Skip to content

Commit 0808168

Browse files
kopporkoppor
authored
Check for secrets being present at GitHub workflows (#5973)
1 parent f480af2 commit 0808168

File tree

8 files changed

+100
-44
lines changed

8 files changed

+100
-44
lines changed

‎.github/workflows/check-outdated-dependencies.yml‎

Lines changed: 16 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Check dependencies
22

3-
on:
3+
on:
44
schedule:
55
- cron: '0 0 * * TUE' # Run every Tuesday (after dependabot, which runs Monday)
66

@@ -9,21 +9,18 @@ jobs:
99
name: Check dependencies
1010
runs-on: ubuntu-latest
1111
steps:
12-
- name: Checkout source
13-
uses: actions/checkout@v1
14-
with:
15-
depth: 1
16-
submodules: false
17-
- name: Set up JDK
18-
uses: actions/setup-java@v1
19-
with:
20-
java-version: 14
21-
- name: Look for outdated dependencies
22-
run: ./gradlew -q checkOutdatedDependencies
23-
- name: Report issues
24-
if: failure()
25-
uses: JasonEtco/create-an-issue@master
26-
env:
27-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
28-
with:
29-
filename: .github/outdatedDependencies.md
12+
- name: Checkout source
13+
uses: actions/checkout@v2
14+
- name: Set up JDK
15+
uses: actions/setup-java@v1
16+
with:
17+
java-version: 14
18+
- name: Look for outdated dependencies
19+
run: ./gradlew -q checkOutdatedDependencies
20+
- name: Report issues
21+
if: failure()
22+
uses: JasonEtco/create-an-issue@master
23+
env:
24+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
25+
with:
26+
filename: .github/outdatedDependencies.md

‎.github/workflows/cleanup_pr.yml‎

Lines changed: 25 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -9,15 +9,28 @@ jobs:
99
runs-on: ubuntu-latest
1010

1111
steps:
12-
- name: Extract branch name
13-
id: extract_branch
14-
run: |
15-
echo "##[set-output name=branch;]$(echo ${{ github.event.pull_request.head.ref }})"
16-
- name: Delete folder on builds.jabref.org
17-
uses: appleboy/[email protected]
18-
with:
19-
script: rm -rf /var/www/builds.jabref.org/www/${{ steps.extract_branch.outputs.branch }}
20-
host: build-upload.jabref.org
21-
port: 9922
22-
username: jrrsync
23-
key: ${{ secrets.buildJabRefPrivateKey }}
12+
- name: Check secrets presence
13+
id: checksecrets
14+
shell: bash
15+
run: |
16+
if [ "$BUILDJABREFPRIVATEKEY" == "" ]; then
17+
echo ::set-output name=secretspresent::false
18+
else
19+
echo ::set-output name=secretspresent::true
20+
fi
21+
env:
22+
BUILDJABREFPRIVATEKEY: ${{ secrets.buildJabRefPrivateKey }}
23+
- name: Extract branch name
24+
id: extract_branch
25+
if: ${{ steps.checksecrets.outputs.secretspresent }}
26+
run: |
27+
echo "##[set-output name=branch;]$(echo ${{ github.event.pull_request.head.ref }})"
28+
- name: Delete folder on builds.jabref.org
29+
if: ${{ steps.checksecrets.outputs.secretspresent }}
30+
uses: appleboy/[email protected]
31+
with:
32+
script: rm -rf /var/www/builds.jabref.org/www/${{ steps.extract_branch.outputs.branch }}
33+
host: build-upload.jabref.org
34+
port: 9922
35+
username: jrrsync
36+
key: ${{ secrets.buildJabRefPrivateKey }}

‎.github/workflows/deployment.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,17 @@ jobs:
9393
runs-on: ubuntu-latest
9494
needs: [build]
9595
steps:
96+
- name: Check secrets presence
97+
id: checksecrets
98+
shell: bash
99+
run: |
100+
if [ "$BUILDJABREFPRIVATEKEY" == "" ]; then
101+
echo ::set-output name=secretspresent::false
102+
else
103+
echo ::set-output name=secretspresent::true
104+
fi
105+
env:
106+
BUILDJABREFPRIVATEKEY: ${{ secrets.buildJabRefPrivateKey }}
96107
- name: Checkout source
97108
uses: actions/checkout@v2
98109
- name: Fetch all history for all tags and branches
@@ -121,6 +132,7 @@ jobs:
121132
path: build/distribution/
122133
- name: Deploy to builds.jabref.org
123134
id: deploy
135+
if: ${{ steps.checksecrets.outputs.secretspresent }}
124136
uses: Pendect/[email protected]
125137
env:
126138
DEPLOY_KEY: ${{ secrets.buildJabRefPrivateKey }}

‎.github/workflows/snap.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,17 @@ jobs:
1111
name: Create snapcraft image
1212

1313
steps:
14+
- name: Check secrets presence
15+
id: checksecrets
16+
shell: bash
17+
run: |
18+
if [ "SNAPCRAFT_LOGIN_FILE" == "" ]; then
19+
echo ::set-output name=secretspresent::false
20+
else
21+
echo ::set-output name=secretspresent::true
22+
fi
23+
env:
24+
SNAPCRAFT_LOGIN_FILE: ${{ secrets.SNAPCRAFT_LOGIN_FILE }}
1425
- name: Checkout source
1526
uses: actions/checkout@v2
1627
# The image relies on https://builds.jabref.org/master/JabRef-5.0-portable_linux.tar.gz^
@@ -19,6 +30,7 @@ jobs:
1930
uses: jhenstridge/snapcraft-build-action@v1
2031
id: snapcraft
2132
- name: Build snap (2) Upload snap
33+
if: ${{ steps.checksecrets.outputs.secretspresent }}
2234
uses: jhenstridge/snapcraft-publish-action@v1
2335
with:
2436
store_login: ${{ secrets.SNAPCRAFT_LOGIN_FILE }}

‎.github/workflows/tests-fetchers.yml‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,10 +30,7 @@ jobs:
3030
runs-on: ubuntu-latest
3131
steps:
3232
- name: Checkout source
33-
uses: actions/checkout@v1
34-
with:
35-
depth: 1
36-
submodules: false
33+
uses: actions/checkout@v2
3734
- name: Set up JDK
3835
uses: actions/setup-java@v1
3936
with:

‎.github/workflows/tests-oracle.yml‎

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -26,30 +26,42 @@ jobs:
2626
name: Oracle tests
2727
runs-on: ubuntu-latest
2828
steps:
29+
- name: Check secrets presence
30+
id: checksecrets
31+
shell: bash
32+
run: |
33+
if [ "CCRYPT" == "" ]; then
34+
echo ::set-output name=secretspresent::false
35+
else
36+
echo ::set-output name=secretspresent::true
37+
fi
38+
env:
39+
SNAPCRAFT_LOGIN_FILE: ${{ secrets.CCRYPT }}
2940
- name: Checkout source
30-
uses: actions/checkout@v1
31-
with:
32-
depth: 1
33-
submodules: false
41+
uses: actions/checkout@v2
3442
- name: Set up JDK
43+
if: ${{ steps.checksecrets.outputs.secretspresent }}
3544
uses: actions/setup-java@v1
3645
with:
3746
java-version: 14
38-
- uses: actions/cache@v1
39-
name: Restore gradle chache
47+
- name: Restore gradle chache
48+
if: ${{ steps.checksecrets.outputs.secretspresent }}
49+
uses: actions/cache@v1
4050
with:
4151
path: ~/.gradle/caches
4252
key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}
4353
restore-keys: |
4454
${{ runner.OS }}-gradle-${{ env.cache-name }}-
4555
${{ runner.OS }}-gradle-
4656
${{ runner.OS }}-
47-
- uses: actions/cache@v1
48-
name: Restore gradle wrapper
57+
- name: Restore gradle wrapper
58+
if: ${{ steps.checksecrets.outputs.secretspresent }}
59+
uses: actions/cache@v1
4960
with:
5061
path: ~/.gradle/wrapper
5162
key: ${{ runner.os }}-gradle-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }}
5263
- name: Start Oracle XE
64+
if: ${{ steps.checksecrets.outputs.secretspresent }}
5365
run: |
5466
mkdir ~/oracle-xe || true
5567
cd ~/oracle-xe
@@ -71,6 +83,7 @@ jobs:
7183
env:
7284
CCRYPT: ${{ secrets.CCRYPT }}
7385
- name: Run database test
86+
if: ${{ steps.checksecrets.outputs.secretspresent }}
7487
run: ./gradlew databaseTest --rerun-tasks
7588
env:
7689
DBMS: "oracle"

‎.github/workflows/tests.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,17 @@ jobs:
170170
# needed because the postgres container does not provide a healthcheck
171171
options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
172172
steps:
173+
- name: Check secrets presence
174+
id: checksecrets
175+
shell: bash
176+
run: |
177+
if [ "CODECOV_TOKEN" == "" ]; then
178+
echo ::set-output name=secretspresent::false
179+
else
180+
echo ::set-output name=secretspresent::true
181+
fi
182+
env:
183+
SNAPCRAFT_LOGIN_FILE: ${{ secrets.CODECOV_TOKEN }}
173184
- name: Checkout source
174185
uses: actions/checkout@v2
175186
- name: Set up JDK
@@ -191,6 +202,7 @@ jobs:
191202
path: ~/.gradle/wrapper
192203
key: ${{ runner.os }}-gradle-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }}
193204
- name: Update test coverage metrics
205+
if: ${{ steps.checksecrets.outputs.secretspresent }}
194206
run: xvfb-run --auto-servernum ./gradlew jacocoTestReport && bash <(curl -s https://codecov.io/bash);
195207
env:
196208
CI: "false" # we pretend to run locally - even if tests fail on the CI, they count towards test coverage

‎codecov.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,5 @@ coverage:
55
patch: false
66
project:
77
default:
8-
threshold: 0.005
8+
threshold: 0.01
99
comment: false

0 commit comments

Comments
 (0)