ci.yml

name: CI

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}

on:
  push:
    branches:
      - main
    paths-ignore:
      - '.github/**'
      - '!.github/workflows/ci.yml'
      - '.sdkmanrc'
      - 'renovate.json5'
      - '*.md'
  schedule:
    - cron: '0 11,23 * * *'
  workflow_dispatch:

jobs:
  build:
    name: Build and test (Maven)

    runs-on: ubuntu-latest

    permissions:
      contents: write

    steps:
      - name: Check out repository
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
        with:
          fetch-depth: 0
          show-progress: false

      - name: Set up Java
        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
        with:
          distribution: 'zulu'
          java-version-file: '.java-version'
          server-id: ossrh
          server-username: OSSRH_USERNAME
          server-password: OSSRH_TOKEN
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE

      - name: Cache local Maven repository
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
          path: |
            ~/.m2/repository
            ~/.m2/wrapper
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml', '.mvn/wrapper/maven-wrapper.properties') }}
          restore-keys: |
            ${{ runner.os }}-maven-

      - name: Build and test, with coverage
        run: ./mvnw -B -ntp -P coverage install

      - name: Upload build output
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        if: always()
        with:
          name: maven-build-output
          path: |
            **/target/site/jacoco-aggregate/
            **/target/surefire-reports/
            **/target/test-classes/projects/*/project/*/src/
            **/target/test-classes/projects/*/project/*/build.log
            **/target/test-classes/projects/*/project/*/pom.xml
            **/target/checkstyle-result.xml
            **/.flattened-pom.xml
          retention-days: 15

      - name: Cache SonarCloud packages
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
          restore-keys: ${{ runner.os }}-sonar

      - name: Analyze
        run: ./mvnw -B -ntp sonar:sonar -Dsonar.host.url="$SONAR_HOST_URL" -Dsonar.organization="$SONAR_ORGANIZATION" -Dsonar.projectKey="$SONAR_PROJECTKEY"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}
          SONAR_ORGANIZATION: ${{ vars.SONAR_ORGANIZATION }}
          SONAR_PROJECTKEY: ${{ vars.SONAR_PROJECTKEY }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

      - name: Publish artifacts
        run: ./mvnw -B -ntp -P release deploy -Dquickly -Dmaven.install.skip=true -Dgpg.keyname="$MAVEN_GPG_KEYNAME"
        env:
          MAVEN_GPG_KEYNAME: 0x${{ vars.GPG_KEY_ID }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
          OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
          OSSRH_TOKEN: ${{ secrets.OSSRH_TOKEN }}

      - name: Stage site
        run: ./mvnw -B -ntp -P coverage,release site site:stage

      - name: Upload site
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        if: always()
        with:
          name: maven-site
          path: target/staging/
          retention-days: 15

      - name: Configure Git
        run: |
          git config --global user.name "$GIT_USER_NAME"
          git config --global user.email "$GIT_USER_EMAIL"
        env:
          GIT_USER_NAME: ${{ vars.GIT_USER_NAME }}
          GIT_USER_EMAIL: ${{ vars.GIT_USER_EMAIL }}

      - name: Publish site
        run: ./mvnw -B -ntp scm-publish:publish-scm -Dusername="$GITHUB_ACTOR" -Dpassword="$GITHUB_TOKEN"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Update dependency graph
        uses: advanced-security/maven-dependency-submission-action@5d0f9011b55d6268922128af45275986303459c3 # v4.0.3

  build-gradle:
    name: Build and test (Gradle)

    runs-on: ubuntu-latest

    permissions:
      contents: write

    steps:
      - name: Check out repository
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
        with:
          fetch-depth: 0
          show-progress: false

      - name: Set up Java
        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
        with:
          distribution: 'zulu'
          java-version-file: '.java-version'

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@db19848a5fa7950289d3668fb053140cf3028d43 # v3.3.2
        with:
          dependency-graph: generate-and-submit

      - name: Build and test, with coverage
        run: ./gradlew build

      - name: Cache SonarCloud packages
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
          restore-keys: ${{ runner.os }}-sonar

      - name: Analyze
        run: ./gradlew sonar --info -Dsonar.host.url="$SONAR_HOST_URL" -Dsonar.organization="$SONAR_ORGANIZATION" -Dsonar.projectKey="$SONAR_PROJECTKEY"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}
          SONAR_ORGANIZATION: ${{ vars.SONAR_ORGANIZATION }}
          SONAR_PROJECTKEY: ${{ vars.SONAR_PROJECTKEY }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

      - name: Publish artifacts
        run: ./gradlew publishToSonatype
        env:
          ORG_GRADLE_PROJECT_signingKeyId: ${{ vars.GPG_KEY_ID }}
          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.GPG_PRIVATE_KEY }}
          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.GPG_PASSPHRASE }}
          ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.OSSRH_USERNAME }}
          ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.OSSRH_TOKEN }}