From 8ecf69d01cb1b4738a7426237525de8f19c4aaa6 Mon Sep 17 00:00:00 2001 From: Kaboom <58372747+kaboombot@users.noreply.github.com> Date: Thu, 6 Aug 2026 12:28:56 +0300 Subject: [PATCH 1/7] CI: add release job and some cleanups --- .github/workflows/main.yml | 71 +++++++++++++++++++++++++------------- 1 file changed, 47 insertions(+), 24 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index d8b7e19..f412881 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -1,33 +1,56 @@ name: Maven CI - -on: - push: - branches: [ master ] - pull_request: - branches: [ master ] +on: [push, pull_request, workflow_dispatch] +permissions: {} jobs: build: runs-on: ubuntu-latest - + timeout-minutes: 15 steps: - - uses: actions/checkout@v4 - - uses: actions/setup-java@v4 - with: - distribution: 'temurin' - java-version: 25 + - name: Checkout code + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Set up Java + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 + with: + distribution: temurin + java-version: 25 + cache: maven - - name: Cache maven packages to speed up build - uses: actions/cache@v4 - with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2 + - name: Build with Maven + run: mvn package + + - name: Upload artifacts + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + path: target/Extras.jar + archive: false + + release: + if: github.repository == 'kaboomserver/extras' && github.ref == 'refs/heads/master' + needs: build + runs-on: ubuntu-slim + timeout-minutes: 15 + permissions: + contents: write + env: + GITHUB_TOKEN: ${{ github.token }} + TAG_NAME: latest + steps: + - name: Checkout code + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - - name: Build with Maven - run: mvn -B package --file pom.xml + - name: Download artifacts + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + path: dist/ + merge-multiple: true - - uses: actions/upload-artifact@v4 - with: - name: Extras - path: target/Extras.jar + - name: Create release + run: | + gh release delete "$TAG_NAME" --cleanup-tag || true + gh release create "$TAG_NAME" --title "$TAG_NAME" --target "$GITHUB_SHA" dist/*.jar From 7c41b857548cea001855f5702c2f23ea8c945451 Mon Sep 17 00:00:00 2001 From: Kaboom <58372747+kaboombot@users.noreply.github.com> Date: Thu, 6 Aug 2026 12:37:09 +0300 Subject: [PATCH 2/7] CI: enable action version updates --- .github/dependabot.yml | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..5e4251f --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,8 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "daily" + cooldown: + default-days: 7 From 5dc4ce72891e4cf461d6c0a240d5af876c9169a1 Mon Sep 17 00:00:00 2001 From: Kaboom <58372747+kaboombot@users.noreply.github.com> Date: Thu, 6 Aug 2026 13:35:31 +0300 Subject: [PATCH 3/7] CI: restore batch mode in Maven --- .github/workflows/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index f412881..cfb7557 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -20,7 +20,7 @@ jobs: cache: maven - name: Build with Maven - run: mvn package + run: mvn -B package - name: Upload artifacts uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 From 78f4992c19c124a223c1282d01fce6e26d140452 Mon Sep 17 00:00:00 2001 From: Kaboom <58372747+kaboombot@users.noreply.github.com> Date: Thu, 6 Aug 2026 16:59:02 +0300 Subject: [PATCH 4/7] CI: attest artifacts --- .github/workflows/main.yml | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index cfb7557..a4e78b2 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -28,11 +28,31 @@ jobs: path: target/Extras.jar archive: false - release: + attestation: if: github.repository == 'kaboomserver/extras' && github.ref == 'refs/heads/master' needs: build runs-on: ubuntu-slim timeout-minutes: 15 + permissions: + id-token: write + attestations: write + steps: + - name: Download artifacts + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + path: dist/ + merge-multiple: true + + - name: Attest + uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1 + with: + subject-path: dist/ + + release: + if: github.repository == 'kaboomserver/extras' && github.ref == 'refs/heads/master' + needs: attestation + runs-on: ubuntu-slim + timeout-minutes: 15 permissions: contents: write env: From 2e9b106d1faa1a77aea427b74bd43af4ab51a21e Mon Sep 17 00:00:00 2001 From: Kaboom <58372747+kaboombot@users.noreply.github.com> Date: Thu, 6 Aug 2026 17:13:59 +0300 Subject: [PATCH 5/7] CI: reduce hardcoding --- .github/workflows/main.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index a4e78b2..8da08bd 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -25,11 +25,11 @@ jobs: - name: Upload artifacts uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: - path: target/Extras.jar + path: target/*.jar archive: false attestation: - if: github.repository == 'kaboomserver/extras' && github.ref == 'refs/heads/master' + if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' needs: build runs-on: ubuntu-slim timeout-minutes: 15 @@ -49,7 +49,7 @@ jobs: subject-path: dist/ release: - if: github.repository == 'kaboomserver/extras' && github.ref == 'refs/heads/master' + if: github.event.repository.fork == false && github.ref == 'refs/heads/master' needs: attestation runs-on: ubuntu-slim timeout-minutes: 15 From 2ff69111bb249d4dcc6a928d74db93754864495c Mon Sep 17 00:00:00 2001 From: Kaboom <58372747+kaboombot@users.noreply.github.com> Date: Fri, 7 Aug 2026 00:09:24 +0300 Subject: [PATCH 6/7] CI: stop hardcoding default branch --- .github/workflows/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 8da08bd..10d0732 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -49,7 +49,7 @@ jobs: subject-path: dist/ release: - if: github.event.repository.fork == false && github.ref == 'refs/heads/master' + if: github.event.repository.fork == false && github.ref_name == github.event.repository.default_branch needs: attestation runs-on: ubuntu-slim timeout-minutes: 15 From 75ef2d7720f70bcd900d79128125bc540e84aca8 Mon Sep 17 00:00:00 2001 From: Kaboom <58372747+kaboombot@users.noreply.github.com> Date: Fri, 7 Aug 2026 04:25:29 +0300 Subject: [PATCH 7/7] CI: fail if no artifacts are found --- .github/workflows/main.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 10d0732..f4d6dd5 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -26,6 +26,7 @@ jobs: uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: path: target/*.jar + if-no-files-found: error archive: false attestation: