spring-projects/spring-boot

10 workflows · maturity 50% · 7 patterns · GitHub ↗

Security 25/100

Practices

✓ Matrix✓ Permissions○ Security scan○ AI review○ Cache✓ Concurrency✓ Reusable workflows

Detected patterns

cross-version-compat ecosystem-ci least-privilege-permissions multi-stage-release per-sample-ci reusable-workflows security-scanning

Security dimensions

permissions

security scan

supply chain

secret handling

harden runner

Workflows (10)

build-and-deploy-snapshot perms .github/workflows/build-and-deploy-snapshot.yml

Triggers

workflow_dispatch, push

Runs on

${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}, ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}

Jobs

build-and-deploy-snapshot, trigger-docs-build, verify

Actions

spring-io/artifactory-deploy-action

Commands

gh workflow run deploy-docs.yml --repo ${{ github.repository }} -r docs-build -f build-sha=${{ github.sha }} -f build-refname=${{ github.ref_name }} -f build-version=${{ needs.build-and-deploy-snapshot.outputs.version }}

View raw YAML

name: Build and Deploy Snapshot
on:
  workflow_dispatch:
  push:
    branches:
      - 'main'
permissions:
  contents: read
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
jobs:
  build-and-deploy-snapshot:
    name: Build and Deploy Snapshot
    if: ${{ github.repository == 'spring-projects/spring-boot' || github.repository == 'spring-projects/spring-boot-commercial' }}
    runs-on: ${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}
    steps:
      - name: Check Out Code
        uses: actions/checkout@v6
      - name: Build and Publish
        id: build-and-publish
        uses: ./.github/actions/build
        with:
          commercial-release-repository-url: ${{ vars.COMMERCIAL_RELEASE_REPO_URL }}
          commercial-repository-password: ${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}
          commercial-repository-username: ${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}
          commercial-snapshot-repository-url: ${{ vars.COMMERCIAL_SNAPSHOT_REPO_URL }}
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
          gradle-cache-read-only: false
          publish: true
      - name: Deploy
        uses: spring-io/artifactory-deploy-action@926d7f7cc810569395346bf3a4d91b380b3e355b # v0.0.4
        with:
          build-name: ${{ vars.COMMERCIAL && format('spring-boot-commercial-{0}', '4.1.x') || format('spring-boot-{0}', '4.1.x') }}
          folder: 'deployment-repository'
          password: ${{ vars.COMMERCIAL && secrets.COMMERCIAL_ARTIFACTORY_PASSWORD || secrets.ARTIFACTORY_PASSWORD }}
          project: ${{ vars.COMMERCIAL && 'spring' }}
          repository: ${{ vars.COMMERCIAL && 'spring-enterprise-maven-dev-local' || 'libs-snapshot-local' }}
          signing-key: ${{ secrets.GPG_PRIVATE_KEY }}
          signing-passphrase: ${{ secrets.GPG_PASSPHRASE }}
          threads: 8
          uri: ${{ vars.COMMERCIAL_DEPLOY_REPO_URL || 'https://repo.spring.io' }}
          username: ${{ vars.COMMERCIAL && secrets.COMMERCIAL_ARTIFACTORY_USERNAME || secrets.ARTIFACTORY_USERNAME }}
      - name: Send Notification
        if: always()
        uses: ./.github/actions/send-notification
        with:
          build-scan-url: ${{ steps.build-and-publish.outputs.build-scan-url }}
          run-name: ${{ format('{0} | Linux | Java 25', github.ref_name) }}
          status: ${{ job.status }}
          webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
    outputs:
      version: ${{ steps.build-and-publish.outputs.version }}
  trigger-docs-build:
    name: Trigger Docs Build
    needs: build-and-deploy-snapshot
    permissions:
      actions: write
    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
    steps:
      - name: Run Deploy Docs Workflow
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh workflow run deploy-docs.yml --repo ${{ github.repository }} -r docs-build -f build-sha=${{ github.sha }} -f build-refname=${{ github.ref_name }} -f build-version=${{ needs.build-and-deploy-snapshot.outputs.version }}
  verify:
    name: Verify
    needs: build-and-deploy-snapshot
    uses: ./.github/workflows/verify.yml
    secrets:
      commercial-repository-password: ${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}
      commercial-repository-username: ${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}
      google-chat-webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
      opensource-repository-password: ${{ secrets.ARTIFACTORY_PASSWORD }}
      opensource-repository-username: ${{ secrets.ARTIFACTORY_USERNAME }}
      token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
    with:
      version: ${{ needs.build-and-deploy-snapshot.outputs.version }}

build-pull-request perms .github/workflows/build-pull-request.yml

Triggers: pull_request
Runs on: ${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}
Jobs: build

View raw YAML

name: Build Pull Request
on: pull_request
permissions:
  contents: read
jobs:
  build:
    name: Build Pull Request
    if: ${{ github.repository == 'spring-projects/spring-boot' }}
    runs-on: ${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}
    steps:
      - name: Check Out Code
        uses: actions/checkout@v6
      - name: Build
        id: build
        uses: ./.github/actions/build
      - name: Print JVM Thread Dumps When Cancelled
        if: cancelled()
        uses: ./.github/actions/print-jvm-thread-dumps
      - name: Upload Build Reports
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: build-reports
          path: '**/build/reports/'

ci matrix perms .github/workflows/ci.yml

Triggers

push

Runs on

${{ matrix.os.id }}

Jobs

Matrix

exclude, exclude.java, exclude.os, java, java.toolchain, java.version, os, os.id, os.name→ ${{ github.repository == 'spring-projects/spring-boot-commercial' && 'Windows' }}, ${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}, 17, 21, 25, 26, False, Linux, True, Windows, windows-latest

Commands

git config --global core.autocrlf true git config --global core.longPaths true Stop-Service -name Docker

View raw YAML

name: CI
on:
  push:
    branches:
      - 'main'
permissions:
  contents: read
jobs:
  ci:
    name: '${{ matrix.os.name}} | Java ${{ matrix.java.version}}'
    if: ${{ github.repository == 'spring-projects/spring-boot' || github.repository == 'spring-projects/spring-boot-commercial' }}
    runs-on: ${{ matrix.os.id }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - id: ${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}
            name: Linux
          - id: windows-latest
            name: Windows
        java:
          - version: 17
            toolchain: true
          - version: 21
            toolchain: true
          - version: 25
            toolchain: false
          - version: 26
            toolchain: true
        exclude:
          - os:
              name: Linux
            java:
              version: 25
          - os:
              name: ${{ github.repository == 'spring-projects/spring-boot-commercial' && 'Windows' }}
    steps:
      - name: Prepare Windows runner
        if: ${{ runner.os == 'Windows' }}
        run: |
          git config --global core.autocrlf true
          git config --global core.longPaths true
          Stop-Service -name Docker
      - name: Check Out Code
        uses: actions/checkout@v6
      - name: Build
        id: build
        uses: ./.github/actions/build
        with:
          commercial-release-repository-url: ${{ vars.COMMERCIAL_RELEASE_REPO_URL }}
          commercial-repository-password: ${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}
          commercial-repository-username: ${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}
          commercial-snapshot-repository-url: ${{ vars.COMMERCIAL_SNAPSHOT_REPO_URL }}
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
          gradle-cache-read-only: false
          java-early-access: ${{ matrix.java.early-access || 'false' }}
          java-distribution: ${{ matrix.java.distribution }}
          java-toolchain: ${{ matrix.java.toolchain }}
          java-version: ${{ matrix.java.version }}
      - name: Send Notification
        if: always()
        uses: ./.github/actions/send-notification
        with:
          build-scan-url: ${{ steps.build.outputs.build-scan-url }}
          run-name: ${{ format('{0} | {1} | Java {2}', github.ref_name, matrix.os.name, matrix.java.version) }}
          status: ${{ job.status }}
          webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}

distribute perms .github/workflows/distribute.yml

Triggers

workflow_dispatch

Runs on

${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}

Jobs

distribute-spring-enterprise-release-bundle

Commands

curl -s -u "${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}:${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}" \ -X POST -H "X-JFrog-Signing-Key-Name: packagesKey" -H "Content-Type: application/json" \ "https://usw1.packages.broadcom.com/lifecycle/api/v2/release_bundle?project=spring" \ -d '{"release_bundle_name": "TNZ-spring-boot-commercial", "release_bundle_version": "${{ inputs.version }}", "skip_docker_manifest_resolution": true, "source_type": "builds", "source": {"builds": [ {"build_repository": "spring-build-info", "build_name": "spring-boot-commercial-${{ inputs.version }}", "build_number": "${{ inputs.build-number }}", "include_dependencies": false}]}}' | \ jq -e 'if has("repository_key") then . else halt_error end'
sleep 30
curl -s -u "${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}:${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}" \ -X POST -H "Content-Type: application/json" \ "https://usw1.packages.broadcom.com/lifecycle/api/v2/distribution/distribute/TNZ-spring-boot-commercial/${{ inputs.version }}?project=spring" \ -d '{"auto_create_missing_repositories": "false", "distribution_rules": [{"site_name": "JP-SaaS"}], "modifications": {"mappings": [{"input": "spring-enterprise-maven-prod-local/(.*)", "output": "spring-enterprise/$1"}]}}' | \ jq -e 'if has("id") then . else halt_error end'

View raw YAML

name: Distribute
on:
  workflow_dispatch:
    inputs:
      build-number:
        description: 'Number of the build to use to create the bundle'
        required: true
        type: string
      create-bundle:
        description: 'Whether to create the bundle. If unchecked, only the bundle distribution is executed'
        required: true
        type: boolean
        default: true
      version:
        description: 'Version to bundle and distribute'
        required: true
        type: string
permissions:
  contents: read
jobs:
  distribute-spring-enterprise-release-bundle:
    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
    steps:
      - name: Create Bundle
        if: ${{ vars.COMMERCIAL && inputs.create-bundle }}
        shell: bash
        run: |
          curl -s -u "${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}:${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}" \
            -X POST -H "X-JFrog-Signing-Key-Name: packagesKey" -H "Content-Type: application/json" \
            "https://usw1.packages.broadcom.com/lifecycle/api/v2/release_bundle?project=spring" \
            -d '{"release_bundle_name": "TNZ-spring-boot-commercial", "release_bundle_version": "${{ inputs.version }}", "skip_docker_manifest_resolution": true, "source_type": "builds", "source": {"builds": [ {"build_repository": "spring-build-info", "build_name": "spring-boot-commercial-${{ inputs.version }}", "build_number": "${{ inputs.build-number }}", "include_dependencies": false}]}}' | \
            jq -e 'if has("repository_key") then . else halt_error end'
      - name: Sleep
        if: ${{ vars.COMMERCIAL && inputs.create-bundle }}
        shell: bash
        run: sleep 30
      - name: Distribute Bundle
        if: ${{ vars.COMMERCIAL }}
        shell: bash
        run: |
          curl -s -u "${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}:${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}" \
            -X POST -H "Content-Type: application/json" \
            "https://usw1.packages.broadcom.com/lifecycle/api/v2/distribution/distribute/TNZ-spring-boot-commercial/${{ inputs.version }}?project=spring" \
            -d '{"auto_create_missing_repositories": "false", "distribution_rules": [{"site_name": "JP-SaaS"}], "modifications": {"mappings": [{"input": "spring-enterprise-maven-prod-local/(.*)", "output": "spring-enterprise/$1"}]}}' | \
            jq -e 'if has("id") then . else halt_error end'

release perms .github/workflows/release.yml

Triggers

push

Runs on

${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}, ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}, ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}, ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}, ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}, ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}, ubuntu-latest, ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}

Jobs

build-and-stage-release, verify, sync-to-maven-central, promote-release, publish-gradle-plugin, publish-to-sdkman, update-homebrew-tap, trigger-docs-build, create-github-release

Actions

spring-io/artifactory-deploy-action, jfrog/setup-jfrog-cli

Commands

jfrog rt build-promote ${{ format('spring-boot-{0}', needs.build-and-stage-release.outputs.version)}} ${{ github.run_number }} libs-release-local
jfrog rt build-promote ${{ format('spring-boot-commercial-{0}', needs.build-and-stage-release.outputs.version)}} ${{ github.run_number }} spring-enterprise-maven-prod-local --project spring
gh workflow run deploy-docs.yml --repo ${{ github.repository }} -r docs-build -f build-refname=${{ github.ref_name }} -f build-version=${{ needs.build-and-stage-release.outputs.version }}

View raw YAML

name: Release
on:
  push:
    tags:
      - v4.1.[0-9]+
permissions:
  contents: read
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
jobs:
  build-and-stage-release:
    name: Build and Stage Release
    if: ${{ github.repository == 'spring-projects/spring-boot' || github.repository == 'spring-projects/spring-boot-commercial' }}
    runs-on: ${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}
    steps:
      - name: Check Out Code
        uses: actions/checkout@v6
      - name: Build and Publish
        id: build-and-publish
        uses: ./.github/actions/build
        with:
          commercial-release-repository-url: ${{ vars.COMMERCIAL_RELEASE_REPO_URL }}
          commercial-repository-password: ${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}
          commercial-repository-username: ${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}
          commercial-snapshot-repository-url: ${{ vars.COMMERCIAL_SNAPSHOT_REPO_URL }}
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
          gradle-cache-read-only: false
          publish: true
      - name: Stage Release
        uses: spring-io/artifactory-deploy-action@926d7f7cc810569395346bf3a4d91b380b3e355b # v0.0.4
        with:
          build-name: ${{ vars.COMMERCIAL && format('spring-boot-commercial-{0}', steps.build-and-publish.outputs.version) || format('spring-boot-{0}', steps.build-and-publish.outputs.version) }}
          folder: 'deployment-repository'
          password: ${{ vars.COMMERCIAL && secrets.COMMERCIAL_ARTIFACTORY_PASSWORD || secrets.ARTIFACTORY_PASSWORD }}
          project: ${{ vars.COMMERCIAL && 'spring' }}
          repository: ${{ vars.COMMERCIAL && 'spring-enterprise-maven-stage-local' || 'libs-staging-local' }}
          signing-key: ${{ secrets.GPG_PRIVATE_KEY }}
          signing-passphrase: ${{ secrets.GPG_PASSPHRASE }}
          threads: 8
          uri: ${{ vars.COMMERCIAL_DEPLOY_REPO_URL || 'https://repo.spring.io' }}
          username: ${{ vars.COMMERCIAL && secrets.COMMERCIAL_ARTIFACTORY_USERNAME || secrets.ARTIFACTORY_USERNAME }}
      - name: Send Notification
        if: failure()
        uses: ./.github/actions/send-notification
        with:
          run-name: ${{ format('{0} | Release Staging | {1}', github.ref_name, inputs.version) }}
          status: ${{ job.status }}
          webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
    outputs:
      version: ${{ steps.build-and-publish.outputs.version }}
  verify:
    name: Verify
    needs: build-and-stage-release
    uses: ./.github/workflows/verify.yml
    secrets:
      commercial-repository-password: ${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}
      commercial-repository-username: ${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}
      google-chat-webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
      opensource-repository-password: ${{ secrets.ARTIFACTORY_PASSWORD }}
      opensource-repository-username: ${{ secrets.ARTIFACTORY_USERNAME }}
      token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
    with:
      staging: true
      version: ${{ needs.build-and-stage-release.outputs.version }}
  sync-to-maven-central:
    name: Sync to Maven Central
    if: ${{ !vars.COMMERCIAL }}
    needs:
      - build-and-stage-release
      - verify
    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
    steps:
      - name: Check Out Code
        uses: actions/checkout@v6
      - name: Sync to Maven Central
        uses: ./.github/actions/sync-to-maven-central
        with:
          central-token-password: ${{ secrets.CENTRAL_TOKEN_PASSWORD }}
          central-token-username: ${{ secrets.CENTRAL_TOKEN_USERNAME }}
          jfrog-cli-config-token: ${{ secrets.JF_ARTIFACTORY_SPRING }}
          spring-boot-version: ${{ needs.build-and-stage-release.outputs.version }}
  promote-release:
    name: Promote Release
    needs:
      - build-and-stage-release
      - sync-to-maven-central
    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
    steps:
      - name: Set up JFrog CLI
        uses: jfrog/setup-jfrog-cli@86dacb6974c66cc99e7651e1205f6581aaddba9a # v4.10.0
        env:
          JF_ENV_SPRING: ${{ vars.COMMERCIAL && secrets.COMMERCIAL_JF_ARTIFACTORY_SPRING || secrets.JF_ARTIFACTORY_SPRING }}
      - name: Promote open source build
        if: ${{ !vars.COMMERCIAL }}
        run: jfrog rt build-promote ${{ format('spring-boot-{0}', needs.build-and-stage-release.outputs.version)}} ${{ github.run_number }} libs-release-local
      - name: Promote commercial build
        if: ${{ vars.COMMERCIAL }}
        run: jfrog rt build-promote ${{ format('spring-boot-commercial-{0}', needs.build-and-stage-release.outputs.version)}} ${{ github.run_number }} spring-enterprise-maven-prod-local --project spring
  publish-gradle-plugin:
    name: Publish Gradle Plugin
    if: ${{ !vars.COMMERCIAL }}
    needs:
      - build-and-stage-release
      - sync-to-maven-central
    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
    steps:
      - name: Check Out Code
        uses: actions/checkout@v6
      - name: Publish
        uses: ./.github/actions/publish-gradle-plugin
        with:
          gradle-plugin-publish-key: ${{ secrets.GRADLE_PLUGIN_PUBLISH_KEY }}
          gradle-plugin-publish-secret: ${{ secrets.GRADLE_PLUGIN_PUBLISH_SECRET }}
          jfrog-cli-config-token: ${{ secrets.JF_ARTIFACTORY_SPRING }}
          plugin-version: ${{ needs.build-and-stage-release.outputs.version }}
  publish-to-sdkman:
    name: Publish to SDKMAN!
    if: ${{ !vars.COMMERCIAL }}
    needs:
      - build-and-stage-release
      - sync-to-maven-central
    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
    steps:
      - name: Check Out Code
        uses: actions/checkout@v6
      - name: Publish to SDKMAN!
        uses: ./.github/actions/publish-to-sdkman
        with:
          make-default: true
          sdkman-consumer-key: ${{ secrets.SDKMAN_CONSUMER_KEY }}
          sdkman-consumer-token: ${{ secrets.SDKMAN_CONSUMER_TOKEN }}
          spring-boot-version: ${{ needs.build-and-stage-release.outputs.version }}
  update-homebrew-tap:
    name: Update Homebrew Tap
    needs:
      - build-and-stage-release
      - sync-to-maven-central
    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
    steps:
      - name: Check Out Code
        uses: actions/checkout@v6
      - name: Update Homebrew Tap
        uses: ./.github/actions/update-homebrew-tap
        with:
          spring-boot-version: ${{ needs.build-and-stage-release.outputs.version }}
          token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
  trigger-docs-build:
    name: Trigger Docs Build
    needs:
      - build-and-stage-release
      - promote-release
    permissions:
      actions: write
    runs-on: ubuntu-latest
    steps:
      - name: Run Deploy Docs Workflow
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh workflow run deploy-docs.yml --repo ${{ github.repository }} -r docs-build -f build-refname=${{ github.ref_name }} -f build-version=${{ needs.build-and-stage-release.outputs.version }}
  create-github-release:
    name: Create GitHub Release
    needs:
      - build-and-stage-release
      - promote-release
      - publish-gradle-plugin
      - publish-to-sdkman
      - trigger-docs-build
      - update-homebrew-tap
    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
    steps:
      - name: Check Out Code
        uses: actions/checkout@v6
      - name: Create GitHub Release
        uses: ./.github/actions/create-github-release
        with:
          commercial: ${{ vars.COMMERCIAL }}
          milestone: ${{ needs.build-and-stage-release.outputs.version }}
          token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}

release-milestone perms .github/workflows/release-milestone.yml

Triggers

push

Runs on

${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}, ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}, ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}, ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}, ubuntu-latest, ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}

Jobs

build-and-stage-release, verify, sync-to-maven-central, promote-release, publish-gradle-plugin, trigger-docs-build, create-github-release

Actions

spring-io/artifactory-deploy-action, jfrog/setup-jfrog-cli

Commands

jfrog rt build-promote ${{ format('spring-boot-{0}', needs.build-and-stage-release.outputs.version)}} ${{ github.run_number }} libs-milestone-local
gh workflow run deploy-docs.yml --repo ${{ github.repository }} -r docs-build -f build-refname=${{ github.ref_name }} -f build-version=${{ needs.build-and-stage-release.outputs.version }}

View raw YAML

name: Release Milestone
on:
  push:
    tags:
      - v4.1.0-M[0-9]
      - v4.1.0-RC[0-9]
permissions:
  contents: read
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
jobs:
  build-and-stage-release:
    name: Build and Stage Release
    if: ${{ github.repository == 'spring-projects/spring-boot' }}
    runs-on: ${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}
    steps:
      - name: Check Out Code
        uses: actions/checkout@v6
      - name: Build and Publish
        id: build-and-publish
        uses: ./.github/actions/build
        with:
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
          gradle-cache-read-only: false
          publish: true
      - name: Stage Release
        uses: spring-io/artifactory-deploy-action@926d7f7cc810569395346bf3a4d91b380b3e355b # v0.0.4
        with:
          build-name: ${{ format('spring-boot-{0}', steps.build-and-publish.outputs.version)}}
          folder: 'deployment-repository'
          password: ${{ secrets.ARTIFACTORY_PASSWORD }}
          repository: 'libs-staging-local'
          signing-key: ${{ secrets.GPG_PRIVATE_KEY }}
          signing-passphrase: ${{ secrets.GPG_PASSPHRASE }}
          threads: 8
          uri: 'https://repo.spring.io'
          username: ${{ secrets.ARTIFACTORY_USERNAME }}
    outputs:
      version: ${{ steps.build-and-publish.outputs.version }}
  verify:
    name: Verify
    needs: build-and-stage-release
    uses: ./.github/workflows/verify.yml
    secrets:
      commercial-repository-password: ${{ secrets.COMMERCIAL_ARTIFACTORY_RO_PASSWORD }}
      commercial-repository-username: ${{ secrets.COMMERCIAL_ARTIFACTORY_RO_USERNAME }}
      google-chat-webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
      opensource-repository-password: ${{ secrets.ARTIFACTORY_PASSWORD }}
      opensource-repository-username: ${{ secrets.ARTIFACTORY_USERNAME }}
      token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
    with:
      staging: true
      version: ${{ needs.build-and-stage-release.outputs.version }}
  sync-to-maven-central:
    name: Sync to Maven Central
    if: ${{ !vars.COMMERCIAL }}
    needs:
      - build-and-stage-release
      - verify
    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
    steps:
      - name: Check Out Code
        uses: actions/checkout@v6
      - name: Sync to Maven Central
        uses: ./.github/actions/sync-to-maven-central
        with:
          central-token-password: ${{ secrets.CENTRAL_TOKEN_PASSWORD }}
          central-token-username: ${{ secrets.CENTRAL_TOKEN_USERNAME }}
          jfrog-cli-config-token: ${{ secrets.JF_ARTIFACTORY_SPRING }}
          spring-boot-version: ${{ needs.build-and-stage-release.outputs.version }}
  promote-release:
    name: Promote Release
    needs:
      - build-and-stage-release
      - sync-to-maven-central
    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
    steps:
      - name: Set up JFrog CLI
        uses: jfrog/setup-jfrog-cli@86dacb6974c66cc99e7651e1205f6581aaddba9a # v4.10.0
        env:
          JF_ENV_SPRING: ${{ secrets.JF_ARTIFACTORY_SPRING }}
      - name: Promote build
        run: jfrog rt build-promote ${{ format('spring-boot-{0}', needs.build-and-stage-release.outputs.version)}} ${{ github.run_number }} libs-milestone-local
  publish-gradle-plugin:
    name: Publish Gradle Plugin
    if: ${{ !vars.COMMERCIAL }}
    needs:
      - build-and-stage-release
      - sync-to-maven-central
    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
    steps:
      - name: Check Out Code
        uses: actions/checkout@v6
      - name: Publish
        uses: ./.github/actions/publish-gradle-plugin
        with:
          gradle-plugin-publish-key: ${{ secrets.GRADLE_PLUGIN_PUBLISH_KEY }}
          gradle-plugin-publish-secret: ${{ secrets.GRADLE_PLUGIN_PUBLISH_SECRET }}
          jfrog-cli-config-token: ${{ secrets.JF_ARTIFACTORY_SPRING }}
          plugin-version: ${{ needs.build-and-stage-release.outputs.version }}
  trigger-docs-build:
    name: Trigger Docs Build
    needs:
      - build-and-stage-release
      - promote-release
    permissions:
      actions: write
    runs-on: ubuntu-latest
    steps:
      - name: Run Deploy Docs Workflow
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh workflow run deploy-docs.yml --repo ${{ github.repository }} -r docs-build -f build-refname=${{ github.ref_name }} -f build-version=${{ needs.build-and-stage-release.outputs.version }}
  create-github-release:
    name: Create GitHub Release
    needs:
      - build-and-stage-release
      - promote-release
      - publish-gradle-plugin
      - trigger-docs-build
    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
    steps:
      - name: Check Out Code
        uses: actions/checkout@v6
      - name: Create GitHub Release
        uses: ./.github/actions/create-github-release
        with:
          commercial: ${{ vars.COMMERCIAL }}
          milestone: ${{ needs.build-and-stage-release.outputs.version }}
          pre-release: true
          token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}

run-codeql-analysis perms .github/workflows/run-codeql-analysis.yml

Triggers: push, pull_request, workflow_dispatch
Runs on: —
Jobs: run-analysis

View raw YAML

name: "Run CodeQL Analysis"
on:
  push:
  pull_request:
  workflow_dispatch:
permissions: read-all
jobs:
  run-analysis:
    permissions:
      actions: read
      contents: read
      security-events: write
    uses: spring-io/github-actions/.github/workflows/codeql-analysis.yml@6e66995f7d29de1e4ff76e4f0def7a10163fe910

run-system-tests matrix perms .github/workflows/run-system-tests.yml

Triggers

push

Runs on

${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}

Jobs

run-system-tests

Matrix

java, java.toolchain, java.version→ 17, 21, True

Commands

echo '{"storage-driver":"overlay2"}' | sudo tee /etc/docker/daemon.json sudo systemctl restart docker
./gradlew systemTest
docker version ; docker info
docker image ls --digests

View raw YAML

name: Run System Tests
on:
  push:
    branches:
      - "main"
permissions:
  contents: read
jobs:
  run-system-tests:
    name: "Java ${{ matrix.java.version}}"
    if: ${{ github.repository == 'spring-projects/spring-boot' }}
    runs-on: ${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}
    strategy:
      matrix:
        java:
          - version: 17
            toolchain: true
          - version: 21
            toolchain: true
    steps:
      - name: Switch Docker to Overlay2
        shell: bash
        run: |
          echo '{"storage-driver":"overlay2"}' | sudo tee /etc/docker/daemon.json
          sudo systemctl restart docker
      - name: Check Out Code
        uses: actions/checkout@v6
      - name: Prepare Gradle Build
        uses: ./.github/actions/prepare-gradle-build
        with:
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
          java-toolchain: ${{ matrix.java.toolchain }}
          java-version: ${{ matrix.java.version }}
      - name: Run System Tests
        id: run-system-tests
        shell: bash
        run: ./gradlew systemTest
      - name: Show docker info
        if: always()
        shell: bash
        run: docker version ; docker info
      - name: List docker images
        if: always()
        shell: bash
        run: docker image ls --digests
      - name: Send Notification
        if: always()
        uses: ./.github/actions/send-notification
        with:
          build-scan-url: ${{ steps.run-system-tests.outputs.build-scan-url }}
          run-name: ${{ format('{0} | System Tests | Java {1}', github.ref_name, matrix.java.version) }}
          status: ${{ job.status }}
          webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}

trigger-docs-build perms .github/workflows/trigger-docs-build.yml

Triggers

push, workflow_dispatch

Runs on

${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}

Jobs

trigger-docs-build

Commands

gh workflow run deploy-docs.yml -r docs-build -f build-refname=${{ github.event.inputs.build-refname }} -f build-sha=${{ github.event.inputs.build-sha }} -f build-version=${{ github.event.inputs.build-version }}

View raw YAML

name: Trigger Docs Build
on:
  push:
    branches: 'main'
    paths: [ 'antora/*' ]
  workflow_dispatch:
    inputs:
      build-version:
        description: 'Version being build (e.g. 1.0.3-SNAPSHOT)'
        required: false
      build-sha:
        description: Enter the SHA to build (e.g. 82c97891569821a7f91a77ca074232e0b54ca7a5)
        required: false
      build-refname:
        description: 'Git refname to build (e.g., 1.0.x)'
        required: false

permissions:
  contents: read
jobs:
  trigger-docs-build:
    name: Trigger Docs Build
    if: github.repository_owner == 'spring-projects'
    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
    permissions:
      actions: write
    steps:
    - name: Check Out
      uses: actions/checkout@v6
      with:
        ref: docs-build
    - name: Trigger Workflow
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      run: gh workflow run deploy-docs.yml -r docs-build -f build-refname=${{ github.event.inputs.build-refname }} -f build-sha=${{ github.event.inputs.build-sha }} -f build-version=${{ github.event.inputs.build-version }}

verify perms .github/workflows/verify.yml

Triggers

workflow_call

Runs on

${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}

Jobs

verify

Actions

Homebrew/actions/setup-homebrew, gradle/actions/setup-gradle

Commands

mkdir -p $HOME/.gradle echo 'org.gradle.daemon=false' >> $HOME/.gradle/gradle.properties
./gradlew spring-boot-release-verification-tests:test

View raw YAML

name: Verify
on:
  workflow_call:
    inputs:
      staging:
        description: 'Whether the release to verify is in the staging repository'
        required: false
        default: false
        type: boolean
      version:
        description: 'Version to verify'
        required: true
        type: string
    secrets:
      commercial-repository-password:
        description: 'Password for authentication with the commercial repository'
        required: false
      commercial-repository-username:
        description: 'Username for authentication with the commercial repository'
        required: false
      google-chat-webhook-url:
        description: 'Google Chat Webhook URL'
        required: true
      opensource-repository-password:
        description: 'Password for authentication with the open-source repository'
        required: false
      opensource-repository-username:
        description: 'Username for authentication with the open-source repository'
        required: false
      token:
        description: 'Token to use for authentication with GitHub'
        required: true
permissions:
  contents: read
jobs:
  verify:
    name: Verify
    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
    steps:
      - name: Check Out Release Verification Tests
        uses: actions/checkout@v6
        with:
          ref: 'v0.0.15'
          repository: spring-projects/spring-boot-release-verification
          token: ${{ secrets.token }}
      - name: Check Out Send Notification Action
        uses: actions/checkout@v6
        with:
          path: send-notification
          sparse-checkout: .github/actions/send-notification
      - name: Set Up Java
        uses: actions/setup-java@v5
        with:
          distribution: 'liberica'
          java-version: 17
      - name: Set Up Homebrew
        if: ${{ !vars.COMMERCIAL }}
        uses: Homebrew/actions/setup-homebrew@7657c9512f50e1c35b640971116425935bab3eea
        with:
          stable: true
      - name: Set Up Gradle
        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
        with:
          cache-read-only: false
      - name: Configure Gradle Properties
        shell: bash
        run: |
          mkdir -p $HOME/.gradle
          echo 'org.gradle.daemon=false' >> $HOME/.gradle/gradle.properties
      - name: Run Release Verification Tests
        env:
          RVT_COMMERCIAL_REPOSITORY_PASSWORD: ${{ secrets.commercial-repository-password }}
          RVT_COMMERCIAL_REPOSITORY_USERNAME: ${{ secrets.commercial-repository-username }}
          RVT_OSS_REPOSITORY_PASSWORD: ${{ secrets.opensource-repository-password }}
          RVT_OSS_REPOSITORY_USERNAME: ${{ secrets.opensource-repository-username }}
          RVT_RELEASE_TYPE: ${{ vars.COMMERCIAL && 'commercial' || 'oss' }}
          RVT_STAGING: ${{ inputs.staging }}
          RVT_VERSION: ${{ inputs.version }}
        run: ./gradlew spring-boot-release-verification-tests:test
      - name: Upload Build Reports on Failure
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: build-reports
          path: '**/build/reports/'
      - name: Send Notification
        if: always()
        uses: ./send-notification/.github/actions/send-notification
        with:
          run-name: ${{ format('{0} | Verification | {1}', github.ref_name, inputs.version) }}
          status: ${{ job.status }}
          webhook-url: ${{ secrets.google-chat-webhook-url }}