From d06556f4dda5846220a6b10817b09122e3e61172 Mon Sep 17 00:00:00 2001 From: linwumingshi Date: Wed, 9 Sep 2026 20:26:10 +0800 Subject: [PATCH 1/2] ci: harden example-project workflow and drop org secret - switch from pull_request_target to pull_request and remove ORG_CHECKOUT_TOKEN, since smart-doc-maven-plugin and smart-doc-example-cn are public repositories - add explicit contents: read permission and Maven dependency caching - rely on bash pipefail instead of grepping "[ERROR]" in build logs --- .../build-and-run-example-project.yml | 322 +++++++++++------- 1 file changed, 208 insertions(+), 114 deletions(-) diff --git a/.github/workflows/build-and-run-example-project.yml b/.github/workflows/build-and-run-example-project.yml index 0d37e816..c7686bbf 100644 --- a/.github/workflows/build-and-run-example-project.yml +++ b/.github/workflows/build-and-run-example-project.yml @@ -1,48 +1,61 @@ name: Build and Run Example Project on: - pull_request_target: + pull_request: branches: - master paths: - - 'src/**' # Trigger workflow only if files in src directory change - - 'pom.xml' # Trigger workflow only if pom.xml file changes + - 'src/**' + - 'pom.xml' + - '.github/workflows/**' + +permissions: + contents: read env: - smart-doc-version: ${{ github.run_id }} # Use the current GitHub workflow run ID as a temporary version number + # Use the current GitHub workflow run ID as a temporary version number. + smart-doc-version: ${{ github.run_id }} jobs: + + # ============================================================ + # Build smart-doc + # ============================================================ build: + name: Build smart-doc runs-on: ubuntu-latest steps: - name: Checkout Repository uses: actions/checkout@v5 with: - ref: ${{ github.event.pull_request.head.sha }} + persist-credentials: false - name: Set up JDK 8 uses: actions/setup-java@v5 with: java-version: '8' distribution: 'temurin' + cache: maven - name: Create Logs Directory + shell: bash run: mkdir -p logs - name: Update Version in pom.xml - run: mvn versions:set -DnewVersion="${{ env.smart-doc-version }}" -DgenerateBackupPoms=false + shell: bash + run: | + mvn versions:set \ + -DnewVersion="${{ env.smart-doc-version }}" \ + -DgenerateBackupPoms=false - name: Build and Install + shell: bash run: | - mvn install -DskipTests=true 2>&1 | tee logs/build.log - if grep -E "\[ERROR\]" logs/build.log; then - cat logs/build.log - exit 1 - fi + set -o pipefail + mvn install -Dmaven.test.skip=true 2>&1 | tee logs/build.log - name: Upload Artifact - id: upload-artifact uses: actions/upload-artifact@v6 with: name: smart-doc-maven-jar @@ -50,15 +63,24 @@ jobs: if-no-files-found: error - name: Upload Build Log - if: failure() # Only run if previous steps fail + if: failure() uses: actions/upload-artifact@v6 with: name: error-log-smart-doc-build path: logs/build.log + + # ============================================================ + # Build smart-doc-maven-plugin + # + # smart-doc-maven-plugin is public. + # No repository secret is required. + # ============================================================ maven-plugin-build: + name: Build Maven Plugin needs: build runs-on: ubuntu-latest + concurrency: group: maven-plugin-build-${{ github.event.pull_request.number }} cancel-in-progress: true @@ -68,45 +90,54 @@ jobs: uses: actions/checkout@v5 with: repository: smart-doc-group/smart-doc-maven-plugin - token: ${{ secrets.ORG_CHECKOUT_TOKEN }} + persist-credentials: false - name: Set up JDK 8 uses: actions/setup-java@v5 with: java-version: '8' distribution: 'temurin' + cache: maven - name: Create Logs Directory + shell: bash run: mkdir -p logs - - name: Download Artifact + - name: Download smart-doc Artifact uses: actions/download-artifact@v7 with: name: smart-doc-maven-jar path: ./artifacts - name: Move Files to Local Maven Repository + shell: bash run: | - mkdir -p ~/.m2/repository/com/github/shalousun - echo "Overwriting target directory with new artifacts:" - rsync -av --delete ./artifacts/ ~/.m2/repository/com/github/shalousun/ + TARGET_DIR="$HOME/.m2/repository/com/github/shalousun" + + mkdir -p "$TARGET_DIR" + + rsync -av --delete \ + ./artifacts/ \ + "$TARGET_DIR/" + echo "Listing files in target directory:" - ls -lh ~/.m2/repository/com/github/shalousun + ls -lh "$TARGET_DIR" - name: Update Version in pom.xml + shell: bash run: | - mvn versions:set-property -Dproperty="smart-doc.version" -DnewVersion="${{ env.smart-doc-version }}" -DgenerateBackupPoms=false + mvn versions:set-property \ + -Dproperty="smart-doc.version" \ + -DnewVersion="${{ env.smart-doc-version }}" \ + -DgenerateBackupPoms=false - name: Build and Install + shell: bash run: | - mvn install -DskipTests=true 2>&1 | tee logs/install-plugin.log - if grep -E "\[ERROR\]" logs/install-plugin.log; then - cat logs/install-plugin.log - exit 1 - fi + set -o pipefail + mvn install -Dmaven.test.skip=true 2>&1 | tee logs/install-plugin.log - name: Upload Plugin Artifact - id: upload-artifact uses: actions/upload-artifact@v6 with: name: smart-doc-maven-plugin-jar @@ -114,18 +145,32 @@ jobs: if-no-files-found: error - name: Upload Plugin Build Log - if: failure() # Only run if previous steps fail + if: failure() uses: actions/upload-artifact@v6 with: name: error-log-maven-plugin-build path: logs/install-plugin.log + + # ============================================================ + # Generate REST / Dubbo / Javadoc / WebSocket API docs + # + # smart-doc-example-cn is public. + # No repository secret is required. + # ============================================================ generate-api-docs: + name: Generate ${{ matrix.doc_type }} API Docs needs: maven-plugin-build runs-on: ubuntu-latest + strategy: matrix: - doc_type: [ rest, dubbo, javadoc, websocket ] + doc_type: + - rest + - dubbo + - javadoc + - websocket + concurrency: group: generate-${{ matrix.doc_type }}-api-doc-${{ github.event.pull_request.number }} cancel-in-progress: true @@ -135,126 +180,164 @@ jobs: uses: actions/checkout@v5 with: repository: smart-doc-group/smart-doc-example-cn - token: ${{ secrets.ORG_CHECKOUT_TOKEN }} + persist-credentials: false - name: Set up JDK 17 uses: actions/setup-java@v5 with: java-version: '17' distribution: 'temurin' + cache: maven - name: Create Logs Directory + shell: bash run: mkdir -p logs - - name: Download Artifact + - name: Download Plugin Artifact uses: actions/download-artifact@v7 with: name: smart-doc-maven-plugin-jar path: ./artifacts - name: Move Files to Local Maven Repository + shell: bash run: | - mkdir -p ~/.m2/repository/com/github/shalousun - echo "Overwriting target directory with new artifacts:" - rsync -av --delete ./artifacts/ ~/.m2/repository/com/github/shalousun/ + TARGET_DIR="$HOME/.m2/repository/com/github/shalousun" + + mkdir -p "$TARGET_DIR" + + rsync -av --delete \ + ./artifacts/ \ + "$TARGET_DIR/" + echo "Listing files in target directory:" - ls -lh ~/.m2/repository/com/github/shalousun + ls -lh "$TARGET_DIR" - name: Update Smart-Doc Version in pom.xml + shell: bash run: | - mvn versions:set-property -Dproperty="smart-doc.version" -DnewVersion="${{ env.smart-doc-version }}" -DgenerateBackupPoms=false + mvn versions:set-property \ + -Dproperty="smart-doc.version" \ + -DnewVersion="${{ env.smart-doc-version }}" \ + -DgenerateBackupPoms=false - name: Build and Install Example Project + shell: bash run: | - mvn -DskipTests=true install 2>&1 | tee logs/build-example-project.log - if grep -E "\[ERROR\]" logs/build-example-project.log; then - cat logs/build-example-project.log - exit 1 - fi + set -o pipefail + mvn -Dmaven.test.skip=true install 2>&1 | tee logs/build-example-project.log - - name: Generate ${{ matrix.doc_type }} API Documentation + - name: Generate API Documentation + shell: bash run: | - case ${{ matrix.doc_type }} in + set -o pipefail + + case "${{ matrix.doc_type }}" in + rest) - mvn -DskipTests=true smart-doc:adoc 2>&1 | tee logs/rest-adoc.log - if grep -E "\[ERROR\]" logs/rest-adoc.log; then cat logs/rest-adoc.log; exit 1; fi - mvn -DskipTests=true smart-doc:html 2>&1 | tee logs/rest-html.log - if grep -E "\[ERROR\]" logs/rest-html.log; then cat logs/rest-html.log; exit 1; fi + mvn -DskipTests=true smart-doc:adoc 2>&1 \ + | tee logs/rest-adoc.log - mvn -DskipTests=true smart-doc:jmeter 2>&1 | tee logs/rest-jmeter.log - if grep -E "\[ERROR\]" logs/rest-jmeter.log; then cat logs/rest-jmeter.log; exit 1; fi + mvn -DskipTests=true smart-doc:html 2>&1 \ + | tee logs/rest-html.log - mvn -DskipTests=true smart-doc:markdown 2>&1 | tee logs/rest-markdown.log - if grep -E "\[ERROR\]" logs/rest-markdown.log; then cat logs/rest-markdown.log; exit 1; fi + mvn -DskipTests=true smart-doc:jmeter 2>&1 \ + | tee logs/rest-jmeter.log - mvn -DskipTests=true smart-doc:openapi 2>&1 | tee logs/rest-openapi.log - if grep -E "\[ERROR\]" logs/rest-openapi.log; then cat logs/rest-openapi.log; exit 1; fi + mvn -DskipTests=true smart-doc:markdown 2>&1 \ + | tee logs/rest-markdown.log - mvn -DskipTests=true smart-doc:postman 2>&1 | tee logs/rest-postman.log - if grep -E "\[ERROR\]" logs/rest-postman.log; then cat logs/rest-postman.log; exit 1; fi + mvn -DskipTests=true smart-doc:openapi 2>&1 \ + | tee logs/rest-openapi.log - mvn -DskipTests=true smart-doc:swagger 2>&1 | tee logs/rest-swagger.log - if grep -E "\[ERROR\]" logs/rest-swagger.log; then cat logs/rest-swagger.log; exit 1; fi + mvn -DskipTests=true smart-doc:postman 2>&1 \ + | tee logs/rest-postman.log - mvn -DskipTests=true smart-doc:word 2>&1 | tee logs/rest-word.log - if grep -E "\[ERROR\]" logs/rest-word.log; then cat logs/rest-word.log; exit 1; fi + mvn -DskipTests=true smart-doc:swagger 2>&1 \ + | tee logs/rest-swagger.log + + mvn -DskipTests=true smart-doc:word 2>&1 \ + | tee logs/rest-word.log + + # This is an actual test and should remain executable. + mvn test \ + -Dtest=com.power.doc.torna.TornaApiTest 2>&1 \ + | tee logs/rest-TornaApiTest.log - mvn test -Dtest=com.power.doc.torna.TornaApiTest 2>&1 | tee logs/rest-TornaApiTest.log - if grep -E "\[ERROR\]" logs/rest-TornaApiTest.log; then cat logs/rest-TornaApiTest.log; exit 1; fi ;; + dubbo) - mvn -DskipTests=true smart-doc:rpc-adoc 2>&1 | tee logs/rpc-adoc.log - if grep -E "\[ERROR\]" logs/rpc-adoc.log; then cat logs/rpc-adoc.log; exit 1; fi - mvn -DskipTests=true smart-doc:rpc-html 2>&1 | tee logs/rpc-html.log - if grep -E "\[ERROR\]" logs/rpc-html.log; then cat logs/rpc-html.log; exit 1; fi - - mvn -DskipTests=true smart-doc:rpc-markdown 2>&1 | tee logs/rpc-markdown.log - if grep -E "\[ERROR\]" logs/rpc-markdown.log; then cat logs/rpc-markdown.log; exit 1; fi + mvn -DskipTests=true smart-doc:rpc-adoc 2>&1 \ + | tee logs/rpc-adoc.log + + mvn -DskipTests=true smart-doc:rpc-html 2>&1 \ + | tee logs/rpc-html.log + + mvn -DskipTests=true smart-doc:rpc-markdown 2>&1 \ + | tee logs/rpc-markdown.log + ;; + javadoc) - mvn -DskipTests=true smart-doc:javadoc-adoc 2>&1 | tee logs/javadoc-adoc.log - if grep -E "\[ERROR\]" logs/javadoc-adoc.log; then cat logs/javadoc-adoc.log; exit 1; fi - mvn -DskipTests=true smart-doc:javadoc-html 2>&1 | tee logs/javadoc-html.log - if grep -E "\[ERROR\]" logs/javadoc-html.log; then cat logs/javadoc-html.log; exit 1; fi - - mvn -DskipTests=true smart-doc:javadoc-markdown 2>&1 | tee logs/javadoc-markdown.log - if grep -E "\[ERROR\]" logs/javadoc-markdown.log; then cat logs/javadoc-markdown.log; exit 1; fi + mvn -DskipTests=true smart-doc:javadoc-adoc 2>&1 \ + | tee logs/javadoc-adoc.log + + mvn -DskipTests=true smart-doc:javadoc-html 2>&1 \ + | tee logs/javadoc-html.log + + mvn -DskipTests=true smart-doc:javadoc-markdown 2>&1 \ + | tee logs/javadoc-markdown.log + ;; + websocket) - mvn -DskipTests=true smart-doc:websocket-adoc 2>&1 | tee logs/websocket-adoc.log - if grep -E "\[ERROR\]" logs/websocket-adoc.log; then cat logs/websocket-adoc.log; exit 1; fi - mvn -DskipTests=true smart-doc:websocket-html 2>&1 | tee logs/websocket-html.log - if grep -E "\[ERROR\]" logs/websocket-html.log; then cat logs/websocket-html.log; exit 1; fi - - mvn -DskipTests=true smart-doc:websocket-markdown 2>&1 | tee logs/websocket-markdown.log - if grep -E "\[ERROR\]" logs/websocket-markdown.log; then cat logs/websocket-markdown.log; exit 1; fi + mvn -DskipTests=true smart-doc:websocket-adoc 2>&1 \ + | tee logs/websocket-adoc.log + + mvn -DskipTests=true smart-doc:websocket-html 2>&1 \ + | tee logs/websocket-html.log + + mvn -DskipTests=true smart-doc:websocket-markdown 2>&1 \ + | tee logs/websocket-markdown.log + ;; + esac - - name: Upload ${{ matrix.doc_type }} API Documentation + - name: Upload API Documentation uses: actions/upload-artifact@v6 with: name: ${{ matrix.doc_type }}-api-doc path: ${{ github.workspace }}/target/doc/ if-no-files-found: error - - name: Upload ${{ matrix.doc_type }} API Documentation Logs + - name: Upload API Documentation Logs if: failure() uses: actions/upload-artifact@v6 with: name: error-log-${{ matrix.doc_type }}-api-docs path: logs + + # ============================================================ + # Generate gRPC API docs + # ============================================================ generate-grpc-api-doc: + name: Generate gRPC API Docs (${{ matrix.os }}) needs: maven-plugin-build runs-on: ${{ matrix.os }} + strategy: matrix: - os: [ubuntu-latest, macos-latest, windows-latest] + os: + - ubuntu-latest + - macos-latest + - windows-latest + concurrency: group: generate-grpc-api-doc-${{ matrix.os }}-${{ github.event.pull_request.number }} cancel-in-progress: true @@ -264,77 +347,88 @@ jobs: uses: actions/checkout@v5 with: repository: smart-doc-group/smart-doc-example-cn - token: ${{ secrets.ORG_CHECKOUT_TOKEN }} + persist-credentials: false - name: Set up JDK 17 uses: actions/setup-java@v5 with: java-version: '17' distribution: 'temurin' + cache: maven - name: Create Logs Directory - run: mkdir -p logs shell: bash + run: mkdir -p logs - - name: Download Artifact + - name: Download Plugin Artifact uses: actions/download-artifact@v7 with: name: smart-doc-maven-plugin-jar path: ./artifacts - name: Move Files to Local Maven Repository + shell: bash run: | + TARGET_DIR="$HOME/.m2/repository/com/github/shalousun" + + mkdir -p "$TARGET_DIR" + if [[ "${{ matrix.os }}" == "ubuntu-latest" || "${{ matrix.os }}" == "macos-latest" ]]; then - TARGET_DIR=~/.m2/repository/com/github/shalousun/ - mkdir -p "$TARGET_DIR" || echo "Directory already exists" - rsync -av --delete ./artifacts/ "$TARGET_DIR" - elif [[ "${{ matrix.os }}" == "windows-latest" ]]; then - TARGET_DIR="$USERPROFILE\\.m2\\repository\\com\\ly\\smart-doc\\" - mkdir -p "$TARGET_DIR" || echo "Directory already exists" - cp -r ./artifacts/* "$TARGET_DIR" + rsync -av --delete \ + ./artifacts/ \ + "$TARGET_DIR/" + else + # GitHub Windows runners provide Git Bash. + # Use $HOME so Maven and Bash resolve the same user home. + cp -r ./artifacts/. "$TARGET_DIR/" fi - shell: bash - + + echo "Listing files in target directory:" + ls -lh "$TARGET_DIR" - name: Update Smart-Doc Version in pom.xml + shell: bash run: | - mvn versions:set-property -Dproperty="smart-doc.version" -DnewVersion="${{ env.smart-doc-version }}" -DgenerateBackupPoms=false + mvn versions:set-property \ + -Dproperty="smart-doc.version" \ + -DnewVersion="${{ env.smart-doc-version }}" \ + -DgenerateBackupPoms=false - name: Build and Install Example Project - run: | - mvn -DskipTests=true install 2>&1 | tee logs/build-example-project.log - if grep -E "\[ERROR\]" logs/build-example-project.log; then - cat logs/build-example-project.log - exit 1 - fi shell: bash + run: | + set -o pipefail + mvn -Dmaven.test.skip=true install 2>&1 | tee logs/build-example-project.log - name: Generate gRPC AsciiDoc Documentation - run: | - mvn -DskipTests=true smart-doc:grpc-adoc 2>&1 | tee logs/grpc-adoc.log - if grep -E "\[ERROR\]" logs/grpc-adoc.log; then cat logs/grpc-adoc.log; exit 1; fi shell: bash + run: | + set -o pipefail + mvn -DskipTests=true smart-doc:grpc-adoc 2>&1 \ + | tee logs/grpc-adoc.log - name: Generate gRPC HTML Documentation - run: | - mvn -DskipTests=true smart-doc:grpc-html 2>&1 | tee logs/grpc-html.log - if grep -E "\[ERROR\]" logs/grpc-html.log; then cat logs/grpc-html.log; exit 1; fi shell: bash + run: | + set -o pipefail + mvn -DskipTests=true smart-doc:grpc-html 2>&1 \ + | tee logs/grpc-html.log - name: Generate gRPC Markdown Documentation - run: | - mvn -DskipTests=true smart-doc:grpc-markdown 2>&1 | tee logs/grpc-markdown.log - if grep -E "\[ERROR\]" logs/grpc-markdown.log; then cat logs/grpc-markdown.log; exit 1; fi shell: bash + run: | + set -o pipefail + mvn -DskipTests=true smart-doc:grpc-markdown 2>&1 \ + | tee logs/grpc-markdown.log - name: Upload gRPC API Documentation uses: actions/upload-artifact@v6 with: - name: gRPC-api-doc-${{ runner.os }} + name: grpc-api-doc-${{ runner.os }} path: ${{ github.workspace }}/target/doc/ if-no-files-found: error - - name: Upload ${{ runner.os }} gRPC API Documentation Log + - name: Upload gRPC API Documentation Log if: failure() uses: actions/upload-artifact@v6 with: From 00796b9091779fe30f7da1f60283d817d3b48c16 Mon Sep 17 00:00:00 2001 From: linwumingshi Date: Wed, 9 Sep 2026 21:47:38 +0800 Subject: [PATCH 2/2] ci: remove redundant checkstyle validation --- .github/workflows/maven.yml | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml index b57c205e..ccb428b2 100644 --- a/.github/workflows/maven.yml +++ b/.github/workflows/maven.yml @@ -14,25 +14,27 @@ on: pull_request: branches: [ "master" ] +permissions: + contents: read + jobs: build: if: ${{ github.repository == 'smart-doc-group/smart-doc' }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 - - name: Set up JDK 8 - uses: actions/setup-java@v5 - with: - java-version: '8' - distribution: 'temurin' - cache: maven - - name: Setup review - uses: dbelyaev/action-checkstyle@master - with: - github_token: ${{ secrets.github_token }} - reporter: github-pr-review - level: warning - - name: Build with Maven - run: mvn -DskipTests=true -B package --file pom.xml + - name: Checkout Repository + uses: actions/checkout@v5 + with: + persist-credentials: false + + - name: Set up JDK 8 + uses: actions/setup-java@v5 + with: + java-version: '8' + distribution: 'temurin' + cache: maven + + - name: Build with Maven + run: mvn -DskipTests=true -B package --file pom.xml