-
Notifications
You must be signed in to change notification settings - Fork 56
75 lines (64 loc) · 2.72 KB
/
analyze.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
# See https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions
name: analyze
on:
push:
branches: ['main', 'maintenance/*']
paths: ['.github/**', '.mvn/**', 'src/**', 'eclipse-formatter-config.xml', 'pom.xml']
pull_request:
branches: ['main', 'maintenance/*']
paths: ['.github/**', '.mvn/**', 'src/**', 'eclipse-formatter-config.xml', 'pom.xml']
schedule:
- cron: '0 0 * * 6'
permissions:
contents: 'read'
pull-requests: 'write' # Required by SonarCloud to comment PRs
security-events: 'write' # Required by all codeql-action workflows
jobs:
sonar:
# This workflow is only of value to the marcwrobel/jbanking repository and would always fail in forks
if: github.repository == 'marcwrobel/jbanking'
runs-on: 'ubuntu-latest'
steps:
- name: Checkout
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
with:
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of sonar analysis
- name: Set up Java
uses: actions/setup-java@6a0805fcefea3d4657a47ac4c165951e33482018 # v4.2.2
with:
distribution: 'temurin'
java-version: 17
- name: Cache SonarQube packages
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
with:
path: '~/.sonar/cache'
key: ${{ runner.os }}-sonar
restore-keys: ${{ runner.os }}-sonar
- name: Cache Maven packages
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
with:
path: '~/.m2/repository'
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
restore-keys: ${{ runner.os }}-maven-
- name: Analyze
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SONAR_LOGIN: ${{ secrets.SONAR_LOGIN }}
run: 'mvn --settings .mvn/settings.xml -B -P analyze verify sonar:sonar'
codeql:
runs-on: 'ubuntu-latest'
steps:
- name: Checkout repository
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
with:
# We must fetch at least the immediate parents so that if this is a pull request then we can check out the head.
fetch-depth: 2
- name: Initialize CodeQL
uses: github/codeql-action/init@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
with:
languages: 'java'
queries: 'security-and-quality'
- name: Autobuild
uses: github/codeql-action/autobuild@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6