release: prepare v0.8.0 #212
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: build | |
| on: | |
| push: | |
| branches: ['trunk'] | |
| pull_request: | |
| branches: ['trunk'] | |
| workflow_dispatch: | |
| jobs: | |
| build_multi_os: | |
| permissions: | |
| contents: read | |
| name: Build and test ${{matrix.os}} | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up JDK 17 (Oracle) | |
| uses: actions/setup-java@v4 | |
| with: | |
| java-version: 17 | |
| distribution: oracle | |
| cache: maven | |
| - name: Display Java version | |
| run: java -version | |
| - name: Display Javac version | |
| run: javac -version | |
| - name: Display Maven version | |
| run: mvn -version | |
| - name: Build (Unix) | |
| if: matrix.os != 'windows-latest' | |
| run: mvn install -DskipTests=true -Dgpg.skip -B -V | |
| - name: Build (Windows) | |
| if: matrix.os == 'windows-latest' | |
| run: mvn --% install -DskipTests=true -Dgpg.skip -B -V # tell powershell to stop parsing with --% so it doesn't error with "Unknown lifecycle phase .skip" | |
| - name: Install Spice | |
| uses: ./.github/actions/setup-spice | |
| - name: Init and start spice app | |
| uses: ./.github/actions/start-spice-app | |
| - name: Test | |
| run: mvn test -B | |
| env: | |
| API_KEY: ${{ secrets.SPICE_CLOUD_QUICKSTART_API_KEY }} | |
| - name: Upload test results | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: test-results-${{ matrix.os }} | |
| path: target/surefire-reports/ | |
| retention-days: 7 | |
| - name: Upload coverage report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: coverage-report-${{ matrix.os }} | |
| path: target/site/jacoco/ | |
| retention-days: 7 | |
| build: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| java: | |
| # Microsoft OpenJDK (LTS versions only) | |
| - version: 11 | |
| distribution: microsoft | |
| - version: 17 | |
| distribution: microsoft | |
| - version: 21 | |
| distribution: microsoft # LTS | |
| # Eclipse Temurin (Adoptium) - LTS and recent non-LTS | |
| - version: 21 | |
| distribution: temurin # LTS | |
| - version: 23 | |
| distribution: temurin # Non-LTS - released Sept 2024 | |
| - version: 24 | |
| distribution: temurin # Non-LTS - released March 2025 | |
| # Oracle JDK (17 and later only) | |
| - version: 17 | |
| distribution: oracle | |
| - version: 21 | |
| distribution: oracle # LTS - support until 2031 | |
| - version: 23 | |
| distribution: oracle # Non-LTS - released Sept 2024 | |
| - version: 24 | |
| distribution: oracle # Non-LTS - released March 2025 | |
| - version: 25 | |
| distribution: oracle # LTS - released Sept 2025, support until 2033 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up JDK ${{ matrix.java.version }} (${{ matrix.java.distribution }}) | |
| uses: actions/setup-java@v4 | |
| with: | |
| java-version: ${{ matrix.java.version }} | |
| distribution: ${{ matrix.java.distribution }} | |
| cache: maven | |
| - name: Display Java version | |
| run: java -version | |
| - name: Display Javac version | |
| run: javac -version | |
| - name: Display Maven version | |
| run: mvn -version | |
| - name: Build | |
| run: mvn install -DskipTests=true -Dgpg.skip -B -V | |
| - name: Install Spice | |
| uses: ./.github/actions/setup-spice | |
| - name: Init and start spice app | |
| uses: ./.github/actions/start-spice-app | |
| - name: Test | |
| run: | | |
| EXTRA="" | |
| # JDK 23+ disables sun.misc.Unsafe memory methods by default (JEP 471). | |
| # Arrow/Netty still require them for off-heap memory allocation. | |
| if [ "${{ matrix.java.version }}" -ge 23 ] 2>/dev/null; then | |
| EXTRA="--sun-misc-unsafe-memory-access=allow" | |
| fi | |
| mvn test -B -DextraArgLine="$EXTRA" | |
| env: | |
| API_KEY: ${{ secrets.SPICE_CLOUD_QUICKSTART_API_KEY }} | |
| - name: Upload test results | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: test-results-jdk${{ matrix.java.version }}-${{ matrix.java.distribution }} | |
| path: target/surefire-reports/ | |
| retention-days: 7 | |
| quality: | |
| name: Code quality checks | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up JDK 17 (Oracle) | |
| uses: actions/setup-java@v4 | |
| with: | |
| java-version: 17 | |
| distribution: oracle | |
| cache: maven | |
| - name: Build | |
| run: mvn install -DskipTests=true -Dgpg.skip -B -V | |
| - name: Maven Enforcer | |
| run: mvn validate -B | |
| - name: SpotBugs | |
| run: mvn spotbugs:check -B | |
| - name: Checkstyle + API compatibility (japicmp vs latest release) | |
| run: mvn checkstyle:check japicmp:cmp -B | |
| - name: Cache OWASP Dependency-Check data | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.m2/repository/org/owasp/dependency-check-data | |
| key: dependency-check-data-${{ runner.os }}-${{ hashFiles('**/pom.xml') }} | |
| restore-keys: | | |
| dependency-check-data-${{ runner.os }}- | |
| # Split so network flakiness and the security gate can't mask each other: | |
| # the NVD data refresh may fail or time out without blocking CI, but when | |
| # it completes, the check below runs offline against that data and FAILS | |
| # the build on real CVSS >= 7 findings. | |
| # | |
| # The update is incremental and resumable: even a timed-out attempt makes | |
| # progress that actions/cache persists (the job still succeeds via the | |
| # skip path below), so cold caches converge to a warm one across runs. | |
| # Adding the NVD_API_KEY secret makes the update fast and the gate | |
| # effectively always-on. | |
| - name: OWASP NVD data update (best-effort) | |
| id: nvd-update | |
| continue-on-error: true | |
| timeout-minutes: 15 | |
| env: | |
| NVD_API_KEY: ${{ secrets.NVD_API_KEY }} | |
| run: | | |
| EXTRA="" | |
| if [ -n "$NVD_API_KEY" ]; then | |
| EXTRA="-DnvdApiKey=$NVD_API_KEY" | |
| fi | |
| mvn dependency-check:update-only -B $EXTRA | |
| # Gate only on a completed update: a partial database makes | |
| # dependency-check force a full re-download regardless of | |
| # autoUpdate=false, burning the timeout. | |
| - name: OWASP Dependency-Check (gating) | |
| if: steps.nvd-update.outcome == 'success' | |
| timeout-minutes: 10 | |
| run: mvn dependency-check:check -B -DautoUpdate=false | |
| - name: OWASP gate skipped notice | |
| if: steps.nvd-update.outcome != 'success' | |
| run: echo "::warning::NVD data update did not complete — vulnerability gate skipped this run (add the NVD_API_KEY secret to make it always-on)" | |
| - name: Upload dependency-check report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: dependency-check-report | |
| path: target/dependency-check-report.html | |
| retention-days: 30 | |
| e2e-chaos: | |
| permissions: | |
| contents: read | |
| name: E2E chaos (runtime restart, frozen peer) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up JDK 17 (Oracle) | |
| uses: actions/setup-java@v4 | |
| with: | |
| java-version: 17 | |
| distribution: oracle | |
| cache: maven | |
| - name: Install Spice | |
| uses: ./.github/actions/setup-spice | |
| - name: Run chaos e2e tests | |
| env: | |
| SPICE_E2E_CHAOS: "1" | |
| run: mvn test -B -Dtest=ChaosE2ETest -DfailIfNoTests=true |