diff --git a/.github/workflows/build-pr.yml b/.github/workflows/build-pr.yml index 0bfb5ee..4735d57 100644 --- a/.github/workflows/build-pr.yml +++ b/.github/workflows/build-pr.yml @@ -1,22 +1,19 @@ -name: Build Pull Request -on: [pull_request] +name: Build PR + +on: + pull_request: + +permissions: + contents: read + checks: write + pull-requests: write + jobs: - build_pr: - name: Check PR if can build - if: github.repository_owner == 'OneLiteFeatherNET' - runs-on: ${{ matrix.os }} - strategy: - matrix: - os: [ubuntu-latest, windows-latest, macos-latest] - steps: - - name: Checkout Repository - uses: actions/checkout@v7 - - name: Setup Gradle - uses: gradle/actions/setup-gradle@v6 - - name: Setup Java - uses: actions/setup-java@v5 - with: - distribution: temurin - java-version: 21 - - name: Build on ${{ matrix.os }} - run: ./gradlew clean build + build: + # Shared org build: Temurin toolchain, 3-OS matrix, tests and coverage. + uses: OneLiteFeatherNET/workflows/.github/workflows/gradle-build-pr.yml@v2.8.1 + with: + java-version: "21" + java-distribution: "temurin" + run-tests: false + secrets: inherit diff --git a/.github/workflows/close_invalid_prs.yml b/.github/workflows/close_invalid_prs.yml index 68a00c5..bd99444 100644 --- a/.github/workflows/close_invalid_prs.yml +++ b/.github/workflows/close_invalid_prs.yml @@ -1,14 +1,10 @@ -name: Close invalid Pull Requests +name: Close invalid PRs on: pull_request_target: - types: [ opened ] + types: [opened] jobs: - run: - if: ${{ github.repository != github.event.pull_request.head.repo.full_name && github.head_ref == 'main' }} - runs-on: ubuntu-latest - steps: - - uses: superbrothers/close-pull-request@v3 - with: - comment: "Please do not open pull requests from the `main` branch, create a new branch instead." \ No newline at end of file + close: + uses: OneLiteFeatherNET/workflows/.github/workflows/close-invalid-prs.yml@v2.8.1 + secrets: inherit diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml new file mode 100644 index 0000000..759b37b --- /dev/null +++ b/.github/workflows/pr-lint.yml @@ -0,0 +1,17 @@ +name: PR Lint + +# Conventional Commits on the PR title and every commit on the branch. +# release-please parses those commit types to decide the version bump and to +# build the changelog - a non-conventional commit silently produces neither. +on: + pull_request: + types: [opened, edited, synchronize, reopened] + +permissions: + contents: read + pull-requests: read + +jobs: + lint: + uses: OneLiteFeatherNET/workflows/.github/workflows/pr-lint.yml@v2.8.1 + secrets: inherit diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml deleted file mode 100644 index 8195b5d..0000000 --- a/.github/workflows/publish.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Release -"on": - push: - branches: - - main - - next - - beta - - alpha - - "*.x" - -permissions: - contents: read # for checkout - -jobs: - release: - name: Release - runs-on: ubuntu-latest - permissions: - contents: write # to be able to publish a GitHub release - issues: write # to be able to comment on released issues - pull-requests: write # to be able to comment on released pull requests - id-token: write # to enable use of OIDC for npm provenance - steps: - - name: Checkout - uses: actions/checkout@v7 - with: - fetch-depth: 0 - - name: Setup Node.js - uses: actions/setup-node@v7 - with: - node-version: "lts/*" - - name: Validate Gradle Wrapper - uses: gradle/actions/wrapper-validation@v6 - - name: Setup Java - uses: actions/setup-java@v5 - with: - distribution: temurin - java-version: 24 - - name: Setup Gradle - uses: gradle/actions/setup-gradle@v6 - - name: Install dependencies - run: npm clean-install - - name: Verify the integrity of provenance attestations and registry signatures for installed dependencies - run: npm audit signatures - - name: Release - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} - HANGAR_SECRET: ${{secrets.HANGAR_KEY}} - MODRINTH_TOKEN: ${{ secrets.MODRINTH_KEY }} - # Token with permissions to push to the client repository - CLIENT_REPO_TOKEN: ${{ secrets.CLIENT_REPO_TOKEN }} - run: npx semantic-release - - name: Get Version - id: get_version - run: echo "VERSION=$(cat VERSION.txt)" >> $GITHUB_ENV - - name: Upload BOM to Dependency-Track - uses: DependencyTrack/gh-upload-sbom@v4 - with: - serverhostname: ${{ secrets.DEPENDENCYTRACK_HOSTNAME }} - apikey: ${{ secrets.DEPENDENCYTRACK_APIKEY }} - projectname: "Attollo" - projectversion: ${{ env.VERSION }} - projecttags: 'bukkit,paper,plugin' - bomfilename: "build/reports/cyclonedx/bom.xml" - autocreate: true - parent: 'becbe738-ef2b-4333-bd13-477ab794d76a' diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml new file mode 100644 index 0000000..9bac2c6 --- /dev/null +++ b/.github/workflows/release-please.yml @@ -0,0 +1,98 @@ +name: Release + +# release-please collects Conventional Commits into a release PR; merging it +# tags the version and cuts the GitHub release. Everything that has to happen +# for a release is chained into this same run on purpose: release-please tags +# with GITHUB_TOKEN, and a tag pushed that way does NOT start a separate +# `on: push: tags` workflow. +on: + push: + branches: [main] + workflow_dispatch: +permissions: + contents: write + pull-requests: write + +jobs: + release-please: + uses: OneLiteFeatherNET/workflows/.github/workflows/release-please.yml@v2.8.1 + secrets: inherit + + publish: + name: Publish to Hangar and Modrinth + needs: release-please + if: needs.release-please.outputs.release_created == 'true' + runs-on: ubuntu-latest + permissions: + contents: write + env: + HANGAR_SECRET: ${{ secrets.HANGAR_KEY }} + MODRINTH_TOKEN: ${{ secrets.MODRINTH_KEY }} + steps: + - name: Checkout the released tag + uses: actions/checkout@v6 + with: + ref: ${{ needs.release-please.outputs.tag_name }} + + - name: Validate Gradle wrapper + uses: gradle/actions/wrapper-validation@v6 + + - name: Set up JDK + uses: actions/setup-java@v5 + with: + distribution: temurin + java-version: "24" + + - name: Setup Gradle + uses: gradle/actions/setup-gradle@v6 + + # Same command semantic-release ran as its publishCmd, with the version + # coming from release-please instead of from ${nextRelease.version}. + - name: Build and publish + run: ./gradlew -Pversion=${{ needs.release-please.outputs.version }} shadowJar publishAllPublicationsToHangar modrinth cyclonedxBom + + - name: Attach the plugin JAR to the release + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG: ${{ needs.release-please.outputs.tag_name }} + run: gh release upload "$TAG" build/libs/Attollo-*.jar --clobber + + - name: Upload SBOM to Dependency-Track + uses: DependencyTrack/gh-upload-sbom@v4 + with: + serverhostname: ${{ secrets.DEPENDENCYTRACK_HOSTNAME }} + apikey: ${{ secrets.DEPENDENCYTRACK_APIKEY }} + projectname: "Attollo" + projectversion: ${{ needs.release-please.outputs.version }} + projecttags: 'bukkit,paper,plugin' + bomfilename: "build/reports/cyclonedx/bom.xml" + autocreate: true + parent: 'becbe738-ef2b-4333-bd13-477ab794d76a' + sbom: + name: Attach SBOM to release + needs: release-please + if: needs.release-please.outputs.release_created == 'true' + runs-on: ubuntu-latest + permissions: + contents: write + steps: + - name: Checkout + uses: actions/checkout@v6 + with: + ref: ${{ needs.release-please.outputs.tag_name }} + + - name: Generate CycloneDX SBOM + uses: aquasecurity/trivy-action@v0.36.0 + with: + scan-type: fs + scan-ref: . + format: cyclonedx + output: bom.json + # An SBOM is an inventory, not a finding list - never fail on it. + exit-code: '0' + + - name: Attach SBOM to the release + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG: ${{ needs.release-please.outputs.tag_name }} + run: gh release upload "$TAG" bom.json --clobber diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 0000000..e295875 --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,55 @@ +name: Security + +# Trivy vulnerability gate plus a CycloneDX SBOM of the repository. Self-contained +# on purpose: it needs no build tool and no registry credentials, so it is the +# baseline security gate for every repository regardless of language. +on: + pull_request: + push: + branches: [main] + schedule: + - cron: "37 3 * * 1" + workflow_dispatch: +permissions: + contents: read + security-events: write + +jobs: + trivy: + name: Trivy scan + uses: OneLiteFeatherNET/workflows/.github/workflows/security-scan.yml@v2.8.1 + with: + scan-type: "fs" + scanners: "vuln,secret" + severity: "CRITICAL,HIGH" + # Report-only for now, so adopting this does not turn CI red on day one. + fail-on-findings: false + upload-sarif: true + secrets: inherit + + sbom: + name: CycloneDX SBOM + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Checkout + uses: actions/checkout@v6 + + - name: Generate SBOM + uses: aquasecurity/trivy-action@v0.36.0 + with: + scan-type: fs + scan-ref: . + format: cyclonedx + output: bom.json + # An SBOM is an inventory, not a finding list - never fail on it. + exit-code: '0' + + - name: Upload SBOM + uses: actions/upload-artifact@v4 + with: + name: sbom-cyclonedx + path: bom.json + if-no-files-found: error + retention-days: 90 diff --git a/.release-please-manifest.json b/.release-please-manifest.json new file mode 100644 index 0000000..4aeeaa4 --- /dev/null +++ b/.release-please-manifest.json @@ -0,0 +1,3 @@ +{ + ".": "1.5.8" +} diff --git a/.releaserc.json b/.releaserc.json deleted file mode 100644 index f207ccf..0000000 --- a/.releaserc.json +++ /dev/null @@ -1,41 +0,0 @@ -{ - "plugins": [ - [ - "@semantic-release/commit-analyzer", - { - "preset": "conventionalcommits" - } - ], - [ - "@semantic-release/exec", - { - "verifyConditionsCmd": "./gradlew check", - "publishCmd": "./gradlew -Pversion=${nextRelease.version} shadowJar publishAllPublicationsToHangar modrinth cyclonedxBom && echo '${nextRelease.version}' > VERSION.txt" - } - ], - [ - "@semantic-release/changelog", - { - "changelogFile": "CHANGELOG.md" - } - ], - [ - "@semantic-release/git", - { - "assets": ["CHANGELOG.md"] - } - ], - "@semantic-release/git", - "@semantic-release/release-notes-generator", - [ - "@semantic-release/github", - { - "assets": [ - { - "path": "build/libs/Attollo-*.jar" - } - ] - } - ] - ] -} \ No newline at end of file diff --git a/build.gradle.kts b/build.gradle.kts index ffcc4db..cf90a20 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -15,6 +15,8 @@ plugins { jacoco } +version = "1.5.8" // x-release-please-version + if (!File("$rootDir/.git").exists()) { logger.lifecycle( """ diff --git a/commitlint.config.mjs b/commitlint.config.mjs new file mode 100644 index 0000000..0616fb9 --- /dev/null +++ b/commitlint.config.mjs @@ -0,0 +1,3 @@ +export default { + extends: ['@commitlint/config-conventional'], +}; diff --git a/gradle.properties b/gradle.properties index 2dcd025..5754614 100644 --- a/gradle.properties +++ b/gradle.properties @@ -1,6 +1,5 @@ kotlin.code.style=official ### Project Settings -version = 999.0.0-SNAPSHOT group = net.onelitefeather ## Gradle Settings diff --git a/release-please-config.json b/release-please-config.json new file mode 100644 index 0000000..40e7281 --- /dev/null +++ b/release-please-config.json @@ -0,0 +1,19 @@ +{ + "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json", + "release-type": "simple", + "include-component-in-tag": false, + "include-v-in-tag": true, + "packages": { + ".": { + "package-name": "Attollo", + "changelog-path": "CHANGELOG.md", + "extra-files": [ + { + "type": "generic", + "path": "build.gradle.kts" + } + ] + } + }, + "bootstrap-sha": "1eb2ddfaacc861b3277458527c8f823a6372319a" +}