Compare commits

...

9 commits
v1.0.3 ... main

Author SHA1 Message Date
97030434e7 chore(deps): pin dependencies
Signed-off-by: RenovateBot <renovatebot@w9r.dev>
2025-01-08 11:50:14 +00:00
0af6142823 chore(deps): add renovate.json
Signed-off-by: RenovateBot <renovatebot@w9r.dev>
2025-01-08 11:14:38 +00:00
ac4173a983
fix: wrong variable name 2025-01-08 05:58:38 +01:00
ae3481a1ca
fix: rename variables to simplify dependant workflows 2025-01-08 05:51:15 +01:00
111f07883a
fix: add git user and email output 2025-01-07 13:33:16 +01:00
4365e1ee27
fix: add zstd 2025-01-07 12:47:27 +01:00
121253786d
feat: change to setup-maven-action 2025-01-07 12:27:05 +01:00
d15dc34811
fix: remove required from inputs 2025-01-07 12:02:18 +01:00
e9bb9c4209
fix: add license 2025-01-07 11:53:56 +01:00
3 changed files with 92 additions and 64 deletions

21
LICENSE Normal file
View file

@ -0,0 +1,21 @@
MIT License
Copyright (c) [year] [fullname]
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

View file

@ -1,59 +1,74 @@
--- ---
name: Setup Java environment # SPDX-License-Identifier: MIT
description: Initialize Java Environment and retrieve secrets from Vault name: "Setup Java environment"
description: "Initialize Java Environment and retrieve secrets from Vault"
author: Oliver Weyhmüller
inputs: inputs:
vault-role-id: roleid:
description: Role ID of Approle description: "Role ID of Approle"
required: true default: ""
vault-secret-id: secretid:
description: Secret ID of Approle description: "Secret ID of Approle"
required: true default: ""
outputs:
gituser:
description: User to use for git operations
value: ${{ steps.import-gpg.outputs.name }}
gitemail:
description: Email to use for git operations
value: ${{ steps.import-gpg.outputs.email }}
runs: runs:
using: composite using: "composite"
steps: steps:
- name: Import Secrets - name: "Import Secrets"
id: import-secrets id: "import-secrets"
uses: https://github.com/hashicorp/vault-action@v3 uses: "https://github.com/hashicorp/vault-action@d1720f055e0635fd932a1d2a48f87a666a57906c" # v3
with: with:
url: https://vault.w9r.dev url: "https://vault.w9r.dev"
method: approle method: "approle"
role: forgejo-ci role: "forgejo-ci"
roleId: ${{ inputs.vault-role-id }} roleId: "${{ inputs.roleid }}"
secretId: ${{ inputs.vault-secret-id }} secretId: "${{ inputs.secretid }}"
secrets: | secrets: |
kv/data/ci/nexus username | NEXUS_USERNAME ; kv/data/ci/nexus username | MAVEN_USERNAME ;
kv/data/ci/nexus password | NEXUS_PASSWORD ; kv/data/ci/nexus password | MAVEN_CENTRAL_TOKEN ;
kv/data/ci/nexus username | JRELEASER_ARTIFACTORY_USERNAME ;
kv/data/ci/nexus password | JRELEASER_ARTIFACTORY_TOKEN ;
kv/data/ci/vulnz username | VULNZ_USERNAME ; kv/data/ci/vulnz username | VULNZ_USERNAME ;
kv/data/ci/vulnz password | VULNZ_PASSWORD ; kv/data/ci/vulnz password | VULNZ_PASSWORD ;
kv/data/ci/releasebot gpgPrivateKey | RELEASEBOT_PRIVATE_KEY ; kv/data/ci/releasebot gpgPrivateKey | JRELEASER_GPG_SECRET_KEY ;
kv/data/ci/releasebot gpgPublicKey | RELEASEBOT_PUBLIC_KEY ; kv/data/ci/releasebot gpgPublicKey | JRELEASER_GPG_PUBLIC_KEY ;
kv/data/ci/releasebot gpgPassphrease | RELEASEBOT_PASSPHRASE ; kv/data/ci/releasebot gpgPassphrase | JRELEASER_GPG_PASSPHRASE ;
kv/data/ci/releasebot ciToken | JRELEASER_GITEA_TOKEN ; kv/data/ci/releasebot ciToken | JRELEASER_GITEA_TOKEN ;
kv/data/ci/signing gpgPrivateKey | GPG_PRIVATE_KEY ; kv/data/ci/signing gpgPrivateKey | GPG_PRIVATE_KEY ;
kv/data/ci/signing gpgPublicKey | GPG_PUBLIC_KEY ; kv/data/ci/signing gpgPublicKey | GPG_PUBLIC_KEY ;
kv/data/ci/signing gpgPassphrease | GPG_PASSPHRASE ; kv/data/ci/signing gpgPassphrase | MAVEN_GPG_PASSPHRASE ;
kv/data/ci/sonarqube sonarToken | SONARQUBE_TOKEN ; kv/data/ci/sonarqube sonarToken | SONAR_TOKEN ;
kv/data/ci/sonarqube sonarHost | SONARQUBE_HOST ; kv/data/ci/sonarqube sonarHost | SONAR_HOST_URL ;
- name: Set up Environment - name: "Set up Environment"
shell: bash shell: "bash"
run: | run: |
apt update apt update
apt install -y zip apt install -y zip zstd
mkdir -p /root/.jreleaser mkdir -p /root/.jreleaser
mkdir -p /root/.m2 mkdir -p /root/.m2
touch /root/.jreleaser/config.properties touch /root/.jreleaser/config.properties
- name: Install syft - name: "Install syft"
uses: https://github.com/anchore/sbom-action/download-syft@v0 uses: "https://github.com/anchore/sbom-action/download-syft@df80a981bc6edbc4e220a492d3cbe9f5547a6e75" # v0
id: install_syft id: "install_syft"
with: with:
syft-version: v1.18.1 syft-version: "v1.18.1"
- name: maven-settings-xml-action - name: "Setup Java and Maven"
uses: https://github.com/whelk-io/maven-settings-xml-action@v22 uses: "https://github.com/s4u/setup-maven-action@4f7fb9d9675e899ca81c6161dadbba0189a4ebb1" # v1.18.0
with: with:
repositories: > checkout-fetch-depth: 0
java-distribution: "temurin"
java-version: 21
maven-version: 3.9.9
settings-repositories: >
[ [
{ {
"id": "maven-releases", "id": "maven-releases",
@ -86,22 +101,22 @@ runs:
} }
} }
] ]
servers: > settings-servers: >
[ [
{ {
"id": "maven-group", "id": "maven-group",
"username": "${{ env.NEXUS_USERNAME }}", "username": "${{ env.MAVEN_USERNAME }}",
"password": "${{ env.NEXUS_PASSWORD }}" "password": "${{ env.MAVEN_CENTRAL_TOKEN }}"
}, },
{ {
"id": "maven-snapshots", "id": "maven-snapshots",
"username": "${{ env.NEXUS_USERNAME }}", "username": "${{ env.MAVEN_USERNAME }}",
"password": "${{ env.NEXUS_PASSWORD }}" "password": "${{ env.MAVEN_CENTRAL_TOKEN }}"
}, },
{ {
"id": "maven-releases", "id": "maven-releases",
"username": "${{ env.NEXUS_USERNAME }}", "username": "${{ env.MAVEN_USERNAME }}",
"password": "${{ env.NEXUS_PASSWORD }}" "password": "${{ env.MAVEN_CENTRAL_TOKEN }}"
}, },
{ {
"id": "vulnz", "id": "vulnz",
@ -109,7 +124,7 @@ runs:
"password": "${{ env.VULNZ_PASSWORD }}" "password": "${{ env.VULNZ_PASSWORD }}"
} }
] ]
mirrors: > settings-mirrors: >
[ [
{ {
"id": "maven-group", "id": "maven-group",
@ -118,32 +133,18 @@ runs:
"url": "https://nexus.w9r.dev/repository/maven-group/" "url": "https://nexus.w9r.dev/repository/maven-group/"
} }
] ]
plugin_groups: >
[
"org.sonarsource.scanner.maven"
]
output_file: /root/.m2/settings.xml
- name: Setup Java - name: "Import Commit Signing GPG key"
uses: https://github.com/actions/setup-java@v4 id: "import-gpg"
uses: "https://github.com/crazy-max/ghaction-import-gpg@cb9bde2e2525e640591a934b1fd28eef1dcaf5e5" # v6
with: with:
distribution: temurin # See 'Supported distributions' for available options gpg_private_key: "${{ env.JRELEASER_GPG_SECRET_KEY }}"
java-version: 21 passphrase: "${{ env.JRELEASER_GPG_PASSPHRASE }}"
cache: maven
check-latest: true
- name: Import Commit Signing GPG key
id: import-gpg
uses: https://github.com/crazy-max/ghaction-import-gpg@v6
with:
gpg_private_key: ${{ env.RELEASEBOT_PRIVATE_KEY }}
passphrase: ${{ env.RELEASEBOT_PASSPHRASE }}
git_user_signingkey: true git_user_signingkey: true
git_commit_gpgsign: true git_commit_gpgsign: true
- name: GPG user IDs - name: "GPG user IDs"
shell: bash shell: "bash"
run: | run: |
echo "fingerprint: ${{ steps.import-gpg.outputs.fingerprint }}" echo "fingerprint: ${{ steps.import-gpg.outputs.fingerprint }}"
echo "keyid: ${{ steps.import-gpg.outputs.keyid }}" echo "keyid: ${{ steps.import-gpg.outputs.keyid }}"

6
renovate.json Normal file
View file

@ -0,0 +1,6 @@
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"local>w9r.dev/renovate-config"
]
}