diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8f0f3c7d..3dbfe147 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -32,11 +32,12 @@ jobs: with: fetch-depth: 0 show-progress: false - - uses: gradle/wrapper-validation-action@v1 + - uses: gradle/actions/wrapper-validation@v3 - name: build - uses: gradle/gradle-build-action@v2 + uses: gradle/actions/setup-gradle@v3 with: arguments: ${{ env.GRADLE_SWITCHES }} build + build-root-directory: rewrite-csharp - name: publish-snapshots if: github.event_name != 'pull_request' diff --git a/.github/workflows/comment-pr.yml b/.github/workflows/comment-pr.yml deleted file mode 100644 index 71d28c31..00000000 --- a/.github/workflows/comment-pr.yml +++ /dev/null @@ -1,59 +0,0 @@ -# Description: This workflow is triggered when the `receive-pr` workflow completes to post suggestions on the PR. -# Since this pull request has write permissions on the target repo, we should **NOT** execute any untrusted code. -# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ ---- -name: comment-pr - -on: - workflow_run: - workflows: ["receive-pr"] - types: - - completed - -jobs: - post-suggestions: - # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#running-a-workflow-based-on-the-conclusion-of-another-workflow - if: ${{ github.event.workflow_run.conclusion == 'success' }} - runs-on: ubuntu-latest - permissions: - actions: read - pull-requests: write - env: - # https://docs.github.com/en/actions/reference/authentication-in-a-workflow#permissions-for-the-github_token - ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }} - timeout-minutes: 10 - steps: - - uses: actions/checkout@v4 - with: - ref: ${{github.event.workflow_run.head_branch}} - repository: ${{github.event.workflow_run.head_repository.full_name}} - - # Download the patch - - uses: actions/download-artifact@v4 - with: - name: patch - github-token: ${{ secrets.GITHUB_TOKEN }} - run-id: ${{ github.event.workflow_run.id }} - - name: Apply patch - run: | - git apply git-diff.patch --allow-empty - rm git-diff.patch - - # Download the PR number - - uses: actions/download-artifact@v4 - with: - name: pr_number - github-token: ${{ secrets.GITHUB_TOKEN }} - run-id: ${{ github.event.workflow_run.id }} - - name: Read pr_number.txt - run: | - PR_NUMBER=$(cat pr_number.txt) - echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV - rm pr_number.txt - - # Post suggestions as a comment on the PR - - uses: googleapis/code-suggester@v4 - with: - command: review - pull_number: ${{ env.PR_NUMBER }} - git_dir: '.' diff --git a/.github/workflows/receive-pr.yml b/.github/workflows/receive-pr.yml deleted file mode 100644 index bd494b15..00000000 --- a/.github/workflows/receive-pr.yml +++ /dev/null @@ -1,60 +0,0 @@ -# Description: This workflow runs OpenRewrite recipes against opened pull request and upload the patch. -# Since this pull request receives untrusted code, we should **NOT** have any secrets in the environment. -# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ ---- -name: receive-pr - -on: - pull_request: - types: [opened, synchronize] - branches: - - main - -concurrency: - group: '${{ github.workflow }} @ ${{ github.ref }}' - cancel-in-progress: true - -env: - GRADLE_OPTS: '-Dorg.gradle.jvmargs="-Xmx2048m -XX:+HeapDumpOnOutOfMemoryError"' - GRADLE_SWITCHES: '--console=plain --info --stacktrace' - -jobs: - upload-patch: - runs-on: ubuntu-latest - timeout-minutes: 10 - steps: - - uses: actions/checkout@v4 - with: - ref: ${{github.event.pull_request.head.ref}} - repository: ${{github.event.pull_request.head.repo.full_name}} - - uses: gradle/wrapper-validation-action@v2 - - uses: actions/setup-java@v4 - with: - java-version: '21' - distribution: 'temurin' - - # Capture the PR number - # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#using-data-from-the-triggering-workflow - - name: Create pr_number.txt - run: echo "${{ github.event.number }}" > pr_number.txt - - uses: actions/upload-artifact@v4 - with: - name: pr_number - path: pr_number.txt - - name: Remove pr_number.txt - run: rm -f pr_number.txt - - # Execute recipes - - name: Apply OpenRewrite best practices - uses: gradle/actions/setup-gradle@v3 - with: - arguments: ${{ env.GRADLE_SWITCHES }} licenseFormat rewriteRun -Drewrite.activeRecipe=org.openrewrite.recipes.OpenRewriteBestPractices - - # Capture the diff - - name: Create patch - run: | - git diff | tee git-diff.patch - - uses: actions/upload-artifact@v4 - with: - name: patch - path: git-diff.patch