ci: add a PR gate, drop the duplicate codecov run, make Sonar non-blocking - #174
Merged
Conversation
codegen 机器人开的 PR 现在无法自动合并，两个原因叠在一起： 一是本仓 PR 上没有任何能回答「生成的代码到底编不编得过」的 check； 二是 sonar 因 SONAR_TOKEN 403 已连续 8 次全红，PR 的 mergeable_state 被它钉死在 unstable、永远到不了 clean。 本次改动： - Makefile 新增 ci-syntax（mvn -B -DskipTests compile）。它一次覆盖 51 个 module， 同时充当两道闸：生成代码编译不过要失败；生成代码里的重复方法、重复 <module> 也是编译期错误，天然被抓住。已知缺口：重复 <dependency> 在 maven 里只有 WARNING、不会失败，本 target 对它无闸；补它需要 maven-enforcer-plugin， 经评估决定不引入，缺口在注释里如实记录，不要以为这条闸是全的。 - 新增 ci.yml：JDK 17 下跑 ci-syntax / lint / test-cov 三个 job，汇总为 ci-gate。 分支保护只需把 ci-gate 配成 required check，其余 job 增删都不影响它。 注意 lint 目前是 echo "skipped" 空壳，留着只为将来填实时位置已在； 门禁的有效性完全由 ci-syntax + test 承担 —— 注释已写明， 不要把「有 lint job」读成「java 做了 lint 把关」。 - 新增 compat.yml：JDK 8/17 矩阵，回答「pom 声明的 maven.compiler.source=1.8 还成不成立」。只挂 schedule 与 workflow_dispatch，刻意不挂 pull_request/push： 每在 codegen PR 上多一个 check，就多一个卡住自动合并的地方， 而这个问题定期回答一次就够，不必每个 PR 都答。 - 删 codecov.yml：它的 mvn test 与 ci.yml 的 test job 完全重复；且它用 JDK 11、 sonar 用 17，同一份代码两个版本各测各的，出分歧时谁准说不清。 覆盖率上传并入 ci.yml 的 test job，作为 continue-on-error 的 step， 且不进 ci-gate 的 needs —— codecov 服务抖动不该把 PR 卡死。 - sonar.yml 缩为纯分析（mvn verify → -DskipTests compile，测试和打包 ci.yml 已做）， 并给「Build and analyze」加 step 级 continue-on-error：step 仍然红、问题不被掩盖， 但 job 结论为 success，不再拖住合并。它从此是质量看板而非门禁，token 另行修。 job 显示名 Build 保持不变——它可能已是分支保护的 required check， 改名会让那条 check 永远 pending、把所有 PR 卡死。 顺带升版 checkout@v2→v7、setup-java@v1→v5、cache@v3→v6。 本地验证（JDK 17.0.20，先清空全部 target/ 模拟全新 checkout）： make ci-syntax exit 0（50 个 module、2301 个源文件真实编译）、 make lint exit 0、make test-cov exit 0（10 tests 全过、jacoco.xml 已生成）。 另用 javac --release 8 对 2301 个 reactor 源文件单独验过 exit 0， 即源码确实只用 Java 8 API，compat.yml 的下界取 8 有据。 同内容已同步到模板仓 opensdk-java 的 template/files/， 否则下一次 codegen 会把这里的改动整个覆盖掉。
兼容矩阵是纯巡检，不参与门禁判定，也没人会盯一个非阻断的定时任务。 声明下界还成不成立是另一个问题，要验的时候手工跑一次即可， 不必为它常驻一条每天运行的 workflow。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
.github/workflows/ci.yml— jobsci-syntax/lint/test, aggregated by a singleci-gatejob.github/workflows/compat.yml— JDK 8/17 matrix, scheduled onlyMakefile: newci-syntaxtarget =mvn -B -DskipTests compilecodecov.yml— itsmvn testis now covered byci.ymlsonar.yml: reduced to Sonar analysis, withcontinue-on-erroron that stepWhy
ci-gateBranch protection only needs
ci-gateas a required check; the jobs behind it can be added or removed without touching the protection settings.Why Sonar became non-blocking
SONAR_TOKENis currently invalid — the "Build and analyze" step has been failing 403 on every run for a long time. While it is red the PR'smergeable_statestaysunstableand never reachesclean, which blocks merges for a reason unrelated to code quality.continue-on-erroris on the step, not the job: the step still goes red so the problem stays visible and someone can fix the token, but the job's conclusion is success. Fixing the token is a separate matter and out of scope here.The job's display name
Buildis deliberately unchanged, in case it is already configured as a required check.One consequence worth stating: the command shrank from
mvn verifytomvn -DskipTests compile, so Sonar no longer receives coverage data. That makes no difference today (nothing is being reported at all), but once the token is fixed, coverage will read 0% until the jacoco report fromci.yml's test job is passed through.Honest note about
lintmake lintin this repo isecho "skipped"— it exits 0 without checking anything. The job is kept so the slot exists when it is filled in, but its green does not mean anything; the gate's value rests entirely onci-syntax+test. This is stated in the Makefile, the workflow header, and inline on the job. Please don't read "java has a lint job" as "java is linted".Verified locally
JDK 17.0.20, after clearing every
target/to avoid a stale-build false pass (the first run exited 0 with 50 ×Nothing to compile):make ci-syntax→ BUILD SUCCESS, 50 modules, 2301 sourcesmake test-cov→ Tests run: 10, Failures: 0, Errors: 0javac --release 8over all 2301 reactor sources → 0ci-gateaggregation script, extracted verbatim and run as a truth table →false/false→ 0, the other three combinations → 1Not verified locally: that
continue-on-errorturns the job green — that needs real Actions. This PR runs the newsonar.ymlon itself, so it is its own test case.