Shared workflows

.github/dependabot.yml

@@ -8,12 +8,22 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
-    ignore:
-      - dependency-name: "*"
-        update-types: ["version-update:semver-major"]
-
+    # wait after a new release till we create a PR, to reduce risk of pulling
+    # a compromised new version
+    cooldown:
+      default-days: 7
+      # Exclude our own repos from cooldown
+      # https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#cooldown-
+      exclude:
+        - "org.jboss.da:*"
+        - "org.jboss.pnc*:*" # match org.jboss.pnc:xyz and org.jboss.pnc.group:xyz
+        - "org.commonjava*:*" # match org.commonjava:xyz and org.commonjava.group:xyz
   - package-ecosystem: "github-actions" # Also update Github actions
     directory: "/"
     schedule:
       # Check for updates to GitHub Actions every week
       interval: "weekly"
+    # wait after a new release till we create a PR, to reduce risk of pulling
+    # a compromised new version
+    cooldown:
+      default-days: 7

.github/release.yml

@@ -0,0 +1,15 @@
+# From https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes#creating-automatically-generated-release-notes-for-a-new-release
+changelog:
+  categories:
+    - title: 🐛 Fixes / 🚀 Enhancements
+      labels:
+        - '*'
+      exclude:
+        labels:
+          - dependencies
+    - title: 👒 Project Dependencies
+      labels:
+        - java
+    - title: 👒 CI Dependencies
+      labels:
+        - github_actions

.github/workflows/maven-mend-pr.yml

@@ -0,0 +1,34 @@
+name: Mend CLI scan for Maven PR
+
+on:
+  workflow_run: # zizmor: ignore[dangerous-triggers]
+    workflows: ["Java CI with Maven"]
+    types: [completed]
+
+permissions:
+  contents: read
+  actions: read
+  checks: write
+  pull-requests: write
+  security-events: write
+
+concurrency:
+  group: mend-scan-${{ github.event.workflow_run.pull_requests[0].number || github.event.workflow_run.head_sha }}
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request'
+    uses: project-ncl/shared-github-actions/.github/workflows/mend-ci.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23
+    with:
+      project_name: "Commonjava/weft"
+      SCA: true
+      SAST: true
+      triggering_run_id: ${{ github.event.workflow_run.id }}
+      pr_feedback: true
+    secrets:
+      MEND_URL: ${{ secrets.MEND_URL }}
+      MEND_USER_KEY: ${{ secrets.MEND_USER_KEY }}
+      MEND_EMAIL: ${{ secrets.MEND_EMAIL }}
+      MEND_ORGNAME: ${{ secrets.MEND_ORGNAME }}
+      MEND_PRODUCTNAME: ${{ secrets.MEND_PRODUCTNAME }}

.github/workflows/maven-mend.yml

@@ -0,0 +1,37 @@
+name: Mend CLI scan for Maven
+
+on:
+  push:
+    branches:
+      - master
+  schedule:
+    - cron: "0 22 * * 0"
+
+permissions:
+  contents: read
+  actions: read
+  checks: write
+  pull-requests: write
+  security-events: write
+
+jobs:
+  build:
+    uses: project-ncl/shared-github-actions/.github/workflows/maven-ci.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23
+    with:
+      java_version: "11"
+      build_command: "MAVEN_OPTS='-Xmx4096m -Xms2048m -XX:MaxMetaspaceSize=4096m -Xss8m' mvn -B -V clean verify"
+      upload_artifacts: true
+
+  call-mend-ci:
+    needs: build
+    uses: project-ncl/shared-github-actions/.github/workflows/mend-ci.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23
+    with:
+      project_name: "Commonjava/weft"
+      SCA: true
+      SAST: true
+    secrets:
+      MEND_URL: ${{ secrets.MEND_URL }}
+      MEND_USER_KEY: ${{ secrets.MEND_USER_KEY }}
+      MEND_EMAIL: ${{ secrets.MEND_EMAIL }}
+      MEND_ORGNAME: ${{ secrets.MEND_ORGNAME }}
+      MEND_PRODUCTNAME: ${{ secrets.MEND_PRODUCTNAME }}

.github/workflows/maven-pr.yml

@@ -0,0 +1,16 @@
+name: Java CI with Maven
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    branches: ["*"]
+
+jobs:
+  call-maven-ci:
+    uses: project-ncl/shared-github-actions/.github/workflows/maven-ci.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23
+    with:
+      java_version: "11"
+      build_command: "MAVEN_OPTS='-Xmx4096m -Xms2048m -XX:MaxMetaspaceSize=4096m -Xss8m' mvn -B -V clean verify"
+      upload_artifacts: true

.github/workflows/maven-release.yml

@@ -0,0 +1,25 @@
+name: "0 Central Release Job" # Adding the 0 so that it's on top of the list of github actions
+on:
+  workflow_dispatch: # Manual trigger so you don't release on every push
+    inputs:
+      ref_to_release:
+        description: "[Optional] Branch or commit to release. Default: Github default branch"
+        required: false
+        type: string
+        # default has to be a static string, no variables allowed
+        default: ""
+
+jobs:
+  call-release-job:
+    permissions:
+      contents: write # needed to push commit and tag back to the repository
+    uses: project-ncl/shared-github-actions/.github/workflows/maven-release.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23
+    with:
+      java_version: "11"
+      ref_to_release: ${{ inputs.ref_to_release }}
+      release_command: 'mvn -B -V release:prepare release:perform -DlocalCheckout=true -DpushChanges=false'
+    secrets:
+      SONATYPE_USERNAME: ${{ secrets.SONATYPE_BOT_USERNAME }}
+      SONATYPE_PASSWORD: ${{ secrets.SONATYPE_BOT_TOKEN }}
+      GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+      GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

.github/workflows/maven-set-version.yml

@@ -0,0 +1,25 @@
+name: "0 Maven Set Version Job" # Adding the 0 so that it's on top of the list of github actions
+on:
+  workflow_dispatch: # Manual trigger
+    inputs:
+      new_version:
+        description: "[Required] Version to set"
+        required: true
+        type: string
+
+      ref_for_version:
+        description: "[Optional] Branch or commit to change version. Default: Github default branch"
+        required: false
+        type: string
+        # default has to be a static string, no variables allowed
+        default: ""
+
+jobs:
+  call-maven-set-version-job:
+    permissions:
+      contents: write # needed to push commit and tag back to the repository
+    uses: project-ncl/shared-github-actions/.github/workflows/maven-set-version.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23
+    with:
+      java_version: "11"
+      new_version: ${{ inputs.new_version }}
+      ref_for_version: ${{ inputs.ref_for_version }}

.github/workflows/maven-snapshot.yml

@@ -0,0 +1,18 @@
+name: Build snapshot version and upload to Maven Central
+
+on:
+  push:
+    branches: ["master"]
+
+permissions: {}
+
+jobs:
+  call-snapshot-job:
+    uses: project-ncl/shared-github-actions/.github/workflows/maven-snapshot.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23
+    with:
+      java_version: "11"
+      project_name: "Commonjava/weft"
+      snapshot_deploy_command: "mvn help:effective-settings -B -V clean deploy -e"
+    secrets:
+      SONATYPE_USERNAME: ${{ secrets.SONATYPE_BOT_USERNAME }}
+      SONATYPE_PASSWORD: ${{ secrets.SONATYPE_BOT_TOKEN }}

.github/workflows/validate-gh-action.yml

@@ -0,0 +1,11 @@
+name: Validate GitHub Actions Workflows
+permissions: {}
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/*.yml"
+
+jobs:
+  validate:
+    uses: project-ncl/shared-github-actions/.github/workflows/validate-gh-action.yml@646d9b629925d6405fb06ed1476aefd6b2cdca86 # v0.0.23

pom.xml

@@ -21,7 +21,7 @@
   <parent>
     <groupId>org.commonjava</groupId>
     <artifactId>commonjava</artifactId>
-    <version>21</version>
+    <version>22</version>
   </parent>
 
   <groupId>org.commonjava.cdi.util</groupId>
@@ -114,4 +114,12 @@
     </plugins>
   </build>
 
+  <repositories>
+    <repository>
+      <id>sonatype-snapshots</id>
+      <url>https://central.sonatype.com/repository/maven-snapshots/</url>
+      <releases><enabled>false</enabled></releases>
+      <snapshots><enabled>true</enabled></snapshots>
+    </repository>
+  </repositories>
 </project>