This is an automated email from the ASF dual-hosted git repository.
pvillard pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/nifi.git
The following commit(s) were added to refs/heads/main by this push:
new 3e12ab9d51a NIFI-15794 Add Validation Steps to GitHub Build Workflow
(#11103)
3e12ab9d51a is described below
commit 3e12ab9d51a40a194b2af13d1e9020c1e92002ad
Author: David Handermann <[email protected]>
AuthorDate: Fri Apr 3 12:20:13 2026 -0500
NIFI-15794 Add Validation Steps to GitHub Build Workflow (#11103)
---
.github/PULL_REQUEST_TEMPLATE.md | 12 ++--
.github/scripts/build/validate-branch-status.sh | 26 ++++++++
.github/scripts/build/validate-commit-messages.sh | 34 +++++++++++
.github/scripts/build/validate-jira-issue.sh | 34 +++++++++++
.github/scripts/build/validate-signed-commits.sh | 38 ++++++++++++
.github/scripts/build/validate-single-commit.sh | 27 +++++++++
.github/scripts/build/validate-title.sh | 27 +++++++++
.github/workflows/{ci-workflow.yml => build.yml} | 70 +++++++++++++++++++++-
README.md | 2 +-
.../nifi/util/locale/TestLocaleOfTestSuite.java | 8 +--
10 files changed, 266 insertions(+), 12 deletions(-)
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 0972900e9b2..4ee2d937df2 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -21,18 +21,18 @@ Please complete the following tracking steps prior to pull
request creation.
### Issue Tracking
-- [ ] [Apache NiFi Jira](https://issues.apache.org/jira/browse/NIFI) issue
created
+- [Apache NiFi Jira](https://issues.apache.org/jira/browse/NIFI) issue created
### Pull Request Tracking
-- [ ] Pull Request title starts with Apache NiFi Jira issue number, such as
`NIFI-00000`
-- [ ] Pull Request commit message starts with Apache NiFi Jira issue number,
as such `NIFI-00000`
-- [ ] Pull request contains [commits
signed](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits)
with a registered key indicating `Verified` status
+- Pull Request title starts with Apache NiFi Jira issue number, such as
`NIFI-00000`
+- Pull Request commit message starts with Apache NiFi Jira issue number, as
such `NIFI-00000`
+- Pull request contains [commits
signed](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits)
with a registered key indicating `Verified` status
### Pull Request Formatting
-- [ ] Pull Request based on current revision of the `main` branch
-- [ ] Pull Request refers to a feature branch with one commit containing
changes
+- Pull Request based on current revision of the `main` branch
+- Pull Request refers to a feature branch with one commit containing changes
# Verification
diff --git a/.github/scripts/build/validate-branch-status.sh
b/.github/scripts/build/validate-branch-status.sh
new file mode 100755
index 00000000000..fbbe1a135d7
--- /dev/null
+++ b/.github/scripts/build/validate-branch-status.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -e
+
+git fetch origin "${TARGET_BRANCH}"
+
+if git merge-base --is-ancestor "origin/${TARGET_BRANCH}" HEAD; then
+ echo "Branch is up to date with origin/${TARGET_BRANCH}"
+else
+ echo "::error::Branch is not up to date with origin/${TARGET_BRANCH}. Rebase
the branch with the latest changes from ${TARGET_BRANCH}."
+ exit 1
+fi
diff --git a/.github/scripts/build/validate-commit-messages.sh
b/.github/scripts/build/validate-commit-messages.sh
new file mode 100755
index 00000000000..840f74fb65a
--- /dev/null
+++ b/.github/scripts/build/validate-commit-messages.sh
@@ -0,0 +1,34 @@
+#!/bin/bash
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -e
+
+INVALID=0
+COMMITS=$(gh api "repos/${REPOSITORY}/pulls/${PR_NUMBER}/commits" --jq
'.[].commit.message | split("\n") | .[0]')
+
+while IFS= read -r FIRST_LINE; do
+ if ! echo "${FIRST_LINE}" | grep -qP '^NIFI-[1-9][0-9]+'; then
+ echo "::error::Commit message does not start with Apache NiFi Jira issue
number: ${FIRST_LINE}"
+ INVALID=1
+ fi
+done <<< "${COMMITS}"
+
+if [ "${INVALID}" -eq 1 ]; then
+ echo "::error::All commit messages must start with an Apache NiFi Jira issue
number such as NIFI-00000"
+ exit 1
+fi
+
+echo "All commit messages start with a valid Apache NiFi Jira issue number"
diff --git a/.github/scripts/build/validate-jira-issue.sh
b/.github/scripts/build/validate-jira-issue.sh
new file mode 100755
index 00000000000..e8657643b84
--- /dev/null
+++ b/.github/scripts/build/validate-jira-issue.sh
@@ -0,0 +1,34 @@
+#!/bin/bash
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -e
+
+ISSUE_KEY=$(echo "${PR_TITLE}" | grep -oP '^NIFI-[1-9][0-9]+' || true)
+
+if [ -z "${ISSUE_KEY}" ]; then
+ echo "::error::Apache NiFi Jira issue number not found in Pull Request title"
+ exit 1
+fi
+
+JIRA_URL="https://issues.apache.org/jira/rest/api/2/issue/${ISSUE_KEY}";
+HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${JIRA_URL}")
+
+if [ "${HTTP_STATUS}" -eq 200 ]; then
+ echo "Apache NiFi Jira issue ${ISSUE_KEY} found"
+else
+ echo "::error::Apache NiFi Jira issue ${ISSUE_KEY} not found: HTTP
${HTTP_STATUS}. Create an issue at https://issues.apache.org/jira/browse/NIFI";
+ exit 1
+fi
diff --git a/.github/scripts/build/validate-signed-commits.sh
b/.github/scripts/build/validate-signed-commits.sh
new file mode 100755
index 00000000000..8a7e6ac2cc0
--- /dev/null
+++ b/.github/scripts/build/validate-signed-commits.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Validates that all pull request commits are signed with a verified key.
+# Requires: GH_TOKEN, REPOSITORY, PR_NUMBER
+
+set -e
+
+INVALID=0
+RESULTS=$(gh api "repos/${REPOSITORY}/pulls/${PR_NUMBER}/commits" --jq '.[] |
(.sha[:8] + " " + (.commit.verification.verified | tostring))')
+
+while IFS= read -r LINE; do
+ SHA=$(echo "${LINE}" | awk '{print $1}')
+ VERIFIED=$(echo "${LINE}" | awk '{print $2}')
+ if [ "${VERIFIED}" != "true" ]; then
+ echo "::error::Commit ${SHA} is not signed. See
https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits";
+ INVALID=1
+ fi
+done <<< "${RESULTS}"
+
+if [ "${INVALID}" -eq 1 ]; then
+ exit 1
+fi
+
+echo "All commits are signed and verified"
diff --git a/.github/scripts/build/validate-single-commit.sh
b/.github/scripts/build/validate-single-commit.sh
new file mode 100755
index 00000000000..7e9d4e43a01
--- /dev/null
+++ b/.github/scripts/build/validate-single-commit.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Validates that the pull request contains exactly one commit.
+# Requires: COMMIT_COUNT
+
+set -e
+
+if [ "${COMMIT_COUNT}" -eq 1 ]; then
+ echo "Pull request contains a single commit"
+elif [ "${GITHUB_EVENT_ACTION}" == "opened" ]; then
+ echo "::error::Pull request contains ${COMMIT_COUNT} commits. Squash commits
into a single commit for initial review."
+ exit 1
+fi
diff --git a/.github/scripts/build/validate-title.sh
b/.github/scripts/build/validate-title.sh
new file mode 100755
index 00000000000..2c85ecd0204
--- /dev/null
+++ b/.github/scripts/build/validate-title.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Validates that the pull request title starts with a Jira issue number.
+# Requires: PR_TITLE
+
+set -e
+
+if echo "${PR_TITLE}" | grep -qP '^NIFI-[1-9][0-9]+'; then
+ echo "Pull Request title starts with valid Apache NiFi Jira issue number"
+else
+ echo "::error::Pull Request title must start with an Apache NiFi Jira issue
number such as NIFI-00000"
+ exit 1
+fi
diff --git a/.github/workflows/ci-workflow.yml b/.github/workflows/build.yml
similarity index 78%
rename from .github/workflows/ci-workflow.yml
rename to .github/workflows/build.yml
index c3b152bec1c..8582545f9ce 100644
--- a/.github/workflows/ci-workflow.yml
+++ b/.github/workflows/build.yml
@@ -13,7 +13,7 @@
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
-name: ci-workflow
+name: build
on: [push, pull_request]
@@ -56,10 +56,72 @@ permissions:
pull-requests: read
jobs:
+ validate-pull-request:
+ timeout-minutes: 10
+ runs-on: ubuntu-24.04
+ name: Validate Pull Request
+ if: github.event_name == 'pull_request' && github.repository ==
'apache/nifi'
+ steps:
+ - name: Checkout Code
+ uses: actions/checkout@v6
+ with:
+ fetch-depth: 0
+ - name: Validate Title
+ id: validate-title
+ continue-on-error: true
+ env:
+ PR_TITLE: ${{ github.event.pull_request.title }}
+ run: .github/scripts/build/validate-title.sh
+ - name: Validate Jira Issue
+ id: validate-jira-issue
+ continue-on-error: true
+ env:
+ PR_TITLE: ${{ github.event.pull_request.title }}
+ run: .github/scripts/build/validate-jira-issue.sh
+ - name: Validate Commit Messages
+ id: validate-commit-messages
+ continue-on-error: true
+ env:
+ GH_TOKEN: ${{ github.token }}
+ REPOSITORY: ${{ github.repository }}
+ PR_NUMBER: ${{ github.event.pull_request.number }}
+ run: .github/scripts/build/validate-commit-messages.sh
+ - name: Validate Signed Commits
+ id: validate-signed-commits
+ continue-on-error: true
+ env:
+ GH_TOKEN: ${{ github.token }}
+ REPOSITORY: ${{ github.repository }}
+ PR_NUMBER: ${{ github.event.pull_request.number }}
+ run: .github/scripts/build/validate-signed-commits.sh
+ - name: Validate Branch Status
+ id: validate-branch-status
+ continue-on-error: true
+ env:
+ TARGET_BRANCH: ${{ github.event.pull_request.base.ref }}
+ run: .github/scripts/build/validate-branch-status.sh
+ - name: Validate Single Commit
+ id: validate-single-commit
+ continue-on-error: true
+ env:
+ COMMIT_COUNT: ${{ github.event.pull_request.commits }}
+ GITHUB_EVENT_ACTION: ${{ github.event.action }}
+ run: .github/scripts/build/validate-single-commit.sh
+ - name: Evaluate Validation Results
+ env:
+ VALIDATION_FAILED: ${{ contains(steps.*.outcome, 'failure') }}
+ run: |
+ if [[ "${VALIDATION_FAILED}" == "true" ]]; then
+ echo "::error::Pull request validation failed"
+ exit 1
+ fi
+
ubuntu-build-en:
timeout-minutes: 120
runs-on: ubuntu-24.04
name: Ubuntu Corretto JDK 21 EN
+ needs: validate-pull-request
+ if: ${{ !cancelled() && (needs.validate-pull-request.result == 'success'
|| needs.validate-pull-request.result == 'skipped') }}
steps:
- name: Clear Disk Space
run: |
@@ -133,6 +195,8 @@ jobs:
timeout-minutes: 120
runs-on: ubuntu-24.04
name: Ubuntu Corretto JDK 25 EN
+ needs: validate-pull-request
+ if: ${{ !cancelled() && (needs.validate-pull-request.result == 'success'
|| needs.validate-pull-request.result == 'skipped') }}
steps:
- name: Clear Disk Space
run: |
@@ -206,6 +270,8 @@ jobs:
timeout-minutes: 150
runs-on: macos-15
name: MacOS Zulu JDK 21 JP
+ needs: validate-pull-request
+ if: ${{ !cancelled() && (needs.validate-pull-request.result == 'success'
|| needs.validate-pull-request.result == 'skipped') }}
steps:
- name: System Information
run: |
@@ -281,6 +347,8 @@ jobs:
timeout-minutes: 150
runs-on: windows-2025
name: Windows Zulu JDK 21 FR
+ needs: validate-pull-request
+ if: ${{ !cancelled() && (needs.validate-pull-request.result == 'success'
|| needs.validate-pull-request.result == 'skipped') }}
steps:
- name: System Information
run: |
diff --git a/README.md b/README.md
index de7bc4882d2..c871c48f3fd 100644
--- a/README.md
+++ b/README.md
@@ -19,7 +19,7 @@
### Status
-[](https://github.com/apache/nifi/actions/workflows/ci-workflow.yml)
+[](https://github.com/apache/nifi/actions/workflows/build.yml)
[](https://github.com/apache/nifi/actions/workflows/system-tests.yml)
[](https://github.com/apache/nifi/actions/workflows/integration-tests.yml)
[](https://github.com/apache/nifi/actions/workflows/docker-tests.yml)
diff --git
a/nifi-commons/nifi-utils/src/test/java/org/apache/nifi/util/locale/TestLocaleOfTestSuite.java
b/nifi-commons/nifi-utils/src/test/java/org/apache/nifi/util/locale/TestLocaleOfTestSuite.java
index 4a7b151f943..2303a714019 100644
---
a/nifi-commons/nifi-utils/src/test/java/org/apache/nifi/util/locale/TestLocaleOfTestSuite.java
+++
b/nifi-commons/nifi-utils/src/test/java/org/apache/nifi/util/locale/TestLocaleOfTestSuite.java
@@ -27,12 +27,12 @@ import static org.junit.jupiter.api.Assumptions.assumeTrue;
/**
* Testing of the test suite environment {@link java.util.Locale}. The
locales specified
- * in ".github/workflows/ci-workflow.yml" are exercised. This test is inert
when run in alternate locales.
+ * in ".github/workflows/build.yml" are exercised. This test is inert when
run in alternate locales.
*/
public class TestLocaleOfTestSuite {
/**
- * Test behaviors associated with non-standard
".github/workflows/ci-workflow.yml" {@link java.util.Locale} "en-AU".
+ * Test behaviors associated with non-standard
".github/workflows/build.yml" {@link java.util.Locale} "en-AU".
*/
@Test
public void testLocaleCI_EN_AU() {
@@ -44,7 +44,7 @@ public class TestLocaleOfTestSuite {
}
/**
- * Test behaviors associated with ".github/workflows/ci-workflow.yml"
{@link java.util.Locale#JAPAN}.
+ * Test behaviors associated with ".github/workflows/build.yml" {@link
java.util.Locale#JAPAN}.
*/
@Test
public void testLocaleCI_JA_JP() {
@@ -56,7 +56,7 @@ public class TestLocaleOfTestSuite {
}
/**
- * Test behaviors associated with ".github/workflows/ci-workflow.yml"
{@link java.util.Locale#FRANCE}.
+ * Test behaviors associated with ".github/workflows/build.yml" {@link
java.util.Locale#FRANCE}.
*/
@Test
public void testLocaleCI_FR_FR() {
