maven.yml

name: 'Maven build'

on:
  push:
    branches:
      - 'master'
  pull_request:
  workflow_dispatch:

jobs:
  check_keystore:
    name: 'Check keystore'
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: 'Check keystore'
        run: |    
         ./jks-certificate-expiry-checker.sh --keystore ./src/main/resources/pkioverheid.jks --password changeit -t90 


  build:
    name: "Java ${{ matrix.java }}  build"
    runs-on: ubuntu-latest
    needs: check_keystore
    strategy:
      matrix:
        java: [ 11 ]
        java-dist: [ 'temurin' ]

    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK for build
        uses: actions/setup-java@v4
        with:
          distribution: ${{ matrix.java-dist }}
          java-version: ${{ matrix.java }}
          cache: 'maven'
          check-latest: true

      - name: 'Install'
        run: mvn -V -B -e install

      - name: 'Javadoc'
        run: |
          mvn javadoc:javadoc
          mvn javadoc:test-javadoc

      - name: 'Site'
        run: mvn -B -e site site:stage -DnvdApiKey=${{ secrets.NVD_API_KEY }}

      - name: 'Upload code coverage'
        uses: codecov/codecov-action@v4
        with:
          fail_ci_if_error: true
          token: ${{ secrets.CODECOV_TOKEN }}


  deploy:
    name: 'Deploy artifacts'
    runs-on: ubuntu-latest
    needs: build
    permissions:
      packages: write
      contents: read
    if: ${{ github.ref == 'refs/heads/master' && ( github.event_name == 'push' || github.event_name == 'workflow_dispatch' ) }}
    steps:
      - uses: actions/checkout@v4

      - name: 'Set up JDK'
        uses: actions/setup-java@v4
        with:
          java-version: 11
          distribution: 'temurin'
          cache: 'maven'

      - name: 'Build and Push'
        # no need to run any QC or tests
        env:
          B3P_DEPLOY_ACTOR: ${{ secrets.B3P_DEPLOY_ACTOR }}
          B3P_DEPLOY_TOKEN: ${{ secrets.B3P_DEPLOY_TOKEN }}
        run: |
          mvn -B -V -fae -Dmaven.test.skip=true clean deploy --settings .github/maven-settings.xml

      - name: 'Deploy SBOM'
        uses: DependencyTrack/gh-upload-sbom@v3
        with:
          serverhostname: ${{ secrets.DEPENDENCY_TRACK_HOSTNAME }}
          apikey: ${{ secrets.DEPENDENCY_TRACK_APIKEY }}
          project: '013d5b00-b560-4d0e-8a8c-c007a3dae484'
          bomfilename: 'target/bom.xml'


  cleanup:
    name: 'Maven cache cleanup'
    if: ${{ always() }}
    needs: [ build, deploy ]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/cache@v4
        with:
          path: ~/.m2/repository
          key: setup-java-Linux-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            setup-java-Linux-maven-

      - name: 'Cleanup snapshot cache'
        run: |
          find ~/.m2/repository -name "*SNAPSHOT*" -type d | xargs rm -rf {}