action.yml

---
name: Build Maven
description: GitHub Action to build, analyze, and deploy a Maven project
inputs:
  artifactory-deployer-role:
    description: Suffix for the Artifactory deployer role in Vault. Defaults to `qa-deployer` for private repositories, and
      `public-deployer` for public repositories.
    default: ''
  artifactory-deploy-repo:
    description: Deployment repository. Defaults to `sonarsource-private-qa` for private repositories, and `sonarsource-public-qa` for
      public repositories.
    default: ''
  deploy:
    description: Whether to deploy on master, maintenance, dogfood and long-lived branches.
    default: 'true'
  deploy-pull-request:
    description: Whether to also deploy pull request artifacts. If deploy is 'false', this has no effect.
    default: 'false'
  maven-args:
    description: Additional Maven arguments to pass to the build script.
    default: ''
  scanner-java-opts:
    description: Additional Java options for the Sonar scanner (`SONAR_SCANNER_JAVA_OPTS`).
    default: -Xmx512m
  sonar-platform:
    description: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans.
    default: next
  run-shadow-scans:
    description: If true, run SonarQube analysis on all three platforms (next, sqc-eu, sqc-us).
      If false, run analysis on the platform specified with sonar-platform.
    default: 'false'
  provenance:
    description: Whether to generate provenance attestation for built artifacts
    default: 'false'
  provenance-artifact-paths:
    description: >-
      Relative paths of the artifacts for which to generate a provenance attestation (glob pattern).
      Default is collected from '*/target/*' (or custom build directory from pom.xml)
    default: ''
  # Inputs passed to config-maven
  working-directory:
    description: Relative path under github.workspace to execute the build in
    default: .
  artifactory-reader-role:
    description: Suffix for the Artifactory reader role in Vault. Defaults to `private-reader` for private repositories, and `public-reader`
      for public repositories.
    default: ''
  common-mvn-flags:
    description: Maven flags for all subsequent mvn calls
    default: --batch-mode --no-transfer-progress --errors --fail-at-end --show-version -Dmaven.test.redirectTestOutputToFile=false
  repox-url:
    description: URL for Repox
    default: https://repox.jfrog.io
  repox-artifactory-url:
    description: URL for Repox Artifactory API (overrides repox-url/artifactory if provided)
    default: ''
  use-develocity:
    description: Whether to use Develocity for build tracking.
    default: 'false'
  develocity-url:
    description: URL for Develocity
    default: https://develocity.sonar.build/
  cache-paths:
    description: Cache paths to use (multiline).
    default: ~/.m2/repository
  cache-cleanup:
    description: Whether to clean up the cache before saving it
    default: 'true'
  disable-caching:
    description: Whether to disable Maven caching entirely
    default: 'false'
  mixed-privacy:
    description: Whether the repository contains both public and private modules
    default: 'false'

outputs:
  project-version:
    description: The release version set as Gradle project version in gradle.properties
    value: ${{ steps.config.outputs.project-version }}
  BUILD_NUMBER:
    description: The build number, incremented or reused if already cached
    value: ${{ steps.config.outputs.BUILD_NUMBER }}
  deployed:
    description: Whether artifacts were deployed
    value: ${{ steps.build.outputs.deployed }}

runs:
  using: composite
  steps:
    - name: Set local action paths
      id: set-path
      shell: bash
      run: |
        echo "::group::Fix for using local actions"
        echo "GITHUB_ACTION_PATH=$GITHUB_ACTION_PATH"
        echo "github.action_path=${{ github.action_path }}"
        ACTION_PATH_BUILD_MAVEN="${{ github.action_path }}"
        echo "ACTION_PATH_BUILD_MAVEN=$ACTION_PATH_BUILD_MAVEN"
        echo "ACTION_PATH_BUILD_MAVEN=$ACTION_PATH_BUILD_MAVEN" >> "$GITHUB_ENV"
        host_actions_root="$(dirname "$ACTION_PATH_BUILD_MAVEN")"
        echo "host_actions_root=$host_actions_root" >> "$GITHUB_OUTPUT"

        mkdir -p ".actions"
        ln -sf "$host_actions_root/config-maven" .actions/config-maven
        ln -sf "$host_actions_root/shared" .actions/shared
        ls -la .actions/*
        echo "::endgroup::"

    - uses: ./.actions/config-maven
      id: config
      with:
        host-actions-root: ${{ steps.set-path.outputs.host_actions_root }}
        working-directory: ${{ inputs.working-directory }}
        artifactory-reader-role: ${{ inputs.artifactory-reader-role }}
        common-mvn-flags: ${{ inputs.common-mvn-flags }}
        repox-url: ${{ inputs.repox-url }}
        repox-artifactory-url: ${{ inputs.repox-artifactory-url }}
        use-develocity: ${{ inputs.use-develocity }}
        develocity-url: ${{ inputs.develocity-url }}
        cache-paths: ${{ inputs.cache-paths }}
        disable-caching: ${{ inputs.disable-caching }}

    - name: Set build parameters
      shell: bash
      id: params
      env:
        USER_MAVEN_ARGS: ${{ inputs.maven-args }}
        ARTIFACTORY_DEPLOY_REPO: ${{ inputs.artifactory-deploy-repo != '' && inputs.artifactory-deploy-repo ||
          (github.event.repository.visibility == 'public' || inputs.mixed-privacy == 'true') && 'sonarsource-public-qa' ||
          'sonarsource-private-qa' }}
        ARTIFACTORY_DEPLOYER_ROLE: ${{ inputs.artifactory-deployer-role != '' && inputs.artifactory-deployer-role ||
          (github.event.repository.visibility == 'public' || inputs.mixed-privacy == 'true') && 'public-deployer' ||
          'qa-deployer' }}
      # yamllint disable rule:line-length
      run: |
        {
          if [[ "${{ inputs.mixed-privacy }}" == 'true' ]]; then
            USER_MAVEN_ARGS="${USER_MAVEN_ARGS} -Dartifactory.publish.artifacts=false"
            echo "ARTIFACTORY_PRIVATE_DEPLOY_REPO=${ARTIFACTORY_PRIVATE_DEPLOY_REPO:=sonarsource-private-qa}"
            echo "ARTIFACTORY_PRIVATE_DEPLOY_ACCESS_TOKEN_VAULT=development/artifactory/token/{REPO_OWNER_NAME_DASH}-${ARTIFACTORY_PRIVATE_DEPLOYER_ROLE:=qa-deployer} access_token | ARTIFACTORY_PRIVATE_DEPLOY_ACCESS_TOKEN;"
          fi
          echo "USER_MAVEN_ARGS=${USER_MAVEN_ARGS}"
          echo "ARTIFACTORY_DEPLOY_REPO=${ARTIFACTORY_DEPLOY_REPO}"
          echo "ARTIFACTORY_DEPLOY_USERNAME_VAULT=development/artifactory/token/{REPO_OWNER_NAME_DASH}-${ARTIFACTORY_DEPLOYER_ROLE} username | ARTIFACTORY_DEPLOY_USERNAME;"
          echo "ARTIFACTORY_DEPLOY_ACCESS_TOKEN_VAULT=development/artifactory/token/{REPO_OWNER_NAME_DASH}-${ARTIFACTORY_DEPLOYER_ROLE} access_token | ARTIFACTORY_DEPLOY_ACCESS_TOKEN;"
        } >> "$GITHUB_OUTPUT"
        echo "SONARSOURCE_REPOSITORY_URL=${ARTIFACTORY_URL}/sonarsource" >> "$GITHUB_ENV"
      # yamllint enable rule:line-length

    - uses: SonarSource/vault-action-wrapper@545e7cfbb5528e7009a1edcc83e073898d292627 # 3.2.0
      id: secrets
      with:
        # yamllint disable rule:line-length
        secrets: |
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/next url | NEXT_URL;' || '' }}
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/next token | NEXT_TOKEN;' || '' }}
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/sonarqube-us url | SQC_US_URL;' || '' }}
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/sonarqube-us token | SQC_US_TOKEN;' || '' }}
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/sonarcloud url | SQC_EU_URL;' || '' }}
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/sonarcloud token | SQC_EU_TOKEN;' || '' }}
          ${{ inputs.deploy != 'false' && inputs.run-shadow-scans != 'true' && steps.params.outputs.ARTIFACTORY_DEPLOY_USERNAME_VAULT || '' }}
          ${{ inputs.deploy != 'false' && inputs.run-shadow-scans != 'true' && steps.params.outputs.ARTIFACTORY_DEPLOY_ACCESS_TOKEN_VAULT || '' }}
          ${{ inputs.deploy != 'false' && inputs.mixed-privacy == 'true' && steps.params.outputs.ARTIFACTORY_PRIVATE_DEPLOY_ACCESS_TOKEN_VAULT || '' }}
          development/kv/data/sign key | SIGN_KEY;
          development/kv/data/sign passphrase | PGP_PASSPHRASE;
        # yamllint enable rule:line-length

    - name: Build, analyze and deploy
      shell: bash
      id: build
      env:
        # GitHub context
        PULL_REQUEST: ${{ github.event.pull_request.number || '' }}
        PULL_REQUEST_SHA: ${{ github.event.pull_request.base.sha || '' }}
        DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}

        # Action inputs
        DEPLOY: ${{ inputs.deploy }}
        DEPLOY_PULL_REQUEST: ${{ inputs.deploy-pull-request }}
        USER_MAVEN_ARGS: ${{ steps.params.outputs.USER_MAVEN_ARGS }}
        SONAR_SCANNER_JAVA_OPTS: ${{ inputs.scanner-java-opts }}
        SONAR_PLATFORM: ${{ inputs.sonar-platform }}
        RUN_SHADOW_SCANS: ${{ inputs.run-shadow-scans }}
        ARTIFACTORY_DEPLOY_REPO: ${{ steps.params.outputs.ARTIFACTORY_DEPLOY_REPO }}

        # Vault secrets
        ARTIFACTORY_DEPLOY_USERNAME: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_DEPLOY_USERNAME }}
        ARTIFACTORY_DEPLOY_ACCESS_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_DEPLOY_ACCESS_TOKEN }}
        ARTIFACTORY_DEPLOY_PASSWORD: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_DEPLOY_ACCESS_TOKEN }} # used in parent POM
        NEXT_URL: ${{ fromJSON(steps.secrets.outputs.vault).NEXT_URL }}
        NEXT_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).NEXT_TOKEN }}
        SQC_EU_URL: ${{ fromJSON(steps.secrets.outputs.vault).SQC_EU_URL }}
        SQC_EU_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SQC_EU_TOKEN }}
        SQC_US_URL: ${{ fromJSON(steps.secrets.outputs.vault).SQC_US_URL }}
        SQC_US_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SQC_US_TOKEN }}
        SIGN_KEY: ${{ fromJSON(steps.secrets.outputs.vault).SIGN_KEY }}
        PGP_PASSPHRASE: ${{ fromJSON(steps.secrets.outputs.vault).PGP_PASSPHRASE }}
      working-directory: ${{ inputs.working-directory }}
      run: $ACTION_PATH_BUILD_MAVEN/build.sh

    - name: Artifacts upload
      shell: bash
      if: |
        inputs.mixed-privacy == 'true' && steps.build.outputs.deployed == 'true' &&
        (github.event_name != 'pull_request' || inputs.deploy-pull-request == 'true')
      env:
        ARTIFACTORY_DEPLOY_REPO: ${{ steps.params.outputs.ARTIFACTORY_DEPLOY_REPO }}
        ARTIFACTORY_DEPLOY_ACCESS_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_DEPLOY_ACCESS_TOKEN }}
        ARTIFACTORY_PRIVATE_DEPLOY_REPO: ${{ steps.params.outputs.ARTIFACTORY_PRIVATE_DEPLOY_REPO }}
        ARTIFACTORY_PRIVATE_DEPLOY_ACCESS_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_PRIVATE_DEPLOY_ACCESS_TOKEN }}
        INSTALLED_ARTIFACTS: ${{ steps.build.outputs.installed-artifacts }}
      run: $ACTION_PATH_BUILD_MAVEN/deploy-artifacts.sh

    - name: Cleanup Maven repository before caching
      if: inputs.cache-cleanup == 'true'
      shell: bash
      run: |
        rm -rf "$MAVEN_CONFIG/repository/org/sonarsource/"
        rm -rf "$MAVEN_CONFIG/repository/com/sonarsource/"
        /usr/bin/find "$MAVEN_CONFIG/repository" -name resolver-status.properties -delete

    - name: Generate provenance attestation
      if: |
        inputs.provenance == 'true' && github.event_name != 'pull_request' && steps.build.outputs.deployed == 'true' &&
        (inputs.provenance-artifact-paths != '' || steps.build.outputs.artifact-paths != '')
      uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
      with:
        subject-path: >-
          ${{ inputs.provenance-artifact-paths != '' && inputs.provenance-artifact-paths || steps.build.outputs.artifact-paths }}
        show-summary: true

    - name: Generate workflow summary
      if: always()
      shell: bash
      run: |
        build_name="${GITHUB_REPOSITORY#*/}"
        echo "## 🏗️ Maven Build Summary" >> $GITHUB_STEP_SUMMARY
        if [[ "${{ steps.build.conclusion }}" == "success" ]]; then
          echo "✅ **Build SUCCESS**" >> $GITHUB_STEP_SUMMARY
        else
          echo "❌ **Build FAILED**" >> $GITHUB_STEP_SUMMARY
        fi
        echo "### 📋 Build Information" >> $GITHUB_STEP_SUMMARY
        echo "- **Project**: \`$build_name\`" >> $GITHUB_STEP_SUMMARY
        echo "- **Version**: \`${PROJECT_VERSION}\`" >> $GITHUB_STEP_SUMMARY
        echo "- **Build Number**: \`${BUILD_NUMBER}\`" >> $GITHUB_STEP_SUMMARY
        echo "- **Branch**: \`${GITHUB_REF}\`" >> $GITHUB_STEP_SUMMARY
        echo "- **Commit**: \`$GITHUB_SHA\`" >> $GITHUB_STEP_SUMMARY

        if [[ "${{ steps.build.outputs.deployed }}" == true ]]; then
          echo "### 🚀 Deployment" >> $GITHUB_STEP_SUMMARY
          ARTIFACTORY_BROWSE_URL="${ARTIFACTORY_URL%/*}/ui/builds/$build_name/$BUILD_NUMBER"
          echo "🔗 **[Browse artifacts in Artifactory](${ARTIFACTORY_BROWSE_URL})**" >> $GITHUB_STEP_SUMMARY
        fi