE-2.0
9+
# http://www.apache.org/licenses/LICENSE-2.0
1110
#
12-
# Unless required by applicable law or agreed to in writing,
13-
# software distributed under the License is distributed on an
14-
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15-
# KIND, either express or implied. See the License for the
16-
# specific language governing permissions and limitations
17-
# under the License.
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
1816
#
1917

2018
version: 2
2119
updates:
2220
- package-ecosystem: "gradle"
2321
directory: "/"
24-
open-pull-requests-limit: 20
22+
open-pull-requests-limit: 15
2523
schedule:
2624
interval: "weekly"
2725
ignore:
2826
- dependency-name: "*"
29-
update-types: ["version-update:semver-major"]
27+
update-types: [ "version-update:semver-major" ]
28+
- package-ecosystem: "gomod"
29+
directory: "eventmesh-sdks/eventmesh-sdk-go"
30+
schedule:
31+
interval: "monthly"
32+
ignore:
33+
- dependency-name: "*"
34+
# Disabled temporarily since the Go SDK is not integrated with CI
35+
update-types: [ "version-update:semver-major", "version-update:semver-minor", "version-update:semver-patch" ]
36+
- package-ecosystem: "github-actions"
37+
directory: "/"
38+
schedule:
39+
interval: "monthly"

Diff for: ‎.github/workflows/auto-dependabot.yml

+42
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
#
2+
# Licensed to the Apache Software Foundation (ASF) under one or more
3+
# contributor license agreements. See the NOTICE file distributed with
4+
# this work for additional information regarding copyright ownership.
5+
# The ASF licenses this file to You under the Apache License, Version 2.0
6+
# (the "License"); you may not use this file except in compliance with
7+
# the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
#
17+
18+
name: Dependabot Auto-approve
19+
on: pull_request_target
20+
21+
permissions:
22+
contents: write
23+
pull-requests: write
24+
25+
jobs:
26+
# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions
27+
# Pull request Auto merge is not enabled for this repository
28+
dependabot:
29+
runs-on: ubuntu-latest
30+
if: github.actor == 'dependabot[bot]'
31+
steps:
32+
- name: Dependabot metadata
33+
id: metadata
34+
uses: dependabot/fetch-metadata@v2
35+
with:
36+
github-token: "${{ secrets.GITHUB_TOKEN }}"
37+
38+
- name: Approve PR
39+
run: gh pr review --approve "$PR_URL"
40+
env:
41+
PR_URL: ${{ github.event.pull_request.html_url }}
42+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Diff for: ‎.github/workflows/ci.yml

+21-40
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,29 @@
11
#
2-
# Licensed to the Apache Software Foundation (ASF) under one
3-
# or more contributor license agreements. See the NOTICE file
4-
# distributed with this work for additional information
5-
# regarding copyright ownership. The ASF licenses this file
6-
# to you under the Apache License, Version 2.0 (the
7-
# "License"); you may not use this file except in compliance
8-
# with the License. You may obtain a copy of the License at
2+
# Licensed to the Apache Software Foundation (ASF) under one or more
3+
# contributor license agreements. See the NOTICE file distributed with
4+
# this work for additional information regarding copyright ownership.
5+
# The ASF licenses this file to You under the Apache License, Version 2.0
6+
# (the "License"); you may not use this file except in compliance with
7+
# the License. You may obtain a copy of the License at
98
#
10-
# http://www.apache.org/licenses/LICENSE-2.0
9+
# http://www.apache.org/licenses/LICENSE-2.0
1110
#
12-
# Unless required by applicable law or agreed to in writing,
13-
# software distributed under the License is distributed on an
14-
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15-
# KIND, either express or implied. See the License for the
16-
# specific language governing permissions and limitations
17-
# under the License.
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
1816
#
1917

2018
name: "Continuous Integration"
2119

2220
on:
2321
push:
24-
branches: [ '*' ]
22+
branches:
23+
- '**'
24+
- '!dependabot/**'
2525
pull_request:
26-
branches: [ '*' ]
26+
branches: [ '**' ]
2727

2828
jobs:
2929
build:
@@ -33,12 +33,12 @@ jobs:
3333
matrix:
3434
os: [ ubuntu-latest, macOS-latest ]
3535
java: [ 8, 11 ]
36-
language: ['java']
36+
language: [ 'java' ]
3737
runs-on: ${{ matrix.os }}
3838

3939
steps:
4040
- name: Checkout repository
41-
uses: actions/checkout@v3
41+
uses: actions/checkout@v4
4242

4343
- if: matrix.language == 'cpp' || matrix.language == 'csharp'
4444
name: Build C
@@ -48,10 +48,10 @@ jobs:
4848
make -C ./eventmesh-sdks/eventmesh-sdk-c
4949
5050
- name: Setup Gradle
51-
uses: gradle/gradle-build-action@v2
51+
uses: gradle/actions/setup-gradle@v3
5252

5353
- name: Set up JDK 11
54-
uses: actions/setup-java@v3
54+
uses: actions/setup-java@v4
5555
with:
5656
distribution: 'zulu'
5757
java-version: 11
@@ -62,7 +62,7 @@ jobs:
6262
GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
6363

6464
- name: Set up JDK ${{ matrix.java }}
65-
uses: actions/setup-java@v3
65+
uses: actions/setup-java@v4
6666
with:
6767
distribution: 'zulu'
6868
java-version: ${{ matrix.java }}
@@ -80,22 +80,3 @@ jobs:
8080

8181
- name: Upload coverage report to codecov.io
8282
run: bash <(curl -s https://codecov.io/bash) || echo 'Failed to upload coverage report!'
83-
84-
license-check:
85-
name: License Check
86-
runs-on: ubuntu-latest
87-
88-
steps:
89-
- name: Checkout repository
90-
uses: actions/checkout@v3
91-
92-
- name: Check license header
93-
uses: apache/skywalking-eyes@main
94-
env:
95-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
96-
97-
- name: Check third party dependencies
98-
run: |
99-
./gradlew clean dist -x spotlessJava -x test -x checkstyleMain -x javaDoc && ./gradlew installPlugin && ./gradlew tar && sh tools/dependency-check/check-dependencies.sh && echo "Thirty party dependencies check success"
100-
env:
101-
GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}

Diff for: ‎.github/workflows/code-scanning.yml

+74
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
#
2+
# Licensed to the Apache Software Foundation (ASF) under one or more
3+
# contributor license agreements. See the NOTICE file distributed with
4+
# this work for additional information regarding copyright ownership.
5+
# The ASF licenses this file to You under the Apache License, Version 2.0
6+
# (the "License"); you may not use this file except in compliance with
7+
# the License. You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
#
17+
18+
name: 'Code Scanning'
19+
20+
on:
21+
push:
22+
branches:
23+
- '**'
24+
- '!dependabot/**'
25+
pull_request:
26+
branches: [ '**' ]
27+
28+
permissions:
29+
security-events: write
30+
contents: read
31+
32+
jobs:
33+
build:
34+
name: Analyze
35+
strategy:
36+
fail-fast: false
37+
matrix:
38+
language: [ 'java', 'go' ]
39+
runs-on: ubuntu-latest
40+
41+
steps:
42+
- name: Checkout repository
43+
uses: actions/checkout@v4
44+
45+
- name: Initialize CodeQL
46+
uses: github/codeql-action/init@v3
47+
with:
48+
# If you wish to specify custom queries, you can do so here or in a config file.
49+
# By default, queries listed here will override any specified in a config file.
50+
# Prefix the list here with "+" to use these queries and those in the config file.
51+
# queries: ./path/to/local/query, your-org/your-repo/queries@main
52+
languages: ${{ matrix.language }}
53+
54+
- name: Set up JDK 11
55+
if: matrix.language == 'java'
56+
uses: actions/setup-java@v4
57+
with:
58+
distribution: 'zulu'
59+
java-version: 11
60+
61+
- name: Setup Gradle
62+
if: matrix.language == 'java'
63+
uses: gradle/actions/setup-gradle@v3
64+
with:
65+
cache-disabled: true
66+
67+
- name: Build
68+
if: matrix.language == 'java'
69+
run: ./gradlew clean assemble compileTestJava --parallel --daemon
70+
env:
71+
GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
72+
73+
- name: Perform CodeQL analysis
74+
uses: github/codeql-action/analyze@v3

Diff for: ‎.github/workflows/codeql.yml

-69
This file was deleted.

0 commit comments

Comments
 (0)