Bump github/codeql-action from 3.24.5 to 3.24.7

.github/workflows/build-reusable.yaml

@@ -0,0 +1,122 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: build-reusable
+
+on:
+  workflow_call:
+    inputs:
+      java-version:
+        description: The Java compiler version
+        default: 17
+        type: string
+      site-enabled:
+        description: Flag indicating if Maven `site` goal should be run
+        default: false
+        type: boolean
+    secrets:
+      CODECOV_TOKEN:
+        description: Codecov.io token
+        required: true
+
+jobs:
+
+  build:
+
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+
+    steps:
+
+      - name: Checkout repository
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11   # 4.1.1
+        with:
+          # When running on `pull_request` use the PR branch, not the target branch
+          ref: ${{ github.event_name == 'pull_request_target' && github.head_ref || github.ref }}
+
+      - name: Set up Java
+        uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93   # 3.7.0
+        with:
+          distribution: temurin
+          java-version: ${{ inputs.java-version }}
+          java-package: jdk
+          architecture: x64
+          cache: maven
+
+      # We could have used `verify`, but `clean install` is required while generating the build reproducibility report, which is performed in the next step.
+      # For details, see: https://maven.apache.org/guides/mini/guide-reproducible-builds.html#how-to-test-my-maven-build-reproducibility
+      - name: Build
+        id: build
+        shell: bash
+        run: |
+          ./mvnw \
+            --show-version --batch-mode --errors --no-transfer-progress \
+            -DtrimStackTrace=false \
+            -DinstallAtEnd=true \
+            clean install
+
+      - name: Build the website
+        if: inputs.site-enabled
+        shell: bash
+        run: |
+          ./mvnw \
+            --show-version --batch-mode --errors --no-transfer-progress \
+            site
+
+      - name: Upload test coverage
+        uses: codecov/codecov-action@0cfda1dd0a4ad9efc75517f399d859cd1ea4ced1 # 4.0.2
+        with:
+          fail_ci_if_error: true
+          slug: ppkarwasz/logging-log4j2
+          token: ${{ secrets.CODECOV_TOKEN }}
+          verbose: true
+
+      # We upload tests results if the build fails.
+      - name: Upload test results
+        if: failure() && steps.build.conclusion == 'failure'
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3   # 4.3.1
+        with:
+          name: surefire-${{matrix.os}}-${{github.run_number}}-${{github.run_attempt}}
+          path: |
+            **/target/surefire-reports
+            **/target/logs
+
+      # `clean verify artifact:compare` is required to generate the build reproducibility report.
+      # For details, see: https://maven.apache.org/guides/mini/guide-reproducible-builds.html#how-to-test-my-maven-build-reproducibility
+      - name: Verify build reproducibility
+        id: reproducibility
+        shell: bash
+        run: |
+          ./mvnw \
+            --show-version --batch-mode --errors --no-transfer-progress \
+            -DskipTests=true \
+            clean verify artifact:compare
+
+      # We reproducibility results if the build fails.
+      - name: Upload reproducibility results
+        if: failure() && steps.reproducibility.conclusion == 'failure'
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3   # 4.3.1
+        with:
+          name: reproducibility-${{matrix.os}}-${{github.run_number}}-${{github.run_attempt}}
+          path: |
+            **/target/bom.xml
+            **/target/*.buildcompare
+            **/target/*.jar
+            **/target/*.zip
+            **/target/reference/**

.github/workflows/build.yaml

@@ -38,12 +38,14 @@ jobs:
 
   build:
     if: github.actor != 'dependabot[bot]'
-    uses: apache/logging-parent/.github/workflows/build-reusable.yaml@rel/10.6.0
+    uses: ppkarwasz/logging-log4j2/.github/workflows/build-reusable.yaml@2.x
     with:
       java-version: |
         8
         17
       site-enabled: true
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   deploy-snapshot:
     needs: build

.github/workflows/scorecards-analysis.yaml

@@ -70,6 +70,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@47b3d888fe66b639e431abf22ebca059152f1eea    # 2.1.22
+        uses: github/codeql-action/upload-sarif@3ab4101902695724f9365a384f86c1074d94e18c    # 2.1.22
         with:
           sarif_file: results.sarif

log4j-api-test/pom.xml

@@ -164,6 +164,24 @@
   <build>
     <plugins>
 
+      <plugin>
+        <groupId>org.jacoco</groupId>
+        <artifactId>jacoco-maven-plugin</artifactId>
+        <executions>
+          <execution>
+            <id>report-test-coverage</id>
+            <phase>none</phase>
+          </execution>
+          <execution>
+            <id>report-aggregate-test-coverage</id>
+            <goals>
+              <goal>report-aggregate</goal>
+            </goals>
+            <phase>verify</phase>
+          </execution>
+        </executions>
+      </plugin>
+
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-surefire-plugin</artifactId>

log4j-core-test/pom.xml

@@ -351,6 +351,24 @@
   <build>
     <plugins>
 
+      <plugin>
+        <groupId>org.jacoco</groupId>
+        <artifactId>jacoco-maven-plugin</artifactId>
+        <executions>
+          <execution>
+            <id>report-test-coverage</id>
+            <phase>none</phase>
+          </execution>
+          <execution>
+            <id>report-aggregate-test-coverage</id>
+            <goals>
+              <goal>report-aggregate</goal>
+            </goals>
+            <phase>verify</phase>
+          </execution>
+        </executions>
+      </plugin>
+
       <!-- Enable Log4j plugin processing -->
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>

log4j-layout-template-json-test/pom.xml

@@ -126,6 +126,24 @@
   <build>
     <plugins>
 
+      <plugin>
+        <groupId>org.jacoco</groupId>
+        <artifactId>jacoco-maven-plugin</artifactId>
+        <executions>
+          <execution>
+            <id>report-test-coverage</id>
+            <phase>none</phase>
+          </execution>
+          <execution>
+            <id>report-aggregate-test-coverage</id>
+            <goals>
+              <goal>report-aggregate</goal>
+            </goals>
+            <phase>verify</phase>
+          </execution>
+        </executions>
+      </plugin>
+
       <!-- Modules that contain `log4j-core` plugins, must be compiled with: `org.apache.logging.log4j.core.config.plugins.processor.PluginProcessor` -->
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>

log4j-osgi-test/pom.xml

@@ -180,6 +180,24 @@
         </executions>
       </plugin>
 
+      <plugin>
+        <groupId>org.jacoco</groupId>
+        <artifactId>jacoco-maven-plugin</artifactId>
+        <executions>
+          <execution>
+            <id>report-test-coverage</id>
+            <phase>none</phase>
+          </execution>
+          <execution>
+            <id>report-aggregate-test-coverage</id>
+            <goals>
+              <goal>report-aggregate</goal>
+            </goals>
+            <phase>verify</phase>
+          </execution>
+        </executions>
+      </plugin>
+
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-compiler-plugin</artifactId>

pom.xml

@@ -333,6 +333,8 @@
     <maven.site.skip>true</maven.site.skip>
     <maven.site.deploy.skip>true</maven.site.deploy.skip>
 
+    <!-- Maven plugin versions -->
+    <jacoco-maven-plugin.version>0.8.11</jacoco-maven-plugin.version>
   </properties>
 
   <dependencyManagement>
@@ -517,6 +519,18 @@
 
   <build>
 
+    <pluginManagement>
+      <plugins>
+
+        <plugin>
+          <groupId>org.jacoco</groupId>
+          <artifactId>jacoco-maven-plugin</artifactId>
+          <version>${jacoco-maven-plugin.version}</version>
+        </plugin>
+
+      </plugins>
+    </pluginManagement>
+
     <plugins>
 
       <!-- Enable BOM flattening -->
@@ -536,6 +550,31 @@
         </executions>
       </plugin>
 
+      <plugin>
+        <groupId>org.jacoco</groupId>
+        <artifactId>jacoco-maven-plugin</artifactId>
+        <configuration>
+          <includes>
+            <include>org/apache/log4j/**</include>
+            <include>org/apache/logging/log4j/**</include>
+          </includes>
+        </configuration>
+        <executions>
+          <execution>
+            <id>prepare-jacoco-agent</id>
+            <goals>
+              <goal>prepare-agent</goal>
+            </goals>
+          </execution>
+          <execution>
+            <id>report-test-coverage</id>
+            <goals>
+              <goal>report</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
+
       <!-- Apache RAT (Release Audit Tool) check to verify licenses.
            `apache-rat-plugin`: https://creadur.apache.org/rat/apache-rat-plugin/
            Release Audit Tool: https://creadur.apache.org/rat/index.html -->