-
Notifications
You must be signed in to change notification settings - Fork 541
Extra workflows #12226
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Extra workflows #12226
Changes from all commits
e851566
e9610de
67d7028
7639a3a
5ef6665
acaabde
04a63db
ec01449
df15374
1703f21
0c5ef01
8ed62f6
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,90 @@ | ||
| name: 'Deploy to dataverse-internal.iq.harvard.edu' | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| buildlabel: | ||
| description: 'Custom label that will appear after the version number (the equivalent of the old "build number" entry).' | ||
| type: string | ||
| required: false | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| concurrency: | ||
| group: deploy-to-internal | ||
| cancel-in-progress: false | ||
|
|
||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v6 | ||
|
|
||
| - uses: actions/setup-java@v5 | ||
| with: | ||
| distribution: 'zulu' | ||
| java-version: '21' | ||
|
|
||
| - name: Set build number | ||
| run: scripts/installer/custom-build-number ${{ github.event.inputs.buildlabel }} | ||
|
|
||
| - name: Build application war | ||
| run: mvn package | ||
|
|
||
| - name: Get war file name | ||
| working-directory: target | ||
| run: echo "war_file=$(ls *.war | head -1)">> $GITHUB_ENV | ||
|
|
||
| - name: Upload war artifact | ||
| uses: actions/upload-artifact@v7 | ||
| with: | ||
| name: built-app | ||
| path: ./target/${{ env.war_file }} | ||
|
|
||
| deploy-to-payara: | ||
| needs: build | ||
| if: ${{ github.repository_owner == 'IQSS' }} | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v6 | ||
|
|
||
| - name: Download war artifact | ||
| uses: actions/download-artifact@v8 | ||
| with: | ||
| name: built-app | ||
| path: ./ | ||
|
|
||
| - name: Get war file name | ||
| run: echo "war_file=$(ls *.war | head -1)">> $GITHUB_ENV | ||
|
|
||
| - name: Copy war file to remote instance | ||
| uses: appleboy/scp-action@master | ||
| with: | ||
| host: ${{ secrets.INTERNAL_PAYARA_INSTANCE_HOST }} | ||
| username: ${{ secrets.INTERNAL_PAYARA_INSTANCE_USERNAME }} | ||
| key: ${{ secrets.INTERNAL_PAYARA_INSTANCE_SSH_PRIVATE_KEY }} | ||
| source: './${{ env.war_file }}' | ||
| target: '/home/${{ secrets.INTERNAL_PAYARA_INSTANCE_USERNAME }}' | ||
| overwrite: true | ||
|
|
||
| - name: Execute payara war deployment remotely | ||
| uses: appleboy/ssh-action@v1.2.5 | ||
| env: | ||
| INPUT_WAR_FILE: ${{ env.war_file }} | ||
| with: | ||
| host: ${{ secrets.INTERNAL_PAYARA_INSTANCE_HOST }} | ||
| username: ${{ secrets.INTERNAL_PAYARA_INSTANCE_USERNAME }} | ||
| key: ${{ secrets.INTERNAL_PAYARA_INSTANCE_SSH_PRIVATE_KEY }} | ||
| envs: INPUT_WAR_FILE | ||
| script: | | ||
| APPLICATION_NAME=dataverse-backend | ||
| ASADMIN='/usr/local/payara7/bin/asadmin --user admin' | ||
| $ASADMIN undeploy $APPLICATION_NAME | ||
| #$ASADMIN stop-domain | ||
| #$ASADMIN start-domain | ||
| $ASADMIN deploy --name $APPLICATION_NAME $INPUT_WAR_FILE | ||
| #$ASADMIN stop-domain | ||
| #$ASADMIN start-domain | ||
|
|
||
| Original file line number | Diff line number | Diff line change | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,41 @@ | |||||||||||||||||||||||||||||
| name: 'Generate dataverse war file' | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| on: | |||||||||||||||||||||||||||||
| workflow_dispatch: | |||||||||||||||||||||||||||||
| inputs: | |||||||||||||||||||||||||||||
| buildlabel: | |||||||||||||||||||||||||||||
| description: 'Custom label that will appear after the version number (the equivalent of the old "build number" entry).' | |||||||||||||||||||||||||||||
| type: string | |||||||||||||||||||||||||||||
| required: false | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| jobs: | |||||||||||||||||||||||||||||
| build: | |||||||||||||||||||||||||||||
| runs-on: ubuntu-latest | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| steps: | |||||||||||||||||||||||||||||
| - uses: actions/checkout@v6 | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| - uses: actions/setup-java@v5 | |||||||||||||||||||||||||||||
| with: | |||||||||||||||||||||||||||||
| distribution: 'zulu' | |||||||||||||||||||||||||||||
| java-version: '21' | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| - name: Set build number | |||||||||||||||||||||||||||||
| run: scripts/installer/custom-build-number ${{ github.event.inputs.buildlabel }} | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| - name: Get branch name | |||||||||||||||||||||||||||||
| id: branch-name | |||||||||||||||||||||||||||||
| uses: tj-actions/branch-names@v7.07 | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| - name: Build application war | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| run: mvn package | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| - name: Get war file name | |||||||||||||||||||||||||||||
| working-directory: target | |||||||||||||||||||||||||||||
| run: echo "war_file=$(ls *.war | head -1)">> $GITHUB_ENV | |||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
| - name: Upload war artifact | |||||||||||||||||||||||||||||
| uses: actions/upload-artifact@v7 | |||||||||||||||||||||||||||||
| with: | |||||||||||||||||||||||||||||
| name: built-app | |||||||||||||||||||||||||||||
| path: ./target/${{ env.war_file }} | |||||||||||||||||||||||||||||
|
Comment on lines
+13
to
+41
Check warningCode scanning / CodeQL Workflow does not contain permissions Medium
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
Copilot AutofixAI about 2 months ago In general, the fix is to explicitly define a For this particular workflow, it only needs to read repository contents (for checkout) and use artifacts. None of the steps push commits, modify issues, or interact with pull requests, so we can safely restrict Concretely, in permissions:
contents: readbetween the
Suggested changeset
1
.github/workflows/generate_war_file.yml
Copilot is powered by AI and may make mistakes. Always verify output.
Refresh and try again.
|
|||||||||||||||||||||||||||||
Uh oh!
There was an error while loading. Please reload this page.