chore: refactored the github workflows#928
Conversation
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - name: Set up Gradle | ||
| uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # pin@v5 | ||
| with: | ||
| gradle-version: wrapper | ||
| cache-cleanup: on-success |
There was a problem hiding this comment.
The setup action no longer validates the Gradle wrapper (gradle/wrapper/gradle-wrapper.properties + gradlew) before executing it. Please add back a wrapper validation step (e.g., gradle/wrapper-validation-action) early in this composite action to reduce supply-chain risk in CI.
There was a problem hiding this comment.
Not valid as the set-up action will perform the wrapper validation on each execution
Starting with v4 the setup-gradle action will [perform wrapper validation](https://github.com/gradle/actions/blob/main/docs/setup-gradle.md#gradle-wrapper-validation) on each execution. If you are using setup-gradle in your workflows, it is unlikely that you will need to use the wrapper-validation action.
| uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # pin@v4 | ||
| with: | ||
| distribution: 'temurin' | ||
| java-version: '17' |
There was a problem hiding this comment.
This composite action declares a required java-version input, but the setup-java step hard-codes java-version: '17'. Either wire this step to ${{ inputs.java-version }} or remove the unused input to avoid confusing callers.
| java-version: '17' | |
| java-version: ${{ inputs.java-version }} |
| - name: Set up Gradle | ||
| uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # pin@v5 |
There was a problem hiding this comment.
The workflow runs ./gradlew during publishing without validating the Gradle wrapper first. Consider adding gradle/wrapper-validation-action after checkout (before setup-gradle) to prevent executing a tampered wrapper in CI.
Changes
This PR refactors the existing Github workflows to use setup actions, Gradle caching and parallel execution to speed up build time
Checklist
I have read the Auth0 general contribution guidelines
I have read the Auth0 Code of Conduct
All existing and new tests complete without errors