LinkedIn/.github/workflows/pr-checks.yml at b3d911fe851550ba8aeef69fe8b02fbae7624eaa · premtsd-code/LinkedIn · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
name: PR Checks

on:
  pull_request:
    branches: [develop, main]

jobs:

  unit-tests:
    name: Unit Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'corretto'
          cache: maven
      - name: Run unit tests
        run: |
          for svc in user-service post-service connections-service notification-service uploader-service; do
            echo "=== Testing $svc ==="
            cd $svc && mvn test -q && cd ..
          done
      - name: Upload test results
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: unit-test-results
          path: '**/target/surefire-reports/*.xml'

  code-coverage:
    name: Code Coverage
    runs-on: ubuntu-latest
    needs: unit-tests
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'corretto'
          cache: maven
      - name: Run tests with coverage
        run: |
          for svc in user-service post-service connections-service notification-service uploader-service; do
            echo "=== Coverage for $svc ==="
            cd $svc && mvn test jacoco:report -q && cd ..
          done
      - name: Upload coverage report
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: '**/target/site/jacoco/'

  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'corretto'
          cache: maven
      - name: OWASP Dependency Check
        run: |
          for svc in user-service post-service connections-service notification-service uploader-service; do
            echo "=== OWASP scan for $svc ==="
            cd $svc && mvn dependency-check:check -DfailBuildOnCVSS=7 -DskipTestScope=true || true
            cd ..
          done
      - name: Upload OWASP report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: owasp-report
          path: '**/target/dependency-check-report.html'

  code-quality:
    name: Code Quality
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'corretto'
          cache: maven
      - name: Checkstyle
        run: |
          for svc in user-service post-service connections-service notification-service uploader-service; do
            echo "=== Checkstyle for $svc ==="
            cd $svc && mvn checkstyle:check -q || true
            cd ..
          done
      - name: SpotBugs
        run: |
          for svc in user-service post-service connections-service notification-service uploader-service; do
            echo "=== SpotBugs for $svc ==="
            cd $svc && mvn compile spotbugs:check -q || true
            cd ..
          done

  sonarcloud:
    name: SonarCloud Analysis
    runs-on: ubuntu-latest
    needs: unit-tests
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'corretto'
          cache: maven
      - name: Cache SonarCloud packages
        uses: actions/cache@v4
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
          restore-keys: ${{ runner.os }}-sonar
      - name: SonarCloud Scan
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: |
          for svc in user-service post-service connections-service notification-service uploader-service; do
            echo "=== Scanning $svc ==="
            cd $svc
            mvn verify jacoco:report sonar:sonar -DskipTests \
              -Dsonar.projectKey=premtsd-code_LinkedIn_${svc} \
              -Dsonar.organization=premtsd-code \
              -Dsonar.host.url=https://sonarcloud.io \
              -Dsonar.projectName="${svc}" \
              -Dsonar.java.coveragePlugin=jacoco \
              -Dsonar.coverage.jacoco.xmlReportPaths=target/site/jacoco/jacoco.xml \
              || true
            cd ..
          done