Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore: updates to gradle build (WIP) #2

Draft
wants to merge 90 commits into
base: master
Choose a base branch
from
Draft

chore: updates to gradle build (WIP) #2

wants to merge 90 commits into from

Conversation

sgammon
Copy link
Owner

@sgammon sgammon commented Jan 6, 2024 •
edited
Loading

Summary

Coming soon. Once clean and fully working, will be filed via binkley#432.

Related PRs

Changelog

  • feat: add testlogger to show test results
  • feat: ship SPDX SBOMs with JARs
  • feat: SLSA provenance support
  • feat: support JPMS (Java Modules)
  • feat: enable parallel gradle builds
  • feat: gradle build caching
  • feat: gradle configuration cache
  • feat: gradle integration with buildless
  • feat: maven integration with buildless
  • feat: accelerated downloads with pkgst
  • feat: refactor for reusable workflows in ci
  • feat: CodeQL scanner
  • feat: github dependency review
  • feat: OSSF scorecard action
  • feat: remote caching with earthly, via github packages
  • feat: coverage reporting with codecov
  • feat: github actions scanner for sonar cloud
  • fix: duplicate github actions builds for PRs
  • fix: workflow permissions
  • fix: align javac args between maven and gradle
  • docs: initial readme updates for gradle changes
  • chore: update gradle → 8.5
  • chore: javax → jakarta
  • chore: dependency updates
  • chore: convert to version catalog
  • chore: add dependency locking
  • chore: add dependency verification
  • chore: update jvm toolchain in CI to 21

@sgammon sgammon self-assigned this Jan 6, 2024
@sgammon sgammon mentioned this pull request Jan 6, 2024
Closed
@step-security-bot @sgammon
chore: apply ci security best practices
58a7986 
Signed-off-by: StepSecurity Bot <[email protected]>
Signed-off-by: Sam Gammon <[email protected]>
@sgammon sgammon force-pushed the gradle-updates branch 5 times, most recently from 1faedef to 74a9eb8 Compare January 6, 2024 21:42
sgammon added 21 commits January 6, 2024 13:56
@sgammon
chore: updates to gradle build
1db18ec 
- feat: add testlogger to show test results
- feat: ship SPDX SBOMs with JARs
- feat: support JPMS (Java Modules)
- feat: enable parallel gradle builds
- feat: gradle build caching
- feat: gradle configuration cache
- feat: accelerated downloads with pkgst
- feat: add pkgst repository endpoints
- docs: initial readme updates for gradle changes
- chore: update gradle → `8.5`
- chore: update jvm target → `21`
- chore: update ci images → `21.0.1_12-jdk-jammy`
- chore: `javax` → `jakarta`
- chore: convert to version catalog
- chore: add dependency locking
- chore: add dependency verification

Signed-off-by: Sam Gammon <[email protected]>
@sgammon
feat: earthly caching, reusable ci workflows
55be827 
- feat: enable earthly remote caching via github packages
- feat: enable step skipping in ci (earthly)
- feat: refactor builds into reusable workflows
- chore: optimize caching with gha cache
- chore: upgrade most actions
- chore: update `build-as-ci-does.sh`

Signed-off-by: Sam Gammon <[email protected]>
@sgammon
temp: issues with pmd and owasp
b001911 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fix: align maven deps with gradle
cd84a56 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
feat: enable buildless for maven
699214f 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
chore: skip daemon in earthly gradle builds
0df415d 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fix: pass buildless key to earthly maven
d16e064 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
chore: cleanup earthly caching (remote, not inline)
363a797 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
chore: clearer maven/gradle caching in earthfile
108ff77 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
feat: gradle scans
d0fbeda 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
chore: cleanup/fixes for maven caching
0e95e3d 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
feat: optimized gradle download, use bin (slim) package
43cf9c8 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fix: trust gradle enterprise plugin
ad39237 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
feat: better earthly caching with dependency layers
f993394 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fix: use of homedir in earthfile
b1cc6b6 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
temp: disable maven caching, creds aren't making it in
cdebf95 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fix: global caching, repository caching for maven, in earthfile
051666b 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
feat: initial on-push workflow to match on-pr
2cba614 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fix: match javac flags between maven and gradle
9dc32bd 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fix: buildless apikey name mismatch
700c626 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fixup: re-enable buildless for maven
752fb07 
Signed-off-by: Sam Gammon <[email protected]>
sgammon added 9 commits January 6, 2024 20:06
@sgammon
fixup: ignore missing artifact paths
825b044 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fixup: drop maven site plugin
151d67c 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fix: allow pushing cached earthly container
70e3d78 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
feat: support for codecov/sonar scan actions
2202d7f 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fixup: coverage flag for gradle build
5c1256d 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fixup: sonar analysis fixes
fcc051b 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fixup: trust github dependency graph plugin
4c0c376 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fixup: properly skip maven site plugin
3a90ac9 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fixup: emit xml coverage report in ci
b431099 
Signed-off-by: Sam Gammon <[email protected]>
@codecov Codecov
Copy link

codecov bot commented Jan 7, 2024

Welcome to Codecov 🎉

Once merged to your default branch, Codecov will compare your coverage reports and display the results in this comment.

Thanks for integrating Codecov - We've got you covered ☂️

sgammon added 18 commits January 6, 2024 20:31
@sgammon
fixup: drop duplicate gradle cache step
aed1d34 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fix: align adoptiom toolchain for gradle
a4cafbd 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
feat: configure dependency review to match owasp plugin
68b04bc 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fixup: retries for dependency snapshot pull
a435919 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fix: replace setup java action for gradle build
ba0e9cf 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fixup: newer setup-java actions
6bbc282 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fixup: package url suppresions for licenses
16f563f 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fixup: avoid duplicate build during codeql scan
ce3e98d 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fixup: more purl fixes
e8dcc0a 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fixup: string syntax for conditional in codeql job
cc1f672 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
feat: enhanced user data for gradle build scans
3671ddd 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
feat: build provenance for gradle build
ed9d6b2 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
feat: enable docker buildx
0b95670 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
chore: update gradle verification metadata
97898db 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fixup: permissions for gradle build
7cc5afd 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fixup: only enable provenance on master builds
64b29f8 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
feat: manual dispatch of push job
b69e4f3 
Signed-off-by: Sam Gammon <[email protected]>
@sgammon
fixup: drop artifact feature from codeql workflow
82655eb 
PR: binkley#432
Signed-off-by: Sam Gammon <[email protected]>
github-advanced-security[bot]
github-advanced-security bot found potential problems Jan 9, 2024
View reviewed changes
Copy link

@github-advanced-security github-advanced-security bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Scorecard found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@sgammon sgammon

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@sgammon @step-security-bot