From ae804f1b1a2100bbb2e5588bab496a5369f1c791 Mon Sep 17 00:00:00 2001
From: Kaboom <58372747+kaboombot@users.noreply.github.com>
Date: Thu, 6 Aug 2026 13:03:02 +0300
Subject: [PATCH 1/5] CI: add release job and some cleanups
---
.github/workflows/main.yml | 71 +++++++++++++++++++++++++-------------
1 file changed, 47 insertions(+), 24 deletions(-)
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 9cf5ca4..8201ac1 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -1,33 +1,56 @@
name: Maven CI
-
-on:
- push:
- branches: [ master ]
- pull_request:
- branches: [ master ]
+on: [push, pull_request, workflow_dispatch]
+permissions: {}
jobs:
build:
runs-on: ubuntu-latest
-
+ timeout-minutes: 15
steps:
- - uses: actions/checkout@v4
- - uses: actions/setup-java@v4
- with:
- distribution: 'temurin'
- java-version: 21
+ - name: Checkout code
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ persist-credentials: false
+
+ - name: Set up Java
+ uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+ with:
+ distribution: temurin
+ java-version: 21
+ cache: maven
- - name: Cache maven packages to speed up build
- uses: actions/cache@v4
- with:
- path: ~/.m2
- key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
- restore-keys: ${{ runner.os }}-m2
+ - name: Build with Maven
+ run: mvn package
+
+ - name: Upload artifacts
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ with:
+ path: target/Weapons.jar
+ archive: false
+
+ release:
+ if: github.repository == 'kaboomserver/weapons' && github.ref == 'refs/heads/master'
+ needs: build
+ runs-on: ubuntu-slim
+ timeout-minutes: 15
+ permissions:
+ contents: write
+ env:
+ GITHUB_TOKEN: ${{ github.token }}
+ TAG_NAME: latest
+ steps:
+ - name: Checkout code
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ persist-credentials: false
- - name: Build with Maven
- run: mvn -B package --file pom.xml
+ - name: Download artifacts
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ with:
+ path: dist/
+ merge-multiple: true
- - uses: actions/upload-artifact@v4
- with:
- name: Weapons
- path: target/Weapons.jar
+ - name: Create release
+ run: |
+ gh release delete "$TAG_NAME" --cleanup-tag || true
+ gh release create "$TAG_NAME" --title "$TAG_NAME" --target "$GITHUB_SHA" dist/*.jar
From 14c4b3b4d8bd7a901caece743c6ce806d950cefc Mon Sep 17 00:00:00 2001
From: Kaboom <58372747+kaboombot@users.noreply.github.com>
Date: Thu, 6 Aug 2026 13:03:39 +0300
Subject: [PATCH 2/5] CI: enable action version updates
---
.github/dependabot.yml | 8 ++++++++
1 file changed, 8 insertions(+)
create mode 100644 .github/dependabot.yml
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..5e4251f
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,8 @@
+version: 2
+updates:
+ - package-ecosystem: "github-actions"
+ directory: "/"
+ schedule:
+ interval: "daily"
+ cooldown:
+ default-days: 7
From 494adf3624775dd17f21277622f122c905fccd10 Mon Sep 17 00:00:00 2001
From: Kaboom <58372747+kaboombot@users.noreply.github.com>
Date: Thu, 6 Aug 2026 13:38:32 +0300
Subject: [PATCH 3/5] CI: restore batch mode in Maven
---
.github/workflows/main.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 8201ac1..33629de 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -20,7 +20,7 @@ jobs:
cache: maven
- name: Build with Maven
- run: mvn package
+ run: mvn -B package
- name: Upload artifacts
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
From 1f4bf9fc10d25f695cc2b7748a7612097efee8a1 Mon Sep 17 00:00:00 2001
From: Kaboom <58372747+kaboombot@users.noreply.github.com>
Date: Fri, 7 Aug 2026 09:52:06 +0300
Subject: [PATCH 4/5] CI: attest artifacts and reduce hardcoding
---
.github/workflows/main.yml | 29 +++++++++++++++++++++++++----
1 file changed, 25 insertions(+), 4 deletions(-)
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 33629de..f4d6dd5 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -16,7 +16,7 @@ jobs:
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
with:
distribution: temurin
- java-version: 21
+ java-version: 25
cache: maven
- name: Build with Maven
@@ -25,14 +25,35 @@ jobs:
- name: Upload artifacts
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
- path: target/Weapons.jar
+ path: target/*.jar
+ if-no-files-found: error
archive: false
- release:
- if: github.repository == 'kaboomserver/weapons' && github.ref == 'refs/heads/master'
+ attestation:
+ if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
needs: build
runs-on: ubuntu-slim
timeout-minutes: 15
+ permissions:
+ id-token: write
+ attestations: write
+ steps:
+ - name: Download artifacts
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ with:
+ path: dist/
+ merge-multiple: true
+
+ - name: Attest
+ uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+ with:
+ subject-path: dist/
+
+ release:
+ if: github.event.repository.fork == false && github.ref_name == github.event.repository.default_branch
+ needs: attestation
+ runs-on: ubuntu-slim
+ timeout-minutes: 15
permissions:
contents: write
env:
From 187ce3e7a57cf6cf1d3e21a718e7033d219b7823 Mon Sep 17 00:00:00 2001
From: Kaboom <58372747+kaboombot@users.noreply.github.com>
Date: Fri, 7 Aug 2026 09:53:40 +0300
Subject: [PATCH 5/5] pom.xml: make builds reproducible
---
pom.xml | 1 +
1 file changed, 1 insertion(+)
diff --git a/pom.xml b/pom.xml
index 62bfc2f..035973a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -9,6 +9,7 @@
17
true
UTF-8
+ 1980-02-01T00:00:00Z