Skip to content

Commit 87b48fc

Browse files
constantine2ndconstantine2nd
committed
feature/Tweak GitHub workflows
1 parent 18daf8d commit 87b48fc

File tree

5 files changed

+110
-39
lines changed

5 files changed

+110
-39
lines changed

‎.github/workflows/auto_update_base_image.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ env:
1111
jobs:
1212
build:
1313
runs-on: ubuntu-latest
14+
if: github.repository == 'OpenBankProject/OBP-API'
1415
steps:
1516
- name: Checkout repository
1617
uses: actions/checkout@v4
@@ -32,4 +33,4 @@ jobs:
3233
workflow_id: 'build_container_develop_branch.yml',
3334
ref: 'refs/heads/develop'
3435
});
35-
if: steps.baseupdatecheck.outputs.needs-updating == 'true'
36+
if: steps.baseupdatecheck.outputs.needs-updating == 'true'

‎.github/workflows/build_container_develop_branch.yml‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ env:
1313
DOCKER_HUB_ORGANIZATION: ${{ vars.DOCKER_HUB_ORGANIZATION }}
1414
DOCKER_HUB_REPOSITORY: obp-api
1515

16-
1716
jobs:
1817
build:
1918
runs-on: ubuntu-latest
@@ -36,8 +35,8 @@ jobs:
3635
- name: Set up JDK 11
3736
uses: actions/setup-java@v4
3837
with:
39-
java-version: '11'
40-
distribution: 'adopt'
38+
java-version: "11"
39+
distribution: "adopt"
4140
cache: maven
4241
- name: Build with Maven
4342
run: |
@@ -126,19 +125,22 @@ jobs:
126125
path: push/
127126

128127
- name: Build the Docker image
128+
if: github.repository == 'OpenBankProject/OBP-API'
129129
run: |
130130
echo "${{ secrets.DOCKER_HUB_TOKEN }}" | docker login -u "${{ secrets.DOCKER_HUB_USERNAME }}" --password-stdin docker.io
131131
docker build . --file .github/Dockerfile_PreBuild --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:$GITHUB_SHA --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:latest --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:develop
132132
docker build . --file .github/Dockerfile_PreBuild_OC --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:$GITHUB_SHA-OC --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:latest-OC --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:develop-OC --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:${GITHUB_REF##*/}-OC
133133
docker push docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }} --all-tags
134134
echo docker done
135135
136-
- uses: sigstore/cosign-installer@main
136+
- uses: sigstore/cosign-installer@4d14d7f17e7112af04ea6108fbb4bfc714c00390
137137

138138
- name: Write signing key to disk (only needed for `cosign sign --key`)
139+
if: github.repository == 'OpenBankProject/OBP-API'
139140
run: echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > cosign.key
140141

141142
- name: Sign container image
143+
if: github.repository == 'OpenBankProject/OBP-API'
142144
run: |
143145
cosign sign -y --key cosign.key \
144146
docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:develop
@@ -151,7 +153,4 @@ jobs:
151153
cosign sign -y --key cosign.key \
152154
docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:latest-OC
153155
env:
154-
COSIGN_PASSWORD: "${{secrets.COSIGN_PASSWORD}}"
155-
156-
157-
156+
COSIGN_PASSWORD: "${{secrets.COSIGN_PASSWORD}}"

‎.github/workflows/build_container_non_develop_branch.yml‎

Lines changed: 48 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@ name: Build and publish container non develop
33
on:
44
push:
55
branches:
6-
- '*'
7-
- '!develop'
6+
- "*"
7+
- "!develop"
88

99
env:
1010
DOCKER_HUB_ORGANIZATION: ${{ vars.DOCKER_HUB_ORGANIZATION }}
@@ -35,11 +35,12 @@ jobs:
3535
- name: Set up JDK 11
3636
uses: actions/setup-java@v4
3737
with:
38-
java-version: '11'
39-
distribution: 'adopt'
38+
java-version: "11"
39+
distribution: "adopt"
4040
cache: maven
4141
- name: Build with Maven
4242
run: |
43+
set -o pipefail
4344
cp obp-api/src/main/resources/props/sample.props.template obp-api/src/main/resources/props/production.default.props
4445
echo connector=star > obp-api/src/main/resources/props/test.default.props
4546
echo starConnector_supported_types=mapped,internal >> obp-api/src/main/resources/props/test.default.props
@@ -75,7 +76,44 @@ jobs:
7576
echo ResetPasswordUrlEnabled=true >> obp-api/src/main/resources/props/test.default.props
7677
7778
echo consents.allowed=true >> obp-api/src/main/resources/props/test.default.props
78-
MAVEN_OPTS="-Xmx3G -Xss2m" mvn clean package -Pprod
79+
MAVEN_OPTS="-Xmx3G -Xss2m" mvn clean package -Pprod 2>&1 | tee maven-build.log
80+
81+
- name: Report failing tests (if any)
82+
if: always()
83+
run: |
84+
echo "Checking build log for failing tests via grep..."
85+
if [ ! -f maven-build.log ]; then
86+
echo "No maven-build.log found; skipping failure scan."
87+
exit 0
88+
fi
89+
if grep -n "\*\*\* FAILED \*\*\*" maven-build.log; then
90+
echo "Failing tests detected above."
91+
exit 1
92+
else
93+
echo "No failing tests detected in maven-build.log."
94+
fi
95+
96+
- name: Upload Maven build log
97+
if: always()
98+
uses: actions/upload-artifact@v4
99+
with:
100+
name: maven-build-log
101+
if-no-files-found: ignore
102+
path: |
103+
maven-build.log
104+
105+
- name: Upload test reports
106+
if: always()
107+
uses: actions/upload-artifact@v4
108+
with:
109+
name: test-reports
110+
if-no-files-found: ignore
111+
path: |
112+
obp-api/target/surefire-reports/**
113+
obp-commons/target/surefire-reports/**
114+
**/target/scalatest-reports/**
115+
**/target/site/surefire-report.html
116+
**/target/site/surefire-report/*
79117
80118
- name: Save .war artifact
81119
run: |
@@ -87,19 +125,22 @@ jobs:
87125
path: push/
88126

89127
- name: Build the Docker image
128+
if: github.repository == 'OpenBankProject/OBP-API'
90129
run: |
91130
echo "${{ secrets.DOCKER_HUB_TOKEN }}" | docker login -u "${{ secrets.DOCKER_HUB_USERNAME }}" --password-stdin docker.io
92131
docker build . --file .github/Dockerfile_PreBuild --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:$GITHUB_SHA --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:${GITHUB_REF##*/}
93132
docker build . --file .github/Dockerfile_PreBuild_OC --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:$GITHUB_SHA-OC --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:${GITHUB_REF##*/}-OC
94133
docker push docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }} --all-tags
95134
echo docker done
96135
97-
- uses: sigstore/cosign-installer@main
136+
- uses: sigstore/cosign-installer@4d14d7f17e7112af04ea6108fbb4bfc714c00390
98137

99138
- name: Write signing key to disk (only needed for `cosign sign --key`)
139+
if: github.repository == 'OpenBankProject/OBP-API'
100140
run: echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > cosign.key
101141

102142
- name: Sign container image
143+
if: github.repository == 'OpenBankProject/OBP-API'
103144
run: |
104145
cosign sign -y --key cosign.key \
105146
docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:${GITHUB_REF##*/}
@@ -108,7 +149,4 @@ jobs:
108149
cosign sign -y --key cosign.key \
109150
docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:$GITHUB_SHA
110151
env:
111-
COSIGN_PASSWORD: "${{secrets.COSIGN_PASSWORD}}"
112-
113-
114-
152+
COSIGN_PASSWORD: "${{secrets.COSIGN_PASSWORD}}"

‎.github/workflows/build_pull_request.yml‎

Lines changed: 44 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,15 @@ name: Build on Pull Request
33
on:
44
pull_request:
55
branches:
6-
- '**'
6+
- "**"
77
env:
88
## Sets environment variable
99
DOCKER_HUB_ORGANIZATION: ${{ vars.DOCKER_HUB_ORGANIZATION }}
1010

11-
1211
jobs:
1312
build:
1413
runs-on: ubuntu-latest
14+
if: github.repository == 'OpenBankProject/OBP-API'
1515
services:
1616
# Label used to access the service container
1717
redis:
@@ -31,11 +31,12 @@ jobs:
3131
- name: Set up JDK 11
3232
uses: actions/setup-java@v4
3333
with:
34-
java-version: '11'
35-
distribution: 'adopt'
34+
java-version: "11"
35+
distribution: "adopt"
3636
cache: maven
3737
- name: Build with Maven
3838
run: |
39+
set -o pipefail
3940
cp obp-api/src/main/resources/props/sample.props.template obp-api/src/main/resources/props/production.default.props
4041
echo connector=star > obp-api/src/main/resources/props/test.default.props
4142
echo starConnector_supported_types=mapped,internal >> obp-api/src/main/resources/props/test.default.props
@@ -65,14 +66,50 @@ jobs:
6566
echo COUNTERPARTY_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
6667
echo SEPA_CREDIT_TRANSFERS_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
6768
68-
6969
echo allow_oauth2_login=true >> obp-api/src/main/resources/props/test.default.props
7070
echo oauth2.jwk_set.url=https://www.googleapis.com/oauth2/v3/certs >> obp-api/src/main/resources/props/test.default.props
7171
7272
echo ResetPasswordUrlEnabled=true >> obp-api/src/main/resources/props/test.default.props
7373
7474
echo consents.allowed=true >> obp-api/src/main/resources/props/test.default.props
75-
MAVEN_OPTS="-Xmx3G -Xss2m" mvn clean package -Pprod
75+
MAVEN_OPTS="-Xmx3G -Xss2m" mvn clean package -Pprod 2>&1 | tee maven-build.log
76+
77+
- name: Report failing tests (if any)
78+
if: always()
79+
run: |
80+
echo "Checking build log for failing tests via grep..."
81+
if [ ! -f maven-build.log ]; then
82+
echo "No maven-build.log found; skipping failure scan."
83+
exit 0
84+
fi
85+
if grep -n "\*\*\* FAILED \*\*\*" maven-build.log; then
86+
echo "Failing tests detected above."
87+
exit 1
88+
else
89+
echo "No failing tests detected in maven-build.log."
90+
fi
91+
92+
- name: Upload Maven build log
93+
if: always()
94+
uses: actions/upload-artifact@v4
95+
with:
96+
name: maven-build-log
97+
if-no-files-found: ignore
98+
path: |
99+
maven-build.log
100+
101+
- name: Upload test reports
102+
if: always()
103+
uses: actions/upload-artifact@v4
104+
with:
105+
name: test-reports
106+
if-no-files-found: ignore
107+
path: |
108+
obp-api/target/surefire-reports/**
109+
obp-commons/target/surefire-reports/**
110+
**/target/scalatest-reports/**
111+
**/target/site/surefire-report.html
112+
**/target/site/surefire-report/*
76113
77114
- name: Save .war artifact
78115
run: |
@@ -81,7 +118,4 @@ jobs:
81118
- uses: actions/upload-artifact@v4
82119
with:
83120
name: ${{ github.sha }}
84-
path: pull/
85-
86-
87-
121+
path: pull/

‎.github/workflows/run_trivy.yml‎

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,10 @@ env:
1212
DOCKER_HUB_ORGANIZATION: ${{ vars.DOCKER_HUB_ORGANIZATION }}
1313
DOCKER_HUB_REPOSITORY: obp-api
1414

15-
1615
jobs:
1716
build:
1817
runs-on: ubuntu-latest
19-
if: ${{ github.event.workflow_run.conclusion == 'success' }}
18+
if: github.repository == 'OpenBankProject/OBP-API' && github.event.workflow_run.conclusion == 'success'
2019

2120
steps:
2221
- uses: actions/checkout@v4
@@ -38,17 +37,17 @@ jobs:
3837
- name: Run Trivy vulnerability scanner
3938
uses: aquasecurity/trivy-action@master
4039
with:
41-
image-ref: 'docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:${{ github.sha }}'
42-
format: 'template'
43-
template: '@/contrib/sarif.tpl'
44-
output: 'trivy-results.sarif'
45-
security-checks: 'vuln'
46-
severity: 'CRITICAL,HIGH'
47-
timeout: '30m'
40+
image-ref: "docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:${{ github.sha }}"
41+
format: "template"
42+
template: "@/contrib/sarif.tpl"
43+
output: "trivy-results.sarif"
44+
security-checks: "vuln"
45+
severity: "CRITICAL,HIGH"
46+
timeout: "30m"
4847
cache-dir: .trivy
4948
- name: Fix .trivy permissions
5049
run: sudo chown -R $(stat . -c %u:%g) .trivy
5150
- name: Upload Trivy scan results to GitHub Security tab
5251
uses: github/codeql-action/upload-sarif@v3
5352
with:
54-
sarif_file: 'trivy-results.sarif'
53+
sarif_file: "trivy-results.sarif"

0 commit comments

Comments
 (0)