Repository navigation
chore(deps): bump actions/upload-artifact from 4 to 6 #42
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| branches: [main] | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| verify: | |
| name: Build, test and lint | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Set up Java 21 | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: temurin | |
| java-version: '21' | |
| cache: maven | |
| - name: Verify build and tests | |
| run: mvn -B -ntp verify | |
| - name: Lint Java source with Checkstyle | |
| run: >- | |
| mvn -B -ntp org.apache.maven.plugins:maven-checkstyle-plugin:3.4.0:check | |
| -Dcheckstyle.config.location=config/checkstyle/checkstyle.xml | |
| -Dcheckstyle.includeTestSourceDirectory=true | |
| - name: Upload test reports | |
| if: always() | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: surefire-reports | |
| path: target/surefire-reports/ | |
| if-no-files-found: ignore | |
| retention-days: 14 | |
| frontend-build: | |
| name: Frontend build | |
| runs-on: ubuntu-24.04 | |
| defaults: | |
| run: | |
| working-directory: frontend | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Set up Node.js 22 | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| cache: npm | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Build dashboard | |
| run: npm run build | |
| dependency-check: | |
| name: Dependency vulnerability scan | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| env: | |
| NVD_API_KEY: ${{ secrets.NVD_API_KEY }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Set up Java 21 | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: temurin | |
| java-version: '21' | |
| cache: maven | |
| - name: Cache OWASP Dependency-Check database | |
| uses: actions/cache@v6 | |
| with: | |
| path: ~/.dependency-check | |
| key: owasp-db-v2-${{ hashFiles('**/pom.xml') }} | |
| restore-keys: | | |
| owasp-db-v2- | |
| owasp-db- | |
| - name: OWASP Dependency-Check | |
| run: | | |
| set -euo pipefail | |
| common_args=( | |
| -DfailOnCVSS=7 | |
| -Dformat=HTML | |
| -DdataDirectory="$HOME/.dependency-check" | |
| -Dnvd.api.delay=6000 | |
| -Dnvd.api.max.retry.count=10 | |
| ) | |
| run_check() { | |
| mvn -B -ntp org.owasp:dependency-check-maven:12.2.2:check \ | |
| "${common_args[@]}" \ | |
| "$@" | |
| } | |
| if [ -n "${NVD_API_KEY:-}" ]; then | |
| if ! run_check -Dnvd.api.key="$NVD_API_KEY"; then | |
| echo "::warning::NVD_API_KEY failed (invalid key or NVD outage). Retrying with cached database only." | |
| run_check -Dnvd.api.check.validforhours=8760 | |
| fi | |
| else | |
| run_check | |
| fi | |
| - name: Upload dependency report | |
| if: always() | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: dependency-check-report | |
| path: target/dependency-check-report.html | |
| if-no-files-found: ignore | |
| retention-days: 14 | |
| codeql: | |
| name: CodeQL SAST | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| security-events: write | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Set up Java 21 | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: temurin | |
| java-version: '21' | |
| cache: maven | |
| - name: Set up Node.js 22 | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| cache: npm | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4.37.3 | |
| with: | |
| languages: java-kotlin, javascript-typescript | |
| build-mode: none | |
| - name: Build Java sources | |
| run: mvn -B -ntp -DskipTests compile | |
| - name: Build frontend | |
| working-directory: frontend | |
| run: | | |
| npm ci | |
| npm run build | |
| - name: Analyze | |
| uses: github/codeql-action/analyze@v4.37.3 |