Skip to content

Commit 5d40747

Browse files
sthulbsthulb
committed
document workflows
1 parent a763718 commit 5d40747

12 files changed

+173
-29
lines changed

‎.github/workflows/build-docs.yml

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,17 @@
1+
# Build Docs
2+
#
3+
# Description:
4+
# Builds the docs and stores them in S3 to be served by our docs platform
5+
#
6+
# The workflow allows us to build to the main location (/lambda/java/) and to an alias
7+
# (i.e. /lambda/java/preview/) if needed
8+
#
9+
# Triggers:
10+
# - workflow_dispatch
11+
#
12+
# Inputs:
13+
# alias – subdirectory to store the docs in for previews or in progress work
14+
115
on:
216
workflow_dispatch:
317
inputs:
@@ -9,16 +23,6 @@ on:
923
versions of the documentation, such as beta versions or snapshots.
1024
1125
https://docs.powertools.aws.dev/lambda/java/<alias>
12-
workflow_call:
13-
inputs:
14-
alias:
15-
type: string
16-
required: false
17-
description: |
18-
Alias to deploy the documentation into, this is mostly for testing pre-release
19-
versions of the documentation, such as beta versions or snapshots.
20-
21-
https://docs.powertools.aws.dev/lambda/java/<alias>
2226
2327
name: Build Docs
2428
run-name: Build Docs - ${{ contains(github.head_ref, 'main') && 'main' || inputs.alias }}

‎.github/workflows/check-build.yml

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,17 @@
1+
# Check Build
2+
#
3+
# Description:
4+
# Runs the build for every java version we support
5+
#
6+
# Triggers:
7+
# - pull_request: when a PR is sent to us
8+
# - push: when code is pushed to a specified branch
9+
#
10+
# Notes:
11+
# The matrix build for this workflow is unusual, we need to make it dyanmic since
12+
# we need to change java versions we build for depending on the branch.
13+
14+
115
on:
216
workflow_dispatch:
317
pull_request:
@@ -58,7 +72,7 @@ jobs:
5872
- id: base
5973
name: Base
6074
run: |
61-
echo build_version=$(test ${{ github.base_ref }} == "v2" && echo "v2" || echo "v1") >> $GITHUB_OUTPUT
75+
echo build_version=$(test ${{ github.ref }} == "v2" && echo "v2" || echo "v1") >> $GITHUB_OUTPUT
6276
- id: build_matrix_v1
6377
name: Build matrix (v1)
6478
if: ${{ steps.base.outputs.build_version == 'v1' }}

‎.github/workflows/check-e2e.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,14 @@
1+
# Run E2E tests for a branch
2+
#
3+
# Description:
4+
# Runs E2E tests for a specified branch
5+
#
6+
# Triggers:
7+
# - push
8+
#
9+
# Secrets:
10+
# - E2E.AWS_IAM_ROLE
11+
112
on:
213
workflow_dispatch:
314

‎.github/workflows/check-pmd.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,14 @@
1+
# Runs PMD for a Pull Request
2+
#
3+
# Description:
4+
# Runs PMD (pmd.github.io) for a pull request and daily.
5+
# This does not error on failure yet, our rules are too strong and would fail on every run
6+
#
7+
# Triggers:
8+
# - pull_request
9+
# - workflow_dispatch
10+
# - cron: every day at 12:00PM
11+
112
on:
213
pull_request:
314
workflow_dispatch:

‎.github/workflows/check-spotbugs.yml

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,11 @@
1+
# Check for Spotbug errors
2+
#
3+
# Description:
4+
# Runs Spotbugs for a pull request.
5+
# This does not error on failure yet, our rules are too strong and would fail on every run
6+
#
7+
# Triggers:
8+
# - pull_request
19
on:
210
pull_request:
311
branches:
@@ -34,19 +42,10 @@ jobs:
3442
runs-on: ubuntu-latest
3543
steps:
3644
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
37-
- name: Setup java JDK 1.8
45+
- name: Setup Java
3846
uses: actions/setup-java@5ffc13f4174014e2d4d4572b3d74c3fa61aeb2c2 # v3.11.0
3947
with:
4048
distribution: 'corretto'
41-
java-version: 8
42-
# https://github.com/jwgmeligmeyling/spotbugs-github-action/issues/6
43-
# https://github.blog/2020-08-03-github-actions-improvements-for-fork-and-pull-request-workflows/
44-
# Avoid complexity of git action with publishing report. Just build with spotbugs profile.
45-
# - name: Build with Maven for spotbugs check to gather reports
46-
# run: mvn -Pbuild-with-spotbugs -B install --file pom.xml -DskipTests -Dmaven.javadoc.skip=true -Dspotbugs.failOnError=false
47-
# - uses: jwgmeligmeyling/spotbugs-github-action@master
48-
# with:
49-
# path: '**/spotbugsXml.xml'
50-
# # Can be simplified post this issue is fixed https://github.com/jwgmeligmeyling/spotbugs-github-action/issues/9
49+
java-version: 21
5150
- name: Build with Maven for spotbugs check to mark build as fail if voilations found
5251
run: mvn -Pbuild-with-spotbugs -B install --file pom.xml -DskipTests -Dmaven.javadoc.skip=true -Dspotbugs.failOnError=true

‎.github/workflows/release-drafter.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
# Generates release notes
2+
#
3+
# Description:
4+
# Generates release notes based on pull request history. This is based on the config
5+
# stored in .github/release-drafter.yml
6+
#
7+
# Triggers:
8+
# - push: main
9+
110
on:
211
push:
312
branches: [ main ]

‎.github/workflows/release.yml

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,34 @@
1+
# Release
2+
#
3+
# Description:
4+
# Creates a release for the project
5+
#
6+
# 1. Runs a setup job to set needed variables (build_matrix & version)
7+
# 2. Versions to the project and stores as an artifact
8+
# 3. Run quality checks
9+
# 4. Build
10+
# 5. Publish to Maven Central
11+
# 6. Create PR
12+
# 7. Publish docs
13+
#
14+
# Inputs:
15+
# - version (string): SemVer of the new release (X.Y.Z)
16+
# - snapshot (bool): If it's a snapshot release, this skips versioning assets like docs
17+
# - skip_checks (bool): Don't run quality checks if it's an emergency release
18+
# - skip_publish (bool): Don't publish to maven central
19+
# - continue_on_error (bool): Don't fail the workflow if a quality check fails
20+
#
21+
# Triggers:
22+
# - workflow_dispatch
23+
#
24+
# Secrets:
25+
# - RELEASE.GPG_SIGNING_KEY
26+
# - RELEASE.OSSRH_JIRA_USERNAME
27+
# - RELEASE.OSSRH_JIRA_PASSWORD
28+
# - RELEASE.GPG_PASSPHRASE
29+
# - DOCS.AWS_DOCS_ROLE_ARN
30+
# - DOCS.AWS_DOCS_BUCKET
31+
132
on:
233
workflow_dispatch:
334
inputs:
@@ -7,7 +38,7 @@ on:
738
snapshot:
839
type: boolean
940
description: Create snapshot release
10-
default: true
41+
default: false
1142
skip_checks:
1243
type: boolean
1344
description: Skip quality checks
@@ -168,6 +199,8 @@ jobs:
168199
distribution: corretto
169200
java-version: 21
170201
cache: maven
202+
gpg-private-key: ${{ secrets.GPG_SIGNING_KEY }}
203+
gpg-passphrase: GPG_PASSPHRASE
171204
- name: Publish package
172205
run: mvn -Prelease clean deploy -DskipTests
173206
env:

‎.github/workflows/security-branch-protections.yml

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,23 @@
1-
# Modified copy of: https://github.com/github/docs/blob/main/.github/workflows/alert-changed-branch-protections.yml
1+
# Branch Protections
2+
#
3+
# Description:
4+
# This workflow compares current security branch protections against those stored,
5+
# if there's any changes, it'll fail the job and alert using a Slack webhook
6+
#
7+
# Triggers:
8+
# - pull_request
9+
# - branch_protection_rule
10+
# - cron: daily at 16:40
11+
#
12+
# Secrets:
13+
# - SECURITY.BRANCH_PROTECTION_TOKEN
14+
# - SECURITY.SLACK_WEBHOOK_URL
15+
#
16+
# Notes:
17+
# Modified copy of: https://github.com/github/docs/blob/main/.github/workflows/alert-changed-branch-protections.yml
218

319
on:
420
branch_protection_rule:
5-
workflow_dispatch:
621
schedule:
722
- cron: '20 16 * * *' # Run daily at 16:20 UTC
823
pull_request:

‎.github/workflows/security-dependabot.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
# Auto merges dependabot PRs
2+
#
3+
# Description:
4+
# Auto-merges dependabot PRs if all checks pass
5+
# We verify all commits in the PR to ensure no one else has committed to the PR
6+
#
7+
# Triggers:
8+
# - pull_request
9+
110
on:
211
pull_request:
312
branches: [ dependabot/* ]

‎.github/workflows/security-dependencies-check.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,15 @@
1+
# Dependency checks
2+
#
3+
# Description:
4+
# Verifies that dependencies are compatible with our project
5+
# by checking licenses and their security posture
6+
#
7+
# Triggers:
8+
# - pull_request
9+
# - push
10+
# - workflow_dispatch
11+
# - cron: daily at 12:00PM
12+
113
on:
214
pull_request:
315
workflow_dispatch:

‎.github/workflows/security-osv.yml

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,26 @@
1+
# Runs OSV scan
2+
#
3+
# Description:
4+
# Checks dependencies already in the project for known issues
5+
#
6+
# Triggers:
7+
# - pull_request
8+
# - workflow_dispatch
9+
# - cron
10+
# - push
11+
112
on:
213
pull_request:
3-
branches: [main]
4-
merge_group:
5-
branches: [main]
14+
branches:
15+
- main
16+
- v2
617
workflow_dispatch: {}
718
schedule:
819
- cron: "30 12 * * 1"
920
push:
10-
branches: [main]
21+
branches:
22+
- main
23+
- v2
1124

1225
name: OpenSource Vulnerability Scanner
1326
run-name: OpenSource Vulnerability Scanner

‎.github/workflows/security-scorecard.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,17 @@
1+
# Runs OSSF
2+
#
3+
# Description:
4+
# Runs OpenSSF Scorecard scan on the project
5+
#
6+
# Triggers:
7+
# - branch_protection_rule
8+
# - cron: 09:00AM
9+
# - push
10+
# - workflow_dispatch
11+
#
12+
# Secrets:
13+
# - Security.SCORECARD_TOKEN
14+
115
on:
216
branch_protection_rule:
317
schedule:

0 commit comments

Comments
 (0)