more fixes for gitlab ci #20

Workflow file for this run

	name: CI/CD Pipeline

	on:
	push:
	branches: [ main, develop ]
	pull_request:
	branches: [ main ]

	jobs:
	build-frontend:
	name: Frontend build & test
	runs-on: ubuntu-latest

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version: '22.x'
	cache-dependency-path: 'frontend/yarn.lock'

	- name: Cache Yarn
	uses: actions/cache@v4
	with:
	path: ~/.cache/yarn/v6
	key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
	restore-keys: \|
	${{ runner.os }}-yarn-

	- name: Install frontend dependencies
	working-directory: frontend
	run: yarn install --frozen-lockfile

	- name: Run frontend tests
	working-directory: frontend
	run: yarn test

	- name: Build frontend
	working-directory: frontend
	run: yarn build

	- name: Upload frontend dist
	uses: actions/upload-artifact@v4
	with:
	name: frontend-dist
	path: frontend/dist
	retention-days: 3

	build-backend:
	name: Backend build & CI tests
	runs-on: ubuntu-latest
	needs: build-frontend

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Download frontend dist
	uses: actions/download-artifact@v4
	with:
	name: frontend-dist
	path: frontend-dist

	- name: Copy frontend assets into backend
	run: \|
	rm -rf backend/src/main/resources/static \|\| true
	mkdir -p backend/src/main/resources/static
	cp -r frontend-dist/* backend/src/main/resources/static/

	- name: Setup Java 21 (Temurin)
	uses: actions/setup-java@v4
	with:
	distribution: 'temurin'
	java-version: '21'

	- name: Print Java info (sanity)
	run: \|
	echo "JAVA_HOME=$JAVA_HOME"
	java -version
	javac -version

	- name: Cache Gradle Wrapper
	uses: actions/cache@v4
	with:
	path: ~/.gradle/wrapper
	key: ${{ runner.os }}-gradle-wrapper-${{ hashFiles('**/gradle-wrapper.properties') }}

	- name: Cache Gradle Caches
	uses: actions/cache@v4
	with:
	path: \|
	~/.gradle/caches
	~/.gradle/native
	key: ${{ runner.os }}-gradle-${{ hashFiles('*/.gradle', '*/gradle-wrapper.properties') }}
	restore-keys: \|
	${{ runner.os }}-gradle-

	- name: Make Gradlew executable
	working-directory: backend
	run: chmod +x ./gradlew

	- name: Build backend (shadowJar)
	working-directory: backend
	run: ./gradlew --no-daemon --quiet clean shadowJar

	- name: Run CI tests
	working-directory: backend
	run: ./gradlew --no-daemon --quiet citest \|\| true

	- name: Upload backend JAR
	uses: actions/upload-artifact@v4
	with:
	name: backend-jar
	path: backend/build/libs/*.jar
	retention-days: 3

	security-scan:
	name: Security scanning
	runs-on: ubuntu-latest
	needs: [ build-frontend, build-backend ]
	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Run Security Scan (Frontend)
	uses: aquasecurity/trivy-action@master
	with:
	scan-type: 'fs'
	scan-ref: 'frontend'
	ignore-unfixed: true

	- name: Run Security Scan (Backend)
	uses: aquasecurity/trivy-action@master
	with:
	scan-type: 'fs'
	scan-ref: 'backend'
	ignore-unfixed: true
	vuln-type: 'library'

	publish:
	name: Publish (Docker push + release + attest)
	runs-on: ubuntu-latest
	needs: [ build-backend, security-scan ]
	if: github.ref == 'refs/heads/main' && github.event_name == 'push'
	permissions:
	contents: write
	packages: write
	id-token: write
	attestations: write

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Download backend JAR
	uses: actions/download-artifact@v4
	with:
	name: backend-jar
	path: .

	- name: Normalize JAR name
	run: \|
	JAR=$(ls *.jar \| head -n1)
	echo "Found jar: $JAR"
	mv "$JAR" knca-signer.jar

	- name: Attest build provenance (SHA checks)
	uses: actions/attest-build-provenance@v1
	with:
	subject-path: knca-signer.jar
	github-token: ${{ secrets.GITHUB_TOKEN }}

	- name: Compute checksums
	run: \|
	sha256sum knca-signer.jar > knca-signer.jar.sha256
	sha512sum knca-signer.jar > knca-signer.jar.sha512
	echo "SHA256:" > checksums.txt
	cat knca-signer.jar.sha256 >> checksums.txt
	echo "\nSHA512:" >> checksums.txt
	cat knca-signer.jar.sha512 >> checksums.txt

	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@v3

	- name: Log in to Container Registry
	uses: docker/login-action@v3
	with:
	registry: ghcr.io
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	- name: Extract metadata
	id: meta
	uses: docker/metadata-action@v5
	with:
	images: ghcr.io/${{ github.repository }}
	tags: \|
	type=ref,event=branch
	type=ref,event=pr
	type=sha,prefix={{branch}}-
	type=raw,value=latest,enable={{is_default_branch}}

	- name: Build and push Docker image
	uses: docker/build-push-action@v5
	with:
	context: .
	push: true
	tags: ${{ steps.meta.outputs.tags }}
	labels: ${{ steps.meta.outputs.labels }}
	cache-from: type=gha
	cache-to: type=gha,mode=max

	- name: Generate CHANGELOG.md
	run: \|
	echo "# Changelog" > CHANGELOG.md
	echo "" >> CHANGELOG.md
	LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null \|\| true)
	if [ -n "$LAST_TAG" ]; then
	RANGE="${LAST_TAG}..HEAD"
	else
	RANGE="HEAD"
	fi
	echo "Changelog generated from git commits in range: $RANGE" >> CHANGELOG.md
	echo "" >> CHANGELOG.md
	git --no-pager log --pretty=format:"* %s (%h) — %an" $RANGE >> CHANGELOG.md \|\| true

	- name: Create release notes file
	run: \|
	echo "# Release notes" > release_notes.md
	echo "" >> release_notes.md
	echo "## Changelog" >> release_notes.md
	cat CHANGELOG.md >> release_notes.md \|\| true
	echo "" >> release_notes.md
	echo "## Docker image" >> release_notes.md
	echo "Image: ghcr.io/${{ github.repository }}" >> release_notes.md
	echo "Tags: ${{ steps.meta.outputs.tags }}" >> release_notes.md
	echo "" >> release_notes.md
	echo "## Checksums" >> release_notes.md
	cat checksums.txt >> release_notes.md

	- name: Create GitHub release
	uses: softprops/action-gh-release@v2
	with:
	body_path: "release_notes.md"
	files: \|
	knca-signer.jar
	knca-signer.jar.sha256
	knca-signer.jar.sha512

Navigation Menu

more fixes for gitlab ci #20

Workflow file

more fixes for gitlab ci #20

Uh oh!

Workflow file for this run