60 lines
2.5 KiB
YAML
60 lines
2.5 KiB
YAML
# The messaging platform's broker certification lane.
|
|
#
|
|
# Separate from ci-quality-gates.yml because it needs a container runtime and several minutes of it.
|
|
# The lane deliberately carries no Docker guard: every other container suite in the messaging tree
|
|
# skips with a stated reason when Docker is absent, and a certification lane that skipped would
|
|
# report success for a broker nobody started — which is the exact claim the evidence exists to rule
|
|
# out.
|
|
#
|
|
# The job runs the evidence gate rather than the lane, and the gate depends on the lane. What it
|
|
# proves is not only that the scenarios pass but that the committed manifest
|
|
# (messaging-testkit/src/main/resources/messaging/broker-certification-evidence.jsonl) is what this
|
|
# run produced, so "certified against a live broker" cannot be restored by editing a file.
|
|
name: messaging-certification
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- "src/messaging/**"
|
|
- ".github/workflows/messaging-certification.yml"
|
|
schedule:
|
|
- cron: "41 4 * * 3"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
# Reuse would hand one scenario the broker another scenario had already faulted.
|
|
TESTCONTAINERS_REUSE_ENABLE: "false"
|
|
|
|
jobs:
|
|
broker-certification:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
|
|
- name: Validate Gradle wrapper
|
|
id: gradle-wrapper-validation
|
|
uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
|
|
- uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
|
|
with:
|
|
distribution: temurin
|
|
java-version: "21.0.11+10"
|
|
cache: gradle
|
|
cache-dependency-path: |
|
|
src/**/*.gradle
|
|
src/**/gradle-wrapper.properties
|
|
src/**/gradle.lockfile
|
|
- name: Certify the Kafka adapter against a real broker
|
|
working-directory: src
|
|
# GITHUB_SHA is read by the lane and written into every evidence line, because "certified"
|
|
# is a claim about one source tree.
|
|
run: ./gradlew :messaging:messaging-kafka:verifyMessagingCertificationEvidence --no-daemon --stacktrace
|
|
- name: Publish the certification evidence
|
|
if: always()
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact@v4.6.2
|
|
with:
|
|
name: messaging-broker-certification-evidence
|
|
path: src/messaging/messaging-kafka/build/messaging-certification/
|
|
if-no-files-found: warn
|