Skip to content

Commit 49f50ef

Browse files
jamesarichjamesarich
authored
ci: publish Dokka to GitHub Pages and add supply-chain checks (#21)
- §6.1: Add docs.yml that builds the plugin's Dokka HTML (:plugin:dokkaGeneratePublicationHtml → plugin/build/dokka/html) and deploys to GitHub Pages on every push to main; also builds (no deploy) on PRs. SHA-pinned actions only, reusing this repo's existing pins plus Pages actions (configure-pages, upload-pages-artifact, deploy-pages). Adds an API-docs badge to README linking the published site. - §5.7: Add dependency-review.yml (copied verbatim from meshtastic-sdk; SHA-pinned, fail-on-severity high). - §5.6: Enable Renovate vulnerabilityAlerts in renovate.json. §4.3 (Kover/Codecov) is deliberately deferred: coverage is awkward to measure meaningfully on a Gradle TestKit plugin whose behaviour is exercised through functional tests in forked Gradle runs.
1 parent d59709a commit 49f50ef

4 files changed

Lines changed: 104 additions & 0 deletions

File tree

‎.github/workflows/dependency-review.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Dependency Review
2+
3+
on:
4+
pull_request:
5+
branches: [main]
6+
7+
concurrency:
8+
group: dep-review-${{ github.ref }}
9+
cancel-in-progress: true
10+
11+
permissions:
12+
contents: read
13+
14+
jobs:
15+
review:
16+
name: Review
17+
runs-on: ubuntu-latest
18+
permissions:
19+
contents: read
20+
pull-requests: write
21+
steps:
22+
- name: Checkout
23+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
24+
25+
- name: Dependency review
26+
uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
27+
with:
28+
fail-on-severity: high
29+
comment-summary-in-pr: on-failure

‎.github/workflows/docs.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
# .github/workflows/docs.yml
2+
#
3+
# Builds the plugin's Dokka HTML documentation and deploys it to GitHub Pages
4+
# on every push to main. The site is also built (but not deployed) on pull
5+
# requests so documentation regressions are caught before merge.
6+
#
7+
# URL after deployment: https://meshtastic.github.io/gradle-flatpak-sources/
8+
9+
name: Documentation
10+
11+
on:
12+
push:
13+
branches: [main]
14+
pull_request:
15+
branches: [main]
16+
17+
permissions:
18+
contents: read
19+
20+
# Only one deployment runs at a time; in-progress deploys are NOT cancelled so
21+
# a concurrent push to main doesn't leave the site in a half-updated state.
22+
concurrency:
23+
group: pages
24+
cancel-in-progress: false
25+
26+
jobs:
27+
build:
28+
name: Build Dokka docs
29+
runs-on: ubuntu-latest
30+
permissions:
31+
contents: read
32+
steps:
33+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
34+
35+
- name: Set up JDK 17
36+
uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
37+
with:
38+
distribution: 'temurin'
39+
java-version: '17'
40+
41+
- name: Set up Gradle
42+
uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
43+
44+
- name: Configure Pages
45+
uses: actions/configure-pages@45bfe019a89a1e2b921f7ec9db1d69c48246c2e2 # v6.0.0
46+
47+
- name: Build Dokka HTML documentation
48+
run: ./gradlew :plugin:dokkaGeneratePublicationHtml --no-daemon --stacktrace
49+
50+
- name: Upload Pages artifact
51+
uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
52+
with:
53+
path: plugin/build/dokka/html
54+
55+
deploy:
56+
name: Deploy to GitHub Pages
57+
needs: build
58+
# Deploy only on pushes to main, not on pull requests.
59+
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
60+
runs-on: ubuntu-latest
61+
permissions:
62+
contents: read
63+
pages: write
64+
id-token: write
65+
environment:
66+
name: github-pages
67+
url: ${{ steps.deployment.outputs.page_url }}
68+
steps:
69+
- name: Deploy to GitHub Pages
70+
id: deployment
71+
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
# gradle-flatpak-sources
22

33
[![CI](https://github.com/meshtastic/gradle-flatpak-sources/actions/workflows/ci.yml/badge.svg)](https://github.com/meshtastic/gradle-flatpak-sources/actions/workflows/ci.yml)
4+
[![API docs](https://img.shields.io/badge/API_docs-Dokka-blue.svg)](https://meshtastic.github.io/gradle-flatpak-sources/)
45
[![Gradle Plugin Portal](https://img.shields.io/gradle-plugin-portal/v/org.meshtastic.flatpak.sources.settings)](https://plugins.gradle.org/plugin/org.meshtastic.flatpak.sources.settings)
56
[![License: GPL-3.0-or-later](https://img.shields.io/badge/License-GPL--3.0--or--later-blue.svg)](COPYING)
67
[![CLA assistant](https://cla-assistant.io/readme/badge/meshtastic/gradle-flatpak-sources)](https://cla-assistant.io/meshtastic/gradle-flatpak-sources)

‎renovate.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@
33
"extends": [
44
"config:recommended"
55
],
6+
"vulnerabilityAlerts": {
7+
"enabled": true
8+
},
69
"packageRules": [
710
{
811
"description": "Automerge non-major dependency updates",

0 commit comments

Comments
 (0)