build: reproducible build + retire the unverified Travis Maven download #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Build + unit tests. Replaces the abandoned Travis config, which fetched a Maven | |
| # distribution over the network with no integrity check (CWE-494). | |
| # | |
| # Rules for this file: | |
| # * every third-party action is pinned by full commit SHA, never a mutable tag; | |
| # * Maven comes from the runner image / setup-java, never an ad-hoc download; | |
| # * `-C` makes Maven FAIL (not warn) on a checksum mismatch for any artifact. | |
| name: Build | |
| on: | |
| pull_request: | |
| branches: ["master", "main"] | |
| push: | |
| branches: ["master", "main"] | |
| permissions: | |
| contents: read | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| java: ['8', '11', '17'] | |
| name: build (JDK ${{ matrix.java }}) | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 | |
| with: | |
| distribution: temurin | |
| java-version: ${{ matrix.java }} | |
| cache: maven | |
| # -C = strict checksum policy: a checksum mismatch on any resolved artifact | |
| # fails the build instead of printing a warning. | |
| - name: Build and test | |
| run: mvn -B -C -Dgpg.skip clean verify |