CI: pin third-party actions, fix the triggers, drop both nightlies #3249
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| # `release/*` because that is where a release is actually built from: the | |
| # release workflow creates the branch through the shared | |
| # eclipse-zenoh/ci/create-release-branch action, and without this CI never runs | |
| # on it. The dry-run branches that same action produces are excluded - they are | |
| # throwaway. | |
| push: | |
| branches: ["main", "release/*", "!release/dry-run/*"] | |
| # Every branch, not just main: a backport pull request targets a release | |
| # branch, and it needs CI as much as any other. Not `push` on every branch as | |
| # well - with this on, that runs the whole matrix twice per branch. | |
| pull_request: | |
| branches: ["**"] | |
| # No schedule. The obvious argument for a nightly is that it would catch | |
| # zenoh-flat-jni moving under us, and it would not: Cargo.lock pins that | |
| # dependency to a commit, and Cargo re-resolves a git dependency only on | |
| # `cargo update`, so a timed build rebuilds exactly what the last merge built. | |
| # Upstream drift arrives here as a lockfile-sync pull request, which runs CI | |
| # like anything else. What is left is an expired Central token or GPG key, | |
| # caught only in a week with no merges at all - a thin canary against a daily | |
| # publication. workflow_dispatch runs the path on demand. | |
| workflow_dispatch: | |
| env: | |
| CARGO_TERM_COLOR: always | |
| # Third-party actions are pinned to a commit, with the version in a trailing | |
| # comment: a tag is mutable, and a moved tag runs code nobody reviewed. Actions | |
| # under eclipse-zenoh/ are ours and stay on a branch. | |
| jobs: | |
| build: | |
| name: Build on ${{ matrix.os }} | |
| runs-on: ["${{ matrix.os }}"] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| steps: | |
| - name: Check out zenoh-java | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| path: zenoh-java | |
| - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 | |
| with: | |
| distribution: temurin | |
| java-version: 11 | |
| # rust-toolchain.toml here tracks zenoh-flat-jni's own, because that is | |
| # what has to compile. Installing it up front keeps a missing toolchain | |
| # from surfacing in the middle of the Gradle build. | |
| # | |
| # Nothing else Rust runs here. Formatting, clippy, the feature-leak test | |
| # and the native build are zenoh-flat-jni's own CI, on three platforms, | |
| # for the very commit pinned here; re-running them from this repository | |
| # only adds ways for the two toolchains to disagree. | |
| - name: Install Rust toolchain | |
| working-directory: zenoh-java | |
| run: rustup show | |
| # v5, not v6: v6 moved caching into a proprietary component under Gradle's | |
| # own terms of use, which is not ours to accept for an Eclipse project. | |
| - name: Setup Gradle | |
| uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2 | |
| - name: Gradle Test | |
| working-directory: zenoh-java | |
| # CI tests against zenoh-flat-jni's source, so it opts into the composite | |
| # build; settings.gradle.kts then fetches the commit Cargo.lock pins. A | |
| # release does not opt in: it resolves zenoh-flat-jni from Maven Central | |
| # like any other consumer. | |
| # | |
| # No checkout or cargo step precedes this. The build fetches its own | |
| # pinned bindings, and their test task depends on their native build, so | |
| # Gradle drives both git and cargo - which is why `./gradlew jvmTest | |
| # -PuseLocalJni=true` reproduces this run anywhere. | |
| run: ./gradlew jvmTest --info -PuseLocalJni=true | |
| markdown_lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| # Pinned where it stands. v18 runs on node20, which is not retired, and a | |
| # newer major changes markdownlint's rules - an upgrade to make on its own, | |
| # not inside a pinning change. | |
| - uses: DavidAnson/markdownlint-cli2-action@eb5ca3ab411449c66620fe7f1b3c9e10547144b0 # v18 | |
| with: | |
| config: '.markdownlint.yaml' | |
| globs: '**/README.md' | |
| # NOTE: In GitHub repository settings, the "Require status checks to pass | |
| # before merging" branch protection rule ensures that commits are only merged | |
| # from branches where specific status checks have passed. These checks are | |
| # specified manually as a list of workflow job names. Thus we use this extra | |
| # job to signal whether all CI checks have passed. | |
| ci: | |
| name: CI status checks | |
| runs-on: ubuntu-latest | |
| needs: [build, markdown_lint] | |
| if: always() | |
| steps: | |
| - name: Check whether all jobs pass | |
| run: echo '${{ toJson(needs) }}' | jq -e 'all(.result == "success")' | |
| # Publish snapshot packages. Only triggered when CI runs on main. | |
| # One job, because both publications now come from a single Gradle | |
| # invocation — see .github/workflows/publish.yml. | |
| publish_snapshot_package: | |
| name: Publish snapshot package | |
| if: contains(fromJSON('["refs/heads/main"]'), github.ref) | |
| needs: ci | |
| uses: ./.github/workflows/publish.yml | |
| permissions: | |
| contents: read | |
| packages: write | |
| with: | |
| snapshot: true | |
| branch: ${{ github.ref_name }} | |
| secrets: inherit |