GeminiAPI/.github/workflows/ci.yml at main · DemchaAV/GeminiAPI · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
name: CI

on:
  push:
    branches:
      - main
      - develop
  pull_request:
  workflow_dispatch:
  schedule:
    - cron: "0 5 * * 1"

jobs:
  build-test:
    name: Build and Test (JDK ${{ matrix.java-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        java-version: [21]

    steps:
      - name: Check out source
        uses: actions/checkout@v4

      - name: Set up Temurin JDK
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: ${{ matrix.java-version }}
          cache: maven

      - name: Make Maven Wrapper executable
        run: chmod +x mvnw

      - name: Build and run tests
        run: ./mvnw -B -ntp clean verify

      - name: Upload unit test reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: surefire-reports-jdk-${{ matrix.java-version }}
          path: |
            target/surefire-reports/**
            target/failsafe-reports/**

  coverage:
    name: Code Coverage
    runs-on: ubuntu-latest

    steps:
      - name: Check out source
        uses: actions/checkout@v4

      - name: Set up Temurin JDK
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21
          cache: maven

      - name: Make Maven Wrapper executable
        run: chmod +x mvnw

      - name: Generate JaCoCo report
        run: ./mvnw -B -ntp clean verify

      - name: Upload coverage artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: jacoco-report
          path: |
            target/site/jacoco/**
            target/jacoco.exec

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v5
        with:
          files: ./target/site/jacoco/jacoco.xml
          fail_ci_if_error: false

  static-analysis:
    name: Static Analysis
    runs-on: ubuntu-latest

    steps:
      - name: Check out source
        uses: actions/checkout@v4

      - name: Set up Temurin JDK
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21
          cache: maven

      - name: Make Maven Wrapper executable
        run: chmod +x mvnw

      - name: Run formatter and static analysis
        run: ./mvnw -B -ntp -Pquality license:check spotless:check checkstyle:check spotbugs:check

      - name: Upload static-analysis reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: static-analysis-reports
          path: |
            target/checkstyle-result.xml
            target/spotbugsXml.xml

  dependency-scan:
    name: Dependency Vulnerability Scan
    runs-on: ubuntu-latest
    timeout-minutes: 25
    env:
      NVD_API_KEY: ${{ secrets.NVD_API_KEY }}

    steps:
      - name: Check out source
        uses: actions/checkout@v4

      - name: Set up Temurin JDK
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21
          cache: maven

      - name: Make Maven Wrapper executable
        run: chmod +x mvnw

      - name: Skip scan when NVD API key is not configured
        if: ${{ env.NVD_API_KEY == '' }}
        run: echo "::notice::Skipping OWASP Dependency-Check because NVD_API_KEY is not configured."

      - name: Run OWASP Dependency-Check
        if: ${{ env.NVD_API_KEY != '' }}
        shell: bash
        run: |
          ./mvnw -B -ntp org.owasp:dependency-check-maven:check \
            -Dformats=HTML,XML \
            -DprettyPrint=true \
            -DnvdApiKey="${NVD_API_KEY}"

      - name: Upload dependency-check reports
        if: ${{ always() && env.NVD_API_KEY != '' }}
        uses: actions/upload-artifact@v4
        with:
          name: dependency-check-report
          path: target/dependency-check-report.*