From bbbb188f4f98325b4afc44d3757858446d6cc252 Mon Sep 17 00:00:00 2001 From: kevpdev Date: Thu, 8 Oct 2026 18:38:19 +0200 Subject: [PATCH 1/2] ci(gate): split verify into lint and unit-tests behind a single ci gate --- .github/workflows/ci.yml | 57 ++++++++++++++++++++++++++++++++++--- .github/workflows/trivy.yml | 30 ------------------- README.md | 2 +- 3 files changed, 54 insertions(+), 35 deletions(-) delete mode 100644 .github/workflows/trivy.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ed7caa2..03bf822 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -7,8 +7,8 @@ permissions: contents: read jobs: - check: - name: check + lint: + name: lint runs-on: ubuntu-24.04 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -17,5 +17,54 @@ jobs: distribution: temurin java-version: '21' cache: maven - - name: Compile and run the tests - run: sh ./mvnw -B verify + - name: Format, style and static analysis (Spotless, Checkstyle, PMD, SpotBugs) + run: sh ./mvnw -B process-classes + + unit-tests: + name: unit-tests + runs-on: ubuntu-24.04 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 + with: + distribution: temurin + java-version: '21' + cache: maven + # The analysers already ran in `lint`. + - name: Unit tests and the coverage threshold (Surefire, JaCoCo) + run: >- + sh ./mvnw -B verify + -Dspotless.check.skip=true -Dcheckstyle.skip=true -Dpmd.skip=true -Dspotbugs.skip=true + + security: + name: security + runs-on: ubuntu-24.04 + permissions: + contents: read + security-events: write + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 + with: + scan-type: fs + format: sarif + output: trivy-results.sarif + exit-code: '1' + severity: CRITICAL,HIGH + ignore-unfixed: true + limit-severities-for-sarif: true + - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 + if: always() + with: + sarif_file: trivy-results.sarif + + # The only check the ruleset requires. `always()` keeps it from being skipped when a job fails, + # since GitHub counts a skipped job as passed. + ci: + name: ci + if: always() + needs: [lint, unit-tests, security] + runs-on: ubuntu-24.04 + steps: + - name: Fail unless every job passed + run: test "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = false diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml deleted file mode 100644 index 903a4fa..0000000 --- a/.github/workflows/trivy.yml +++ /dev/null @@ -1,30 +0,0 @@ -name: trivy -on: - pull_request: - branches: [main] - -permissions: - contents: read - -jobs: - security: - name: security - runs-on: ubuntu-24.04 - permissions: - contents: read - security-events: write - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 - with: - scan-type: fs - format: sarif - output: trivy-results.sarif - exit-code: '1' - severity: CRITICAL,HIGH - ignore-unfixed: true - limit-severities-for-sarif: true - - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 - if: always() - with: - sarif_file: trivy-results.sarif diff --git a/README.md b/README.md index b0e54c2..1fed311 100644 --- a/README.md +++ b/README.md @@ -135,7 +135,7 @@ La commande `sh ./mvnw verify` est la barrière unique, en local comme en CI. El 4. **Tests** (Surefire, classes `*Test`). 5. **JaCoCo** : rapport dans `target/site/jacoco`, échec sous **40 %** de lignes couvertes. -Le workflow `.github/workflows/ci.yml` lance cette commande dans le job `check`. Trois autres contrôles tournent sur les pull requests : `security` (Trivy, dépendances), `codeql` (code Java et workflows GitHub Actions) et Dependabot (`github-actions` et `maven`, chaque semaine). La branche `main` exige `check` et `security`. +Le workflow `.github/workflows/ci.yml` répartit cette chaîne en deux jobs parallèles : `lint` (`sh ./mvnw -B process-classes`, étapes 1 à 3) et `unit-tests` (`verify` avec les analyseurs sautés, étapes 4 et 5). Le job `security` (Trivy, dépendances) tourne à côté, puis la porte `ci` échoue si l'un des trois échoue. La branche `main` n'exige que `ci`. `codeql` (code Java et workflows GitHub Actions) tourne à part, non exigé, et Dependabot met à jour `github-actions` et `maven` chaque semaine. Pour des tests d'intégration `*IT`, il faut déclarer `maven-failsafe-plugin` dans le `pom.xml` : sans lui, Maven ignore ces classes sans erreur. From 34308f6870f659ef489a867fc98df2ec56539517 Mon Sep 17 00:00:00 2001 From: kevpdev Date: Thu, 8 Oct 2026 18:40:52 +0200 Subject: [PATCH 2/2] ci(gate): keep maven verify in a single job, the split run was slower --- .github/workflows/ci.yml | 28 +++++++--------------------- README.md | 2 +- 2 files changed, 8 insertions(+), 22 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 03bf822..d3473a4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -7,8 +7,8 @@ permissions: contents: read jobs: - lint: - name: lint + lint-and-tests: + name: lint-and-tests runs-on: ubuntu-24.04 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -17,24 +17,10 @@ jobs: distribution: temurin java-version: '21' cache: maven - - name: Format, style and static analysis (Spotless, Checkstyle, PMD, SpotBugs) - run: sh ./mvnw -B process-classes - - unit-tests: - name: unit-tests - runs-on: ubuntu-24.04 - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 - with: - distribution: temurin - java-version: '21' - cache: maven - # The analysers already ran in `lint`. - - name: Unit tests and the coverage threshold (Surefire, JaCoCo) - run: >- - sh ./mvnw -B verify - -Dspotless.check.skip=true -Dcheckstyle.skip=true -Dpmd.skip=true -Dspotbugs.skip=true + # One job on purpose: split into lint and unit-tests, the skipped analysers still cost about + # 14 s to load and the split run was slower (kevpdev/swapi#7). + - name: Format, style, static analysis, unit tests and coverage (Maven verify) + run: sh ./mvnw -B verify security: name: security @@ -63,7 +49,7 @@ jobs: ci: name: ci if: always() - needs: [lint, unit-tests, security] + needs: [lint-and-tests, security] runs-on: ubuntu-24.04 steps: - name: Fail unless every job passed diff --git a/README.md b/README.md index 1fed311..2f5fe8f 100644 --- a/README.md +++ b/README.md @@ -135,7 +135,7 @@ La commande `sh ./mvnw verify` est la barrière unique, en local comme en CI. El 4. **Tests** (Surefire, classes `*Test`). 5. **JaCoCo** : rapport dans `target/site/jacoco`, échec sous **40 %** de lignes couvertes. -Le workflow `.github/workflows/ci.yml` répartit cette chaîne en deux jobs parallèles : `lint` (`sh ./mvnw -B process-classes`, étapes 1 à 3) et `unit-tests` (`verify` avec les analyseurs sautés, étapes 4 et 5). Le job `security` (Trivy, dépendances) tourne à côté, puis la porte `ci` échoue si l'un des trois échoue. La branche `main` n'exige que `ci`. `codeql` (code Java et workflows GitHub Actions) tourne à part, non exigé, et Dependabot met à jour `github-actions` et `maven` chaque semaine. +Le workflow `.github/workflows/ci.yml` lance cette commande dans le job `lint-and-tests`. Le job `security` (Trivy, dépendances) tourne à côté, puis la porte `ci` échoue si l'un des deux échoue. La branche `main` n'exige que `ci`. `codeql` (code Java et workflows GitHub Actions) tourne à part, non exigé, et Dependabot met à jour `github-actions` et `maven` chaque semaine. Pour des tests d'intégration `*IT`, il faut déclarer `maven-failsafe-plugin` dans le `pom.xml` : sans lui, Maven ignore ces classes sans erreur.