Skip to content

ci: share build artifacts with contract-test and cancel stale runs #80

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fronzec merged 1 commit into from
Jun 21, 2026
Merged

ci: share build artifacts with contract-test and cancel stale runs #80

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 25 additions & 21 deletions .github/workflows/maven.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,13 @@ on:
pull_request:
branches: ["main"]

# Cancel an in-progress run when a newer commit lands on the same ref, so rapid
# PR pushes don't pile up (each contract-test holds a MySQL service container).
# main is never canceled (its ref is unique per push, but keep pushes serialized).
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

jobs:
build:
runs-on: ubuntu-latest
Expand Down Expand Up @@ -60,6 +67,17 @@ jobs:
# keeps the documented example compiling against batch-job-api.
- name: Build example-payment-job (reference template)
run: mvn -B package -f example-payment-job/pom.xml
# Hand the executable backend JAR and the ticket-pdf-job plugin JAR to
# contract-test so it doesn't recompile what this job already built.
- name: Upload JARs needed by contract-test
uses: actions/upload-artifact@v4

@coderabbitai coderabbitai Bot Jun 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Unpinned workflow actions (tag-based refs):"
rg -nP '^\s*uses:\s*[^@]+@v[0-9]+(\s*)$' .github/workflows/maven.yml || true

echo
echo "Pinned workflow actions (40-char SHA refs):"
rg -nP '^\s*uses:\s*[^@]+@[0-9a-f]{40}\s*$' .github/workflows/maven.yml || true

Repository: fronzec/spring-batch-projects

Length of output: 601

🏁 Script executed:

# Search for policy or documentation about GitHub Actions pinning
find . -type f \( -name "*.md" -o -name "*.txt" -o -name "*.yml" -o -name "*.yaml" \) | head -20 | xargs grep -l "pin\|SHA\|immutable" 2>/dev/null || true

Repository: fronzec/spring-batch-projects

Length of output: 332

🏁 Script executed:

# Check for contributing guidelines or policy files
git ls-files | grep -iE "(CONTRIBUTING|POLICY|SECURITY|README)" || true

Repository: fronzec/spring-batch-projects

Length of output: 600

🏁 Script executed:

# Look for any comments in the maven.yml file that mention pinning policy
head -20 .github/workflows/maven.yml

Repository: fronzec/spring-batch-projects

Length of output: 882

🏁 Script executed:

# Check main README for any GitHub Actions pinning policy
cat README.md | head -100

Repository: fronzec/spring-batch-projects

Length of output: 1363

🏁 Script executed:

# Search specifically for any mention of "blanket policy" or GitHub Actions pinning requirement
rg -i "pin.*github|github.*action.*pin|blanket policy" --max-count=10

Repository: fronzec/spring-batch-projects

Length of output: 55

🏁 Script executed:

# Check if there are any CONTRIBUTING or security guidelines
find . -maxdepth 2 -iname "*CONTRIBUT*" -o -iname "*SECURITY*" | xargs cat 2>/dev/null || echo "No contributing/security files found"

Repository: fronzec/spring-batch-projects

Length of output: 55

Pin GitHub Actions to immutable SHAs.

The workflow uses floating @v4 and @v3/@v5 tags on multiple actions, which weakens supply-chain integrity. Lines 73, 129, and others (34, 111, 185, 215, 222, 225, 251, 254) should pin to full 40-character commit SHAs instead.

Suggested patch 
-      - name: Upload JARs needed by contract-test
-        uses: actions/upload-artifact@v4
+      - name: Upload JARs needed by contract-test
+        uses: actions/upload-artifact@<FULL_40_CHAR_COMMIT_SHA>

@@
-      - name: Download prebuilt JARs from the build job
-        uses: actions/download-artifact@v4
+      - name: Download prebuilt JARs from the build job
+        uses: actions/download-artifact@<FULL_40_CHAR_COMMIT_SHA>
🧰 Tools
🪛 zizmor (1.25.2)

[error] 73-73: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/maven.yml at line 73, Replace all floating version tags in
the GitHub Actions workflow with immutable full 40-character commit SHAs.
Specifically, update the `uses` statements for actions/upload-artifact@v4 (line
73), actions/checkout@v3 (line 34), actions/setup-java@v3 (line 111),
actions/download-artifact@v4 (line 129), and all other action references on
lines 185, 215, 222, 225, 251, 254 to pin them to their respective full commit
SHAs instead of using floating version tags. This ensures supply-chain integrity
by preventing unexpected changes from new action versions.

Source: Linters/SAST tools

with:
name: contract-test-jars
path: |
fr-batch-service/target/*.jar
ticket-pdf-job/target/ticket-pdf-job-1.0.0.jar
retention-days: 1
if-no-files-found: error

# Boots the real backend against MySQL and drives the plugin lifecycle
# (upload -> approve -> enable -> load) through scripts/load-plugins.hurl.
Expand Down Expand Up @@ -94,23 +112,9 @@ jobs:
with:
java-version: "21"
distribution: "temurin"
cache: maven
- name: Configure GitHub Packages authentication
run: |
mkdir -p ~/.m2
cat > ~/.m2/settings.xml << EOF
<settings>
<servers>
<server>
<id>github</id>
<username>${GITHUB_ACTOR}</username>
<password>${GITHUB_TOKEN}</password>
</server>
</servers>
</settings>
EOF
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# No Maven build runs here — the JARs come prebuilt from the `build` job,
# so neither GitHub Packages auth nor a Maven cache is needed; just a JDK
# to run `java -jar`.
- name: Install hurl
env:
HURL_VERSION: 8.0.1
Expand All @@ -121,10 +125,10 @@ jobs:
sudo apt-get update
sudo apt-get install -y /tmp/hurl.deb
hurl --version
- name: Build backend and ticket-pdf-job plugin
run: |
mvn -B -q -DskipTests package -f fr-batch-service/pom.xml
mvn -B -q -DskipTests package -f ticket-pdf-job/pom.xml
- name: Download prebuilt JARs from the build job
uses: actions/download-artifact@v4
with:
name: contract-test-jars
- name: Start backend (local profile)
run: |
# Glob the repackaged executable JAR — *.jar excludes the thin
Expand Down
Loading