Skip to content

CI: implement best practices and update actions #100

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
black-sliver merged 4 commits into from
Apr 15, 2026
Merged

CI: implement best practices and update actions #100

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0a10d75
CI: use cooldown for dependabot
black-sliver Apr 14, 2026
55d5cc0
CI: drop all but required permissions
black-sliver Apr 14, 2026
11c0070
CI: disable cache in release workflow
black-sliver Apr 14, 2026
24044e1
CI: update and pin actions
black-sliver Apr 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,11 @@ updates:
directory: "/" # Location of package manifests
schedule:
interval: "weekly"
cooldown:
default-days: 3
- package-ecosystem: "github-actions" # See documentation for possible values
directory: "/" # Location of package manifests
schedule:
interval: "weekly"
cooldown:
default-days: 3
6 changes: 4 additions & 2 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,15 +4,17 @@ name: Java CI with Maven

on: [pull_request]

permissions: {}

jobs:
build:

runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v6.0.2
- name: Set up JDK 17
uses: actions/setup-java@v4
uses: actions/setup-java@v5.2.0
with:
java-version: '17'
distribution: 'temurin'
Expand Down
7 changes: 4 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,18 +6,19 @@ on:
tags:
- '[0-9]+.[0-9]+.[0-9]+'

permissions: {}

jobs:
build:
if: github
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v6.0.2
- name: Set up JDK 17
uses: actions/setup-java@v4
uses: actions/setup-java@v5.2.0
with:
java-version: '17'
distribution: 'temurin'
cache: gradle
- name: Build with Gradle
# This just publishes to the local file system; jreleaser is responsible for uploading to maven central
run: ./gradlew publish
Expand Down
6 changes: 4 additions & 2 deletions .github/workflows/snapshot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,15 @@ on:
branches:
- 'main'

permissions: {}

jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v6.0.2
- name: Set up JDK 17
uses: actions/setup-java@v4
uses: actions/setup-java@v5.2.0
with:
java-version: '17'
distribution: 'temurin'
Expand Down
9 changes: 6 additions & 3 deletions .github/workflows/update-dependancy-graph.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,18 +4,21 @@ on:
push:
branches: [ main ]

permissions:
contents: write

jobs:
dependency-graph:

runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v6.0.2
- name: Set up JDK 17
uses: actions/setup-java@v4
uses: actions/setup-java@v5.2.0
with:
java-version: '17'
distribution: 'temurin'
cache: gradle
- name: Submit Dependency Snapshot
uses: gradle/actions/dependency-submission@v4
uses: gradle/actions/dependency-submission@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
Copy link
Copy Markdown
Collaborator

@cjmang cjmang Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

By my reading, this looks to have been superceded twice. Firstly, in favor of https://github.com/gradle/gradle-build-action?tab=readme-ov-file#github-dependency-graph-support, and then that was replaced in favor of https://github.com/gradle/actions/blob/main/docs/setup-gradle.md.

Dunno that we need to change it right away, but eventually I guess.

Copy link
Copy Markdown
Member Author

@black-sliver black-sliver Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think setup-gradle replaces setup-java (and also implements submitting the dependency graph), but gradle/actions/dependency-submission seems to still be maintained.
We could switch in the future, but I am not sure if setup-gradle has any real advantage over what we are doing now.