Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
Windows Tipps & SecurityLernen Sie Linux-Befehle mit Webminal direkt im Browser(24.09.2026 um 08:00 Uhr)
Sicherheitslücken (CVE)USN-8811-1: urllib3 vulnerability(24.09.2026 um 03:39 Uhr)
Sichere ProgrammierungYour Agent Has Observability. It Doesn't Have Evals.(24.09.2026 um 07:43 Uhr)
Sichere ProgrammierungProtocol Upgrade Compatibility Review: Robinhood(24.09.2026 um 07:45 Uhr)
Sichere ProgrammierungYour tests share your blind spots. Readers don't.(24.09.2026 um 07:52 Uhr)
Sichere ProgrammierungYour AI agent has more permissions than your users(24.09.2026 um 07:54 Uhr)
Windows Tipps & SecurityLernen Sie Linux-Befehle mit Webminal direkt im Browser(24.09.2026 um 08:00 Uhr)
Sicherheitslücken (CVE)USN-8811-1: urllib3 vulnerability(24.09.2026 um 03:39 Uhr)
Sichere ProgrammierungYour Agent Has Observability. It Doesn't Have Evals.(24.09.2026 um 07:43 Uhr)
Sichere ProgrammierungProtocol Upgrade Compatibility Review: Robinhood(24.09.2026 um 07:45 Uhr)
Sichere ProgrammierungYour tests share your blind spots. Readers don't.(24.09.2026 um 07:52 Uhr)
Sichere ProgrammierungYour AI agent has more permissions than your users(24.09.2026 um 07:54 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

Automating Java Builds with GitHub Actions

We've all been there. You write code, it runs perfectly on your laptop, you push it, and... the build breaks for everyone else. Or worse, a bug sneaks into production because someone forgot to run the tests. This is where Continuous…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

We've all been there. You write code, it runs perfectly on your laptop, you push it, and... the build breaks for everyone else. Or worse, a bug sneaks into production because someone forgot to run the tests.



This is where Continuous Integration (CI) comes in.



In this guide, we are going to break down a very simple GitHub Actions workflow that automatically builds and tests 2 Microservices application (Order Service & Product Service) every time you push code.






What Problem Does This Solve?



Before we look at the code, let's understand why we need it. This YAML file lives in your repository. It solves three massive problems:




  • Consistency: It builds your code in a clean, neutral environment (Ubuntu), not on your potentially messy laptop.


  • Early Bug Detection: It runs your tests automatically on every Pull Request. You can't merge broken code.


  • Monorepo Support: It handles multiple services (OrderService and ProductService) in a single repository, ensuring a change in one doesn't break the other.







The Workflow File



Here is the complete ci.yml file we will be analyzing:





name: Java CI with Maven

on:
push:
branches: [ "main" ]
pull_request:
branches: [ "main" ]
workflow_dispatch:

jobs:
build:
runs-on: ubuntu-latest

steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Set up JDK 17
uses: actions/setup-java@v4
with:
java-version: '17'
distribution: 'temurin'
cache: maven

- name: Build and Test Order Service
working-directory: ./OrderService
run: |
chmod +x mvnw
./mvnw clean verify

- name: Build and Test Product Service
working-directory: ./ProductService
run: |
chmod +x mvnw
./mvnw clean verify









The Code Breakdown



Let's dissect the configuration line by line.



1.The Setup & Triggers





name: Java CI with Maven

on:
push:
branches: [ "main" ]
pull_request:
branches: [ "main" ]
workflow_dispatch:






name: This is how the workflow appears in the "Actions" tab on GitHub.



on: These are the triggers. When does this robot wake up?



push: Runs whenever code is pushed to the main branch.



pull_request: Runs whenever someone tries to merge code into main (Crucial for code review!).



workflow_dispatch: A feature that lets you manually click a "Run Workflow" button in the GitHub UI (great for debugging).



2.The Environment (The Job)





jobs:
build:
runs-on: ubuntu-latest






jobs: A workflow is made of one or more jobs. Here, we just have one called build.



runs-on: ubuntu-latest: This tells GitHub to provision a fresh virtual machine running the latest version of Ubuntu Linux. This is where your code will be downloaded and tested.



3.The Steps (The Actual Work)



Step A: Get the Code





steps:
- name: Checkout code
uses: actions/checkout@v4






uses: This keyword pulls in a pre-made script from the GitHub Marketplace. actions/checkout is the standard action that clones your repository onto the Ubuntu runner so the script can access your files.



Step B: Prepare Java





- name: Set up JDK 17
uses: actions/setup-java@v4
with:
java-version: '17'
distribution: 'temurin'
cache: maven






uses: actions/setup-java: Installs Java on the runner.



distribution: 'temurin': Specifies which vendor of Java to use (Eclipse Temurin is a popular choice).



cache: maven: This speeds up your build massively! It remembers your downloaded dependencies (JARs) so it doesn't have to re-download the internet every time the build runs.



Step C: Build the Microservices





- name: Build and Test Order Service
working-directory: ./OrderService
run: |
chmod +x mvnw
./mvnw clean verify






This is where the magic happens. Since you have a monorepo (multiple projects in one folder), we handle them separately.



working-directory: Tells the runner to cd (change directory) into ./OrderService before running commands.



chmod +x mvnw: Grants execution permission to the Maven Wrapper.



./mvnw clean verify: The command that actually builds your app.



Why mvnw and not mvn? The "Wrapper" ensures the build uses the exact Maven version defined in your project.



Why verify? In the Maven lifecycle, verify runs validation, compilation, unit tests, and integration tests. It is more robust than just install.






How to Set This Up in GitHub




  • Open your project locally or on GitHub.


  • Create the directory structure: Inside your project root, create a folder named .github and inside that, a folder named workflows.




Path: .github/workflows/




  • Create the file: Create a new file named ci.yml.


  • Paste the code: Copy the YAML code we analyzed above into this file.




Commit and Push:





git add .github/workflows/ci.yml
git commit -m "Add CI pipeline"
git push origin main






That's it!



Go to the "Actions" tab in your GitHub repository. You will see your workflow spinning up. If the circles turn Green, your code is safe. If they turn Red, you broke the build—and thankfully, you found out before your users did.



Sample Setup : https://github.com/Rohithv07/OnlineShopping/blob/main/.github/workflows/ci.yml

CTI Threat Relationship Graph3 Knoten / 2 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
SOC Incident Playbook: Vulnerability Remediation & Verification
title: Detect Exploitation - Automating Java Builds with GitHub Actions
id: 3d01a243-ceb7-40e8-8401-ded01ab04acc
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "Automating Java Builds with Gi" ascii wide
    condition:
        any of them
}
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Automating Java Builds with GitHub Actio.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Automating Java Builds with GitHub Actions

Thematisch verwandte Begriffe: Automating, Java, Builds, with · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-96676 | A vulnerability was identified in Fast FAC1900R 20190827_2.0.2. The impa…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick