ci: open the Javadoc jar before publishing it #1221
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - develop | |
| pull_request: | |
| # Run on any incoming PR regardless of the base branch so feature | |
| # branches targeting `develop` also get analysed. | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '32 6 * * 1' | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: CodeQL — ${{ matrix.language }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| env: | |
| JAVA_TOOL_OPTIONS: -Djava.awt.headless=true | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: | |
| - java-kotlin | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v7 | |
| - name: Set up Temurin JDK 17 | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: temurin | |
| java-version: '17' | |
| cache: maven | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| queries: security-and-quality | |
| - name: Build (published code-bearing modules) | |
| # The extractor sees what the build compiles, so the module list is the | |
| # analysis scope. It covers every published module that carries code, which | |
| # is where the untrusted input actually lands: PDFBox and POI parsing, the | |
| # SVG and image paths, font loading, and the ZIP/OPC writers all live in the | |
| # backends rather than in core. | |
| # | |
| # Every deployed module is named outright, including fonts and emoji, which no | |
| # other `-pl` list mentions. They would arrive through `-am` as somebody's | |
| # dependency, and that is precisely the arrangement that ends quietly the day | |
| # the dependency is dropped. `-am` stays for a future module whose upstream is | |
| # not itself deployed. | |
| # | |
| # CodeQlScopeGuardTest holds this list against two inventories — what CI | |
| # compiles and what the publish workflows deploy — so a module that ships and | |
| # is not named here fails the build rather than shipping unscanned. | |
| run: | | |
| ./mvnw -B -ntp -DskipTests package -am \ | |
| -pl :graph-compose-core,:graph-compose-render-pdf,:graph-compose-render-docx,:graph-compose-render-pptx,:graph-compose-templates,:graph-compose-testing,:graph-compose-fonts,:graph-compose-emoji | |
| - name: Perform CodeQL analysis | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: "/language:${{ matrix.language }}" |