version change #12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Manual Build and Docker Verify | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [ main ] | |
| jobs: | |
| quality-and-build: | |
| runs-on: ubuntu-latest | |
| services: | |
| redis: | |
| image: redis | |
| ports: | |
| - 6379:6379 | |
| options: >- | |
| --health-cmd "redis-cli ping" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v4 | |
| - name: Set up JDK 21 | |
| uses: actions/setup-java@v3 | |
| with: | |
| java-version: '21' | |
| distribution: 'temurin' | |
| cache: 'maven' | |
| - name: Extract Maven Project Version | |
| id: project_version | |
| run: | | |
| VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout) | |
| echo "VERSION=$VERSION" >> $GITHUB_OUTPUT | |
| - name: Run All Tests | |
| run: mvn test -B | |
| env: | |
| SPRING_REDIS_HOST: localhost | |
| SPRING_REDIS_PORT: 6379 | |
| - name: Build Application Jar | |
| run: mvn clean package -DskipTests -B | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Build Docker Image (Verify Only) | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| load: true | |
| # Dynamically tag the image with the version from pom.xml | |
| tags: idempotency-core:${{ steps.project_version.outputs.VERSION }} | |
| build-args: | | |
| APP_VERSION=${{ steps.project_version.outputs.VERSION }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Confirm Image Build | |
| run: | | |
| echo "Successfully built image version: ${{ steps.project_version.outputs.VERSION }}" | |
| docker images | grep idempotency-core | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: 'idempotency-core:${{ steps.project_version.outputs.VERSION }}' | |
| format: 'table' | |
| exit-code: '1' # Fails build if high/critical vulnerabilities are found | |
| ignore-unfixed: true | |
| vuln-type: 'os,library' | |
| severity: 'CRITICAL,HIGH' | |
| - name: Archive Production JAR | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: idempotency-core-jar | |
| path: target/*.jar | |
| retention-days: 5 |