Skip to content

Commit f11ba8f

Browse files
sjohnrsjohnr
committed
Switch to reusable workflows
Issue gh-14538 Closes gh-14242 Closes gh-13195 Closes gh-10460 Closes gh-11308
1 parent ad71f57 commit f11ba8f

File tree

2 files changed

+74
-329
lines changed

2 files changed

+74
-329
lines changed

‎.github/workflows/continuous-integration-workflow.yml

Lines changed: 70 additions & 258 deletions
Original file line numberDiff line numberDiff line change
@@ -9,299 +9,111 @@ on:
99
workflow_dispatch: # Manual trigger
1010

1111
env:
12-
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
13-
GRADLE_ENTERPRISE_CACHE_USER: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USER }}
12+
GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USER }}
1413
GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
15-
GRADLE_ENTERPRISE_SECRET_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_SECRET_ACCESS_KEY }}
16-
COMMIT_OWNER: ${{ github.event.pusher.name }}
17-
COMMIT_SHA: ${{ github.sha }}
18-
STRUCTURE101_LICENSEID: ${{ secrets.STRUCTURE101_LICENSEID }}
19-
ARTIFACTORY_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }}
20-
ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
14+
GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_SECRET_ACCESS_KEY }}
2115

2216
permissions:
2317
contents: read
2418

2519
jobs:
26-
prerequisites:
27-
name: Pre-requisites for building
28-
runs-on: ubuntu-latest
29-
if: ${{ github.repository == 'spring-projects/spring-security' }}
30-
outputs:
31-
runjobs: ${{ steps.continue.outputs.runjobs }}
32-
project_version: ${{ steps.continue.outputs.project_version }}
33-
samples_branch: ${{ steps.continue.outputs.samples_branch }}
34-
steps:
35-
- uses: actions/checkout@v4
36-
- id: continue
37-
name: Determine if should continue
38-
run: |
39-
# Run jobs if in upstream repository
40-
echo "runjobs=true" >>$GITHUB_OUTPUT
41-
# Extract version from gradle.properties
42-
version=$(cat gradle.properties | grep "version=" | awk -F'=' '{print $2}')
43-
echo "project_version=$version" >>$GITHUB_OUTPUT
44-
samples_branch=$(cat gradle.properties | grep "samplesBranch=" | awk -F'=' '{print $2}')
45-
echo "samples_branch=$samples_branch" >>$GITHUB_OUTPUT
46-
build_jdk_17:
47-
name: Build JDK 17
48-
needs: [prerequisites]
20+
build:
21+
name: Build
22+
uses: spring-io/spring-security-release-tools/.github/workflows/build.yml@v1
4923
strategy:
5024
matrix:
51-
os: [ubuntu-latest, windows-latest]
52-
runs-on: ${{ matrix.os }}
53-
if: needs.prerequisites.outputs.runjobs
54-
steps:
55-
- uses: actions/checkout@v4
56-
- name: Set up JDK 17
57-
uses: actions/setup-java@v4
58-
with:
59-
java-version: '17'
60-
distribution: 'temurin'
61-
cache: 'gradle'
62-
- name: Set up Gradle
63-
uses: gradle/gradle-build-action@v3
64-
- name: Set up gradle user name
65-
run: echo 'systemProp.user.name=spring-builds+github' >> gradle.properties
66-
- name: Build with Gradle
67-
env:
68-
GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USER }}
69-
GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
70-
GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_SECRET_ACCESS_KEY }}
71-
run: ./gradlew clean build --continue -PartifactoryUsername="$ARTIFACTORY_USERNAME" -PartifactoryPassword="$ARTIFACTORY_PASSWORD"
72-
snapshot_tests:
73-
name: Test against snapshots
74-
needs: [prerequisites]
75-
runs-on: ubuntu-latest
76-
if: needs.prerequisites.outputs.runjobs
77-
steps:
78-
- uses: actions/checkout@v4
79-
- name: Set up gradle
80-
uses: spring-io/spring-gradle-build-action@v2
81-
with:
82-
java-version: '17'
83-
distribution: 'temurin'
84-
- name: Snapshot Tests
85-
run: |
86-
export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
87-
export GRADLE_ENTERPRISE_CACHE_PASSWORD="$GRADLE_ENTERPRISE_CACHE_PASSWORD"
88-
export GRADLE_ENTERPRISE_ACCESS_KEY="$GRADLE_ENTERPRISE_SECRET_ACCESS_KEY"
89-
./gradlew test --refresh-dependencies -PartifactoryUsername="$ARTIFACTORY_USERNAME" -PartifactoryPassword="$ARTIFACTORY_PASSWORD" -PforceMavenRepositories=snapshot -PisOverrideVersionCatalog -PspringFrameworkVersion='6.0.+' -PreactorVersion='2022.0.+' -PspringDataVersion='2022.0.+' -PlocksDisabled --stacktrace
90-
check_samples:
91-
name: Check Samples project
92-
needs: [prerequisites]
25+
os: [ ubuntu-latest, windows-latest ]
26+
jdk: [ 17 ]
27+
with:
28+
runs-on: ${{ matrix.os }}
29+
java-version: ${{ matrix.jdk }}
30+
distribution: temurin
31+
secrets: inherit
32+
test:
33+
name: Test Against Snapshots
34+
uses: spring-io/spring-security-release-tools/.github/workflows/test.yml@v1
35+
strategy:
36+
matrix:
37+
java-version: [ 17 ]
38+
with:
39+
java-version: ${{ matrix.java-version }}
40+
test-args: --refresh-dependencies -PforceMavenRepositories=snapshot -PisOverrideVersionCatalog -PspringFrameworkVersion=6.0.+ -PreactorVersion=2022.0.+ -PspringDataVersion=2022.0.+ --stacktrace
41+
secrets: inherit
42+
check-samples:
43+
name: Check Samples
9344
runs-on: ubuntu-latest
94-
if: needs.prerequisites.outputs.runjobs
45+
if: ${{ github.repository_owner == 'spring-projects' }}
9546
steps:
9647
- uses: actions/checkout@v4
9748
- name: Set up gradle
9849
uses: spring-io/spring-gradle-build-action@v2
9950
with:
100-
java-version: '17'
101-
distribution: 'temurin'
51+
java-version: 17
52+
distribution: temurin
10253
- name: Check samples project
10354
env:
10455
LOCAL_REPOSITORY_PATH: ${{ github.workspace }}/build/publications/repos
10556
SAMPLES_DIR: ../spring-security-samples
106-
VERSION: ${{ needs.prerequisites.outputs.project_version }}
107-
SAMPLES_BRANCH: ${{ needs.prerequisites.outputs.samples_branch }}
10857
run: |
109-
export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
110-
export GRADLE_ENTERPRISE_CACHE_PASSWORD="$GRADLE_ENTERPRISE_CACHE_PASSWORD"
111-
export GRADLE_ENTERPRISE_ACCESS_KEY="$GRADLE_ENTERPRISE_SECRET_ACCESS_KEY"
58+
# Extract version from gradle.properties
59+
version=$(cat gradle.properties | grep "version=" | awk -F'=' '{print $2}')
60+
# Extract samplesBranch from gradle.properties
61+
samples_branch=$(cat gradle.properties | grep "samplesBranch=" | awk -F'=' '{print $2}')
11262
./gradlew publishMavenJavaPublicationToLocalRepository
113-
./gradlew cloneRepository -PrepositoryName="spring-projects/spring-security-samples" -Pref="$SAMPLES_BRANCH" -PcloneOutputDirectory="$SAMPLES_DIR"
114-
./gradlew --project-dir "$SAMPLES_DIR" --init-script spring-security-ci.gradle -PlocalRepositoryPath="$LOCAL_REPOSITORY_PATH" -PspringSecurityVersion="$VERSION" :runAllTests
115-
check_tangles:
63+
./gradlew cloneRepository -PrepositoryName="spring-projects/spring-security-samples" -Pref="$samples_branch" -PcloneOutputDirectory="$SAMPLES_DIR"
64+
./gradlew --project-dir "$SAMPLES_DIR" --init-script spring-security-ci.gradle -PlocalRepositoryPath="$LOCAL_REPOSITORY_PATH" -PspringSecurityVersion="$version" :runAllTests
65+
check-tangles:
11666
name: Check for Package Tangles
117-
needs: [ prerequisites ]
11867
runs-on: ubuntu-latest
119-
if: needs.prerequisites.outputs.runjobs
68+
if: ${{ github.repository_owner == 'spring-projects' }}
12069
steps:
12170
- uses: actions/checkout@v4
12271
- name: Set up gradle
12372
uses: spring-io/spring-gradle-build-action@v2
12473
with:
125-
java-version: '17'
126-
distribution: 'temurin'
74+
java-version: 17
75+
distribution: temurin
12776
- name: Check for package tangles
77+
env:
78+
STRUCTURE101_LICENSEID: ${{ secrets.STRUCTURE101_LICENSEID }}
12879
run: |
129-
export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
130-
export GRADLE_ENTERPRISE_CACHE_PASSWORD="$GRADLE_ENTERPRISE_CACHE_PASSWORD"
131-
export GRADLE_ENTERPRISE_ACCESS_KEY="$GRADLE_ENTERPRISE_SECRET_ACCESS_KEY"
13280
./gradlew check s101 -Ps101.licenseId="$STRUCTURE101_LICENSEID" --stacktrace
133-
deploy_artifacts:
81+
deploy-artifacts:
13482
name: Deploy Artifacts
135-
needs: [build_jdk_17, snapshot_tests, check_samples, check_tangles]
136-
runs-on: ubuntu-latest
137-
steps:
138-
- uses: actions/checkout@v4
139-
- name: Set up gradle
140-
uses: spring-io/spring-gradle-build-action@v2
141-
with:
142-
java-version: '17'
143-
distribution: 'temurin'
144-
- name: Deploy artifacts
145-
run: |
146-
export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
147-
export GRADLE_ENTERPRISE_CACHE_PASSWORD="$GRADLE_ENTERPRISE_CACHE_PASSWORD"
148-
export GRADLE_ENTERPRISE_ACCESS_KEY="$GRADLE_ENTERPRISE_SECRET_ACCESS_KEY"
149-
./gradlew publishArtifacts finalizeDeployArtifacts -PossrhUsername="$OSSRH_TOKEN_USERNAME" -PossrhPassword="$OSSRH_TOKEN_PASSWORD" -PartifactoryUsername="$ARTIFACTORY_USERNAME" -PartifactoryPassword="$ARTIFACTORY_PASSWORD" --stacktrace
150-
env:
151-
ORG_GRADLE_PROJECT_signingKey: ${{ secrets.GPG_PRIVATE_KEY }}
152-
ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.GPG_PASSPHRASE }}
153-
OSSRH_TOKEN_USERNAME: ${{ secrets.OSSRH_S01_TOKEN_USERNAME }}
154-
OSSRH_TOKEN_PASSWORD: ${{ secrets.OSSRH_S01_TOKEN_PASSWORD }}
155-
ARTIFACTORY_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }}
156-
ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
157-
deploy_docs:
83+
needs: [ build, test, check-samples, check-tangles ]
84+
uses: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml@v1
85+
with:
86+
should-deploy-artifacts: ${{ needs.build.outputs.should-deploy-artifacts }}
87+
secrets: inherit
88+
deploy-docs:
15889
name: Deploy Docs
159-
needs: [build_jdk_17, snapshot_tests, check_samples, check_tangles]
160-
runs-on: ubuntu-latest
161-
steps:
162-
- uses: actions/checkout@v4
163-
- name: Set up gradle
164-
uses: spring-io/spring-gradle-build-action@v2
165-
with:
166-
java-version: '17'
167-
distribution: 'temurin'
168-
- name: Deploy Docs
169-
run: |
170-
export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
171-
export GRADLE_ENTERPRISE_CACHE_PASSWORD="$GRADLE_ENTERPRISE_CACHE_PASSWORD"
172-
export GRADLE_ENTERPRISE_ACCESS_KEY="$GRADLE_ENTERPRISE_SECRET_ACCESS_KEY"
173-
./gradlew deployDocs -PdeployDocsSshKey="$DOCS_SSH_KEY" -PdeployDocsSshUsername="$DOCS_USERNAME" -PdeployDocsHost="$DOCS_HOST" --stacktrace
174-
env:
175-
DOCS_USERNAME: ${{ secrets.DOCS_USERNAME }}
176-
DOCS_SSH_KEY: ${{ secrets.DOCS_SSH_KEY }}
177-
DOCS_HOST: ${{ secrets.DOCS_HOST }}
178-
deploy_schema:
90+
needs: [ build, test, check-samples, check-tangles ]
91+
uses: spring-io/spring-security-release-tools/.github/workflows/deploy-docs.yml@v1
92+
with:
93+
should-deploy-docs: ${{ needs.build.outputs.should-deploy-artifacts }}
94+
secrets: inherit
95+
deploy-schema:
17996
name: Deploy Schema
180-
needs: [build_jdk_17, snapshot_tests, check_samples, check_tangles]
181-
runs-on: ubuntu-latest
182-
steps:
183-
- uses: actions/checkout@v4
184-
- name: Set up gradle
185-
uses: spring-io/spring-gradle-build-action@v2
186-
with:
187-
java-version: '17'
188-
distribution: 'temurin'
189-
- name: Deploy Schema
190-
run: |
191-
export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
192-
export GRADLE_ENTERPRISE_CACHE_PASSWORD="$GRADLE_ENTERPRISE_CACHE_PASSWORD"
193-
export GRADLE_ENTERPRISE_ACCESS_KEY="$GRADLE_ENTERPRISE_SECRET_ACCESS_KEY"
194-
./gradlew deploySchema -PdeployDocsSshKey="$DOCS_SSH_KEY" -PdeployDocsSshUsername="$DOCS_USERNAME" -PdeployDocsHost="$DOCS_HOST" --stacktrace --info
195-
env:
196-
DOCS_USERNAME: ${{ secrets.DOCS_USERNAME }}
197-
DOCS_SSH_KEY: ${{ secrets.DOCS_SSH_KEY }}
198-
DOCS_HOST: ${{ secrets.DOCS_HOST }}
199-
perform_release:
200-
name: Perform release
201-
needs: [prerequisites, deploy_artifacts, deploy_docs, deploy_schema]
202-
runs-on: ubuntu-latest
203-
permissions:
204-
contents: write
205-
timeout-minutes: 90
206-
if: ${{ !endsWith(needs.prerequisites.outputs.project_version, '-SNAPSHOT') }}
207-
env:
208-
REPO: ${{ github.repository }}
209-
BRANCH: ${{ github.ref_name }}
210-
TOKEN: ${{ github.token }}
211-
VERSION: ${{ needs.prerequisites.outputs.project_version }}
212-
steps:
213-
- uses: actions/checkout@v4
214-
with:
215-
token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
216-
- name: Set up gradle
217-
uses: spring-io/spring-gradle-build-action@v2
218-
with:
219-
java-version: '17'
220-
distribution: 'temurin'
221-
- name: Wait for Artifactory Artifacts
222-
if: ${{ contains(needs.prerequisites.outputs.project_version, '-RC') || contains(needs.prerequisites.outputs.project_version, '-M') }}
223-
run: |
224-
echo "Wait for artifacts of $REPO@$VERSION to appear on Artifactory."
225-
until curl -f -s https://repo.spring.io/artifactory/milestone/org/springframework/security/spring-security-core/$VERSION/ > /dev/null
226-
do
227-
sleep 30
228-
echo "."
229-
done
230-
echo "Artifacts for $REPO@$VERSION have been released to Artifactory."
231-
- name: Wait for Maven Central Artifacts
232-
if: ${{ !contains(needs.prerequisites.outputs.project_version, '-RC') && !contains(needs.prerequisites.outputs.project_version, '-M') }}
233-
run: |
234-
echo "Wait for artifacts of $REPO@$VERSION to appear on Maven Central."
235-
until curl -f -s https://repo1.maven.org/maven2/org/springframework/security/spring-security-core/$VERSION/ > /dev/null
236-
do
237-
sleep 30
238-
echo "."
239-
done
240-
echo "Artifacts for $REPO@$VERSION have been released to Maven Central."
241-
- name: Create GitHub Release
242-
run: |
243-
export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
244-
export GRADLE_ENTERPRISE_CACHE_PASSWORD="$GRADLE_ENTERPRISE_CACHE_PASSWORD"
245-
export GRADLE_ENTERPRISE_ACCESS_KEY="$GRADLE_ENTERPRISE_SECRET_ACCESS_KEY"
246-
echo "Tagging and publishing $REPO@$VERSION release on GitHub."
247-
./gradlew createGitHubRelease -PnextVersion=$VERSION -Pbranch=$BRANCH -PcreateRelease=true -PgitHubAccessToken=$TOKEN
248-
- name: Announce Release on Slack
249-
id: spring-security-announcing
250-
uses: slackapi/[email protected]
251-
with:
252-
payload: |
253-
{
254-
"text": "spring-security-announcing `${{ env.VERSION }}` is available now",
255-
"blocks": [
256-
{
257-
"type": "section",
258-
"text": {
259-
"type": "mrkdwn",
260-
"text": "spring-security-announcing `${{ env.VERSION }}` is available now"
261-
}
262-
}
263-
]
264-
}
265-
env:
266-
SLACK_WEBHOOK_URL: ${{ secrets.SPRING_RELEASE_SLACK_WEBHOOK_URL }}
267-
SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
268-
- name: Setup git config
269-
run: |
270-
git config user.name 'github-actions[bot]'
271-
git config user.email 'github-actions[bot]@users.noreply.github.com'
272-
- name: Update to next Snapshot Version
273-
run: |
274-
export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
275-
export GRADLE_ENTERPRISE_CACHE_PASSWORD="$GRADLE_ENTERPRISE_CACHE_PASSWORD"
276-
export GRADLE_ENTERPRISE_ACCESS_KEY="$GRADLE_ENTERPRISE_SECRET_ACCESS_KEY"
277-
echo "Updating $REPO@$VERSION to next snapshot version."
278-
./gradlew :updateToSnapshotVersion
279-
git commit -am "Next development version"
280-
git push
281-
perform_post_release:
282-
name: Perform post-release
283-
needs: [prerequisites, deploy_artifacts, deploy_docs, deploy_schema]
284-
runs-on: ubuntu-latest
285-
permissions:
286-
contents: read
287-
issues: write
288-
timeout-minutes: 90
289-
if: ${{ endsWith(needs.prerequisites.outputs.project_version, '-SNAPSHOT') }}
290-
env:
291-
TOKEN: ${{ github.token }}
292-
VERSION: ${{ needs.prerequisites.outputs.project_version }}
293-
steps:
294-
- uses: actions/checkout@v4
295-
- name: Set up gradle
296-
uses: spring-io/spring-gradle-build-action@v2
297-
with:
298-
java-version: '17'
299-
distribution: 'temurin'
300-
- name: Schedule next release (if not already scheduled)
301-
run: ./gradlew scheduleNextRelease -PnextVersion=$VERSION -PgitHubAccessToken=$TOKEN
97+
needs: [ build, test, check-samples, check-tangles ]
98+
uses: spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml@v1
99+
with:
100+
should-deploy-schema: ${{ needs.build.outputs.should-deploy-artifacts }}
101+
secrets: inherit
102+
perform-release:
103+
name: Perform Release
104+
needs: [ deploy-artifacts, deploy-docs, deploy-schema ]
105+
uses: spring-io/spring-security-release-tools/.github/workflows/perform-release.yml@v1
106+
with:
107+
should-perform-release: ${{ needs.deploy-artifacts.outputs.artifacts-deployed }}
108+
project-version: ${{ needs.deploy-artifacts.outputs.project-version }}
109+
milestone-repo-url: https://repo.spring.io/artifactory/milestone
110+
release-repo-url: https://repo1.maven.org/maven2
111+
artifact-path: org/springframework/security/spring-security-core
112+
slack-announcing-id: spring-security-announcing
113+
secrets: inherit
302114
notify_result:
303115
name: Check for failures
304-
needs: [perform_release, perform_post_release]
116+
needs: [ perform-release ]
305117
if: failure()
306118
runs-on: ubuntu-latest
307119
permissions:

0 commit comments

Comments
 (0)