Files
spring-pulsar/.github/workflows/ci-pr.yml
Chris Bono 0db29a674f [CI] Add Trivy vulnerability scans
Adds Trivy vulnerability scan jobs to both CI and PR workflows.

Resolves #466
2023-10-06 21:50:50 -05:00

64 lines
1.8 KiB
YAML

name: CI PRs
on:
pull_request:
branches:
- 'main'
- '0.2.x'
paths-ignore:
- '.github/**'
jobs:
build_and_verify:
name: Build and Verify
if: github.repository == 'spring-projects/spring-pulsar'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: spring-io/spring-gradle-build-action@v2
- name: Build and run unit tests
run: |
./gradlew clean build -x integrationTest --continue --scan
- name: Create Aggregated Jacoco Report
if: contains(github.event.pull_request.labels.*.name, 'ci/upload-jacoco')
run: |
./gradlew aggregateJacocoTestReport --info
- name: Upload Aggregated Jacoco Report
if: contains(github.event.pull_request.labels.*.name, 'ci/upload-jacoco')
uses: actions/upload-artifact@v3
with:
name: jacoco-results
path: 'build/reports/jacoco/**/*.*'
retention-days: 3
- name: Run integration tests
run: |
./gradlew integrationTest --rerun-tasks -DdownloadRabbitConnector=true --scan
- name: Capture Test Results
if: failure()
uses: actions/upload-artifact@v3
with:
name: test-results
path: '*/build/reports/tests/**/*.*'
retention-days: 3
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Run Trivy vulnerability scanner in repo mode
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
ignore-unfixed: true
format: 'table'
severity: 'CRITICAL,HIGH'
- name: 'Scanned'
shell: bash
run: echo "::info ::Scanned"
done:
runs-on: ubuntu-latest
needs: [ build_and_verify, scan ]
steps:
- name: 'Done'
shell: bash
run: echo "::info ::Done"