-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathcomplete-pipeline-example.yml
More file actions
265 lines (242 loc) Β· 9.05 KB
/
complete-pipeline-example.yml
File metadata and controls
265 lines (242 loc) Β· 9.05 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
# Example: Complete Enterprise CI/CD Pipeline
# This example demonstrates a full-featured pipeline with:
# - Multi-version testing
# - Security scanning
# - Code quality checks
# - Artifact publishing
# - Release automation
name: Complete Enterprise Pipeline
on:
push:
branches: [main, develop]
pull_request:
branches: [main]
release:
types: [created]
jobs:
# Stage 1: Build and Test
build-and-test:
name: π¨ Build & Test
uses: techishthoughts-org/workflows/.github/workflows/java-ci-universal.yml@v2.1.0
with:
java-version: '25'
build-tool: 'maven' # or 'gradle'
os-matrix: 'ubuntu-latest,windows-latest,macos-latest'
coverage-tool: 'jacoco'
test-pattern: '**/*Test'
maven-opts: '-Xmx4g'
secrets:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
# Stage 2: Security Scanning
security-scan:
name: π Security Analysis
needs: [build-and-test]
if: github.event_name == 'push' || github.event_name == 'pull_request'
uses: techishthoughts-org/workflows/.github/workflows/ci-security.yml@v2.1.0
with:
java-version: '25'
build-tool: 'maven'
enable-codeql: true
enable-dependency-check: true
enable-trivy: true
enable-snyk: true
fail-on-severity: 'high'
notify-on-vulnerabilities: true
secrets:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
# Stage 3: Compatibility Testing (Java LTS versions)
compatibility-test:
name: π Java ${{ matrix.java }} Compatibility
needs: [build-and-test]
if: github.event_name == 'pull_request'
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
java: ['11', '17', '21', '25']
steps:
- name: π₯ Checkout
uses: actions/checkout@v4
- name: β Setup Java ${{ matrix.java }}
uses: actions/setup-java@v4
with:
java-version: ${{ matrix.java }}
distribution: 'temurin'
cache: 'maven'
- name: π¨ Build & Test
run: ./mvnw clean verify -B
- name: π Test Results
if: always()
uses: actions/upload-artifact@v4
with:
name: test-results-java-${{ matrix.java }}
path: target/surefire-reports/
# Stage 4: Code Quality (SonarQube - Optional)
code-quality:
name: π Code Quality
needs: [build-and-test]
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
runs-on: ubuntu-latest
steps:
- name: π₯ Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0 # Full history for better analysis
- name: β Setup Java
uses: actions/setup-java@v4
with:
java-version: '25'
distribution: 'temurin'
cache: 'maven'
- name: π SonarQube Analysis
if: env.SONAR_TOKEN != ''
run: |
./mvnw verify sonar:sonar \
-Dsonar.projectKey=${{ github.repository_owner }}_${{ github.event.repository.name }} \
-Dsonar.organization=${{ github.repository_owner }} \
-Dsonar.host.url=https://sonarcloud.io \
-Dsonar.login=${{ secrets.SONAR_TOKEN }}
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# Stage 5: Build Docker Image (if needed)
build-docker:
name: π³ Build Docker Image
needs: [build-and-test, security-scan]
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- name: π₯ Checkout
uses: actions/checkout@v4
- name: β Setup Java
uses: actions/setup-java@v4
with:
java-version: '25'
distribution: 'temurin'
cache: 'maven'
- name: π¨ Build artifact
run: ./mvnw clean package -DskipTests -B
- name: π³ Build & Push Docker Image
uses: techishthoughts-org/workflows/.github/actions/docker-build-push@v2.1.0
with:
image-name: ${{ github.event.repository.name }}
image-tag: ${{ github.sha }}
registry: 'ghcr.io'
push: 'true'
platforms: 'linux/amd64,linux/arm64'
build-args: |
VERSION=${{ github.sha }}
BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
# Stage 6: Publish Artifacts (on release)
publish-artifacts:
name: π€ Publish Artifacts
needs: [build-and-test, security-scan]
if: github.event_name == 'release'
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- name: π₯ Checkout
uses: actions/checkout@v4
- name: π€ Publish to GitHub Packages
uses: techishthoughts-org/workflows/.github/actions/artifact-publish@v2.1.0
with:
build-tool: 'maven'
publish-target: 'github'
artifact-version: ${{ github.event.release.tag_name }}
java-version: '25'
skip-tests: false
gpg-sign: false
env:
MAVEN_USERNAME: ${{ github.actor }}
MAVEN_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
- name: π€ Publish to Maven Central (Optional)
if: env.OSSRH_USERNAME != ''
uses: techishthoughts-org/workflows/.github/actions/artifact-publish@v2.1.0
with:
build-tool: 'maven'
publish-target: 'maven-central'
artifact-version: ${{ github.event.release.tag_name }}
java-version: '25'
skip-tests: true # Already tested
gpg-sign: true
env:
OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
# Stage 7: Release Summary
release-summary:
name: π Release Summary
needs: [publish-artifacts]
if: github.event_name == 'release'
runs-on: ubuntu-latest
steps:
- name: π Generate Summary
run: |
echo "### π Release ${{ github.event.release.tag_name }}" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "#### β
Completed Stages:" >> $GITHUB_STEP_SUMMARY
echo "- β
Build & Test (Multi-OS)" >> $GITHUB_STEP_SUMMARY
echo "- β
Security Scanning" >> $GITHUB_STEP_SUMMARY
echo "- β
Artifact Publishing" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "#### π¦ Published Artifacts:" >> $GITHUB_STEP_SUMMARY
echo "- GitHub Packages: https://github.com/${{ github.repository }}/packages" >> $GITHUB_STEP_SUMMARY
echo "- Maven Central: https://search.maven.org/ (check after sync)" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "#### π Quality Metrics:" >> $GITHUB_STEP_SUMMARY
echo "- Security Score: Check Security tab" >> $GITHUB_STEP_SUMMARY
echo "- Test Coverage: Check artifacts" >> $GITHUB_STEP_SUMMARY
echo "- Code Quality: Check SonarCloud" >> $GITHUB_STEP_SUMMARY
- name: π Notify Success
if: env.SLACK_WEBHOOK_URL != ''
run: |
curl -X POST ${{ secrets.SLACK_WEBHOOK_URL }} \
-H 'Content-Type: application/json' \
-d '{
"text": "π Release ${{ github.event.release.tag_name }} published successfully!",
"blocks": [
{
"type": "section",
"text": {
"type": "mrkdwn",
"text": "*Release ${{ github.event.release.tag_name }}*\n\nβ
All stages completed\nπ¦ Artifacts published\nπ Security checks passed"
}
}
]
}'
env:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
# Required Secrets:
# - SLACK_WEBHOOK_URL: For notifications (optional)
# - SNYK_TOKEN: For Snyk scanning (optional)
# - SONAR_TOKEN: For SonarQube analysis (optional)
# - OSSRH_USERNAME: For Maven Central (optional)
# - OSSRH_PASSWORD: For Maven Central (optional)
# - GPG_PRIVATE_KEY: For Maven Central signing (optional)
# - GPG_PASSPHRASE: For GPG signing (optional)
# Pipeline Stages:
# 1. Build & Test: Multi-OS testing with coverage
# 2. Security Scan: SAST, SCA, secrets detection
# 3. Compatibility Test: Test with multiple Java versions
# 4. Code Quality: SonarQube analysis (optional)
# 5. Docker Build: Container image creation
# 6. Publish Artifacts: Release to package repositories
# 7. Release Summary: Final reporting and notifications
# Best Practices:
# 1. Always run security scans before publishing
# 2. Test with all LTS Java versions for compatibility
# 3. Use semantic versioning for releases
# 4. Publish to GitHub Packages first, then Maven Central
# 5. Run full test suite before releasing
# 6. Use GitHub Environments for production deployments
# 7. Enable required status checks on main branch
# 8. Use Dependabot for dependency updates
# 9. Monitor security advisories regularly
# 10. Keep workflows and actions up to date