refactor(profile): resolve architecture violations and fix integratio… #24
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PCM CI/CD | |
| on: | |
| push: | |
| branches: [ "main", "develop" ] | |
| pull_request: | |
| branches: [ "main", "develop" ] | |
| jobs: | |
| # ───────────────────────────────────────────────────────────────────────────── | |
| # Job 1 : Build & Unit Tests | |
| # ───────────────────────────────────────────────────────────────────────────── | |
| build: | |
| name: Build & Unit Tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up JDK 21 | |
| uses: actions/setup-java@v4 | |
| with: | |
| java-version: '21' | |
| distribution: 'temurin' | |
| cache: maven | |
| - name: Build with Maven | |
| run: mvn -B clean install -DskipTests | |
| - name: Run Unit Tests | |
| run: mvn -B test | |
| - name: Upload build artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: build-artifacts | |
| path: '**/target/*.jar' | |
| retention-days: 1 | |
| # ───────────────────────────────────────────────────────────────────────────── | |
| # Job 2 : SAST — Static Application Security Testing — Secure development & vulnerability management | |
| # ───────────────────────────────────────────────────────────────────────────── | |
| sast: | |
| name: SAST (SpotBugs + Find Security Bugs) | |
| runs-on: ubuntu-latest | |
| needs: build | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up JDK 21 | |
| uses: actions/setup-java@v4 | |
| with: | |
| java-version: '21' | |
| distribution: 'temurin' | |
| cache: maven | |
| - name: Run SpotBugs with Find Security Bugs | |
| # find-sec-bugs plugin is declared in the root pom.xml spotbugs profile | |
| run: mvn -B compile spotbugs:check -Pspotbugs -DskipTests | |
| continue-on-error: false | |
| - name: Upload SpotBugs report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: spotbugs-report | |
| path: '**/target/spotbugsXml.xml' | |
| retention-days: 30 | |
| # ───────────────────────────────────────────────────────────────────────────── | |
| # Job 3 : Dependency Vulnerability Scan | |
| # ───────────────────────────────────────────────────────────────────────────── | |
| dependency-scan: | |
| name: Dependency Vulnerability Scan (OWASP) | |
| runs-on: ubuntu-latest | |
| needs: build | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up JDK 21 | |
| uses: actions/setup-java@v4 | |
| with: | |
| java-version: '21' | |
| distribution: 'temurin' | |
| cache: maven | |
| - name: OWASP Dependency-Check | |
| run: | | |
| mvn -B dependency-check:check \ | |
| -DfailBuildOnCVSS=7 \ | |
| -DsuppressionFile=.github/owasp-suppressions.xml \ | |
| -Dformats=HTML,JSON \ | |
| --no-transfer-progress | |
| continue-on-error: false | |
| - name: Upload Dependency-Check report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: dependency-check-report | |
| path: '**/target/dependency-check-report.*' | |
| retention-days: 30 | |
| # ───────────────────────────────────────────────────────────────────────────── | |
| # Job 4 : SBOM Generation — Supplier security policy (software supply chain) | |
| # ───────────────────────────────────────────────────────────────────────────── | |
| sbom: | |
| name: Generate SBOM (CycloneDX) | |
| runs-on: ubuntu-latest | |
| needs: build | |
| if: github.ref == 'refs/heads/main' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up JDK 21 | |
| uses: actions/setup-java@v4 | |
| with: | |
| java-version: '21' | |
| distribution: 'temurin' | |
| cache: maven | |
| - name: Generate CycloneDX SBOM | |
| run: mvn -B cyclonedx:makeAggregateBom -DskipTests | |
| - name: Upload SBOM | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: sbom-cyclonedx | |
| path: target/bom.* | |
| retention-days: 90 | |
| # ───────────────────────────────────────────────────────────────────────────── | |
| # Job 5 : Secret Scanning — No credentials in source code | |
| # ───────────────────────────────────────────────────────────────────────────── | |
| secret-scan: | |
| name: Secret Scanning (Gitleaks) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Run Gitleaks | |
| uses: gitleaks/gitleaks-action@v2 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} |