Skip to content

Commit 58c3b4a

Browse files
johnjeffersjohnjeffers
authored
Merge pull request #171 from FusionAuth/refactor/switch-to-user-token
ci(release): switch to user token
2 parents a665944 + 981fecf commit 58c3b4a

File tree

8 files changed

+126
-137
lines changed

8 files changed

+126
-137
lines changed

‎.github/workflows/codeql.yml‎

Lines changed: 33 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,6 @@
1212
name: Vulnerability Scan with CodeQL
1313

1414
on:
15-
push:
16-
branches: [ "main", "release-please--branches--main"]
1715
pull_request:
1816
branches: [ "main" ]
1917
schedule:
@@ -51,44 +49,44 @@ jobs:
5149
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
5250

5351
steps:
54-
- name: Checkout repository
55-
uses: actions/[email protected]
52+
- name: Checkout repository
53+
uses: actions/[email protected]
5654

57-
- name: Setup JDK 17
58-
uses: actions/[email protected]
59-
with:
60-
java-version: '17'
61-
distribution: 'zulu'
62-
63-
# Initializes the CodeQL tools for scanning.
64-
- name: Initialize CodeQL
65-
uses: github/codeql-action/[email protected]
66-
with:
67-
languages: ${{ matrix.language }}
68-
# If you wish to specify custom queries, you can do so here or in a config file.
69-
# By default, queries listed here will override any specified in a config file.
70-
# Prefix the list here with "+" to use these queries and those in the config file.
55+
- name: Setup JDK 17
56+
uses: actions/[email protected]
57+
with:
58+
java-version: '17'
59+
distribution: 'zulu'
7160

72-
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
73-
queries: security-and-quality
61+
# Initializes the CodeQL tools for scanning.
62+
- name: Initialize CodeQL
63+
uses: github/codeql-action/[email protected]
64+
with:
65+
languages: ${{ matrix.language }}
66+
# If you wish to specify custom queries, you can do so here or in a config file.
67+
# By default, queries listed here will override any specified in a config file.
68+
# Prefix the list here with "+" to use these queries and those in the config file.
7469

70+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
71+
queries: security-and-quality
7572

76-
# Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
77-
# If this step fails, then you should remove it and run the build manually (see below)
78-
- name: Autobuild
79-
uses: github/codeql-action/[email protected]
8073

81-
# ℹ️ Command-line programs to run using the OS shell.
82-
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
74+
# Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
75+
# If this step fails, then you should remove it and run the build manually (see below)
76+
- name: Autobuild
77+
uses: github/codeql-action/[email protected]
8378

84-
# If the Autobuild fails above, remove it and uncomment the following three lines.
85-
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
79+
# ℹ️ Command-line programs to run using the OS shell.
80+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
8681

87-
# - run: |
88-
# echo "Run, Build Application using script"
89-
# ./location_of_script_within_repo/buildscript.sh
82+
# If the Autobuild fails above, remove it and uncomment the following three lines.
83+
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
9084

91-
- name: Perform CodeQL Analysis
92-
uses: github/codeql-action/[email protected]
93-
with:
94-
category: "/language:${{matrix.language}}"
85+
# - run: |
86+
# echo "Run, Build Application using script"
87+
# ./location_of_script_within_repo/buildscript.sh
88+
89+
- name: Perform CodeQL Analysis
90+
uses: github/codeql-action/[email protected]
91+
with:
92+
category: "/language:${{matrix.language}}"

‎.github/workflows/detekt.yml‎

Lines changed: 35 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,10 @@
1818
name: Vulnerability Scan with Detekt
1919

2020
on:
21-
# Triggers the workflow on push or pull request events but only for default and protected branches
22-
push:
23-
branches: [ "main", "release-please--branches--main"]
2421
pull_request:
2522
branches: [ "main" ]
2623
schedule:
27-
- cron: '25 6 * * 1'
24+
- cron: '25 6 * * 1'
2825
# Allows you to run this workflow manually from the Actions tab
2926
workflow_dispatch:
3027
# Triggers the workflow on call from another workflow
@@ -48,44 +45,44 @@ jobs:
4845

4946
# Steps represent a sequence of tasks that will be executed as part of the job
5047
steps:
51-
# Sets up JDK as a prerequisite to run Gradle
52-
- name: Setup Java
53-
uses: actions/[email protected]
54-
with:
55-
java-version: '17'
56-
distribution: 'zulu'
48+
# Sets up JDK as a prerequisite to run Gradle
49+
- name: Setup Java
50+
uses: actions/[email protected]
51+
with:
52+
java-version: '17'
53+
distribution: 'zulu'
5754

58-
# Sets up the reviewdog cli
59-
- name: Setup reviewdog
60-
uses: reviewdog/[email protected]
55+
# Sets up the reviewdog cli
56+
- name: Setup reviewdog
57+
uses: reviewdog/[email protected]
6158

62-
- name: Show reviewdog version
63-
run: reviewdog -version
59+
- name: Show reviewdog version
60+
run: reviewdog -version
6461

65-
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
66-
- name: Checkout repository
67-
uses: actions/[email protected]
62+
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
63+
- name: Checkout repository
64+
uses: actions/[email protected]
6865

69-
# Sets up Gradle as a prerequisite to run Detekt
70-
- name: Setup Gradle
71-
uses: gradle/actions/[email protected]
72-
with:
73-
gradle-home-cache-cleanup: true
66+
# Sets up Gradle as a prerequisite to run Detekt
67+
- name: Setup Gradle
68+
uses: gradle/actions/[email protected]
69+
with:
70+
gradle-home-cache-cleanup: true
7471

75-
# Performs analysis using Detekt via Gradle and outputs a Sarif Report
76-
- name: Run Detekt
77-
run: ./gradlew detektRelease detektTest detektReportMergeSarif --continue
72+
# Performs analysis using Detekt via Gradle and outputs a Sarif Report
73+
- name: Run Detekt
74+
run: ./gradlew detektRelease detektTest detektReportMergeSarif --continue
7875

79-
# Uploads Sarif Report to GitHub
80-
- name: Upload SARIF to GitHub
81-
uses: github/codeql-action/[email protected]
82-
if: success() || failure()
83-
with:
84-
sarif_file: build/reports/detekt/merge.sarif.json
76+
# Uploads Sarif Report to GitHub
77+
- name: Upload SARIF to GitHub
78+
uses: github/codeql-action/[email protected]
79+
if: success() || failure()
80+
with:
81+
sarif_file: build/reports/detekt/merge.sarif.json
8582

86-
# Process Sarif Report file from Detekt with reviewdog cli
87-
- name: Run reviewdog
88-
if: success() || failure()
89-
env:
90-
REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
91-
run: reviewdog -f=sarif -diff="git diff FETCH_HEAD" -name="detekt" -reporter=github-pr-check < build/reports/detekt/merge.sarif.json
83+
# Process Sarif Report file from Detekt with reviewdog cli
84+
- name: Run reviewdog
85+
if: success() || failure()
86+
env:
87+
REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
88+
run: reviewdog -f=sarif -diff="git diff FETCH_HEAD" -name="detekt" -reporter=github-pr-check < build/reports/detekt/merge.sarif.json

‎.github/workflows/e2e-test-fusionauth-latest-android-matrix.yml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,6 @@
99
name: E2E Test with latest FusionAuth
1010

1111
on:
12-
# Triggers the workflow on push or pull request events but only for default and protected branches
13-
push:
14-
branches: [ "release-please--branches--main"]
1512
# Triggers the workflow on pull request events but only for default and protected branches
1613
pull_request:
1714
branches: [ "main" ]

‎.github/workflows/lint.yml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,6 @@
1414
name: Check Code Quality with Android Lint
1515

1616
on:
17-
# Triggers the workflow on push or pull request events but only for default and protected branches
18-
push:
19-
branches: [ "main", "release-please--branches--main"]
2017
pull_request:
2118
branches: [ "main" ]
2219
# Allows you to run this workflow manually from the Actions tab

‎.github/workflows/mobsf.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,6 @@
66
name: Vulnerability Scan with MobSF
77

88
on:
9-
push:
10-
branches: [ "main", "release-please--branches--main"]
119
pull_request:
1210
branches: [ "main" ]
1311
schedule:

‎.github/workflows/prerelease-publish-local.yml‎

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -37,26 +37,26 @@ jobs:
3737

3838
# Steps represent a sequence of tasks that will be executed as part of the job
3939
steps:
40-
# Sets up JDK as a prerequisite to run Gradle
41-
- name: Setup Java
42-
uses: actions/[email protected]
43-
with:
44-
java-version: '17'
45-
distribution: 'zulu'
46-
47-
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
48-
- name: Checkout repository
49-
uses: actions/[email protected]
50-
51-
# Sets up Gradle as a prerequisite to run Maven Pre-Release
52-
- name: Setup Gradle
53-
uses: gradle/actions/[email protected]
54-
with:
55-
gradle-home-cache-cleanup: true
56-
57-
# Performs a Local Maven Pre-Release
58-
- name: Run Maven Local Pre-Release
59-
env:
60-
ORG_GRADLE_PROJECT_signingKey: ${{ secrets.GPG_SIGNING_KEY }}
61-
ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.GPG_SIGNING_PASSWORD }}
62-
run: ./gradlew publishReleasePublicationToMavenLocal
40+
# Sets up JDK as a prerequisite to run Gradle
41+
- name: Setup Java
42+
uses: actions/[email protected]
43+
with:
44+
java-version: '17'
45+
distribution: 'zulu'
46+
47+
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
48+
- name: Checkout repository
49+
uses: actions/[email protected]
50+
51+
# Sets up Gradle as a prerequisite to run Maven Pre-Release
52+
- name: Setup Gradle
53+
uses: gradle/actions/[email protected]
54+
with:
55+
gradle-home-cache-cleanup: true
56+
57+
# Performs a Local Maven Pre-Release
58+
- name: Run Maven Local Pre-Release
59+
env:
60+
ORG_GRADLE_PROJECT_signingKey: ${{ secrets.GPG_SIGNING_KEY }}
61+
ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.GPG_SIGNING_PASSWORD }}
62+
run: ./gradlew publishReleasePublicationToMavenLocal

‎.github/workflows/release-publish-ossrh.yml‎

Lines changed: 33 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -48,50 +48,50 @@ jobs:
4848
runs-on: ubuntu-latest
4949

5050
# Requires the staging_profile_id and e2e-test job
51-
needs: [create_staging_repository,e2e-test]
51+
needs: [ create_staging_repository,e2e-test ]
5252

5353
# Steps represent a sequence of tasks that will be executed as part of the job
5454
steps:
55-
# Sets up JDK as a prerequisite to run Gradle
56-
- name: Setup Java
57-
uses: actions/[email protected]
58-
with:
59-
java-version: '17'
60-
distribution: 'zulu'
55+
# Sets up JDK as a prerequisite to run Gradle
56+
- name: Setup Java
57+
uses: actions/[email protected]
58+
with:
59+
java-version: '17'
60+
distribution: 'zulu'
6161

62-
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
63-
- name: Checkout repository
64-
uses: actions/[email protected]
62+
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
63+
- name: Checkout repository
64+
uses: actions/[email protected]
6565

66-
# Sets up Gradle as a prerequisite to run Maven Release
67-
- name: Setup Gradle
68-
uses: gradle/actions/[email protected]
69-
with:
70-
gradle-home-cache-cleanup: true
66+
# Sets up Gradle as a prerequisite to run Maven Release
67+
- name: Setup Gradle
68+
uses: gradle/actions/[email protected]
69+
with:
70+
gradle-home-cache-cleanup: true
7171

72-
# Performs a Local Maven Release
73-
- name: Run Maven Local Release
74-
env:
75-
ORG_GRADLE_PROJECT_signingKey: ${{ secrets.GPG_SIGNING_KEY }}
76-
ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.GPG_SIGNING_PASSWORD }}
77-
run: ./gradlew publishReleasePublicationToMavenLocal
72+
# Performs a Local Maven Release
73+
- name: Run Maven Local Release
74+
env:
75+
ORG_GRADLE_PROJECT_signingKey: ${{ secrets.GPG_SIGNING_KEY }}
76+
ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.GPG_SIGNING_PASSWORD }}
77+
run: ./gradlew publishReleasePublicationToMavenLocal
7878

79-
# Performs a Maven Release to oss.sonatype.org
80-
- name: Run Maven Release to OSSRH
81-
env:
82-
ossrhUsername: ${{ secrets.NXRM_TOKEN_USERNAME }}
83-
ossrhPassword: ${{ secrets.NXRM_TOKEN_PASSWORD }}
84-
ORG_GRADLE_PROJECT_ossrhUsername: ${{ secrets.NXRM_TOKEN_USERNAME }}
85-
ORG_GRADLE_PROJECT_ossrhPassword: ${{ secrets.NXRM_TOKEN_PASSWORD }}
86-
ORG_GRADLE_PROJECT_signingKey: ${{ secrets.GPG_SIGNING_KEY }}
87-
ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.GPG_SIGNING_PASSWORD }}
88-
SONATYPE_REPOSITORY_ID: ${{ needs.create_staging_repository.outputs.repository_id }}
89-
run: ./gradlew clean publishReleasePublicationToOSSRHRepository
79+
# Performs a Maven Release to oss.sonatype.org
80+
- name: Run Maven Release to OSSRH
81+
env:
82+
ossrhUsername: ${{ secrets.NXRM_TOKEN_USERNAME }}
83+
ossrhPassword: ${{ secrets.NXRM_TOKEN_PASSWORD }}
84+
ORG_GRADLE_PROJECT_ossrhUsername: ${{ secrets.NXRM_TOKEN_USERNAME }}
85+
ORG_GRADLE_PROJECT_ossrhPassword: ${{ secrets.NXRM_TOKEN_PASSWORD }}
86+
ORG_GRADLE_PROJECT_signingKey: ${{ secrets.GPG_SIGNING_KEY }}
87+
ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.GPG_SIGNING_PASSWORD }}
88+
SONATYPE_REPOSITORY_ID: ${{ needs.create_staging_repository.outputs.repository_id }}
89+
run: ./gradlew clean publishReleasePublicationToOSSRHRepository
9090

9191
# The finalize job checks for the success for failure of previous jobs and then either discards or releases the published build
9292
finalize:
9393
runs-on: ubuntu-latest
94-
needs: [create_staging_repository,publish,e2e-test]
94+
needs: [ create_staging_repository,publish,e2e-test ]
9595
if: ${{ always() && needs.create_staging_repository.result == 'success' }}
9696
steps:
9797
- name: Discard

‎.github/workflows/release.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ jobs:
7171
with:
7272
config-file: ".github/prerelease-config.json"
7373
manifest-file: ".github/prerelease-manifest.json"
74+
token: ${{ secrets.RELEASE_WORKFLOW_TOKEN }}
7475

7576
# This job runs tests before the creation of the prerelease
7677
prerelease-test:
@@ -107,6 +108,7 @@ jobs:
107108
with:
108109
config-file: ".github/release-config.json"
109110
manifest-file: ".github/release-manifest.json"
111+
token: ${{ secrets.RELEASE_WORKFLOW_TOKEN }}
110112

111113
post-prerelease:
112114
name: Post Prerelease Steps

0 commit comments

Comments
 (0)