ci-java.yml

name: 'CI - Java'
on:
  schedule:
    - cron: '13 8 * * 1-5'  # Early morning continental US hours, Monday through Friday
  pull_request:
  merge_group:
  workflow_dispatch:
    inputs:
      branch:
        description: >-
          branch: Override the branch targeted for this build.
          Default to the selected _ref_ in the `Use workflow from` gui field or `ref` argument from the cli.
        required: false
        default: null
  push:
    branches:
      - master

permissions:
  id-token: write
  contents: write

env:
  # workflow file matchers - workflow jobs will only run if matching files are found
  # please see https://github.com/CMSgov/beneficiary-fhir-data/pull/773 for why we
  # are using this workflow logic
  # NOTE: The expression below can be extended to multi-line
  # using a '\' as a continuation character.
  # https://stackoverflow.com/questions/6268391/is-there-a-way-to-represent-a-long-string-that-doesnt-have-any-whitespace-on-mul
  workflow_files_re: "^apps/(?!bfd-model/bfd-model-idr|utils).+$|^.github/workflows/ci-java.yml$"
  AWS_REGION: us-east-1

jobs:
  workflow:
    name: Checking workflow
    runs-on: ubuntu-24.04
    outputs:
      files: ${{ steps.workflow_files.outputs.files }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 2
          ref: ${{ inputs.branch }}
      - id: workflow_files
        name: Set output
        run: |
          echo "files<<EOF" >> $GITHUB_OUTPUT
          echo "$(git diff --name-only --diff-filter=ACMRTD HEAD^ HEAD | grep -P '${{ env.workflow_files_re }}')" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

  mvn-fmt-maven-plugin:
    runs-on: ubuntu-24.04
    needs: workflow
    if: needs.workflow.outputs.files
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 2
          ref: ${{ inputs.branch }}
      - name: 'Setup JDK'
        uses: actions/setup-java@v5
        with:
          java-version: '25'
          distribution: 'corretto'
      - name: 'Run maven ${{ matrix.mvn_commmand }}'
        run: mvn com.spotify.fmt:fmt-maven-plugin:check
        working-directory: ./apps

  mvn-verify:
    runs-on: codebuild-bfd-non-prod-platform-large-${{ github.run_id }}-${{ github.run_attempt }}
    needs: workflow
    if: ${{ needs.workflow.outputs.files || (github.actor != 'actions-user' && github.ref_name == 'master') }}
    steps:
      - name: 'Checkout repo'
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          ref: ${{ inputs.branch }}
      - name: Node installation ISO sonarqube template analysis
        uses: actions/setup-node@v6
        with:
          node-version: "22"
      - name: 'Setup JDK'
        uses: actions/setup-java@v5
        with:
          java-version: '25'
          distribution: 'corretto'
          cache: 'maven'
      - name: Install uv
        uses: astral-sh/setup-uv@v7

      - name: Mask sensitive AWS data
        id: mask-sensitive-aws-data
        run: |
          caller_id="$(aws sts get-caller-identity)"
          account_num="$(jq -r '.Account' <<<${caller_id})"
          role_arn="$(jq -r '.Arn' <<<${caller_id})"
          user_id="$(jq -r '.UserId' <<<${caller_id})"

          echo "::add-mask::$account_num"
          echo "::add-mask::$role_arn"
          echo "::add-mask::$user_id"

      - name: Set env vars from AWS params
        uses: cmsgov/cdap/actions/aws-params-env-action@main
        with:
          params: |
            SONAR_TOKEN=/bfd/platform/sonar/sensitive/service_account_access_key

      - name: 'Run Maven Build'
        run: |
          mvn clean install \
          --threads 1C \
          --no-transfer-progress \
          -Dapidocgen.skip=false \
          -Dmaven.build.cache.enabled=false \
          -Dmaven.jacoco.skip=false
        working-directory: ./apps

      - name: 'Convert JaCoCo to Generic Coverage'
        if: ${{ github.event_name != 'merge_group' }}
        run: |
          python utils/scripts/jacoco-to-generic.py \
          --src-root $(pwd) \
          --in report-aggregate/target/site/jacoco-aggregate/jacoco.xml \
          --out coverage.xml
        working-directory: ./apps

      - name: 'Upload Analysis'
        if: ${{ github.event_name != 'merge_group' }}
        env:
          BFD_BRANCH: ${{ inputs.branch }}
          SONAR_SCANNER_JAVA_OPTS: -Xmx4096m
        run: |
          mvn -X org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \
            -DskipITs \
            -DskipTests \
            --no-transfer-progress \
            ${{ inputs.branch != null && '-Dsonar.branch.name=$BFD_BRANCH' || null }} -Dsonar.ci.autoconfig.disabled=true \
            -Dsonar.host.url="https://sonarqube.cloud.cms.gov" \
            -Dsonar.projectKey="bfd-parent" \
            -Dsonar.projectVersion="$(git log -1 --format=%H)" \
            -Dsonar.qualitygate.wait=true \
            -Dsonar.coverageReportPaths=coverage.xml
        working-directory: ./apps


# TODO: Conformance testing is currently missing from mvn-verify. BFD-3245 will re-examine conformance regression testing in BFD.