This is an automated email from the ASF dual-hosted git repository. ppkarwasz pushed a commit to branch fix/build-project in repository https://gitbox.apache.org/repos/asf/logging-flume-rpc.git
commit b45abe666ff745307a09cf3143365c24521e4437 Author: Piotr P. Karwasz <[email protected]> AuthorDate: Wed Sep 2 20:07:48 2026 +0200 Add GitHub Actions workflows from `logging-flume` Port the `build`, CodeQL and Dependabot workflows and the Dependabot configuration from the main Flume repository, adapted to this repository: `main` default branch, no Maven site, Java only and `flume-rpc` as the distribution identifier. Fix the required status check name in `.asf.yaml`: the reusable build workflow reports it as `build / build (ubuntu-latest)`. Until that change is on `main`, a temporary job named `build (ubuntu-latest)` satisfies the ruleset currently in force. Assisted-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01F9NiqMnCccUGDtqt64uKe6 --- .asf.yaml | 2 +- .github/dependabot.yaml | 68 ++++++++++++++++++++++ .github/workflows/analyze-dependabot.yaml | 37 ++++++++++++ .github/workflows/build.yaml | 97 +++++++++++++++++++++++++++++++ .github/workflows/build.yml | 71 ---------------------- .github/workflows/codeql-analysis.yml | 20 ++++--- .github/workflows/process-dependabot.yaml | 48 +++++++++++++++ 7 files changed, 264 insertions(+), 79 deletions(-) diff --git a/.asf.yaml b/.asf.yaml index 7a2c143..4a6f577 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -71,7 +71,7 @@ github: required_status_checks: # The GitHub Actions app - app_slug: github-actions - name: "build (ubuntu-latest)" + name: "build / build (ubuntu-latest)" # The GitHub Advanced Security app - app_slug: github-advanced-security name: "CodeQL" diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml new file mode 100644 index 0000000..b0b1164 --- /dev/null +++ b/.github/dependabot.yaml @@ -0,0 +1,68 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to you under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +# +# ██ ██ █████ ██████ ███ ██ ██ ███ ██ ██████ ██ +# ██ ██ ██ ██ ██ ██ ████ ██ ██ ████ ██ ██ ██ +# ██ █ ██ ███████ ██████ ██ ██ ██ ██ ██ ██ ██ ██ ███ ██ +# ██ ███ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ +# ███ ███ ██ ██ ██ ██ ██ ████ ██ ██ ████ ██████ ██ +# +# `dependabot.yaml` must be stored in the `.github` directory of the default branch[1]. +# +# 1. Make all your changes to this file! +# Don't create another `dependabot.yaml` – it will simply be discarded. +# +# 2. Always associate your entries to a branch! +# For instance, use `target-branch` in `updates` entries +# +# [1] https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file +# + +version: 2 + +# Fix the Maven Central to the ASF repository to work around: https://github.com/dependabot/dependabot-core/issues/8329 +registries: + maven-central: + type: maven-repository + url: https://repo.maven.apache.org/maven2 + +updates: + + - package-ecosystem: maven + directory: "/" + schedule: + interval: "monthly" + cooldown: + default-days: 7 + groups: + # Groups all non-major updates in a single PR. + # No group matches major updates, so each one gets a separate PR. + maven-minor-updates: + update-types: [ "minor", "patch" ] + target-branch: "main" + registries: + - maven-central + + - package-ecosystem: github-actions + directory: "/" + schedule: + interval: "monthly" + groups: + github-actions-updates: + patterns: [ "*" ] + target-branch: "main" diff --git a/.github/workflows/analyze-dependabot.yaml b/.github/workflows/analyze-dependabot.yaml new file mode 100644 index 0000000..be94bce --- /dev/null +++ b/.github/workflows/analyze-dependabot.yaml @@ -0,0 +1,37 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to you under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +name: "Dependabot Analyze PR" + +on: + pull_request: + +# Default permissions for each job. +# Additional permissions should be assigned on a per-job basis. +permissions: { } + +jobs: + + analyze-dependabot: + # `github.actor` prevents recursive calls when `github-actions[bot]` pushes to the PR; + # `github.event.pull_request.user.login` skips PRs not opened by Dependabot. + if: ${{ + github.repository == 'apache/logging-flume-rpc' + && github.actor == 'dependabot[bot]' + && github.event.pull_request.user.login == 'dependabot[bot]' + }} + uses: apache/logging-parent/.github/workflows/analyze-dependabot-reusable.yaml@gha/v0 diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml new file mode 100644 index 0000000..8e8f492 --- /dev/null +++ b/.github/workflows/build.yaml @@ -0,0 +1,97 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to you under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +name: build + +on: + push: + branches: + - "main" + - "release/*" + pull_request: + +# Disable all permissions by defaults: +# Permissions are enabled on a per-job basis. +permissions: { } + +concurrency: + # One group per PR, or per ref for branch pushes. + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + # Cancel in-progress runs for PRs only, so release branch builds always complete. + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + +jobs: + + build: + uses: apache/logging-parent/.github/workflows/build-reusable.yaml@gha/v0 + with: + java-version: 17 + + # TODO: remove once the `.asf.yaml` ruleset on `main` requires `build / build (ubuntu-latest)`. + # The ruleset currently in force requires a check named `build (ubuntu-latest)`, which the + # reusable workflow cannot produce, so this job carries that name until the fix is merged. + build-legacy-check: + name: build (ubuntu-latest) + runs-on: ubuntu-latest + steps: + - run: echo OK + + deploy-snapshot: + needs: build + if: github.repository == 'apache/logging-flume-rpc' && github.ref_name == 'main' + uses: apache/logging-parent/.github/workflows/deploy-snapshot-reusable.yaml@gha/v0 + # Secrets for deployments + secrets: + NEXUS_USERNAME: ${{ secrets.LOGGING_STAGE_DEPLOYER_USER }} + NEXUS_PASSWORD: ${{ secrets.LOGGING_STAGE_DEPLOYER_PW }} + with: + java-version: 17 + + deploy-release: + needs: build + if: github.repository == 'apache/logging-flume-rpc' && startsWith(github.ref_name, 'release/') + uses: apache/logging-parent/.github/workflows/deploy-release-reusable.yaml@gha/v0 + # Secrets for deployments + secrets: + GPG_SECRET_KEY: ${{ secrets.LOGGING_GPG_SECRET_KEY }} + NEXUS_USERNAME: ${{ secrets.LOGGING_STAGE_DEPLOYER_USER }} + NEXUS_PASSWORD: ${{ secrets.LOGGING_STAGE_DEPLOYER_PW }} + SVN_USERNAME: ${{ secrets.LOGGING_SVN_DEV_USERNAME }} + SVN_PASSWORD: ${{ secrets.LOGGING_SVN_DEV_PASSWORD }} + # Write permissions to allow the Maven `revision` property update, changelog release, etc. + permissions: + contents: write + with: + java-version: 17 + project-id: flume-rpc + + verify-reproducibility-snapshot: + needs: deploy-snapshot + uses: apache/logging-parent/.github/workflows/verify-reproducibility-reusable.yaml@gha/v0 + with: + java-version: 17 + # Compare against the repository `deploy-snapshot` uploaded as a run artifact, so that + # the check does not depend on the snapshot having propagated to the Nexus group repository. + reference-artifact-name: ${{ needs.deploy-snapshot.outputs.repository-artifact-name }} + + verify-reproducibility-release: + needs: deploy-release + uses: apache/logging-parent/.github/workflows/verify-reproducibility-reusable.yaml@gha/v0 + with: + java-version: 17 + # `deploy-release` publishes no run artifact, so the staging repository is the reference. + nexus-url: ${{ needs.deploy-release.outputs.nexus-url }} diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml deleted file mode 100644 index 2df41f8..0000000 --- a/.github/workflows/build.yml +++ /dev/null @@ -1,71 +0,0 @@ -# -# Licensed to the Apache Software Foundation (ASF) under one or more -# contributor license agreements. See the NOTICE file distributed with -# this work for additional information regarding copyright ownership. -# The ASF licenses this file to you under the Apache License, Version 2.0 -# (the "License"); you may not use this file except in compliance with -# the License. You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# - -name: build - -on: - push: - branches: - - trunk - - build-dev - pull_request: - -# Remove all permissions by default. They will be added at a job level. -permissions: {} - -jobs: - build: - - runs-on: ${{ matrix.os }} - name: build (${{ matrix.os }}) - - strategy: - # Don't cancel the remaining OS builds when one fails - fail-fast: false - matrix: - os: [ ubuntu-latest, windows-latest ] - java-distribution: [ temurin ] - # - # There is no protobuf 2.x version for `aarch64`. - # Reenable the macOS build after the dependency has been upgraded. - # - #include: - # # There is no Temurin JDK 8 for ARM - # - os: macos-latest - # java-distribution: zulu - - steps: - - - name: Checkout repository - uses: actions/checkout@v6 - - # JDK 8 is needed for the build, and it is the primary bytecode target. - - name: Setup JDK 17 - uses: actions/setup-java@v5 - with: - distribution: ${{ matrix.java-distribution }} - java-version: 17 - cache: maven - - - name: Build with Maven - timeout-minutes: 120 - shell: bash - run: | - ./mvnw clean verify -DredirectTestOutput=true \ - --show-version --batch-mode --errors --no-transfer-progress \ - -DtrimStackTrace=false \ - -Dsurefire.rerunFailingTestsCount=2 diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index b6eb02c..60a80d2 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -18,16 +18,22 @@ name: "CodeQL" on: push: - branches: [ trunk ] + branches: [ main ] pull_request: # The branches below must be a subset of the branches above - branches: [ trunk ] + branches: [ main ] schedule: - cron: '15 0 * * 5' # Remove all permissions by default. They will be added at a job level. permissions: {} +concurrency: + # One group per PR, or per ref for branch pushes. + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + # Cancel in-progress runs for PRs only, so release branch builds always complete. + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + jobs: analyze: name: Analyze @@ -40,17 +46,17 @@ jobs: strategy: fail-fast: false matrix: - language: [ 'java', 'python' ] + language: [ 'java' ] # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ] # Learn more about CodeQL language support at https://git.io/codeql-language-support steps: - name: Checkout repository - uses: actions/checkout@v2 + uses: actions/checkout@v7 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@959cbb7472c4d4ad70cdfe6f4976053fe48ab394 # 2.1.37 + uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # 4.37.9 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -61,7 +67,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@959cbb7472c4d4ad70cdfe6f4976053fe48ab394 # 2.1.37 + uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # 4.37.9 # ℹ️ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl @@ -75,4 +81,4 @@ jobs: # make release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@959cbb7472c4d4ad70cdfe6f4976053fe48ab394 # 2.1.37 + uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # 4.37.9 diff --git a/.github/workflows/process-dependabot.yaml b/.github/workflows/process-dependabot.yaml new file mode 100644 index 0000000..2079ac3 --- /dev/null +++ b/.github/workflows/process-dependabot.yaml @@ -0,0 +1,48 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to you under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +name: "Dependabot Process PR" + +on: + workflow_run: + workflows: + - "Dependabot Analyze PR" + types: + - completed + +# Default permissions for each job. +# Additional permissions should be assigned on a per-job basis. +permissions: { } + +jobs: + + process-dependabot: + # Skip this workflow on commits not pushed by Dependabot + if: ${{ + github.repository == 'apache/logging-flume-rpc' + && github.actor == 'dependabot[bot]' + && github.event.workflow_run.conclusion == 'success' + }} + uses: apache/logging-parent/.github/workflows/process-dependabot-reusable.yaml@gha/v0 + permissions: + # Append the changelog commit + contents: write + # Convert the PR into draft + pull-requests: write + with: + # The path to the changelog directory for the current development branch. + changelog-path: src/changelog/.2.x.x
