ci.yml

name: CI

# Runs on EVERY pull request to main (no paths filter) so required checks always report.
# Required status checks: `ci-ok` (this workflow) and `pr-title` (pr-title.yml); see
# .github/CI_CD_SETUP.md.
on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
  merge_group:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}
  # Cancel superseded PR runs; let every push to main finish (each one feeds SonarCloud).
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  test:
    name: test (${{ matrix.module }})
    runs-on: ubuntu-latest
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        include:
          - module: openespi-handoff
          - module: openespi-common
          - module: openespi-datacustodian
          - module: openespi-thirdparty
          - module: openespi-authserver
    steps:
      - uses: actions/checkout@v7

      - uses: ./.github/actions/setup-java-maven

      # Matrix strategy: each module runs in parallel. Upstream modules (handoff, common) are only
      # COMPILED and installed here (-DskipTests, ~30 s) - their tests run in their own matrix
      # entry - and then `verify` runs for this module alone, so no test suite runs twice.
      - name: Install upstream modules (no tests)
        if: matrix.module != 'openespi-handoff'
        run: mvn install -DskipTests -pl ${{ matrix.module }} -am

      - name: Verify ${{ matrix.module }}
        run: mvn verify -pl ${{ matrix.module }} ${{ matrix.test-args }}

      - name: Stage JaCoCo report for SonarCloud
        if: always()
        run: |
          report="${{ matrix.module }}/target/site/jacoco/jacoco.xml"
          if [[ -f "$report" ]]; then
            mkdir -p "coverage/${{ matrix.module }}"
            cp "$report" "coverage/${{ matrix.module }}/jacoco.xml"
          fi

      - name: Upload JaCoCo report
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: jacoco-${{ matrix.module }}
          path: coverage/
          if-no-files-found: ignore
          retention-days: 3

      - name: Upload surefire reports
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: surefire-reports-${{ matrix.module }}
          path: ${{ matrix.module }}/target/surefire-reports/
          if-no-files-found: ignore
          retention-days: 14

  quality:
    name: quality (SonarCloud)
    needs: test
    # Same-repo PRs and pushes to main only: fork PRs have no SONAR_TOKEN and are analysed by
    # sonarcloud-fork-pr.yml (workflow_run) instead. Dependabot PRs are skipped too: Dependabot-
    # triggered runs get no Actions secrets, and a version bump has no source for Sonar to analyse;
    # the push to main after merge is still analysed (#222). PR author, not github.actor, so a
    # maintainer re-run of a Dependabot PR is still skipped.
    if: >-
      github.event_name == 'push' ||
      (github.event_name == 'pull_request' &&
       github.event.pull_request.head.repo.full_name == github.repository &&
       github.event.pull_request.user.login != 'dependabot[bot]')
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0 # full history for SonarCloud blame / new-code detection

      - uses: ./.github/actions/setup-java-maven

      - name: Cache SonarCloud packages
        uses: actions/cache@v6
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
          restore-keys: ${{ runner.os }}-sonar

      # Compile only: the tests already ran in the `test` matrix; their JaCoCo reports are reused.
      - name: Compile all modules
        run: mvn install -DskipTests

      - name: Download JaCoCo reports
        uses: actions/download-artifact@v8
        with:
          pattern: jacoco-*
          path: coverage
          merge-multiple: true

      - name: Restore JaCoCo reports into module target directories
        run: |
          # Root pom sets sonar.coverage.jacoco.xmlReportPaths=${project.basedir}/target/site/jacoco/jacoco.xml
          for report in coverage/*/jacoco.xml; do
            [[ -f "$report" ]] || continue
            module="$(basename "$(dirname "$report")")"
            mkdir -p "$module/target/site/jacoco"
            cp "$report" "$module/target/site/jacoco/jacoco.xml"
          done

      - name: SonarCloud analysis
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        # sonar.projectKey / organization / host.url / coverage paths come from the root pom.
        run: mvn org.sonarsource.scanner.maven:sonar-maven-plugin:sonar

  ci-ok:
    name: ci-ok
    # The ONE required status check. Always runs and fails if any needed job failed or was
    # cancelled; `skipped` is fine (quality on fork PRs and merge-queue runs).
    if: always()
    needs: [test, quality]
    runs-on: ubuntu-latest
    steps:
      - name: Check job results
        env:
          RESULTS: ${{ join(needs.*.result, ' ') }}
        run: |
          echo "Job results: $RESULTS"
          for r in $RESULTS; do
            if [[ "$r" == "failure" || "$r" == "cancelled" ]]; then
              echo "::error::At least one CI job did not succeed ($RESULTS)"
              exit 1
            fi
          done