separating pipeline #718

Schmarvinius · 2026-01-23T07:56:59Z

Separating CI Pipelines for Main and Pull Request Workflows

Changes

This pull request restructures the CI/CD workflows by splitting the monolithic pipeline into separate workflows for main branch, pull requests, and releases.

.github/workflows/ci-main.yml: Renamed and simplified to focus on main branch operations. Removed PR-specific triggers (pull_request_target) and workflow dispatch. Removed Blackduck scanning step. Updated deployment credentials to use secrets directly instead of environment variables. Consolidated multi-line Maven command into a single line.
.github/workflows/ci-pr.yml: New file created specifically for pull request workflows. Contains all PR-specific logic including approval gates, build matrix for Java 17 and 21, integration tests across multiple configurations (build-version, latest-version, oss), SonarQube scanning, and build artifact management. Triggers on pull_request_target and workflow_dispatch events.
.github/workflows/ci-pr-codeql.yml: Renamed with adjusted triggers. Removed pull_request trigger, keeping only scheduled scans and main branch pushes.
.github/workflows/ci-release.yml: Renamed without content changes, maintaining release-specific workflow logic.
.pipeline/config.yml: Updated Black Duck scan configuration to disable artifact installation (installArtifacts: false).
pom.xml: Removed cds-feature-attachments-fs from the excluded artifacts list in the central publishing plugin configuration.
samples/bookshop/pom.xml: Replaced parameterized ${revision} version with hardcoded 1.0.0-SNAPSHOT. Removed the revision property definition from properties section.
samples/bookshop/srv/pom.xml: Updated parent version from ${revision} to hardcoded 1.0.0-SNAPSHOT.

🔄 Regenerate and Update Summary

…unnecessary exclusions in config

hyperspace-insights

Summary

This pull request has critical configuration issues in .github/workflows/ci-main.yml. The workflow was renamed and changed to "CodeQL Advanced" but still contains all the original CI jobs (build, integration-tests, sonarqube-scan, deploy-snapshot) while removing the environment variables they depend on (MAVEN_VERSION, SONARQ_TOKEN, GITHUB_TOKEN, cloud storage credentials). Additionally, several job conditions reference pull_request_target events that are no longer in the workflow triggers. These issues will cause immediate workflow failures when the CI jobs attempt to run.

PR Bot Information

Version: 1.17.30 | 📖 Documentation | 🚨 Create Incident | 💬 Feedback

Correlation ID: 18b8de20-f831-11f0-900d-2f929a99e504
LLM: anthropic--claude-4.5-sonnet
Event Trigger: pull_request.opened

hyperspace-insights · 2026-01-23T07:57:52Z

.github/workflows/ci-main.yml

    runs-on: ubuntu-latest
-    timeout-minutes: 30
    name: "Waiting for PR approval as this workflow runs on pull_request_target"
    if: github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.owner.login != 'cap-java'


Logic Error: Job condition references pull_request_target but workflow doesn't trigger on it

The requires-approval job checks for github.event_name == 'pull_request_target', but the workflow's on: trigger (lines 14-18) only includes push and schedule events—not pull_request_target. This job will always be skipped, and the name is misleading for a workflow that runs on push to main and scheduled.

Consider removing this job or updating the trigger to include pull_request_target events if approval is needed.

Please provide feedback on the review comment by checking the appropriate box:

🌟 Awesome comment, a human might have missed that.

✅ Helpful comment

🤷 Neutral

❌ This comment is not helpful

hyperspace-insights · 2026-01-23T07:57:52Z

.github/workflows/ci-main.yml

+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL Advanced"


Naming: Workflow name "CodeQL Advanced" doesn't match actual job content

The workflow is named "CodeQL Advanced" with template comments about CodeQL analysis, but it actually contains CI jobs (build, integration-tests, sonarqube-scan, deploy-snapshot) and no CodeQL analysis job. This is misleading and will confuse maintainers.

Consider renaming to "CI - Main Branch" or similar to reflect the actual purpose, or splitting CodeQL into a separate workflow.

Please provide feedback on the review comment by checking the appropriate box:

🌟 Awesome comment, a human might have missed that.

✅ Helpful comment

🤷 Neutral

❌ This comment is not helpful

hyperspace-insights · 2026-01-23T07:57:52Z

.github/workflows/ci-pr.yml

+          java-version: 17
+          maven-version: ${{ env.MAVEN_VERSION }}
+          sonarq-token: ${{ env.SONARQ_TOKEN }}
+          github-token: ${{ env.GITHUB_TOKEN }}


Bug: Missing newline at end of file

The file ends without a newline character after line 111. While this doesn't cause functional issues in YAML, it violates POSIX standards and many linters flag this.

Consider adding a newline at the end of the file.

Please provide feedback on the review comment by checking the appropriate box:

🌟 Awesome comment, a human might have missed that.

✅ Helpful comment

🤷 Neutral

❌ This comment is not helpful

hyperspace-insights · 2026-01-23T07:57:52Z

.github/workflows/ci-main.yml

          sonarq-token: ${{ env.SONARQ_TOKEN }}
          github-token: ${{ env.GITHUB_TOKEN }}


Logic Error: Missing environment variables for SonarQube scan

The SonarQube scan job references ${{ env.SONARQ_TOKEN }} and ${{ env.GITHUB_TOKEN }} at lines 102-103, but these environment variables were removed from the workflow definition. This will cause the scan to fail or be skipped.

Consider adding back the required environment variables:

env: SONARQ_TOKEN: ${{ secrets.SONARQ_TOKEN }} GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}

Please provide feedback on the review comment by checking the appropriate box:

🌟 Awesome comment, a human might have missed that.

✅ Helpful comment

🤷 Neutral

❌ This comment is not helpful

hyperspace-insights · 2026-01-23T07:57:52Z

.github/workflows/ci-main.yml

      - name: Set up Maven ${{ env.MAVEN_VERSION }}
        uses: stCarolas/setup-maven@v5
        with:
          maven-version: ${{ env.MAVEN_VERSION }}


Logic Error: Missing MAVEN_VERSION for deploy-snapshot job

The deploy-snapshot job references ${{ env.MAVEN_VERSION }} at line 128, but this environment variable is not defined in the workflow. This will cause Maven setup to fail or use an unintended version.

Consider adding MAVEN_VERSION to the workflow's env section.

Please provide feedback on the review comment by checking the appropriate box:

🌟 Awesome comment, a human might have missed that.

✅ Helpful comment

🤷 Neutral

❌ This comment is not helpful

hyperspace-insights · 2026-01-23T07:57:52Z

.github/workflows/ci-main.yml

 on:
-  workflow_dispatch:
  push:
-    branches: [main]
-  pull_request_target:
-    branches: [main]
-    types: [reopened, synchronize, opened]
+    branches: [ "main" ]
+  schedule:
+    - cron: '24 18 * * 2'


Logic Error: Missing all environment variables needed by CI jobs

The workflow name was changed to "CodeQL Advanced" but still contains build, integration-tests, and other CI jobs that require environment variables like MAVEN_VERSION, SONARQ_TOKEN, GITHUB_TOKEN, and cloud storage credentials. All these env variables were removed from the top of the file (previously defined in lines with AWS_S3_, AZURE_, GS_*, etc.), causing all downstream jobs to fail.

Consider either: (1) Restoring the env section with all required variables, or (2) Removing the CI jobs if this should be a CodeQL-only workflow.

Please provide feedback on the review comment by checking the appropriate box:

🌟 Awesome comment, a human might have missed that.

✅ Helpful comment

🤷 Neutral

❌ This comment is not helpful

hyperspace-insights · 2026-01-23T07:57:52Z

.github/workflows/ci-main.yml

  requires-approval:
    runs-on: ubuntu-latest
-    timeout-minutes: 30
    name: "Waiting for PR approval as this workflow runs on pull_request_target"
    if: github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.owner.login != 'cap-java'
    environment: pr-approval


Bug: Inconsistent event trigger check

The condition checks for pull_request_target but the workflow only triggers on push to main and schedule. Since this workflow never runs on pull_request_target events (per lines 15-18), this condition will always evaluate to false, making the requires-approval job redundant.

Consider removing this job entirely from ci-main.yml since it's a push/schedule workflow, not a PR workflow.

Please provide feedback on the review comment by checking the appropriate box:

🌟 Awesome comment, a human might have missed that.

✅ Helpful comment

🤷 Neutral

❌ This comment is not helpful

hyperspace-insights · 2026-01-23T07:57:52Z

.github/workflows/ci-main.yml


      - name: Set Dry Run for Pull Request
-        if: github.event_name == 'pull_request'
+        if: github.event_name == 'pull_request_target'


Logic Error: Incorrect event type in conditional

This condition checks for pull_request but the ci-main.yml workflow doesn't trigger on any pull request events (only push and schedule per lines 15-18). Additionally, line 131 was changed from pull_request to pull_request_target for consistency, but since this workflow doesn't trigger on either event type, the DRY_RUN_PARAM will never be set.

Consider removing this step entirely from ci-main.yml since snapshots from push to main should deploy normally, not as dry runs.

Please provide feedback on the review comment by checking the appropriate box:

🌟 Awesome comment, a human might have missed that.

✅ Helpful comment

🤷 Neutral

❌ This comment is not helpful

…t variable organization

…ne workflow for improved build and deployment processes

…eline

Schmarvinius added 6 commits January 22, 2026 16:48

pipeline

570ca6c

Update POM files to use fixed version instead of variable and remove …

63cec04

…unnecessary exclusions in config

Set installArtifacts to false in pipeline configuration

587a086

remove blackduck

29f7605

Refactor deployment user credentials to use secrets in CI configuration

36f5afa

additions

ffad0dd

hyperspace-insights bot reviewed Jan 23, 2026

View reviewed changes

Schmarvinius added 6 commits January 23, 2026 08:58

Merge branch 'main' into bugfix/pipeline

6d00b1b

confusion in main merge

634bfc5

Refactor CI workflows to remove approval steps and improve environmen…

9fa4a50

…t variable organization

Remove obsolete CI workflow files and introduce a new reusable pipeli…

2158682

…ne workflow for improved build and deployment processes

Add 'needs: build' dependency to CodeQL Analysis job in pipeline

26b219a

Remove unnecessary dry run parameter from Maven deploy command in pip…

d91d816

…eline

Schmarvinius marked this pull request as ready for review January 23, 2026 09:28

Schmarvinius merged commit f1c1e4a into main Jan 23, 2026
3 checks passed

Schmarvinius deleted the bugfix/pipeline branch January 23, 2026 09:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

separating pipeline #718

separating pipeline #718

Uh oh!

Schmarvinius commented Jan 23, 2026 •

edited by hyperspace-insights bot

Loading

Uh oh!

hyperspace-insights bot left a comment

Uh oh!

hyperspace-insights bot Jan 23, 2026

Uh oh!

hyperspace-insights bot Jan 23, 2026

Uh oh!

hyperspace-insights bot Jan 23, 2026

Uh oh!

hyperspace-insights bot Jan 23, 2026

Uh oh!

hyperspace-insights bot Jan 23, 2026

Uh oh!

hyperspace-insights bot Jan 23, 2026

Uh oh!

hyperspace-insights bot Jan 23, 2026

Uh oh!

hyperspace-insights bot Jan 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		sonarq-token: ${{ env.SONARQ_TOKEN }}
		github-token: ${{ env.GITHUB_TOKEN }}

separating pipeline #718

separating pipeline #718

Uh oh!

Conversation

Schmarvinius commented Jan 23, 2026 • edited by hyperspace-insights bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Separating CI Pipelines for Main and Pull Request Workflows

Changes

Uh oh!

hyperspace-insights bot left a comment

Choose a reason for hiding this comment

Summary

Uh oh!

hyperspace-insights bot Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

hyperspace-insights bot Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

hyperspace-insights bot Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

hyperspace-insights bot Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

hyperspace-insights bot Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

hyperspace-insights bot Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

hyperspace-insights bot Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

hyperspace-insights bot Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Schmarvinius commented Jan 23, 2026 •

edited by hyperspace-insights bot

Loading