Skip to content

Commit 485e5b2

Browse files
SplatcrafterSplatcrafter
authored
Merge pull request #31 from aether-framework/feature/security-and-code-style-hardening
Simplify and enhance CI workflows and code quality checks
2 parents 0934f66 + 94ce756 commit 485e5b2

79 files changed

Lines changed: 5338 additions & 378 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/dependabot.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
version: 2
2+
updates:
3+
# Maven dependencies
4+
- package-ecosystem: "maven"
5+
directory: "/"
6+
schedule:
7+
interval: "weekly"
8+
day: "monday"
9+
time: "06:00"
10+
timezone: "Europe/Berlin"
11+
open-pull-requests-limit: 10
12+
reviewers:
13+
- "aether-framework/maintainers"
14+
labels:
15+
- "dependencies"
16+
- "java"
17+
commit-message:
18+
prefix: "deps"
19+
include: "scope"
20+
groups:
21+
jackson:
22+
patterns:
23+
- "com.fasterxml.jackson*"
24+
update-types:
25+
- "minor"
26+
- "patch"
27+
spring:
28+
patterns:
29+
- "org.springframework*"
30+
update-types:
31+
- "minor"
32+
- "patch"
33+
testing:
34+
patterns:
35+
- "org.junit*"
36+
- "org.assertj*"
37+
update-types:
38+
- "minor"
39+
- "patch"
40+
maven-plugins:
41+
patterns:
42+
- "org.apache.maven.plugins:maven-*"
43+
- "org.codehaus.mojo:*"
44+
update-types:
45+
- "minor"
46+
- "patch"
47+
build-plugins:
48+
patterns:
49+
- "org.sonatype.central:*"
50+
- "org.owasp:*"
51+
- "org.cyclonedx:*"
52+
- "org.jacoco:*"
53+
- "com.github.spotbugs:*"
54+
update-types:
55+
- "minor"
56+
- "patch"
57+
58+
# GitHub Actions
59+
- package-ecosystem: "github-actions"
60+
directory: "/"
61+
schedule:
62+
interval: "weekly"
63+
day: "monday"
64+
time: "06:00"
65+
timezone: "Europe/Berlin"
66+
open-pull-requests-limit: 5
67+
labels:
68+
- "dependencies"
69+
- "github-actions"
70+
commit-message:
71+
prefix: "ci"
72+
include: "scope"

‎.github/workflows/ci.yml‎

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [ main, develop, 'feature/**' ]
6+
pull_request:
7+
branches: [ main, develop ]
8+
9+
permissions:
10+
contents: read
11+
checks: write
12+
pull-requests: write
13+
14+
jobs:
15+
build:
16+
name: Build & Test (Java ${{ matrix.java }})
17+
runs-on: ubuntu-latest
18+
strategy:
19+
fail-fast: false
20+
matrix:
21+
java: [ '17', '21' ]
22+
23+
steps:
24+
- name: Checkout repository
25+
uses: actions/checkout@v4
26+
with:
27+
fetch-depth: 1
28+
29+
- name: Set up JDK ${{ matrix.java }}
30+
uses: actions/setup-java@v4
31+
with:
32+
java-version: ${{ matrix.java }}
33+
distribution: 'temurin'
34+
cache: 'maven'
35+
36+
- name: Build and test with Maven
37+
run: mvn -B clean verify -Pqa -Ddependency-check.skip=true
38+
39+
- name: Upload test results
40+
uses: actions/upload-artifact@v4
41+
if: always()
42+
with:
43+
name: test-results-java-${{ matrix.java }}
44+
path: |
45+
**/target/surefire-reports/
46+
**/target/failsafe-reports/
47+
retention-days: 7
48+
49+
- name: Upload coverage report
50+
uses: actions/upload-artifact@v4
51+
if: matrix.java == '21'
52+
with:
53+
name: coverage-report
54+
path: |
55+
**/target/site/jacoco/
56+
**/target/jacoco.exec
57+
retention-days: 7
58+
59+
- name: Publish Test Report
60+
uses: mikepenz/action-junit-report@v4
61+
if: always()
62+
with:
63+
report_paths: '**/target/*-reports/TEST-*.xml'
64+
check_name: Test Report (Java ${{ matrix.java }})
65+
66+
quality:
67+
name: Code Quality Analysis
68+
runs-on: ubuntu-latest
69+
needs: build
70+
71+
steps:
72+
- name: Checkout repository
73+
uses: actions/checkout@v4
74+
with:
75+
fetch-depth: 1
76+
77+
- name: Set up JDK 21
78+
uses: actions/setup-java@v4
79+
with:
80+
java-version: '21'
81+
distribution: 'temurin'
82+
cache: 'maven'
83+
84+
- name: Install artifacts for analysis
85+
run: mvn -B -Ddependency-check.skip=true clean install -Pqa -DskipTests
86+
87+
- name: Run SpotBugs analysis
88+
run: mvn -B spotbugs:check -Pqa -Ddependency-check.skip=true
89+
continue-on-error: true
90+
91+
- name: Run Checkstyle analysis
92+
run: mvn -B checkstyle:check -Pqa -Ddependency-check.skip=true
93+
continue-on-error: true
94+
95+
- name: Upload SpotBugs report
96+
uses: actions/upload-artifact@v4
97+
if: always()
98+
with:
99+
name: spotbugs-report
100+
path: '**/target/spotbugsXml.xml'
101+
retention-days: 7
102+
103+
- name: Upload Checkstyle report
104+
uses: actions/upload-artifact@v4
105+
if: always()
106+
with:
107+
name: checkstyle-report
108+
path: '**/target/checkstyle-result.xml'
109+
retention-days: 7
110+
111+
dependency-check:
112+
name: OWASP Dependency Check
113+
runs-on: ubuntu-latest
114+
needs: build
115+
env:
116+
NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
117+
118+
steps:
119+
- name: Checkout repository
120+
uses: actions/checkout@v4
121+
122+
- name: Set up JDK 21
123+
uses: actions/setup-java@v4
124+
with:
125+
java-version: '21'
126+
distribution: 'temurin'
127+
cache: 'maven'
128+
129+
- name: Cache Dependency-Check DB
130+
uses: actions/cache@v4
131+
with:
132+
path: ~/.m2/repository/org/owasp/dependency-check-data
133+
key: depcheck-${{ runner.os }}-${{ hashFiles('**/pom.xml') }}
134+
restore-keys: |
135+
depcheck-${{ runner.os }}-
136+
137+
- name: Run OWASP Dependency Check
138+
run: mvn -B dependency-check:aggregate -Pqa
139+
continue-on-error: true
140+
141+
- name: Upload Dependency Check report
142+
uses: actions/upload-artifact@v4
143+
if: always()
144+
with:
145+
name: dependency-check-report
146+
path: |
147+
target/dependency-check-report.html
148+
retention-days: 30

‎.github/workflows/codeql.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
name: CodeQL Security Analysis
2+
3+
on:
4+
push:
5+
branches: [ main, develop ]
6+
pull_request:
7+
branches: [ main, develop ]
8+
schedule:
9+
- cron: '0 0 * * 1' # Monday 00:00 UTC
10+
11+
permissions:
12+
contents: read
13+
security-events: write
14+
actions: read
15+
16+
jobs:
17+
analyze:
18+
name: Analyze (java-kotlin)
19+
runs-on: ubuntu-latest
20+
21+
steps:
22+
- name: Checkout repository
23+
uses: actions/checkout@v4
24+
with:
25+
fetch-depth: 1
26+
27+
- name: Set up JDK 21
28+
uses: actions/setup-java@v4
29+
with:
30+
java-version: '21'
31+
distribution: 'temurin'
32+
cache: 'maven'
33+
34+
- name: Initialize CodeQL
35+
uses: github/codeql-action/init@v3
36+
with:
37+
languages: java-kotlin
38+
build-mode: manual
39+
queries: security-extended,security-and-quality
40+
41+
- name: Build with Maven
42+
run: mvn -B clean compile -DskipTests
43+
44+
- name: Perform CodeQL Analysis
45+
uses: github/codeql-action/analyze@v3
46+
with:
47+
category: "/language:java-kotlin"

‎.github/workflows/dependency-review.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: Dependency Review
2+
3+
on:
4+
pull_request:
5+
branches: [ main, develop ]
6+
7+
permissions:
8+
contents: read
9+
pull-requests: write
10+
11+
jobs:
12+
dependency-review:
13+
name: Dependency Review
14+
runs-on: ubuntu-latest
15+
16+
steps:
17+
- name: Checkout repository
18+
uses: actions/checkout@v4
19+
with:
20+
fetch-depth: 1
21+
22+
- name: Dependency Review
23+
uses: actions/dependency-review-action@v4
24+
with:
25+
fail-on-severity: high
26+
deny-licenses: GPL-3.0-only, GPL-3.0-or-later, AGPL-3.0-only, AGPL-3.0-or-later
27+
comment-summary-in-pr: always
28+
warn-only: false

0 commit comments

Comments
 (0)