Skip to content

Commit 0551bf6

Browse files
ThomasVitaleThomasVitale
committed
test: Update demo scaffolder template
1 parent 932b6ba commit 0551bf6

File tree

5 files changed

+133
-9
lines changed

5 files changed

+133
-9
lines changed

‎demo-catalog/templates/spring-boot-ai-rag/base/.github/dependabot.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: gradle
4+
directory: "/"
5+
schedule:
6+
interval: daily
7+
time: "23:00"
8+
timezone: Europe/Copenhagen
9+
open-pull-requests-limit: 10
10+
labels:
11+
- "dependencies"
12+
commit-message:
13+
prefix: "deps:"
14+
- package-ecosystem: "github-actions"
15+
directory: "/"
16+
schedule:
17+
interval: daily
18+
time: "00:30"
19+
timezone: Europe/Copenhagen
20+
open-pull-requests-limit: 10
21+
labels:
22+
- "dependencies"
23+
commit-message:
24+
prefix: "deps:"

‎demo-catalog/templates/spring-boot-ai-rag/base/.github/workflows/commit-stage.yml‎

Lines changed: 96 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,78 @@
11
name: Commit Stage
2+
23
on:
34
push:
45
branches:
56
- main
7+
paths-ignore:
8+
- '.editorconfig'
9+
- '.gitignore'
10+
- '.sdkmanrc'
11+
- '*.adoc'
12+
- '*.png'
13+
- '*.md'
14+
- 'docs/**'
15+
- '.github/ISSUE_TEMPLATE/**'
16+
- '.github/*.md'
17+
- '.github/*.yml'
18+
- '.github/*.yaml'
619

720
env:
821
REGISTRY: ghcr.io
922
IMAGE_NAME: ${{ values.repoUrl.owner | lower }}/${{ values.repoUrl.repo }}
1023
VERSION: ${{ '${{ github.sha }}' }}
1124

25+
permissions:
26+
contents: read
27+
1228
jobs:
1329
build:
1430
name: Build
1531
runs-on: ubuntu-24.04
1632
permissions:
1733
contents: read
1834
packages: write
35+
security-events: write
1936
steps:
2037
- name: Check out source code
21-
uses: actions/checkout@v4
22-
38+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
39+
with:
40+
fetch-depth: 0
41+
2342
- name: Set up Java
24-
uses: actions/setup-java@v4
43+
uses: actions/setup-java@b36c23c0d998641eff861008f374ee103c25ac73 # v4.4.0
2544
with:
2645
java-version: 22
27-
distribution: temurin
28-
cache: gradle
46+
distribution: 'graalvm'
47+
48+
- name: Setup Gradle
49+
uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4.1.0
2950

3051
- name: Compile and test
31-
run: ./gradlew build
52+
run: ./gradlew build sonar
53+
env:
54+
SONAR_TOKEN: ${{ '${{ secrets.SONAR_TOKEN }}' }}
55+
56+
- name: SBOM vulnerability scanning
57+
uses: aquasecurity/trivy-action@97646fedde05bcd0961217c60b50e23f721e7ec7 # master
58+
with:
59+
scan-type: 'sbom'
60+
scan-ref: 'build/reports/application.cdx.json'
61+
format: 'sarif'
62+
output: 'trivy-results-build.sarif'
63+
64+
- name: Upload vulnerability report
65+
uses: github/codeql-action/upload-sarif@461ef6c76dfe95d5c364de2f431ddbd31a417628 # v3.26.9
66+
if: success() || failure()
67+
with:
68+
sarif_file: 'trivy-results-build.sarif'
69+
category: build
3270

3371
- name: Package as OCI image
3472
run: ./gradlew bootBuildImage --imageName ${{ '${{ env.REGISTRY }}' }}/${{ '${{ env.IMAGE_NAME }}' }}:${{ '${{ env.VERSION }}' }}
3573

3674
- name: Authenticate with the container registry
37-
uses: docker/login-action@v3
75+
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
3876
with:
3977
username: ${{ '${{ github.actor }}' }}
4078
password: ${{ '${{ secrets.GITHUB_TOKEN }}' }}
@@ -45,3 +83,54 @@ jobs:
4583
docker tag ${{ '${{ env.REGISTRY }}' }}/${{ '${{ env.IMAGE_NAME }}' }}:${{ '${{ env.VERSION }}' }} ${{ '${{ env.REGISTRY }}' }}/${{ '${{ env.IMAGE_NAME }}' }}:latest
4684
docker push ${{ '${{ env.REGISTRY }}' }}/${{ '${{ env.IMAGE_NAME }}' }}:${{ '${{ env.VERSION }}' }}
4785
docker push ${{ '${{ env.REGISTRY }}' }}/${{ '${{ env.IMAGE_NAME }}' }}:latest
86+
87+
sign:
88+
name: Sign
89+
runs-on: ubuntu-24.04
90+
needs: [ build ]
91+
permissions:
92+
contents: read
93+
packages: write
94+
id-token: write
95+
outputs:
96+
image-digest: ${{ '${{ steps.image-info.outputs.digest }}' }}
97+
image-name: ${{ '${{ steps.image-info.outputs.name }}' }}
98+
steps:
99+
- name: Install Cosign
100+
uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0
101+
102+
- uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1.7
103+
with:
104+
username: ${{ '${{ github.actor }}' }}
105+
password: ${{ '${{ secrets.GITHUB_TOKEN }}' }}
106+
registry: ${{ '${{ env.REGISTRY }}' }}
107+
108+
- name: Fetch OCI image
109+
run: podman pull ${{ '${{ env.REGISTRY }}' }}/${{ '${{ env.IMAGE_NAME }}' }}:${{ '${{ env.VERSION }}' }}
110+
111+
- name: Get OCI image digest
112+
id: image-info
113+
run: |
114+
image_digest=$(podman inspect --format='{{.Digest}}' ${REGISTRY}/${IMAGE_NAME}:${VERSION})
115+
echo $image_digest
116+
echo "IMAGE_DIGEST=${image_digest}" >> $GITHUB_ENV
117+
echo "digest=${image_digest}" >> $GITHUB_OUTPUT
118+
echo "name=${REGISTRY}/${IMAGE_NAME}" >> $GITHUB_OUTPUT
119+
120+
- name: Sign image
121+
run: |
122+
cosign sign --yes "${REGISTRY}/${IMAGE_NAME}@${IMAGE_DIGEST}"
123+
124+
provenance:
125+
needs: [ sign ]
126+
permissions:
127+
actions: read
128+
id-token: write
129+
packages: write
130+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.0.0
131+
with:
132+
image: ${{ '${{ needs.sign.outputs.image-name }}' }}
133+
digest: ${{ '${{ needs.sign.outputs.image-digest }}' }}
134+
registry-username: ${{ '${{ github.actor }}' }}
135+
secrets:
136+
registry-password: ${{ '${{ secrets.GITHUB_TOKEN }}' }}

‎demo-catalog/templates/spring-boot-ai-rag/base/build.gradle‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
plugins {
22
id 'java'
3-
id 'org.springframework.boot' version '3.4.0-M2'
3+
id 'org.springframework.boot' version '3.4.0-M3'
44
id 'io.spring.dependency-management' version '1.1.6'
5+
id 'org.cyclonedx.bom' version '1.10.0'
6+
id 'org.sonarqube' version '4.4.1.3373'
57
}
68

79
group = '${{ values.groupId }}'
@@ -83,3 +85,11 @@ tasks.named('bootBuildImage') {
8385
builder = "paketobuildpacks/builder-jammy-buildpackless-tiny"
8486
buildpacks = [ "gcr.io/paketo-buildpacks/java" ]
8587
}
88+
89+
sonar {
90+
properties {
91+
property "sonar.projectKey", "${{ values.repoUrl.owner }}_${{ values.repoUrl.repo }}"
92+
property "sonar.organization", "${{ values.repoUrl.owner }}"
93+
property "sonar.host.url", "https://sonarcloud.io"
94+
}
95+
}

‎demo-catalog/templates/spring-boot-ai-rag/base/catalog-info.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ metadata:
77
annotations:
88
backstage.io/kubernetes-id: ${{ values.name }}
99
backstage.io/techdocs-ref: dir:.
10+
endoflife.date/products: spring-boot
1011
github.com/project-slug: ${{ values.repoUrl.owner }}/${{ values.repoUrl.repo }}
1112
sonarqube.org/project-key: ${{ values.repoUrl.owner }}_${{ values.repoUrl.repo }}
1213
spec:

‎demo-catalog/templates/spring-boot-ai-rag/base/gradle/wrapper/gradle-wrapper.properties‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
distributionBase=GRADLE_USER_HOME
22
distributionPath=wrapper/dists
3-
distributionUrl=https\://services.gradle.org/distributions/gradle-8.10-bin.zip
3+
distributionUrl=https\://services.gradle.org/distributions/gradle-8.10.2-bin.zip
44
networkTimeout=10000
55
validateDistributionUrl=true
66
zipStoreBase=GRADLE_USER_HOME

0 commit comments

Comments
 (0)