build.yml

name: Build
on:
  push:
    branches:
      - master
      - branch-*
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  build:
    name: Build
    runs-on: github-ubuntu-latest-s
    permissions:
      id-token: write
      contents: write
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
        with:
          version: 2025.7.12

      - name: get secrets
        id: secrets
        uses: SonarSource/vault-action-wrapper@v3
        with:
          secrets: |
            development/kv/data/develocity token | DEVELOCITY_TOKEN;

      - name: Create Gradle User Home
        shell: bash
        run: |
          export GRADLE_USER_HOME=${GITHUB_WORKSPACE}/.gradle
          mkdir -p ${GRADLE_USER_HOME}
          echo "GRADLE_USER_HOME=${GRADLE_USER_HOME}" >> $GITHUB_ENV
          export TODAY=$(date '+%Y-%m-%d')
          echo "TODAY=${TODAY}" >> $GITHUB_ENV
          find . -name '*.gradle.kts' -type f -exec md5sum {} \; | sort && md5sum gradle/libs.versions.toml && md5sum gradle/wrapper/gradle-wrapper.properties && md5sum gradle.properties > gradle-md5-sums.txt 
          export GRADLE_CACHE_KEY=$(md5sum gradle-md5-sums.txt | awk '{ print $1 }')
          echo "GRADLE_CACHE_KEY=${GRADLE_CACHE_KEY}" >> $GITHUB_ENV
          rm gradle-md5-sums.txt
      - name: Cache Gradle Dependencies
        uses: SonarSource/ci-github-actions/cache@v1
        with:
          path: ${{ env.GRADLE_USER_HOME }}
          key: gradle-${{ env.GRADLE_CACHE_KEY }}

      - uses: SonarSource/ci-github-actions/build-gradle@v1
        env:
          DEVELOCITY_ACCESS_KEY: develocity-public.sonar.build=${{ fromJSON(steps.secrets.outputs.vault).DEVELOCITY_TOKEN }}
        with:
          deploy: false
          use-develocity: true
          artifactory-reader-role: private-reader
          disable-caching: 'true'