Issue/434 Automate Builds by hhund · Pull Request #437 · datasharingframework/dsf

hhund · 2026-03-15T18:44:30Z

Improved Actions workflow and dependabot config:

Added a dependabot config to automate creation of pull requests for maven, github-actions, docker and docker-compose version upgrades. Will be active once merged into main.
Fixed missing tika-core version in maven api v2 dependency copy config.
Pinned base docker images in Dockerfiles.
Reconfigured GitHub Actions workflows: New build.yml workflow with automated maven and docker builds. Maven build configured to run tests and other elements in parallel. Docker images are scanned with trivy, trivy results are published to the internal GitHub Security Code Scanning results page. Docker images are signed and can be verified using cosign verify ghcr.io/datasharingframework/<image>:<tag>@sha256:<digest> --certificate-identity-regexp "https://github.com/datasharingframework/dsf/.*" --certificate-oidc-issuer "https://token.actions.githubusercontent.com". A cyclonedx SBOM is generated for the docker images and attached to the registry, SBOM is signed by cosign. New workflow includes codeql config.
New build.yml workflow is configured to run for pushes in release/* and hotfix/* branches, on Git tag pushes (regular releases, milestone and release candidates), on pull request to main and develop (opened, synchronize, reopened and closed events) as well as on a weakly schedule.
Releases are triggered via Git tags: If a commit is tagged that is part of the main branch, the docker images are tagged with a.b, a.b.c and 'latest'. Other Git tags (e.g. in a hotfix branch) will result in a.b and a.b.c for regular releases, and (e.g. in a release branch) a.b.c-RCx or a.b.c-Mx for preview releases. Merged pull requests into the develop branch trigger a docker image build that is tagged with 'develop'.

closes #434

@sha256

* Added a dependabot config to automate creation of pull requests for maven, github-actions, docker and docker-compose version upgrades. Will be active once merged into main. * Fixed missing tika-core version in maven api v2 dependency copy config. * Pinned base docker images in Dockerfiles. * Reconfigured GitHub Actions workflows: New build.yml workflow with automated maven and docker builds. Maven build configured to run tests and other elements in parallel. Docker images are scanned with trivy, trivy results are published to the internal GitHub Security Code Scanning results page. Docker images are signed and can be verified using ```cosign verify ghcr.io/datasharingframework/<image>:<tag>@sha256:<digest> --certificate-identity-regexp "https://github.com/datasharingframework/dsf/.*" --certificate-oidc-issuer "https://token.actions.githubusercontent.com"```. A cyclonedx SBOM is generated for the docker images and attached to the registry, SBOM is signed by cosign. New workflow includes codeql config. * New build.yml workflow is configured to run for pushes in release/* and hotfix/* branches, on Git tag pushes (regular releases, milestone and release candidates), on pull request to main and develop (opened, synchronize, reopened and closed events) as well as on a weakly schedule. * Releases are triggered via Git tags: If a commit is tagged that is part of the main branch, the docker images are tagged with a.b, a.b.c and 'latest'. Other Git tags (e.g. in a hotfix branch) will result in a.b and a.b.c for regular releases, and (e.g. in a release branch) a.b.c-RCx or a.b.c-Mx for preview releases. Merged pull requests into the develop branch trigger a docker image build that is tagged with 'develop'.

github-advanced-security · 2026-03-15T18:47:34Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

hhund · 2026-03-15T19:00:21Z

The Node.js 20 deprecation warning in https://github.com/datasharingframework/dsf/actions/runs/23116834123 is related to aquasecurity/trivy-action using actions/cache v4, see aquasecurity/trivy-action#528

schwzr · 2026-03-24T17:37:56Z

.github/workflows/build.yml

+      - name: Checkout repository 
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Download quick-build results
+        uses: actions/download-artifact/@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0


actions/download-artifact/@7 -> actions/download-artifact@7 (remove tailing /)

schwzr · 2026-03-24T17:39:01Z

.github/workflows/build.yml

+      - name: Checkout repository 
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Download quick-build results
+        uses: actions/download-artifact/@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0


remove tailing /

schwzr · 2026-03-24T17:39:16Z

.github/workflows/build.yml

+      - name: Checkout repository 
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Download quick-build results
+        uses: actions/download-artifact/@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0


remove tailing /

schwzr · 2026-03-24T17:39:23Z

.github/workflows/build.yml

+      - name: Checkout repository 
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Download quick-build results
+        uses: actions/download-artifact/@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0


remove tailing /

schwzr · 2026-03-24T17:40:59Z

.github/workflows/build.yml

+        id: main
+        run: echo "main=$( [ "$GITHUB_SHA" = "$(git rev-parse HEAD)" ] && echo true || echo false )" >> $GITHUB_OUTPUT
+
+  maven-full:


do we need the .m2 directory here from the fast build for some of the tasks?

schwzr · 2026-03-24T17:42:56Z

.github/workflows/build.yml

+          - name: Formatter, Impsort, Enforcer, License Check
+            cmd: mvn compile test-compile license:check -Dmaven.buildNumber.skip=true
+          - name: DAO Tests (not Binary)
+            cmd: mvn failsafe:integration-test --fail-at-end -P!generate-source-and-javadoc-jars -Dimpsort.skip=true -Dformatter.skip=true -Dlicense.skip=true -Denforcer.skip -Dmaven.buildNumber.skip=true -DskipShadePlugin=true -Dfailsafe.includes=**/*DaoTest -Dfailsafe.excludes=**/BinaryDaoTest -DforkCount=2


maybe create an env definition for that like

env: MAVEN_SKIP_FLAGS: "-Dimpsort.skip=true -Dformatter.skip=true -Dlicense.skip=true -Denforcer.skip -Dmaven.buildNumber.skip=true -DskipShadePlugin=true"

schwzr · 2026-03-24T17:43:33Z

.github/workflows/build.yml

+          - name: Unit Tests
+            cmd: mvn dependency:properties surefire:test --fail-at-end -P!generate-source-and-javadoc-jars -Dimpsort.skip=true -Dformatter.skip=true -Dlicense.skip=true -Denforcer.skip -Dmaven.buildNumber.skip=true -DskipShadePlugin=true
+    name: ${{ matrix.mvn.name }}
+    timeout-minutes: 8


why a timeout only here?

schwzr · 2026-03-24T17:57:54Z

We could improve the pipeline, if we fail it on new, critical / high dependency vulnerabilities.

Maybe we could:

Create a .trivyignore file at the root directory
Add a new action like this (but that might execute the scan twice)

    - name: Scan Docker image with Trivy (full report)
      uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
      with:
        image-ref: ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }}:${{ github.sha }}
        format: 'sarif'
        output: 'trivy-results.sarif'

    - name: Upload Trivy scan results to GitHub Security tab
      uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
      if: always()
      with:
        sarif_file: 'trivy-results.sarif'

+   - name: Fail on CRITICAL or HIGH vulnerabilities
+     uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
+     with:
+       image-ref: ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }}:${{ github.sha }}
+       format: 'table'
+       exit-code: '1'
+       severity: 'CRITICAL,HIGH'
+       trivyignores: '.trivyignore'

hhund added this to the 2.0.3 milestone Mar 15, 2026

hhund requested a review from schwzr March 15, 2026 18:44

hhund self-assigned this Mar 15, 2026

hhund linked an issue Mar 16, 2026 that may be closed by this pull request

Automate Docker Image Builds and Maven Central Deploys #434

Open

schwzr approved these changes Mar 24, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Issue/434 Automate Builds#437

Issue/434 Automate Builds#437
hhund wants to merge 1 commit intodevelopfrom
issue/434_Automate_Builds

hhund commented Mar 15, 2026

Uh oh!

github-advanced-security bot commented Mar 15, 2026

Uh oh!

hhund commented Mar 15, 2026

Uh oh!

schwzr Mar 24, 2026

Uh oh!

schwzr Mar 24, 2026

Uh oh!

schwzr Mar 24, 2026

Uh oh!

schwzr Mar 24, 2026

Uh oh!

schwzr Mar 24, 2026

Uh oh!

schwzr Mar 24, 2026

Uh oh!

schwzr Mar 24, 2026

Uh oh!

schwzr commented Mar 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

hhund commented Mar 15, 2026

Uh oh!

github-advanced-security bot commented Mar 15, 2026

What Enabling Code Scanning Means:

Uh oh!

hhund commented Mar 15, 2026

Uh oh!

schwzr Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

schwzr Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

schwzr Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

schwzr Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

schwzr Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

schwzr Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

schwzr Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

schwzr commented Mar 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants