ci.yml

# This file is part of Dependency-Track.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0
# Copyright (c) OWASP Foundation. All Rights Reserved.
name: CI

on:
  push:
    branches:
    - main
    - "feature-**"
  pull_request:
    branches:
    - main
    - "feature-**"

permissions: { }

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # tag=v4.1.7
    - name: Set up JDK
      uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # tag=v4.2.1
      with:
        java-version: '21'
        distribution: 'temurin'
        cache: maven
    - name: Test
      run: |-
        mvn -B --no-transfer-progress -pl '!e2e' clean verify \
          failsafe:integration-test -DskipITs=false
    # Publishing coverage to Codacy is only possible for builds of push events.
    # PRs from forks do not get access to repository secrets.
    # https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
    - name: Publish test coverage
      if: ${{ github.event_name != 'pull_request' && github.repository_owner == 'DependencyTrack' }}
      run: |-
        bash <(curl -Ls https://coverage.codacy.com/get.sh) report \
          --project-token ${{ secrets.CODACY_PROJECT_TOKEN }} \
          --commit-uuid ${{ github.sha }} \
          --coverage-reports **/target/site/jacoco/jacoco.xml \
          --language Java
    - name: Save PR details
      if: ${{ github.event_name == 'pull_request' }}
      run: |-
        echo ${{ github.sha }} > pr-commit.txt
        echo ${{ github.event.number }} > PR_NUMBER.txt
    - name: Upload PR test coverage report
      if: ${{ github.event_name == 'pull_request' }}
      uses: actions/upload-artifact@v4
      with:
        name: pr-test-coverage-report
        path: |-
          pr-commit.txt
          PR_NUMBER.txt
          **/target/site/jacoco/jacoco.xml

  test-native-image:
    name: Test Native Image
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'pull_request' }}
    timeout-minutes: 20
    strategy:
      matrix:
        module:
        - mirror-service
        - notification-publisher
        - repository-meta-analyzer
        - vulnerability-analyzer
      fail-fast: true
    steps:
    - name: Checkout Repository
      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # tag=v4.1.7
    - name: Set up JDK
      uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # tag=v4.2.1
      with:
        java-version: '21'
        distribution: 'temurin'
        cache: maven
    - name: Set up GraalVM
      uses: graalvm/setup-graalvm@2f25c0caae5b220866f732832d5e3e29ff493338 # tag=v1
      with:
        # NOTE: Do NOT use the Oracle GraalVM distribution, as that is causing issues
        # with Protobuf serialization.
        #   https://github.com/DependencyTrack/hyades/issues/641
        #   https://github.com/quarkusio/quarkus/issues/35125
        distribution: 'mandrel'
        version: 'mandrel-23.1.2.0-Final'
        java-version: '21'
        components: 'native-image'
        github-token: ${{ secrets.GITHUB_TOKEN }}
    - name: Build Modules
      run: |-
        mvn -B --no-transfer-progress clean install -DskipTests
    - name: Build Native Image
      run: |-
        mvn -B --no-transfer-progress -pl ${{ matrix.module }} package -Dnative -DskipTests
    - name: Test Native Image
      run: |-
        mvn -B --no-transfer-progress -pl ${{ matrix.module }} \
          test-compile failsafe:integration-test failsafe:verify -Dnative