Trunk #1857
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Trunk Checks Workflow | |
| # | |
| # This workflow is triggered on pushes to the main branch or manually via workflow_dispatch. | |
| # It orchestrates a comprehensive set of checks, builds, tests, and deployments for the trunk (main) branch. | |
| # | |
| # Key features: | |
| # - Triggered on push to main or manual dispatch | |
| # - Configurable options for reusing previous builds and running all tests | |
| # - Comprehensive checks including build, tests, Semgrep analysis, and CLI artifact building | |
| # - Deployment to the trunk environment | |
| # - Final reporting of the workflow status | |
| name: '-3 Trunk Workflow' | |
| run-name: "Trunk${{ inputs.java-version && format(' [{0}]', inputs.java-version) || '' }}" | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - master | |
| workflow_dispatch: | |
| inputs: | |
| reuse-previous-build: | |
| description: 'Indicates if the workflow should reuse the previous build' | |
| type: boolean | |
| default: true | |
| build-on-missing-artifacts: | |
| type: boolean | |
| description: 'Indicates if the workflow should build on missing artifacts' | |
| default: false | |
| run-all-tests: | |
| description: 'Run all tests' | |
| type: boolean | |
| default: false | |
| publish-npm-sdk-libs: | |
| description: 'Publish NPM SDKs' | |
| type: boolean | |
| default: false | |
| disable-semgrep: | |
| description: 'Disable Semgrep job' | |
| type: boolean | |
| default: false | |
| java-version: | |
| description: 'Override Java version (SDKMAN format, e.g., 25.0.1-open)' | |
| type: string | |
| required: false | |
| default: '' | |
| maven-compiler-release: | |
| description: 'Override Maven compiler release version (e.g., 21). Preferred over source/target.' | |
| type: string | |
| required: false | |
| default: '' | |
| artifact-suffix: | |
| description: 'Override artifact suffix (e.g., -java25, -java25.0.1, -java25-ms). If not set, derived from java-version major.' | |
| type: string | |
| required: false | |
| default: '' | |
| jobs: | |
| # Initialize the trunk check process | |
| initialize: | |
| name: Initialize | |
| uses: ./.github/workflows/cicd_comp_initialize-phase.yml | |
| with: | |
| reuse-previous-build: ${{ inputs.reuse-previous-build || github.event_name != 'workflow_dispatch' }} | |
| build-on-missing-artifacts: ${{ inputs.build-on-missing-artifacts || github.event_name != 'workflow_dispatch' }} | |
| # Enable change detection to determine if SDK libs changed (for publishing decision) | |
| # Note: Trunk doesn't use filter outputs for test selection - it uses run-all-tests input | |
| change-detection: 'enabled' | |
| # Build job - only runs if no artifacts were found during initialization | |
| build: | |
| name: Trunk Build | |
| needs: [ initialize ] | |
| if: needs.initialize.outputs.found_artifacts == 'false' | |
| uses: ./.github/workflows/cicd_comp_build-phase.yml | |
| with: | |
| java-version: ${{ github.event.inputs.java-version || '' }} | |
| maven-compiler-release: ${{ github.event.inputs.maven-compiler-release || '' }} | |
| artifact-suffix: ${{ github.event.inputs.artifact-suffix || '' }} | |
| permissions: | |
| contents: read | |
| packages: write | |
| # Test job - runs various tests | |
| test: | |
| name: Trunk Test | |
| needs: [ initialize,build ] | |
| if: always() && !failure() && !cancelled() | |
| uses: ./.github/workflows/cicd_comp_test-phase.yml | |
| with: | |
| run-all-tests: ${{ inputs.run-all-tests || false }} | |
| artifact-run-id: ${{ needs.initialize.outputs.artifact-run-id }} | |
| e2e: false | |
| java-version: ${{ github.event.inputs.java-version || '' }} | |
| maven-compiler-release: ${{ github.event.inputs.maven-compiler-release || '' }} | |
| artifact-suffix: ${{ github.event.inputs.artifact-suffix || '' }} | |
| secrets: | |
| DOTCMS_LICENSE: ${{ secrets.DOTCMS_LICENSE }} | |
| permissions: | |
| contents: read | |
| packages: write | |
| semgrep: | |
| name: Trunk Semgrep | |
| needs: [ initialize, test ] | |
| if: always() && !failure() && !cancelled() && vars.DISABLE_SEMGREP != 'true' | |
| uses: ./.github/workflows/cicd_comp_semgrep-phase.yml | |
| with: | |
| artifact-run-id: ${{ needs.initialize.outputs.artifact-run-id }} | |
| secrets: | |
| SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} | |
| # CLI Build job - builds CLI artifacts | |
| # Skipped when java-version is overridden due to GraalVM/Quarkus compatibility requirements | |
| build-cli: | |
| name: CLI Build | |
| needs: [ initialize,test ] | |
| if: always() && !failure() && !cancelled() && !inputs.java-version | |
| uses: ./.github/workflows/cicd_comp_cli-native-build-phase.yml | |
| with: | |
| buildNativeImage: true | |
| artifact-run-id: ${{ needs.initialize.outputs.artifact-run-id }} | |
| branch: ${{ github.ref }} | |
| # Deployment job - deploys to the trunk environment | |
| deployment: | |
| needs: [ initialize,build-cli,semgrep,test ] | |
| if: always() && !failure() && !cancelled() | |
| uses: ./.github/workflows/cicd_comp_deployment-phase.yml | |
| with: | |
| artifact-run-id: ${{ needs.initialize.outputs.artifact-run-id }} | |
| deploy-cli: true | |
| publish-npm-sdk-libs: ${{ fromJSON(needs.initialize.outputs.filters).sdk_libs == 'true' && github.event_name != 'workflow_dispatch' }} | |
| environment: trunk | |
| # tag-identifier intentionally omitted: trunk uses only the environment name as its tag | |
| java-version: ${{ github.event.inputs.java-version || '' }} | |
| artifact-suffix: ${{ github.event.inputs.artifact-suffix || '' }} | |
| secrets: | |
| DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }} | |
| DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }} | |
| EE_REPO_USERNAME: ${{ secrets.EE_REPO_USERNAME }} | |
| EE_REPO_PASSWORD: ${{ secrets.EE_REPO_PASSWORD }} | |
| NPM_ORG_TOKEN: ${{ secrets.NPM_ORG_TOKEN }} | |
| SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }} | |
| # Finalize job - aggregates results from previous jobs | |
| finalize: | |
| name: Finalize | |
| if: always() | |
| needs: [ initialize, build, build-cli, test, semgrep, deployment] | |
| uses: ./.github/workflows/cicd_comp_finalize-phase.yml | |
| with: | |
| artifact-run-id: ${{ needs.initialize.outputs.artifact-run-id }} | |
| needsData: ${{ toJson(needs) }} | |
| # Report job - generates and sends the final workflow report | |
| report: | |
| name: Report | |
| if: always() | |
| needs: [ finalize ] | |
| uses: ./.github/workflows/cicd_post-workflow-reporting.yml | |
| secrets: | |
| SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }} |