Skip to content
Build

Draw resolves: and generates: in the intent Glue & Outputs diagram (#… #5288

Sign in to view logs

Draw resolves: and generates: in the intent Glue & Outputs diagram (#…

Draw resolves: and generates: in the intent Glue & Outputs diagram (#… #5288

Workflow file for this run

.github/workflows/build.yml at 7aa04e5
name: Build
on:
push:
branches:
- main
- master
permissions:
security-events: write
jobs:
code-style:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Set up JDK Corretto 24
uses: actions/setup-java@v4
with:
distribution: 'corretto'
java-version: '24'
architecture: x64
- name: Validate Java code formatting
run: mvn -T 1C formatter:validate
build-deploy:
needs: [ tests, integration-tests-h2, integration-tests-postgresql ]
runs-on: ${{ matrix.runner }}
strategy:
matrix:
include:
- runner: ubuntu-latest
platform: amd64
- runner: ubuntu-24.04-arm
platform: arm64
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Cache local Maven repository
uses: actions/cache@v4
with:
path: ~/.m2/repository
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
restore-keys: ${{ runner.os }}-maven-
- name: Set up JDK Corretto 24
uses: actions/setup-java@v4
with:
distribution: 'corretto'
java-version: '24'
- name: Install NodeJS
uses: actions/setup-node@v4
with:
node-version: 22.x
- name: Install TypeScript and esbuild
run: npm install -g typescript@5.9.3 esbuild
- name: Maven Build
run: mvn clean install -P quick-build
- name: Log in to Registry
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKER_USER }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Build and push by digest
id: build
uses: docker/build-push-action@v6
with:
context: build/application
platforms: ${{ matrix.platform }}
tags: dirigiblelabs/dirigible
outputs: type=image,push-by-digest=true,name-canonical=true,push=true
- name: Export digest
run: |
mkdir -p /tmp/digests
digest="${{ steps.build.outputs.digest }}"
touch "/tmp/digests/${digest#sha256:}"
- name: Upload digest
uses: actions/upload-artifact@v4
with:
name: digests-${{ matrix.platform }}
path: /tmp/digests/*
if-no-files-found: error
retention-days: 1
build-deploy-manifest:
needs: build-deploy
runs-on: ubuntu-latest
steps:
- name: Download digests
uses: actions/download-artifact@v4
with:
path: /tmp/digests
pattern: digests-*
merge-multiple: true
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Log in to Registry
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKER_USER }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: Create manifest list and push
working-directory: /tmp/digests
run: |
docker buildx imagetools create -t dirigiblelabs/dirigible:latest \
$(printf 'dirigiblelabs/dirigible@sha256:%s ' *)
tests:
runs-on: ${{ matrix.os }}-latest
strategy:
matrix:
os: [ ubuntu, windows ]
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Cache local Maven repository
uses: actions/cache@v4
with:
path: ~/.m2/repository
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
restore-keys: ${{ runner.os }}-maven-
- name: Set up JDK Corretto 24
uses: actions/setup-java@v4
with:
distribution: 'corretto'
java-version: '24'
architecture: x64
- name: Install NodeJS
uses: actions/setup-node@v4
with:
node-version: 22.x
- name: Install TypeScript and esbuild
run: npm install -g typescript@5.9.3 esbuild
- name: Maven Build
run: mvn clean install -P unit-tests
- name: Container Tests
if: runner.os == 'Linux'
run: mvn test -P testcontainers
# The full IT suite is split ("sharded") into four disjoint slices selected by JUnit 5 tags, so
# the wall-clock time of a run is the slowest shard (~35 min) instead of the whole suite (~2h+):
# api - every HTTP-level IT (untagged, i.e. everything not tagged "ui") bar the long poles
# ui - the browser-driven ITs except the sample-project, camel and long-pole families
# samples - the sample-project clone/publish ITs ("sample") + the camel journeys still driven
# through the browser ("camel"), which is now only the two template starters - the
# route ITs themselves publish over HTTP and so live in "api"
# slow - the long poles of both families ("slow"). Membership is a balancing decision, not a
# semantic one: without it "api" (~48 min) and "ui" (~43 min) are the critical path
# while "samples" idles at ~10 min. It is currently the api classes measured above
# ~55 s and the browser journeys above ~110 s on the h2 leg (measured on the shard
# logs of run 31883998354). Re-check the cut when the shard times drift apart again.
# The shards partition the suite: api + ui + samples + slow = the complete IT set, and no IT is
# selected by two of them. A new untagged IT lands in "api"; a new UI IT (extends
# UserInterfaceIntegrationTest) lands in "ui" unless it is explicitly tagged "sample", "camel" or
# "slow". Mistagging can only unbalance the shards, never drop an IT from the run.
integration-tests-h2:
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
shard:
- name: api
groups: "!ui & !slow"
- name: ui
groups: "ui & !slow & !sample & !camel"
- name: samples
groups: "ui & !slow & (sample | camel)"
- name: slow
groups: "slow"
# A green shard takes ~35 min (~40 on the PostgreSQL leg); a heap-exhausted JVM used to thrash
# for 4h+ before anyone noticed. Cap the job above the healthy time so hangs fail fast instead
# of burning runners.
timeout-minutes: 60
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Cache local Maven repository
uses: actions/cache@v4
with:
path: ~/.m2/repository
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
restore-keys: ${{ runner.os }}-maven-
- name: Set up JDK Corretto 24
uses: actions/setup-java@v4
with:
distribution: 'corretto'
java-version: '24'
architecture: x64
- name: Install NodeJS
uses: actions/setup-node@v4
with:
node-version: 22.x
- name: Install TypeScript and esbuild
run: npm install -g typescript@5.9.3 esbuild
- name: Install ttyd (prebuilt)
run: |
sudo apt update
sudo apt install -y ttyd
- name: Verify ttyd installation
run: ttyd --version
- name: Integration tests
run: mvn clean install -P integration-tests -Dit.groups='${{ matrix.shard.groups }}'
- name: Generate a random artifact name
if: always()
id: generate_name
run: |
TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
echo "ARTIFACT_NAME=selenide-screenshots-h2-${{ matrix.shard.name }}-${TIMESTAMP}.zip" >> $GITHUB_ENV
- name: Upload selenide screenshots
uses: actions/upload-artifact@v4
if: always()
with:
retention-days: 3
name: ${{ env.ARTIFACT_NAME }}
path: tests/tests-integrations/build/reports/tests
integration-tests-postgresql:
runs-on: ubuntu-latest
# Same sharding + timeout rationale as integration-tests-h2.
strategy:
fail-fast: false
matrix:
shard:
- name: api
groups: "!ui & !slow"
- name: ui
groups: "ui & !slow & !sample & !camel"
- name: samples
groups: "ui & !slow & (sample | camel)"
- name: slow
groups: "slow"
timeout-minutes: 60
env:
POSTGRES_DB: testdb
POSTGRES_USER: testuser
POSTGRES_PASS: testpass
services:
postgres:
image: postgres:16
ports:
- 5432:5432
env:
POSTGRES_DB: ${{ env.POSTGRES_DB }}
POSTGRES_USER: ${{ env.POSTGRES_USER }}
POSTGRES_PASSWORD: ${{ env.POSTGRES_PASS }}
options: >-
--health-cmd pg_isready
--health-interval 10s
--health-timeout 5s
--health-retries 5
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Cache local Maven repository
uses: actions/cache@v4
with:
path: ~/.m2/repository
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
restore-keys: ${{ runner.os }}-maven-
- name: Set up JDK Corretto 24
uses: actions/setup-java@v4
with:
distribution: 'corretto'
java-version: '24'
architecture: x64
- name: Install NodeJS
uses: actions/setup-node@v4
with:
node-version: 22.x
- name: Install TypeScript and esbuild
run: npm install -g typescript@5.9.3 esbuild
- name: Install ttyd (prebuilt)
run: |
sudo apt update
sudo apt install -y ttyd
- name: Verify ttyd installation
run: ttyd --version
- name: Integration tests
run: mvn clean install -P integration-tests -Dit.groups='${{ matrix.shard.groups }}'
env:
DIRIGIBLE_DATASOURCE_DEFAULT_DRIVER: org.postgresql.Driver
DIRIGIBLE_DATASOURCE_DEFAULT_URL: jdbc:postgresql://localhost:5432/${{ env.POSTGRES_DB }}
DIRIGIBLE_DATASOURCE_DEFAULT_USERNAME: ${{ env.POSTGRES_USER }}
DIRIGIBLE_DATASOURCE_DEFAULT_PASSWORD: ${{ env.POSTGRES_PASS }}
- name: Generate a random artifact name
if: always()
id: generate_name
run: |
TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
echo "ARTIFACT_NAME=selenide-screenshots-postgresql-${{ matrix.shard.name }}-${TIMESTAMP}.zip" >> $GITHUB_ENV
- name: Upload selenide screenshots
uses: actions/upload-artifact@v4
if: always()
with:
retention-days: 3
name: ${{ env.ARTIFACT_NAME }}
path: tests/tests-integrations/build/reports/tests
scan-image:
name: Scan Docker image using Docker Scout
needs: [ build-deploy-manifest ]
runs-on: ubuntu-latest
steps:
- name: Checkout # need to upload the report to GitHub Security tab
uses: actions/checkout@v4
- name: Log in Docker Hub # required dockerhub login for docker/scout-action
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKER_USER }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: Docker Scout Quickview and CVEs
uses: docker/scout-action@v1
with:
registry-user: ${{ secrets.DOCKER_USER }}
registry-password: ${{ secrets.DOCKER_PASSWORD }}
command: quickview,cves
image: dirigiblelabs/dirigible:latest
sarif-file: sast_docker_scout_sarif.json
summary: true
only-fixed: false
- name: Upload Docker Scout SARIF file as artifact
uses: actions/upload-artifact@v4
with:
name: sast_docker_scout_sarif.json
path: sast_docker_scout_sarif.json
- name: Upload Docker Scout SARIF Report to GitHub Security tab
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: sast_docker_scout_sarif.json
dast-scan:
name: Perform DAST testing using ZAP
needs: [ build-deploy-manifest ]
runs-on: ubuntu-latest
services:
app:
image: dirigiblelabs/dirigible:latest
ports:
- 8080:8080
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Wait for app to start
run: |
URL='http://localhost:8080/actuator/health/readiness'
for i in {1..30}; do
echo "Checking readiness at $URL... attempt $i"
if curl -f $URL; then
echo '----------------------'
echo "Application is ready."
break
fi
sleep 5
done
- name: Run OWASP ZAP Full Scan
uses: zaproxy/action-full-scan@v0.12.0
with:
target: 'http://localhost:8080'
cmd_options: '-T 10' # https://www.zaproxy.org/docs/docker/full-scan/
artifact_name: dast_zap_report # all results will be uploaded with an artifact with this name
allow_issue_writing: false # create an issue with the results
issue_title: '[DAST] ZAP Full Scan Report'