Maven CI

验证：未记录

适用版本: 未记录
验证范围: 尚未登记验证记录。

本文缩写（英文全称与中文含义）

缩写	英文全称／名称	中文含义
CI	Continuous Integration	持续集成
OS	Operating System	操作系统

Links#

https://maven.apache.org/guides/mini/guide-deployment-security-settings.html
https://maven.apache.org/settings.html
https://docs.github.com/en/actions
https://www.jenkins.io/doc/

1. Important Points#

CI rules:
    use ./mvnw
    use -B batch mode
    cache ~/.m2/repository
    inject settings.xml from secret
    publish test reports and coverage reports

2. Standard Commands#

./mvnw -B clean verify
./mvnw -B clean deploy

verify:
    compile, test, integration checks, quality gates

deploy:
    publish artifact to remote repository

3. Jenkins#

pipeline {
  agent any

  environment {
    MAVEN_OPTS = '-Dfile.encoding=UTF-8'
  }

  stages {
    stage('Test') {
      steps {
        sh './mvnw -B clean verify'
      }
      post {
        always {
          junit '**/target/surefire-reports/*.xml'
          archiveArtifacts artifacts: '**/target/site/jacoco/**', allowEmptyArchive: true
        }
      }
    }

    stage('Deploy') {
      when { branch 'main' }
      steps {
        withCredentials([file(credentialsId: 'maven-settings', variable: 'MAVEN_SETTINGS')]) {
          sh './mvnw -B -s "$MAVEN_SETTINGS" clean deploy'
        }
      }
    }
  }
}

4. GitHub Actions#

name: maven

on:
  push:
  pull_request:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'
          cache: maven
      - run: ./mvnw -B clean verify

5. Private Repository Settings#

cat > settings.xml <<'EOF'
<settings>
  <servers>
    <server>
      <id>company-releases</id>
      <username>${env.MAVEN_REPO_USER}</username>
      <password>${env.MAVEN_REPO_PASSWORD}</password>
    </server>
  </servers>
</settings>
EOF

./mvnw -B -s settings.xml clean deploy

仓库凭据通过 CI Secret 注入 settings.xml，不提交到 Git；构建日志和归档产物也不能包含凭据。

settings.xml:
    generate in CI workspace
    do not commit credentials

6. Docker Build In CI#

./mvnw -B clean package -DskipTests
docker build -t registry.example.com/order-api:${GIT_COMMIT} .

docker build --secret id=maven_settings,src="$HOME/.m2/settings.xml" -t registry.example.com/order-api:${GIT_COMMIT} .

7. Checklist#

check:
    tests cannot be silently skipped
    dependency cache is scoped by OS and pom hash
    deploy credentials are branch-protected
    release job writes artifact and tag once
    test/coverage/security reports are archived