shared-actions/maven-build/README.md

maven-build

Action for building and validating Maven projects.

Inputs

Input	Required	Default	Description
java-version	No	25	Java version to set up for the build
maven-version	No	3.9.15	Maven version to set up for the build
distribution	No	temurin	JDK distribution to use
phase	No	verify	Build phase to execute: verify runs code-quality checks; deploy builds and pushes a Docker image
verify-goals	No	spotless:check checkstyle:check test	Space-separated Maven goals to run during the verify phase
maven-profile	No	test	Maven profile to activate during deploy
service-dir	No	.	Working directory for the Maven build
maven-settings	Yes	—	Secret containing the settings.xml content used for repository authentication
extra-args	No	""	Additional Maven arguments appended to the build command

Outputs

Output	Description
image-tag	The Docker image tag used during the deploy phase

Usage

Verify (code quality + tests)

- uses: https://schmalz-git.git.onstackit.cloud/schmalz/shared-actions/maven-build@maven-build-v1
  with:
    maven-settings: ${{ secrets.MAVEN_SETTINGS }}

Deploy (build and push Docker image)

- uses: https://schmalz-git.git.onstackit.cloud/schmalz/shared-actions/maven-build@maven-build-v1
  with:
    phase: deploy
    maven-profile: prod
    maven-settings: ${{ secrets.MAVEN_SETTINGS }}

Multi-module project

- uses: https://schmalz-git.git.onstackit.cloud/schmalz/shared-actions/maven-build@maven-build-v1
  with:
    service-dir: my-service
    maven-settings: ${{ secrets.MAVEN_SETTINGS }}

Notes

• The maven-settings input is written to a temporary file (/tmp/maven-settings.xml) and removed after the build, even on failure.
• During the deploy phase, the image tag is generated as <FORGEJO_SHA>-<unix-timestamp> and exposed via the image-tag output.
• Third-party actions used internally are pinned to exact commit SHAs to prevent supply chain attacks.