chore(deps): update github actions to 6f3fa03 #522
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: The ilo Authors | |
| # SPDX-License-Identifier: 0BSD | |
| name: Verify Commits | |
| on: | |
| pull_request: | |
| branches: [ main ] | |
| # Cancel superseded runs on the same branch so rapid pushes don't keep stale 3-OS native builds alive. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| # These jobs run untrusted PR code; the token needs only read access to the checkout. | |
| permissions: | |
| contents: read | |
| jobs: | |
| verify: | |
| name: Build on ${{ matrix.os }} | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 45 | |
| strategy: | |
| matrix: | |
| os: | |
| - ubuntu-latest | |
| - macos-latest | |
| - windows-latest | |
| steps: | |
| - id: checkout | |
| name: Clone Git Repository | |
| # Full history so the Linux leg's SonarQube analysis can assign blame and compute the new-code period. | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| fetch-depth: 0 | |
| - id: graal | |
| name: Set up GraalVM | |
| uses: graalvm/setup-graalvm@6f3fa030c4b8f77c1f554a860f593a654538fa38 # v1 | |
| with: | |
| distribution: graalvm-community | |
| java-version: 25 | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| - id: cache | |
| name: Cache Maven Repository | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5 | |
| with: | |
| path: ~/.m2/repository | |
| key: maven-${{ github.job }}-${{ hashFiles('**/pom.xml') }} | |
| restore-keys: | | |
| maven-${{ github.job }}- | |
| maven- | |
| - id: verify | |
| name: Verify Project | |
| run: mvn --batch-mode --define skipNativeBuild=false verify | |
| - id: smoke | |
| name: Smoke test the native binary | |
| shell: bash | |
| # Run the freshly built binary so a native-only failure (a missing reflection/resource | |
| # registration) is caught here instead of shipping a binary that crashes on first run. | |
| run: | | |
| bin="target/ilo"; [ -f "target/ilo.exe" ] && bin="target/ilo.exe" | |
| "$bin" --version | |
| "$bin" --help | |
| - id: sonar | |
| name: SonarQube analysis | |
| # Linux-only, and skipped on fork PRs (which cannot read SONAR_TOKEN). Reuses the test run and | |
| # coverage data the verify step already produced, so the PR scan adds no second build. The | |
| # push-to-main analysis (the new-code baseline this decoration compares against) lives in sonar.yml. | |
| if: runner.os == 'Linux' && github.event.pull_request.head.repo.fork == false | |
| run: mvn --batch-mode org.jacoco:jacoco-maven-plugin:report sonar:sonar | |
| env: | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| mutation: | |
| name: Mutation tests (PIT) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| steps: | |
| - id: checkout | |
| name: Clone Git Repository | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| - id: graal | |
| name: Set up GraalVM | |
| uses: graalvm/setup-graalvm@6f3fa030c4b8f77c1f554a860f593a654538fa38 # v1 | |
| with: | |
| distribution: graalvm-community | |
| java-version: 25 | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| - id: cache | |
| name: Cache Maven Repository | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5 | |
| with: | |
| path: ~/.m2/repository | |
| key: maven-${{ github.job }}-${{ hashFiles('**/pom.xml') }} | |
| restore-keys: | | |
| maven-${{ github.job }}- | |
| maven- | |
| - id: mutation | |
| name: Run Mutation Tests | |
| # PIT is configured in pluginManagement but not bound to a phase, so it is invoked directly; | |
| # the explicit threshold makes this a real gate regardless of the parent's configuration. | |
| run: mvn --batch-mode test-compile org.pitest:pitest-maven:mutationCoverage -DmutationThreshold=65 | |
| integration: | |
| name: Integration tests (Docker) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - id: checkout | |
| name: Clone Git Repository | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| - id: graal | |
| name: Set up GraalVM | |
| uses: graalvm/setup-graalvm@6f3fa030c4b8f77c1f554a860f593a654538fa38 # v1 | |
| with: | |
| distribution: graalvm-community | |
| java-version: 25 | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| - id: cache | |
| name: Cache Maven Repository | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5 | |
| with: | |
| path: ~/.m2/repository | |
| key: maven-${{ github.job }}-${{ hashFiles('**/pom.xml') }} | |
| restore-keys: | | |
| maven-${{ github.job }}- | |
| maven- | |
| - id: integration | |
| name: Run Integration Tests | |
| # ubuntu-latest ships rootful Docker and rootless Podman; require both runtimes' tests to | |
| # actually run rather than silently skip if a runtime is somehow unavailable. | |
| run: mvn --batch-mode -Pintegration verify | |
| env: | |
| ILO_IT_DOCKER: "true" | |
| ILO_IT_PODMAN: "true" |