Apply CI changes from v5

Author: ascopes

.github/dependabot.yml

@@ -7,6 +7,8 @@ updates:
     schedule:
       interval: weekly
       day: monday
+      time: "06:00"
+      timezone: Europe/London
     target-branch: main
     assignees:
       - ascopes
@@ -19,6 +21,8 @@ updates:
     schedule:
       interval: weekly
       day: monday
+      time: "06:00"
+      timezone: Europe/London
     target-branch: main
     assignees:
       - ascopes

.github/workflows/build.yml

@@ -20,22 +20,36 @@ jobs:
       matrix:
         os-name: [ubuntu-latest]
         java-version:
-          - 11  # LTS
           - 17  # LTS
           - 21  # LTS
+          - GA  # General access
+        include:
+          - os-name: windows-latest
+            java-version: GA
+          - os-name: macos-latest
+            java-version: GA
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           fetch-depth: 2
 
-      - name: Initialize JDK
+      - name: Initialize Zulu JDK
+        if: matrix.java-version != 'GA'
         uses: actions/setup-java@v4
         with:
           check-latest: true
           distribution: zulu
           java-version: ${{ matrix.java-version }}
 
+      - name: Initialize Oracle JDK
+        if: matrix.java-version == 'GA'
+        uses: oracle-actions/setup-java@v1
+        with:
+          website: jdk.java.net
+          release: ${{ matrix.java-version }}
+
       - name: Maven cache
         uses: actions/cache@v4
         env:
@@ -44,7 +58,7 @@ jobs:
           path:
             ~/.m2
           key: build-${{ env.cache-name }}
-          
+
       - name: Compile and run tests
         shell: bash
         run: ./mvnw -B -U clean verify
@@ -66,3 +80,22 @@ jobs:
             **/failsafe-reports/**
             **/build*.log
           retention-days: 30
+
+  notify-coverage:
+    name: Notify of coverage
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    needs:
+      - build
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Publish code coverage
+        uses: codecov/codecov-action@v5
+        continue-on-error: true
+        if: always()
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          fail_ci_if_error: true
+          run_command: send-notifications

.github/workflows/deploy.yml

@@ -1,4 +1,4 @@
-name: Deploy a branch
+name: Release New Version
 
 on:
   workflow_dispatch:
@@ -8,14 +8,19 @@ on:
         default: false
         type: boolean
 
+      skip-tests:
+        description: "Skip unit and integration tests"
+        default: false
+        type: boolean
+
       version:
         description: "Override deployment version"
         default: ""
         type: string
 
 jobs:
-  maven-central:
-    name: Deploy to Maven Central
+  release:
+    name: Release
     environment:
       name: maven-central
       url: https://repo1.maven.org/maven2/io/github/ascopes/jct/java-compiler-testing/
@@ -35,26 +40,21 @@ jobs:
         uses: actions/setup-java@v4
         with:
           distribution: zulu
-          # Must use >= JDK 17 for Javadocs to generate correctly
-          java-version: 23
-          server-id: ossrh
-          server-username: OSSRH_USERNAME
-          server-password: OSSRH_TOKEN
+          java-version: 24
+          server-id: central
+          server-username: CENTRAL_USERNAME
+          server-password: CENTRAL_TOKEN
           gpg-passphrase: GPG_PASSPHRASE
           gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
 
-      - name: Deploy to staging
-        shell: bash
+      - name: Configure Git
         run: |-
           git config user.name '${{ github.actor }}'
           git config user.email '${{ github.actor }}@users.noreply.github.com'
 
-          group_id="$(./mvnw help:evaluate -q -DforceStdout -Dexpression="project.groupId")"
-          echo "group_id=${group_id}" >> "${GITHUB_ENV}"
-
-          artifact_id="$(./mvnw help:evaluate -q -DforceStdout -Dexpression="project.artifactId")"
-          echo "artifact_id=${artifact_id}" >> "${GITHUB_ENV}"
-
+      - name: Create Maven Central Release
+        shell: bash
+        run: |-
           if [[ '${{ inputs.version }}' == "" ]]; then
             release_version="$(./mvnw -B help:evaluate -Dexpression=project.version -q -DforceStdout | sed 's/-SNAPSHOT//g')"
           else
@@ -65,50 +65,26 @@ jobs:
           ./mvnw -B -e \
               -Preleases \
               -DdryRun='${{ inputs.dry-run }}' \
+              -Dinvoker.skip='${{ inputs.skip-tests }}' \
               -Dpassword='${{ secrets.GITHUB_TOKEN }}' \
               -DreleaseVersion="${release_version}" \
               -DsignTag=false \
+              -DskipTests='${{ inputs.skip-tests }}' \
               -Dtag="v${release_version}" \
               clean verify release:prepare release:perform
-
-          echo "Created staging release for ${group_id}/${artifact_id}/${release_version}"
         env:
-          OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
-          OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }}
+          CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
+          CENTRAL_TOKEN: ${{ secrets.CENTRAL_TOKEN }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
-      - name: Promote Maven Central Staging Release
-        if: ${{ ! inputs.dry-run }}
-        shell: bash
-        run: |-
-          echo "Will now promote ${group_id}/${artifact_id}/${release_version} to Maven Central"
-
-          ./scripts/close-nexus-repository.sh \
-              -u "${OSSRH_USERNAME}" \
-              -p "${OSSRH_TOKEN}" \
-              -g "${group_id}" \
-              -a "${artifact_id}" \
-              -v "${release_version}" \
-              -s "https://s01.oss.sonatype.org/"
-
-          echo "Promoted staging ${group_id}/${artifact_id}/${release_version} to Maven Central successfully"
-        env:
-          OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
-          OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }}
-          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
-
-      - name: Abort and rollback staging release
+      - name: Revert Maven Central Release
         if: ${{ failure() }}
         run: |-
           ./mvnw -B -e \
               -Dpassword='${{ secrets.GITHUB_TOKEN }}' \
               -DreleaseVersion="${release_version}" \
               -Dtag="v${release_version}" \
               release:rollback
-        env:
-          OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
-          OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }}
-          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
       - name: Create GitHub Release
         if: ${{ ! inputs.dry-run }}

.github/workflows/security.yml

@@ -3,6 +3,7 @@ on:
   push:
     branches:
       - main
+      - v5
 
 jobs:
   submit-dependency-snapshot: