ci: add GitHub Actions workflows and JReleaser configuration #188
Conversation
- Add CI workflow for automated testing and validation - Add prerelease workflow for snapshot builds and testing - Add release workflow for automated Maven Central publishing - Configure JReleaser for streamlined release management - Enable automated build, test, and deployment pipeline - Support both snapshot and stable release processes
WalkthroughAdds three GitHub Actions workflows (CI, prerelease, release) and a JReleaser configuration enabling multi-module publishing, signing, changelog-driven release notes, artifact uploads, and PR-specific security/quality checks; workflows support matrix builds, Maven caching, conditional tests, GPG setup, and artifact retention. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Dev as Developer
participant GH as GitHub Actions
participant MVN as Maven
participant QC as Quality Tools
participant SEC as OWASP DepCheck
participant Store as Artifact Store
Dev->>GH: Push / Open PR
GH->>GH: Matrix build (Java 17, 21)
GH->>MVN: mvn test (uses cache)
MVN-->>GH: Test reports
GH->>Store: Upload test artifacts
par Static analysis & security (PRs)
GH->>QC: SpotBugs / PMD / Checkstyle
GH->>SEC: Dependency-Check
end
GH->>MVN: mvn -DskipTests package
GH->>Store: Upload build artifacts
sequenceDiagram
autonumber
actor Op as Operator
participant GH as GitHub Actions
participant MVN as Maven
participant GPG as GPG Setup
participant JR as JReleaser
participant OSSRH as Maven Central (OSSRH)
participant GHRel as GitHub Releases
participant Store as Artifact Store
Op->>GH: workflow_dispatch (version, type, skip_tests)
opt run tests
GH->>MVN: mvn test
end
GH->>MVN: mvn -DskipTests package
GH->>GPG: Import keys from secrets
GH->>JR: Run JReleaser (args from inputs)
JR->>OSSRH: Publish & sign artifacts
JR->>GHRel: Create release / tag / notes
GH->>Store: Upload jreleaser/output/*
GH-->>Op: Append run summary (version, type, tests skipped, link)
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Suggested reviewers
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests
📜 Recent review detailsConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (10)
jreleaser.yml (1)
15-20: Library coordinates: verifymainClass.For SDK modules,
project.java.mainClassis typically unnecessary and can be omitted. Confirm it’s intentional; otherwise remove to avoid confusion..github/workflows/ci.yml (4)
31-37: Duplicate Maven caching; prefer one cache.You’re using
actions/setup-java@v4withcache: mavenand alsoactions/cache@v4on~/.m2. This double-caches and can cause cache churn. Drop the explicitactions/cachesteps and rely on setup‑java’s cache.Apply this diff in all jobs:
- - name: Cache Maven dependencies - uses: actions/cache@v4 - with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2Also applies to: 75-81, 144-150
110-117: Pin the OWASP Dependency‑Check action; avoid@main.Using
@mainis mutable and risky. Pin to a tagged release or a commit SHA to improve supply‑chain safety. Also consider settingJAVA_HOME: /opt/jdkif you see JAVA_HOME errors when combined with setup‑java, as per the action’s docs.Example:
- uses: dependency-check/Dependency-Check_Action@main + uses: dependency-check/Dependency-Check_Action@vX.Y.Z # or a commit SHAThe action recommends pinning and notes the
JAVA_HOMEcaveat. (github.com)
12-19: Matrix: considerfail-fast: false.Prevents one JDK failure from cancelling the other matrix runs; improves debuggability.
strategy: + fail-fast: false matrix: java-version: [17, 21]
1-11: Tighten default permissions.Add minimal permissions at the workflow level (e.g.,
permissions: contents: read) to follow least‑privilege.name: CI + +permissions: + contents: read.github/workflows/release.yml (3)
55-61: Remove duplicate Maven cache; rely on setup‑java cache.Same as CI: drop the explicit
actions/cache@v4step.- - name: Cache Maven dependencies - uses: actions/cache@v4 - with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2Also applies to: 55-61
41-47: Checkout token: default is sufficient.
actions/checkout@v4already usesGITHUB_TOKEN. You can remove the explicittokenunless you need a PAT.- name: Checkout uses: actions/checkout@v4 - with: - fetch-depth: 0 - token: ${{ secrets.GITHUB_TOKEN }} + with: + fetch-depth: 0
29-40: Add concurrency control to prevent overlapping releases.Protects against accidental double publishes.
jobs: release: name: Release runs-on: ubuntu-latest + concurrency: + group: release-${{ github.ref }} + cancel-in-progress: true.github/workflows/prerelease.yml (2)
54-60: Remove duplicate Maven cache; rely on setup‑java cache.Same rationale as CI/release.
- - name: Cache Maven dependencies - uses: actions/cache@v4 - with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2
28-39: Add concurrency control to prevent overlapping prereleases.Use a group keyed by version input.
jobs: prerelease: name: Pre-release runs-on: ubuntu-latest + concurrency: + group: prerelease-${{ inputs.version }} + cancel-in-progress: true
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
.github/workflows/ci.yml(1 hunks).github/workflows/prerelease.yml(1 hunks).github/workflows/release.yml(1 hunks)jreleaser.yml(1 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
**/*
⚙️ CodeRabbit configuration file
**/*: Please focus on:
- Code quality and best practices
- Security considerations
- Performance implications
- Test coverage and quality
- API design and consistency
- Error handling and edge cases
For Java code specifically:
- Check for proper exception handling
- Verify async method implementations
- Review builder pattern usage
- Validate test coverage
- Check for memory leaks in async operations
Ignore:
- Generated code files
- Build artifacts
- Configuration files
- Documentation formatting
Files:
jreleaser.yml
🪛 YAMLlint (1.37.1)
jreleaser.yml
[error] 26-26: duplication of key "name" in mapping
(key-duplicates)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: build
🔇 Additional comments (1)
jreleaser.yml (1)
212-246: Changelog + GitHub release notes conflict. Pick one.You’ve enabled
changelogand attempted to enable GitHub “generated release notes.” JReleaser supports either its ownchangelogor GitHub’sreleaseNotes, not both. The diff above disablesreleaseNotes; alternatively, disablechangelogif you prefer GitHub’s notes.Confirm the intended source of truth (JReleaser changelog vs GitHub release notes) and keep only one enabled. (jreleaser.org)
- Update prerelease workflow with improved build and test steps - Enhance release workflow for better Maven Central deployment - Refine JReleaser configuration for more robust release process - Improve error handling and logging in CI/CD pipelines - Optimize workflow triggers and conditions for better automation
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/release.yml (1)
55-61: Remove the extra Maven cache.
actions/setup-java@v4already restores and saves the Maven repository because you enabledcache: maven, so this additionalactions/cachestep on~/.m2is redundant. It adds risk of persisting transient config files (for examplesettings.xmlwith credentials) and can slow the workflow when both caches contend for the same path. Drop this block and let the Java setup action manage the cache on its own.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
.github/workflows/prerelease.yml(1 hunks).github/workflows/release.yml(1 hunks)jreleaser.yml(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (2)
- .github/workflows/prerelease.yml
- jreleaser.yml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: build
- Update JReleaser YAML configuration with latest settings - Improve release automation and deployment pipeline - Refine artifact publishing and distribution settings - Enhance release metadata and changelog generation - Optimize Maven Central deployment configuration
|
This needs more testing |
2 participants
Explain your changes
Checklist
🛟 If you need help, consider asking for advice over in the Kinde community.
Summary by CodeRabbit