ci-validate-bom.yaml

# Copyright 2023 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# Github action job to test core java library features on
# downstream client libraries before they are released.
on:
  push:
    branches:
    - main
  pull_request:
name: test for tests/validate-bom logic
jobs:
  test-invalid-bom:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Fetch the bad protobuf-bom version 3.22.1
      shell: bash
      # 3.22.1 had a issue in their pom.xml
      # https://github.com/protocolbuffers/protobuf/issues/12170
      run: |
        mkdir -p bad-protobuf-bom
        curl https://repo1.maven.org/maven2/com/google/protobuf/protobuf-bom/3.22.1/protobuf-bom-3.22.1.pom \
            --output bad-protobuf-bom/pom.xml
    - name: Check the bad BOM
      uses: ./tests/validate-bom
      id: validate-bom
      with:
        bom-path: bad-protobuf-bom/pom.xml
      continue-on-error: true
    - name: Ensure the validate-bom invalidated the bad BOM
      shell: bash
      if: steps.validate-bom.outcome != 'failure'
      run: |
        echo "The validate-bom check should have invalidated the bad BOM"
        exit 1