code-compliance.yml

# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
name: Code Compliance

on:
  pull_request:
    paths:
      - 'extensions/**'
      - 'pom.xml'
      - 'checkstyle.xml'
      - 'pmd-ruleset.xml'
  push:
    branches: [main]
    paths:
      - 'extensions/**'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  security-events: write
  actions: read

env:
  MAVEN_OPTS: >-
    -Xmx4g
    -Dorg.slf4j.simpleLogger.defaultLogLevel=WARN

jobs:
  validate:
    runs-on: ubuntu-latest
    name: Checkstyle + PMD + RAT
    steps:
      - name: Checkout Code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Set up Java 21
        uses: actions/setup-java@v5
        with:
          distribution: 'corretto'
          java-version: '21'
          cache: 'maven'

      - name: Detect Changed Bundles
        id: find-bundles
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            CHANGED_FILES=$(git diff --name-only origin/${{ github.event.pull_request.base.ref }}...HEAD)
          else
            CHANGED_FILES=$(git diff --name-only HEAD~1)
          fi

          BUNDLES=()
          for file in $CHANGED_FILES; do
            if [[ "$file" == extensions/* ]]; then
              dir="$file"
              while [[ "$dir" != "extensions" && "$dir" != "." ]]; do
                if [[ -f "$dir/pom.xml" ]] && grep -q '<packaging>pom</packaging>' "$dir/pom.xml" 2>/dev/null; then
                  if grep -q '<modules>' "$dir/pom.xml" 2>/dev/null; then
                    BUNDLES+=("$dir")
                    break
                  fi
                fi
                dir=$(dirname "$dir")
              done
            fi
          done

          UNIQUE_BUNDLES=($(printf '%s\n' "${BUNDLES[@]}" | sort -u))

          for bundle in "${UNIQUE_BUNDLES[@]}"; do
            echo "Validating: $bundle"
            ./mvnw validate \
              -Pcontrib-check \
              -f "$bundle/pom.xml" \
              --no-snapshot-updates \
              --no-transfer-progress
          done

  codeql:
    runs-on: ubuntu-latest
    name: CodeQL Analysis
    if: github.event_name == 'push' || github.event_name == 'pull_request'
    steps:
      - name: Checkout Code
        uses: actions/checkout@v6

      - name: Set up Java 21
        uses: actions/setup-java@v5
        with:
          distribution: 'corretto'
          java-version: '21'
          cache: 'maven'

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: java

      - name: Build All Bundles
        run: |
          for pom in $(find extensions -name "pom.xml" -path "*-bundle/pom.xml"); do
            ./mvnw compile -DskipTests -f "$pom" --no-snapshot-updates --no-transfer-progress || true
          done

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4