From d90008f8f32bbf352c2831820ff206de9c14b1bc Mon Sep 17 00:00:00 2001
From: David Waltermire <david.waltermire@nist.gov>
Date: Thu, 20 Jul 2023 13:30:52 -0400
Subject: [PATCH] Updated build workflows. (#162)

- Moved website generation to end of build.yml and release.yml
- Removed -Pgpg from website build.
- Updated pom.xml to latest oss-maven version. Cleaned up extra plugin configurations.
---
 .github/workflows/build.yml   | 23 ++++++++++-------------
 .github/workflows/release.yml | 26 ++++++++++++--------------
 pom.xml                       | 32 +++-----------------------------
 3 files changed, 25 insertions(+), 56 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8b72e1be..e9ed2f33 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -25,9 +25,8 @@ jobs:
       with:
         token: ${{ github.token }}
         submodules: recursive
-        fetch-depth: 0
     # -------------------------
-    # Java
+    # Java Environment Setup
     # -------------------------
     - name: Set up Maven
       uses: stCarolas/setup-maven@07fbbe97d97ef44336b7382563d66743297e442f
@@ -61,19 +60,10 @@ jobs:
     # Maven Build
     # -------------------------
     - name: Build and Test Code
+      if: ${{ !((github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref_name == 'develop') }}
       run: |
         mvn -B -e -Prelease -Preporting install
-    - name: Test Website
-      run: |
-        # this needs to be run as a second build to ensure source is fully generated by the previous step
-        mvn -B -e -Prelease -Preporting install site site:stage
-    - name: Perform CodeQL Analysis
-      if: github.event_name == 'push'
-      uses: github/codeql-action/analyze@46ed16ded91731b2df79a2893d3aea8e9f03b5c4
-    # -------------------------
-    # Maven Deploy
-    # -------------------------
-    - name: Deploy SNAPSHOTs
+    - name: Build, Test and DEPLOY SNAPSHOT Code
       if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref_name == 'develop'
       run: |
         mvn -B -e -Pgpg -Prelease -Preporting deploy -Dmaven.deploy.skip=releases
@@ -81,3 +71,10 @@ jobs:
         MAVEN_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
         MAVEN_CENTRAL_TOKEN: ${{ secrets.SONATYPE_PASSWORD }}
         MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+    - name: Perform CodeQL Analysis
+      if: github.event_name == 'push'
+      uses: github/codeql-action/analyze@46ed16ded91731b2df79a2893d3aea8e9f03b5c4
+    - name: Test Website
+      run: |
+        # this needs to be run as a second build to ensure source is fully generated by the previous step
+        mvn -B -e -Prelease -Preporting install site site:stage
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6a97c299..4f3bdb08 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,11 +12,10 @@ jobs:
       actions: read
       contents: write
     steps:
-    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.0.2
+    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
       with:
         token: ${{ github.token }}
         submodules: recursive
-        fetch-depth: 0
     # -------------------------
     # Java
     # -------------------------
@@ -25,28 +24,17 @@ jobs:
       with:
         maven-version: 3.9.3
     - name: Set up JDK 11
-      uses: actions/setup-java@5ffc13f4174014e2d4d4572b3d74c3fa61aeb2c2 # v3.3.0
+      uses: actions/setup-java@5ffc13f4174014e2d4d4572b3d74c3fa61aeb2c2
       with:
         java-version: 11
         distribution: 'temurin'
         cache: 'maven'
-        settings-path: ${{ github.workspace }}
         server-id: ossrh # Value of the distributionManagement/repository/id field of the pom.xml
         server-username: MAVEN_USERNAME # env variable for username in deploy
         server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy
         gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }} # Value of the GPG private key to import
         gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase
     # -------------------------
-    # Maven Site
-    # -------------------------
-    - name: Build Website
-      run: |
-        mvn -B -e -Pgpg -Prelease -Preporting install site site:stage
-    - name: Run Website Deploy Script
-      run: |
-        touch target/staging/.nojekyll
-        bash .github/workflows/deploy.sh --push-only -v -m "Deploying website [ci skip]"
-    # -------------------------
     # Maven Deploy
     # -------------------------
     - name: Deploy Maven Artifacts
@@ -57,3 +45,13 @@ jobs:
         MAVEN_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
         MAVEN_CENTRAL_TOKEN: ${{ secrets.SONATYPE_PASSWORD }}
         MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+    # -------------------------
+    # Maven Site
+    # -------------------------
+    - name: Build Website
+      run: |
+        mvn -B -e -Prelease -Preporting install site site:stage
+    - name: Run Website Deploy Script
+      run: |
+        touch target/staging/.nojekyll
+        bash .github/workflows/deploy.sh --push-only -v -m "Deploying website [ci skip]"
diff --git a/pom.xml b/pom.xml
index 7b503499..06b01310 100644
--- a/pom.xml
+++ b/pom.xml
@@ -4,7 +4,7 @@
 	<parent>
 		<groupId>gov.nist.secauto</groupId>
 		<artifactId>oss-parent</artifactId>
-		<version>25-SNAPSHOT</version>
+		<version>26</version>
 	</parent>
 
 	<groupId>gov.nist.secauto.oscal</groupId>
@@ -27,7 +27,8 @@
 		<url>https://github.com/usnistgov/liboscal-java</url>
 		<connection>scm:git:git@github.com:usnistgov/liboscal-java.git</connection>
 		<developerConnection>scm:git:git@github.com:usnistgov/liboscal-java.git</developerConnection>
-	</scm>
+	  <tag>HEAD</tag>
+    </scm>
 
 	<distributionManagement>
 		<snapshotRepository>
@@ -135,7 +136,6 @@
 
 		<plugin.cyclonedx.version>2.7.3</plugin.cyclonedx.version>
         <plugin.maven-toolchains.version>3.1.0</plugin.maven-toolchains.version>
-		<plugin.spotbugs.version>4.7.3.4</plugin.spotbugs.version>
 
 		<cyclonedx.schema.version>1.3</cyclonedx.schema.version>
 		<oscal-content.commit>main</oscal-content.commit>
@@ -327,32 +327,6 @@
                         </toolchains>
                     </configuration>
                 </plugin>
-				<plugin>
-					<groupId>com.mycila</groupId>
-					<artifactId>license-maven-plugin</artifactId>
-					<configuration>
-						<licenseSets>
-							<licenseSet>
-								<header>license/nist/license.txt</header>
-								<includes>
-									<include>src/**/*.java</include>
-								</includes>
-							</licenseSet>
-						</licenseSets>
-						<failIfMissing>true</failIfMissing>
-					</configuration>
-				</plugin>
-				<plugin>
-					<groupId>org.apache.maven.plugins</groupId>
-					<artifactId>maven-checkstyle-plugin</artifactId>
-					<configuration>
-						<sourceDirectories>
-							<sourceDirectory>${project.build.sourceDirectory}</sourceDirectory>
-							<sourceDirectory>
-								${project.build.testSourceDirectory}</sourceDirectory>
-						</sourceDirectories>
-					</configuration>
-				</plugin>
 				<plugin>
 					<groupId>org.apache.maven.plugins</groupId>
 					<artifactId>maven-pmd-plugin</artifactId>