Fix(build): Bump maven-build-action to v0.4.0 - #41
Merged
askb merged 1 commit intoAug 27, 2026
Merged
Conversation
Multi-module (multi-subproject) Maven reactors get structurally wrong coverage from the run_jacoco path: each subproject's report runs before downstream subprojects' tests execute, so cross-module attribution is lost and the badge, summary and coverage outputs under-report. maven-build-action v0.4.0 fixes this inside the action: jacoco-mode defaults to auto, pointing every subproject's agent at one execution-data file and rerunning the report goal after the reactor completes, backing off when the project or caller arranges its own coverage or requests a parallel reactor. This lane already passes run-jacoco, so bumping the pin delivers the aggregation with no input changes. The bump also brings workspace variable expansion in mvn-params, restoring Jenkins-era behaviour for callers passing workspace-anchored paths. The security-workflows scan lanes adopted v0.4.0 in their v0.3.1 release; this aligns the standard build lane with them. Fixes lfreleng-actions#28 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
requested review from
a team
and
a balanced review from Copilot
August 27, 2026 11:59
Copilot started reviewing on behalf of
ModeSevenIndustrialSolutions
August 27, 2026 11:59
View session
There was a problem hiding this comment.
Pull request overview
Updates the Maven build workflow to fix multi-module JaCoCo coverage aggregation.
Changes:
- Bumps
maven-build-actionfrom v0.3.1 to signed v0.4.0. - Retains existing workflow inputs and coverage outputs.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
askb
approved these changes
Aug 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Multi-module (multi-subproject) Maven reactors get structurally wrong coverage from the
run_jacocopath: Maven completes each subproject's lifecycle before starting the next, so each subproject's report runs before downstream subprojects' tests execute. Cross-module attribution is lost, and the badge, step summary andcoverage/branch_coverageoutputs under-report. Tracked in #28.Fix
Bump
maven-build-actionv0.3.1 → v0.4.0, which fixes this inside the action:jacoco-modedefaults toauto: every subproject's agent writes one execution-data file and the report goal reruns after the reactor completes, so each subproject's report covers its classes with data from every subproject's testsjacoco.append=false, or requests a parallel reactor (checked acrossmvn-params,mvn-opts,MAVEN_ARGSand.mvn/maven.config)mvn-params(restores Jenkins-era$WORKSPACEbehaviour)This lane already passes
run-jacoco, so the pin bump delivers the aggregation with no input changes. Thesecurity-workflowsscan lanes adopted v0.4.0 in their v0.3.1 release (lfreleng-actions/security-workflows#53); this aligns the standard build lane with them — the last consumer on the broken version.Validation
4fe48909…is the commit SHA the signedv0.4.0tag dereferences tozizmor --persona=auditoron the changed workflow: zero findingsaislop ci --changes: 0 errors / 0 warningsprekhooks (actionlint, yamllint, gitlint, workflow validators): all passFixes #28