build.yml

# This workflow builds Operaton, and cache/restore any dependencies to improve the workflow execution time
name: build

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

permissions:
  contents: read
  checks: write
  id-token: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
  
jobs:
  build:
    name: Build
    strategy:
      fail-fast: true
      matrix:
        os: [ubuntu-latest] # If needed multi-OS add macos-13, windows-latest
    runs-on: ${{ matrix.os }}
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0 # Prevent Shallow Clone to satisfy Sonarqube
    - name: Set up JDK 17
      uses: actions/setup-java@v4
      with:
        java-version: '17'
        distribution: 'temurin'
        cache: maven
    - name: Cache Maven packages
      uses: actions/cache@v4
      with:
        path: ~/.m2
        key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
        restore-keys: ${{ runner.os }}-m2
    - name: Cache SonarCloud packages
      uses: actions/cache@v4
      with:
        path: ~/.sonar/cache
        key: ${{ runner.os }}-sonar
        restore-keys: ${{ runner.os }}-sonar
    - name: Maven Build
      shell: bash
      run: ./mvnw package
    - name: Publish Test Report
      if: always()
      uses: mikepenz/action-junit-report@v4 #https://github.com/marketplace/actions/junit-report-action
      with:
        report_paths: ${{ github.workspace }}/**/target/surefire-reports/*.xml
        require_passed_tests: true
    - name: Upload Surefire Reports
      if: always()
      uses: actions/upload-artifact@v4
      with:
        name: surefire-reports
        path: ${{ github.workspace }}/**/target/surefire-reports/**
        retention-days: 30
    - name: Sonarqube Analysis
      if: github.ref == 'refs/heads/main' || github.event_name == 'pull_request' && github.repository_owner == 'operaton'
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
      shell: bash
      run: ./mvnw org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=operaton_operaton
      continue-on-error: true
      # Uploads the full dependency graph to GitHub to improve the quality of Dependabot alerts this repository can receive
    - name: Update dependency graph
      if: github.ref == 'refs/heads/main' && github.repository_owner == 'operaton'
      uses: advanced-security/maven-dependency-submission-action@v4
      continue-on-error: true
      with:
        token: '${{ secrets.GITHUB_TOKEN }}'