Skip to content

ci(deps): bump the all-actions group with 11 updates #1272

ci(deps): bump the all-actions group with 11 updates

ci(deps): bump the all-actions group with 11 updates #1272

Workflow file for this run

name: CI/CD Pipeline
on:
schedule:
- cron: '00 5 * * *'
push:
branches:
- master
tags:
- 'v*.*.*'
pull_request:
branches:
- master
# Set minimal permissions for all jobs by default
permissions:
contents: read
env:
JAVA_VERSION: '21'
JAVA_DISTRIBUTION: 'temurin'
BLAZECTL_VERSION: v1.2.0
BLAZECTL_CHECKSUM: c0b2bf0b35c60ff0aa1d66f638d5b8d3a77c506211643932e4132784069cc759
jobs:
lint-agent-backend:
name: Code Format (Agent Backend)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
java-version: ${{ env.JAVA_VERSION }}
distribution: ${{ env.JAVA_DISTRIBUTION }}
cache: 'maven'
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
path: |
~/.m2/repository
~/.m2/wrapper
key: ${{ runner.os }}-maven-agent-${{ hashFiles('agent/backend/pom.xml', '**/pom.xml') }}
restore-keys: |
${{ runner.os }}-maven-agent-${{ hashFiles('agent/backend/pom.xml') }}
${{ runner.os }}-maven-agent-
${{ runner.os }}-maven-
- working-directory: agent/backend
run: mvn --quiet clean com.spotify.fmt:fmt-maven-plugin:check
lint-agent-frontend:
name: Code Format (Agent Frontend)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: '18'
cache: 'npm'
cache-dependency-path: 'agent/frontend/package-lock.json'
- name: Install dependencies
working-directory: agent/frontend
run: npm ci
- name: Run ESLint
working-directory: agent/frontend
run: npm run lint
lint-server-frontend:
name: Code Format (Server Frontend)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: '18'
cache: 'npm'
cache-dependency-path: 'server/frontend/package-lock.json'
- name: Install dependencies
working-directory: server/frontend
run: npm ci
- name: Run ESLint
working-directory: server/frontend
run: npm run lint
lint-server:
name: Code Format (Server)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
java-version: ${{ env.JAVA_VERSION }}
distribution: ${{ env.JAVA_DISTRIBUTION }}
cache: 'maven'
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
path: |
~/.m2/repository
~/.m2/wrapper
key: ${{ runner.os }}-maven-server-${{ hashFiles('server/backend/pom.xml', '**/pom.xml') }}
restore-keys: |
${{ runner.os }}-maven-server-${{ hashFiles('server/backend/pom.xml') }}
${{ runner.os }}-maven-server-
${{ runner.os }}-maven-
- working-directory: server/backend
run: mvn --quiet clean com.spotify.fmt:fmt-maven-plugin:check
test:
name: Unit & Integration Tests (Agent)
runs-on: ubuntu-latest
needs:
- lint-agent-backend
- lint-agent-frontend
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
java-version: ${{ env.JAVA_VERSION }}
distribution: ${{ env.JAVA_DISTRIBUTION }}
cache: 'maven'
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
path: |
~/.m2/repository
~/.m2/wrapper
key: ${{ runner.os }}-maven-agent-${{ hashFiles('agent/backend/pom.xml', '**/pom.xml') }}
restore-keys: |
${{ runner.os }}-maven-agent-${{ hashFiles('agent/backend/pom.xml') }}
${{ runner.os }}-maven-agent-
${{ runner.os }}-maven-
- working-directory: agent/backend
run: mvn --quiet test
- name: Upload coverage to Codecov
uses: codecov/codecov-action@v6
with:
token: ${{ secrets.CODECOV_TOKEN }}
files: ./agent/backend/target/site/jacoco/jacoco.xml
flags: agent
name: agent-coverage
fail_ci_if_error: false
test-server:
name: Unit & Integration Tests (Server)
runs-on: ubuntu-latest
needs:
- lint-server
- lint-server-frontend
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
with:
java-version: ${{ env.JAVA_VERSION }}
distribution: ${{ env.JAVA_DISTRIBUTION }}
cache: 'maven'
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
path: |
~/.m2/repository
~/.m2/wrapper
key: ${{ runner.os }}-maven-server-${{ hashFiles('server/backend/pom.xml', '**/pom.xml') }}
restore-keys: |
${{ runner.os }}-maven-server-${{ hashFiles('server/backend/pom.xml') }}
${{ runner.os }}-maven-server-
${{ runner.os }}-maven-
- working-directory: server/backend
run: mvn --quiet test
build-agent-image:
name: Docker Image Build (Agent)
runs-on: ubuntu-latest
needs:
- lint-agent-backend
- lint-agent-frontend
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Set up QEMU
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
- uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
name: Build new image
with:
context: .
file: ./agent/Dockerfile
tags: ghcr.io/bbmri-cz/data-quality-agent:latest
load: true
outputs: type=docker,dest=/tmp/agent-image.tar
cache-from: type=gha
cache-to: type=gha,mode=max
- uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
name: Build new image artifact
with:
context: .
file: ./agent/Dockerfile
tags: ghcr.io/bbmri-cz/data-quality-agent:latest
build-args: ARTIFACT_VERSION=${{ github.ref_name }}
outputs: type=docker,dest=/tmp/agent-image.tar
cache-from: type=gha
- name: Upload agent image artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: agent-image
path: /tmp/agent-image.tar
test-agent-migration:
name: Agent DB Migration Test
runs-on: ubuntu-latest
needs: build-agent-image
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- run: docker compose up -d quality-agent
name: Spin up latest stable image
- name: Run blaze
run: docker run -d --name blaze -p 8080:8080 samply/blaze:latest
- name: Wait for Blaze
run: .github/workflows/scripts/wait-for-url.sh http://localhost:8080/health
- name: Install Blazectl
env:
GH_TOKEN: ${{ github.token }}
run: .github/workflows/scripts/install-blazectl.sh
- name: Load Data
run: blazectl --no-progress --server http://localhost:8080/fhir upload agent/backend/src/test/resources/test_data
- name: Generate Data Quality Report
run: .github/workflows/scripts/generate-report.sh
- run: docker compose down
name: Down the container
- name: Download agent image artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: agent-image
path: /tmp
- name: Load Docker images
run: |
docker load -i /tmp/agent-image.tar
- run: docker compose up -d quality-agent
name: Spin up latest stable image
- name: Check agent health
run: |
for i in {1..20}; do
STATUS=$(docker inspect --format='{{.State.Health.Status}}' quality-agent)
echo "Health status: $STATUS"
if [ "$STATUS" == "healthy" ]; then
echo "Container is healthy"
exit 0
fi
sleep 3
done
echo "Container is not healthy"
docker logs quality-agent
exit 1
- name: Generate Data Quality Report
run: .github/workflows/scripts/generate-report.sh
- name: Test basic API calls
run: .github/workflows/scripts/test-api-calls.sh
build-server-image:
name: Docker Image Build (Server)
runs-on: ubuntu-latest
needs:
- lint-server
- lint-server-frontend
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Set up QEMU
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
- run: docker compose up -d quality-server || exit 0
name: Spin up latest stable image
- uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
name: Build new image
with:
context: .
file: ./server/Dockerfile
tags: ghcr.io/bbmri-cz/data-quality-server:latest
load: true
outputs: type=docker
cache-from: type=gha
cache-to: type=gha,mode=max
- uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
name: Build new image artifact
with:
context: .
file: ./server/Dockerfile
tags: ghcr.io/bbmri-cz/data-quality-server:latest
build-args: ARTIFACT_VERSION=${{ github.ref_name }}
outputs: type=docker,dest=/tmp/server-image.tar
cache-from: type=gha
- name: Upload server image artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: server-image
path: /tmp/server-image.tar
test-server-migration:
name: Server DB Migration Test
runs-on: ubuntu-latest
needs: build-server-image
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- run: docker compose up -d quality-server
name: Spin up latest stable image
- run: docker compose down
name: Down the container
- name: Download agent image artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: server-image
path: /tmp
- name: Load Docker images
run: |
docker load -i /tmp/server-image.tar
- run: docker compose up -d quality-server
name: Spin up latest stable image
- name: Check server health
run: |
for i in {1..20}; do
STATUS=$(docker inspect --format='{{.State.Health.Status}}' quality-server)
echo "Health status: $STATUS"
if [ "$STATUS" == "healthy" ]; then
echo "Container is healthy"
exit 0
fi
sleep 3
done
echo "Container is not healthy"
docker logs quality-server
exit 1
docs:
name: Documentation Build and Deployment
runs-on: ubuntu-latest
if: github.ref == 'refs/heads/master'
env:
MATOMO_BASE_URL: 'https://matomo.bbmri-eric.eu/'
MATOMO_SITE_ID: '12'
permissions:
contents: read
pages: write
id-token: write
concurrency:
group: "pages"
cancel-in-progress: false
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: '18'
cache: 'npm'
cache-dependency-path: 'docs/package-lock.json'
- name: Install dependencies
working-directory: docs
run: npm ci
- name: Build documentation
working-directory: docs
run: npm run build
- name: Setup Pages
uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
- name: Upload artifact
uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
with:
path: docs/.vitepress/dist
- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
build:
name: Agent Image Publishing
runs-on: ubuntu-latest
needs:
- integration-test
- otel-metrics-push-test
permissions:
packages: write
contents: read
id-token: write
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Install Cosign
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
- name: Download agent image artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: agent-image
path: /tmp
- name: Load Docker image
run: docker load -i /tmp/agent-image.tar
- id: meta
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
with:
images: ghcr.io/${{ github.repository_owner }}/data-quality-agent
tags: |
type=sha
type=raw,value=${{ github.head_ref }},event=pr
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
type=semver,pattern={{major}}
type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'master') }}
- uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Tag and push images
env:
TAGS: ${{ steps.meta.outputs.tags }}
run: |
LOADED_IMAGE="ghcr.io/bbmri-cz/data-quality-agent:latest"
# Tag and push each generated tag
echo "$TAGS" | while read -r tag; do
if [ -n "$tag" ]; then
echo "Tagging and pushing: $tag"
docker tag "$LOADED_IMAGE" "$tag"
docker push "$tag"
fi
done
- name: Sign images with Cosign
env:
TAGS: ${{ steps.meta.outputs.tags }}
run: |
# Sign each pushed image
echo "$TAGS" | while read -r tag; do
if [ -n "$tag" ]; then
echo "Signing: $tag"
cosign sign --yes "$tag"
fi
done
publish-server-image:
name: Server Image Publishing
runs-on: ubuntu-latest
needs:
- integration-test
- otel-metrics-push-test
permissions:
packages: write
contents: read
id-token: write
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Install Cosign
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
- name: Download server image artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: server-image
path: /tmp
- name: Load Docker image
run: docker load -i /tmp/server-image.tar
- id: meta
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
with:
images: ghcr.io/${{ github.repository_owner }}/data-quality-server
tags: |
type=sha
type=raw,value=${{ github.head_ref }},event=pr
type=semver,pattern={{version}}
type=semver,pattern={{major}}
type=semver,pattern={{major}}.{{minor}}
type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'master') }}
- uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Tag and push images
env:
TAGS: ${{ steps.meta.outputs.tags }}
run: |
LOADED_IMAGE="ghcr.io/bbmri-cz/data-quality-server:latest"
# Tag and push each generated tag
echo "$TAGS" | while read -r tag; do
if [ -n "$tag" ]; then
echo "Tagging and pushing: $tag"
docker tag "$LOADED_IMAGE" "$tag"
docker push "$tag"
fi
done
- name: Sign images with Cosign
env:
TAGS: ${{ steps.meta.outputs.tags }}
run: |
# Sign each pushed image
echo "$TAGS" | while read -r tag; do
if [ -n "$tag" ]; then
echo "Signing: $tag"
cosign sign --yes "$tag"
fi
done
integration-test:
name: System Test
runs-on: ubuntu-latest
needs:
- build-agent-image
- build-server-image
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
- name: Download agent image artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: agent-image
path: /tmp
- name: Download server image artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: server-image
path: /tmp
- name: Run blaze
run: docker run -d --name blaze -p 8080:8080 samply/blaze:latest
- name: Wait for Blaze
run: .github/workflows/scripts/wait-for-url.sh http://localhost:8080/health
- name: Install Blazectl
env:
GH_TOKEN: ${{ github.token }}
run: .github/workflows/scripts/install-blazectl.sh
- name: Load Data
run: blazectl --no-progress --server http://localhost:8080/fhir upload agent/backend/src/test/resources/test_data
- name: Load Docker images
run: |
docker load -i /tmp/agent-image.tar
docker load -i /tmp/server-image.tar
- name: Docker Compose Up
run: docker compose -f compose.yaml -f .github/compose.override.yaml up -d
- name: Check agent health
run: |
for i in {1..20}; do
STATUS=$(docker inspect --format='{{.State.Health.Status}}' quality-agent)
echo "Health status: $STATUS"
if [ "$STATUS" == "healthy" ]; then
echo "Container is healthy"
exit 0
fi
sleep 3
done
echo "Container is not healthy"
docker logs quality-agent
exit 1
- name: Check server health
run: |
for i in {1..20}; do
STATUS=$(docker inspect --format='{{.State.Health.Status}}' quality-server)
echo "Health status: $STATUS"
if [ "$STATUS" == "healthy" ]; then
echo "Container is healthy"
exit 0
fi
sleep 3
done
echo "Container is not healthy"
docker logs quality-server
exit 1
- name: Check OIDC server health
run: .github/workflows/scripts/wait-for-url.sh http://localhost:4011/.well-known/openid-configuration
- name: Test Agent and Server Interaction
run: .github/workflows/scripts/system-test-interaction.sh
otel-metrics-push-test:
name: OTEL Metrics Push Test
runs-on: ubuntu-latest
needs:
- build-agent-image
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Download agent image artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: agent-image
path: /tmp
- name: Load agent image
run: docker load -i /tmp/agent-image.tar
- name: Docker Compose Up (Agent + OTEL Collector)
run: docker compose -f compose.yaml -f .github/compose.otel.override.yaml up -d quality-agent otel-collector
- name: Wait for agent health endpoint
run: .github/workflows/scripts/wait-for-url.sh http://localhost:8081/api/health
- name: Trigger a few requests for application metrics
run: |
for i in {1..5}; do
curl -fsS http://localhost:8081/api/health >/dev/null
sleep 1
done
- name: Validate OTEL metrics push
run: bash .github/workflows/scripts/validate-otel-metrics-push.sh