Merge pull request #22 from spt-development/feature/quality-improvements

Added additional quality gates to build.

Author: SimonTaylor

.github/workflows/build.yml

@@ -7,27 +7,28 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up JDK 21
         uses: oracle-actions/setup-java@v1
         with:
           website: jdk.java.net
           release: 21
-
-      - name: Build with Maven
-        run: mvn clean install -B
-
-      - name: Mutation testing
-        run: mvn org.pitest:pitest-maven:mutationCoverage -B
+      - run: ./mvnw clean install -Pall-quality-gates -B
 
   release:
     runs-on: ubuntu-latest
     needs: build
     if: github.ref == 'refs/heads/main'
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up JDK 21
         uses: oracle-actions/setup-java@v1
@@ -36,7 +37,7 @@ jobs:
           release: 21
 
       - name: Determine version
-        run: echo "POM_VERSION=$(mvn -q -Dexec.executable=echo -Dexec.args='${project.version}' --non-recursive exec:exec | sed -e 's/-SNAPSHOT//')" >> $GITHUB_ENV
+        run: echo "POM_VERSION=$(./mvnw -q -Dexec.executable=echo -Dexec.args='${project.version}' --non-recursive exec:exec | sed -e 's/-SNAPSHOT//')" >> $GITHUB_ENV
 
       - name: Import GPG key
         id: import_gpg
@@ -51,7 +52,7 @@ jobs:
           git config user.name "GitHub Actions"
 
       - name: Create release
-        run: mvn --settings .github/maven-settings.xml release:prepare release:perform -DskipTests -Prelease -B
+        run: ./mvnw --settings .github/maven-settings.xml release:prepare release:perform -DskipTests -Prelease -B
         env:
           OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
           OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
@@ -66,4 +67,5 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
           tag: ${{ env.POM_VERSION }}
           artifacts: spt-development-logging-spring-boot-autoconfigure/target/spt-development-logging-spring-boot-autoconfigure-${{ env.POM_VERSION }}.jar,spt-development-logging-spring-boot-starter/target/spt-development-logging-spring-boot-starter-${{ env.POM_VERSION }}.jar
-          artifactContentType: application/java-archive
+          artifactContentType: application/java-archive
+          bodyFile: documentation/releases/release-${{ env.POM_VERSION }}.md

.github/workflows/latest-versions.yml

@@ -0,0 +1,17 @@
+name: Latest Versions Check
+
+on: [pull_request]
+
+jobs:
+  versions:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 21
+        uses: oracle-actions/setup-java@v1
+        with:
+          website: jdk.java.net
+          release: 21
+      - run: ./mvnw clean versions:update-properties scm:check-local-modification -U -B

.github/workflows/owasp.yml

@@ -0,0 +1,17 @@
+name: OWASP Dependency Check
+
+on: [pull_request]
+
+jobs:
+  owasp:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 21
+        uses: oracle-actions/setup-java@v1
+        with:
+          website: jdk.java.net
+          release: 21
+      - run: ./mvnw clean install dependency-check:check -DskipTests -B

.mvn/wrapper/maven-wrapper.properties

@@ -0,0 +1,18 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.4/apache-maven-3.9.4-bin.zip
+wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar

README.md

@@ -34,7 +34,7 @@ Building locally
 To build the library, run the following maven command:
 
 ```shell
-$ mvn clean install
+$ ./mvnw clean install
 ```
 
 Release

maven-version-rules.xml renamed to config/versions/version-rules.xml

@@ -0,0 +1,7 @@
+## General
+
+* Added additional quality gates to build.
+
+## Dependencies
+
+* Aligned dependencies with Spring Boot 3.1.5