claude-code
1ee7a87150
werkator build succeeded after 01:04
Co-authored-by: claude-code <claude-code@javagil.de>
85 lines
3.7 KiB
YAML
85 lines
3.7 KiB
YAML
# Werkator CI configuration for werkregie (built by https://werkator.javagil.de).
|
|
# Reference: https://github.com/mhoennig/werkator/blob/main/docs/configuration.md
|
|
werkator:
|
|
version:
|
|
since: "1.0.1"
|
|
|
|
gitea:
|
|
baseUrl: https://git.javagil.de
|
|
owner: mi
|
|
repo: werkregie
|
|
statusContext: werkator
|
|
|
|
artifacts:
|
|
retentionPerBranch: 3
|
|
|
|
watcher:
|
|
newBranchMaxAge: 5d
|
|
|
|
builds:
|
|
# The gradle wrapper is committed, so the build environment needs a JDK
|
|
# and nothing else; Foojay loads the Temurin 25 of the toolchain (ADR 0001).
|
|
# Gradle itself runs on it too, by dashboard/gradle/gradle-daemon-jvm.properties:
|
|
# the host's Java 17 is too old for werkcrappit's plugin.
|
|
default:
|
|
trigger:
|
|
onPush: true
|
|
cleanCommand: rm -rf dashboard/build
|
|
# pitestPartial mutates the classes the branch changes against origin/main; a few take a minute, all of them 13
|
|
buildCommand: cd dashboard && ./gradlew --console=plain --no-daemon build pitestPartial mutationCrapCheck
|
|
timeout: 20m
|
|
artifactDirs:
|
|
- dashboard/build/reports
|
|
stdoutLog: build.stdout.log
|
|
stderrLog: build.stderr.log
|
|
|
|
# The deployment of the server on mih09: what it does is the repository's,
|
|
# when, for which branches, where and with which key is the host's part in .git/werkator/.werkator.yml,
|
|
# pinned, so that no branch deploys itself; without it this definition has no trigger and never runs.
|
|
# The host part: the trigger afterSuccessOf default on main, and the ssh alias werkregie-deploy, see dashboard/README.md.
|
|
deploy:
|
|
# keeps what the green build compiled; the script builds the runtime bundle of the tested commit
|
|
cleanCommand: ""
|
|
buildCommand: dashboard/packaging/werkregie-deploy
|
|
statusContext: werkator/deploy
|
|
# the bundle is 89 MiB and has no reader once it is installed
|
|
artifactDirs: []
|
|
|
|
# The known vulnerabilities of the dependencies (doc/risk-analysis.md), for each branch but main:
|
|
# it fails only on those the branch brings against the merge base with main; main is checked each night.
|
|
# It only reads the NVD data, which vulnerability-data loads each night into the Gradle home of the host's user;
|
|
# the host's gradle.properties holds the NVD API key as OWASP_API_KEY.
|
|
dependencies:
|
|
trigger:
|
|
onPush: true
|
|
# named, not left out: Werkator merges a branch's trigger key by key into main's
|
|
branches: ["*", "!main"]
|
|
buildCommand: >-
|
|
cd dashboard && ./gradlew --console=plain --no-daemon
|
|
checkNewVulnerabilities -PvulnerabilityBaseline=origin/main
|
|
statusContext: werkator/dependencies
|
|
# inherits everything but the trigger from default, so artifactDirs keeps the reports of dashboard/build/reports
|
|
|
|
# Loads the NVD data once a day, so that no check waits for it; a first download takes far longer than 10 min.
|
|
# Then it checks main in full: a vulnerability found anew in a dependency of main turns it red.
|
|
vulnerability-data:
|
|
trigger:
|
|
atTimes: ["02:00"]
|
|
branches: ["main"]
|
|
buildCommand: cd dashboard && ./gradlew --console=plain --no-daemon dependencyCheckUpdate dependencyCheckAnalyze
|
|
# empty takes the host's executor.buildTimeout instead of the 10 min this build would inherit from default
|
|
timeout: ""
|
|
statusContext: werkator/vulnerability-data
|
|
|
|
# Mutates all classes of main and writes the CodeCharta.
|
|
# It shares main's worktree with default, so it deletes only its own reports (Werkator, PR#94).
|
|
mutation:
|
|
trigger:
|
|
atTimes: ["04:00"]
|
|
branches: ["main"]
|
|
activeWithin: 24h
|
|
cleanCommand: rm -rf dashboard/build/reports/pitest dashboard/build/reports/codecharta
|
|
buildCommand: cd dashboard && ./gradlew --console=plain --no-daemon pitestFull mutationCrapCodeCharta mutationCrapCheck
|
|
timeout: ""
|
|
statusContext: werkator/mutation
|