java-ci.yml

# from https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-java-with-gradle

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

# GitHub recommends pinning actions to a commit SHA.
# To get a newer version, you will need to update the SHA.
# You can also reference a tag or branch, but the action may change without warning.

name: Java CI

on:
  push:
    branches: [ development ]
    paths-ignore: [ '*.md']
  pull_request:
    branches: [ '**' ]
  merge_group:

jobs:
  build:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres

        env:
          POSTGRES_PASSWORD: dbpwd
          POSTGRES_USER: test_dbuser
          POSTGRES_DB: pearl_test

        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of SonarQube analysis
      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'adopt'
      - name: Validate Gradle wrapper
        uses: gradle/wrapper-validation-action@f9c9c575b8b21b6485636a91ffecd10e558c62f6
      - name: Build with Gradle
        uses: gradle/gradle-build-action@093dfe9d598ec5a42246855d09b49dc76803c005
        with:
          arguments: build --info # if you need to see test failure full stacktraces, change this to `build --info`
      - name: Upload test artifacts
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: test-results
          path: |
            api-admin/build/test-results/test/*.xml
            api-participant/build/test-results/test/*.xml
            core/build/test-results/test/*.xml
            populate/build/test-results/test/*.xml
      - name: JUnit test report
        # Generate a report if the tests fail or succeed, but not if the user cancels
        # For Dependabot PRs, we'll skip generating the test report to simplify our permissions setup
        if: (success() || failure()) && github.actor != 'dependabot[bot]'
        uses: dorny/test-reporter@v1
        with:
          name: JUnit Tests
          path: >
            api-admin/build/test-results/test/*.xml,
            api-participant/build/test-results/test/*.xml,
            core/build/test-results/test/*.xml,
            populate/build/test-results/test/*.xml
          reporter: java-junit
      - name: Notify slack on failure
        uses: broadinstitute/action-slack@v3.15.0
        if: failure() && github.ref == 'refs/heads/development'
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
        with:
          channel: '#juniper-dev-notifications'
          status: failure
          author_name: Java CI build failed on merge to development
          fields: job
          text: "Java CI build failed :sadpanda:"
          username: 'Juniper Build Notifications'

  # Need to uncomment these in follow up PR, The new Trivy and Tag workflows need to exist on the development branch
  # before the following steps will work

  # Run DSP App Sec Trivy Scanner on PRs
  dispatch-trivy:
    needs: [ build ]
    runs-on: ubuntu-latest

    if: github.event_name == 'pull_request'

    steps:
      - name: Trigger Trivy Scan
        uses: broadinstitute/workflow-dispatch@v1
        with:
          workflow: Trivy
          token: ${{ secrets.BROADBOT_TOKEN }}
          ref: ${{ github.event.pull_request.head.ref }}

  dispatch-tag:
    needs: [ build ]
    runs-on: ubuntu-latest

    # Only tag a new release if prior steps were successful and triggering commit is a merge to mainline
    if: success() && github.ref == 'refs/heads/development'

    steps:
      - name: Trigger Tag Workflow
        uses: broadinstitute/workflow-dispatch@v1
        with:
          workflow: Tag
          token: ${{ secrets.BROADBOT_TOKEN }}