ci.yml

name: "🏗️ CI"

on:
  push:
    branches:
      - main
      - development
      - '!feature/**'
    paths:
      - '**'
      - '!.github/**/*.yml'
    tags:
      - '*'
  pull_request:
    branches:
      - main
      - development
      - 'feature/**'
permissions:
  contents: read
  packages: write
  pull-requests: read

jobs:
  build:
    runs-on: ubuntu-latest

    name: "🛠️ build"

    steps:
      - uses: actions/checkout@v3
        name: Checkout project
        with:
          fetch-depth: 0 #spotless fix

      - name: debug
        shell: bash
        env:
          JSON: ${{ toJSON(github) }}
        run: echo $JSON

      - uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'adopt'

      - name: build without tests
        uses: gradle/gradle-build-action@v3
        with:
          arguments: build -x test

      - name: scan dependencies for vulnerabilities
        if: ${{ vars.TRIVY_ROOTFS_SCAN_ENABLED == 'true' }}
        uses: docker://docker.io/aquasec/trivy
        with:
          args: rootfs --skip-dirs=.sonar --ignore-unfixed --severity "HIGH,CRITICAL" --scanners "vuln" --exit-code 1 --debug .

  test:
    needs: [build]
    runs-on: ubuntu-latest

    name: "📝 run tests"

    steps:
      - uses: actions/checkout@v3
        name: Checkout project

      - uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'adopt'

      - name: run unit tests
        id: run_tests
        uses: gradle/gradle-build-action@v3
        with:
          arguments: test --info

      - name: publish test report
        uses: mikepenz/action-junit-report@v3.6.2
        if: always() # always run even if the previous step fails
        with:
          report_paths: '**/build/test-results/test/TEST-*.xml'
          annotate_only: true

      - name: check sonarcloud.io
        id: sonarcloud_probe
        shell: bash +e {0}
        run: |
          curl -kv https://sonarcloud.io
          echo "exit=$?" >> $GITHUB_OUTPUT
          exit 0

      - name: run sonar scan
        if: ${{ github.actor != 'dependabot[bot]' && vars.SONAR_SCAN_ENABLED == 'true' && steps.sonarcloud_probe.outputs.exit == '0' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: https://sonarcloud.io
        uses: gradle/gradle-build-action@v3
        with:
          arguments: sonarqube --info

  publish:
    if: ${{ github.actor != 'dependabot[bot]' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/development') }}
    needs: [test]
    runs-on: ubuntu-latest
    
    permissions:
      contents: read
      packages: write

    name: "🚀 publish"

    steps:
      - uses: actions/checkout@v3
        name: checkout project

      - uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'adopt'

      - name: publish package
        uses: gradle/gradle-build-action@v3
        with:
          arguments: publish
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}