ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 2 * * *'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Minimal workflow-level permissions. Jobs elevate as needed at the job level
# (owasp-dc and checkov add security-events: write for SARIF upload). Fixes
# Checkov CKV2_GHA_1 — without this, jobs inherit the repo default token,
# which may include write scopes we do not intend to grant here.
permissions:
  contents: read

env:
  PYTHON_VERSION: "3.11"
  NODE_VERSION: "20"

jobs:
  # ==========================================================================
  # Lint Job - Code Quality Checks
  # ==========================================================================
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0

      - name: Setup Python
        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c  # v6.0.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444  # v5.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          # v5 defaults package-manager-cache: true, which auto-invokes pnpm
          # (found via packageManager field in package.json) before pnpm has
          # been installed by the later "Setup pnpm" step. Our workflow caches
          # the pnpm store separately via actions/cache, so we disable this.
          package-manager-cache: false

      - name: Setup pnpm
        # v5 rejects both `version:` input AND package.json `packageManager`
        # being set. We defer to the packageManager field (single source of
        # truth for pnpm version, currently "pnpm@9.15.0").
        uses: pnpm/action-setup@b307475762933b98ed359c036b0e51f26b63b74b  # v5.0.0

      - name: Install Python tools
        run: |
          pip install ruff mypy

      - name: Install backend dependencies for type checking
        run: |
          cd src/backend
          pip install -e ".[dev]"

      - name: Run Ruff (Python linting)
        run: |
          ruff check src/backend/
          ruff format --check src/backend/

      - name: Run mypy (Python type checking)
        run: |
          cd src/backend
          mypy .

      - name: Get pnpm store directory
        shell: bash
        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_OUTPUT
        id: pnpm-cache

      - name: Cache pnpm modules
        uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7  # v5.0.2
        with:
          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install frontend dependencies
        run: pnpm install --frozen-lockfile

      - name: Run ESLint (TypeScript/React linting)
        run: pnpm --filter @forge-works/frontend lint

      - name: Run TypeScript type check
        run: pnpm --filter @forge-works/frontend typecheck

      - name: Run yamllint
        run: |
          pip install yamllint
          yamllint -c .yamllint .

      - name: Run markdownlint
        run: |
          npm install -g markdownlint-cli
          markdownlint '**/*.md' --ignore node_modules --ignore .history \
            --ignore '**/node_modules/**' --ignore '**/venv/**' --ignore '**/.venv/**' \
            --ignore .skills --ignore '**/.skills/**'

      - name: Run hadolint (Dockerfile linting)
        uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf  # v3.1.0
        with:
          dockerfile: src/backend/Dockerfile
          failure-threshold: warning

  # ==========================================================================
  # Security Job - Secret and Vulnerability Scanning
  # ==========================================================================
  security:
    name: Security
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
        with:
          fetch-depth: 0

      - name: Run Gitleaks
        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e  # v3.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # AB-008 Phase 2 (2026-05-22): Gate Snyk steps on actual dependency
      # manifest changes to keep Free-tier OSS test quota viable
      # (~200/month cap; per-PR every-push scans burned 600+ tests/month).
      # See research/github_apps/snyk_app_migration.md for context.
      - name: Detect dependency manifest changes
        id: deps
        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d  # v4.0.1
        with:
          filters: |
            python:
              - '**/pyproject.toml'
              - '**/requirements*.txt'
              - '**/setup.cfg'
              - '**/setup.py'
            maven:
              - '**/pom.xml'

      # Snyk PR gate — HIGH/CRITICAL fail the PR. Severity below that is
      # reported but doesn't block. Vulns the codebase has accepted (with
      # rationale) live in .snyk and are filtered out automatically.
      #
      # Note on --policy-path: with --all-projects, a root .snyk file only
      # auto-applies to manifests at the repo root. Our Flink poms live under
      # src/flink-jobs/<module>/, so we must point Snyk at the root .snyk
      # explicitly. (Per-module .snyk mirrors also exist for Snyk App parity
      # — see commit c8b086e.) Docs: https://docs.snyk.io/manage-risk/policies/the-.snyk-file
      - name: Snyk test — Python (all projects)
        if: steps.deps.outputs.python == 'true'
        uses: snyk/actions/python@9cf6ca713d71123d2d229cc3d7f145b96ea3c518  # master 2026-05-21 (AB-008)
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: >-
            --all-projects
            --severity-threshold=high
            --policy-path=.snyk
            --exclude=tests,frontend,node_modules,.venv,venv

      - name: Snyk test — Maven (all Flink modules)
        if: steps.deps.outputs.maven == 'true'
        uses: snyk/actions/maven@9cf6ca713d71123d2d229cc3d7f145b96ea3c518  # master 2026-05-21 (AB-008)
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: >-
            --all-projects
            --severity-threshold=high
            --policy-path=.snyk
            --exclude=tests,frontend,node_modules,.venv,venv

  # ==========================================================================
  # OSS CVE Scan - OWASP Dependency-Check (Python, Maven, JavaScript)
  # ==========================================================================
  # AB-023 Step 2 (2026-05-23): Always-on OSS CVE gate. Default OSS scanner
  # across every PR — Snyk is reserved for high-stakes events
  # (breaking-change / hotfix / production labels + release-branch pushes;
  # see AB-023 Step 4 for the gating logic, to land after this job has
  # baked for ~1 week).
  #
  # CLI invoked directly from a version-selected, currently unverified
  # GitHub release asset (chosen by DC_VERSION) rather than the
  # `dependency-check/Dependency-Check_Action` wrapper, which has been
  # unmaintained since 2021-04 (v1.1.0). DC_VERSION enables Renovate
  # bumps via a custom-regex manager but does not provide cryptographic
  # integrity verification of the ZIP — checksum / GPG-signature check
  # is a documented follow-up (tracked as an AB-NNN candidate in the
  # AB-023 retrospective's § Follow-up backlog).
  #
  # Suppressions in /dependency-check-suppressions.xml — parallel ignore
  # list to .snyk (same 8 transitive HIGH-severity CVEs, different format).
  # At --failOnCVSS 9 (CRITICAL only) none of those 8 would fail the build
  # even unsuppressed; the suppressions keep the GitHub Security tab clean
  # for reviewers and maintain discipline for future CRITICAL CVEs.
  #
  # See research/github_apps/multi_scanner_architecture.md for the full
  # multi-scanner design (OWASP DC + Mend Bolt + event-gated Snyk).
  owasp-dc:
    name: OSS CVE Scan (OWASP DC)
    runs-on: ubuntu-latest
    needs: [lint]
    permissions:
      contents: read
      security-events: write   # required for SARIF upload to Security tab
    env:
      DC_VERSION: "12.1.0"
    steps:
      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0

      # On PRs, skip the scan if no dependency manifests changed (saves ~5 min).
      # On push-to-main and nightly schedule, always scan.
      - name: Detect dependency manifest changes
        id: deps
        if: github.event_name == 'pull_request'
        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d  # v4.0.1
        with:
          filters: |
            manifests:
              - '**/pom.xml'
              - '**/pyproject.toml'
              - '**/requirements*.txt'
              - '**/setup.cfg'
              - '**/setup.py'
              - '**/package.json'
              - '**/pnpm-lock.yaml'
              - '**/poetry.lock'
              - 'dependency-check-suppressions.xml'

      - name: Decide whether to scan
        id: should-scan
        shell: bash
        run: |
          if [[ "${{ github.event_name }}" != "pull_request" ]]; then
            echo "scan=true" >> "$GITHUB_OUTPUT"
          elif [[ "${{ steps.deps.outputs.manifests }}" == "true" ]]; then
            echo "scan=true" >> "$GITHUB_OUTPUT"
          else
            echo "scan=false" >> "$GITHUB_OUTPUT"
          fi

      # NVD database is ~600 MB. Cache it weekly (key includes ISO year+week
      # so cache rolls over each Monday, picking up new CVE entries without
      # re-downloading on every PR).
      - name: Compute cache key suffix (ISO week)
        if: steps.should-scan.outputs.scan == 'true'
        id: cache-key
        shell: bash
        run: echo "week=$(date -u +%G-W%V)" >> "$GITHUB_OUTPUT"

      - name: Cache NVD database
        id: cache-nvd
        if: steps.should-scan.outputs.scan == 'true'
        uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7  # v5.0.2
        with:
          path: ~/.dependency-check/data
          key: nvd-${{ env.DC_VERSION }}-${{ runner.os }}-${{ steps.cache-key.outputs.week }}
          restore-keys: |
            nvd-${{ env.DC_VERSION }}-${{ runner.os }}-

      # TODO(supply-chain hardening): verify GPG signature of release zip
      # (.asc available alongside the download) before unpacking. Tracked
      # as AB-025 in roadmap/AUTOMATIONS_BACKLOG.md (carved out of AB-023
      # Step 6 as a dedicated backlog entry).
      - name: Install OWASP Dependency-Check CLI
        if: steps.should-scan.outputs.scan == 'true'
        shell: bash
        run: |
          set -euo pipefail
          curl -fsSL -o dc.zip \
            "https://github.com/jeremylong/DependencyCheck/releases/download/v${DC_VERSION}/dependency-check-${DC_VERSION}-release.zip"
          unzip -q dc.zip
          ./dependency-check/bin/dependency-check.sh --version

      - name: Setup JDK 21
        if: steps.should-scan.outputs.scan == 'true'
        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165  # v5.0.0
        with:
          distribution: temurin
          java-version: "21"
          cache: maven

      - name: Resolve Maven transitive dependencies
        if: steps.should-scan.outputs.scan == 'true'
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p /tmp/maven-deps
          for module in event-router insight-generator pattern-matcher; do
            echo "--- Copying dependencies for $module ---"
            mvn -B -f "src/flink-jobs/$module/pom.xml" \
              dependency:copy-dependencies -DoutputDirectory=/tmp/maven-deps
          done

      - name: Run OWASP Dependency-Check
        if: steps.should-scan.outputs.scan == 'true'
        shell: bash
        env:
          NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
        run: |
          set -euo pipefail
          mkdir -p reports

          EXTRA_ARGS=()
          if [[ -n "${NVD_API_KEY:-}" ]]; then
            EXTRA_ARGS+=(--nvdApiKey "${NVD_API_KEY}")
          fi
          # Reuse cached NVD DB on PRs only if the cache actually restored.
          # First-ever run (or any cache miss) falls through to a full update
          # using the NVD API key — the nightly cron on main keeps subsequent
          # PR runs fast.
          event_name="${{ github.event_name }}"
          cache_hit="${{ steps.cache-nvd.outputs.cache-hit }}"
          if [[ "$event_name" == "pull_request" && "$cache_hit" == "true" ]]; then
            EXTRA_ARGS+=(--noupdate)
          fi

          ./dependency-check/bin/dependency-check.sh \
            --project "forge-works" \
            --scan "src/backend" \
            --scan "src/flink-jobs" \
            --scan "src/frontend" \
            --scan "/tmp/maven-deps" \
            --suppression dependency-check-suppressions.xml \
            --failOnCVSS 9 \
            --format SARIF \
            --out reports \
            --enableExperimental \
            --disableOssIndex \
            "${EXTRA_ARGS[@]}" \
            --exclude "**/node_modules/**" \
            --exclude "**/.venv/**" \
            --exclude "**/venv/**" \
            --exclude "**/dist/**" \
            --exclude "**/build/**" \
            --exclude "**/target/**" \
            --exclude "**/__tests__/**" \
            --exclude "**/tests/**" \
            --exclude "**/test/**"

      - name: Upload SARIF to GitHub Security tab
        if: always() && steps.should-scan.outputs.scan == 'true'
        uses: github/codeql-action/upload-sarif@9e5b0f05baedb1bdd548380cf129d0dac19b77d1  # v4.30.9
        with:
          sarif_file: reports/dependency-check-report.sarif
          category: owasp-dc

  # ==========================================================================
  # IaC Scan - Checkov (Kubernetes manifests, Dockerfiles, GitHub Actions)
  # ==========================================================================
  # OSS path: runs the Checkov CLI directly rather than installing the
  # Bridgecrew Marketplace App. Same scanner, no SaaS data egress, no App
  # permissions grant. See research/github_apps/evaluation_list.md → Checkov.
  #
  # First-pass rollout uses soft_fail: true to baseline existing findings
  # without breaking CI. After triage we tighten via soft_fail_on: per
  # severity. Findings flow to the GitHub Security tab via SARIF upload.
  checkov:
    name: IaC Scan (Checkov)
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write   # required for SARIF upload to Security tab
    steps:
      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0

      # TODO(sha-pin): retrofit to commit SHA per
      # research/github_actions/GITHUB_ACTIONS.md §2D — tracked in follow-up.
      - name: Run Checkov
        uses: bridgecrewio/checkov-action@4048c972aae68d0b983a48bb3479aab2d877b898  # v12
        with:
          directory: .
          framework: kubernetes,dockerfile,github_actions
          output_format: cli,sarif
          output_file_path: console,checkov.sarif
          soft_fail: true
          # Skip generated, vendored, and out-of-scope paths
          skip_path: node_modules,.venv,venv,dist,build,coverage,.history

      - name: Upload SARIF to GitHub Security tab
        if: always()
        uses: github/codeql-action/upload-sarif@9e5b0f05baedb1bdd548380cf129d0dac19b77d1  # v4.30.9
        with:
          sarif_file: checkov.sarif
          category: checkov

  # ==========================================================================
  # Test Job - Backend Tests
  # ==========================================================================
  test-backend:
    name: Test Backend
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:14
        env:
          POSTGRES_USER: forge
          POSTGRES_PASSWORD: forge
          POSTGRES_DB: forge_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
        with:
          # Codecov needs HEAD + previous commit to compute diff coverage
          # and resolve the base ref.
          fetch-depth: 2

      - name: Setup Python
        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c  # v6.0.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Cache pip packages
        uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7  # v5.0.2
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-pip-${{ hashFiles('src/backend/pyproject.toml') }}
          restore-keys: |
            ${{ runner.os }}-pip-

      - name: Install dependencies
        run: |
          cd src/backend
          pip install -e ".[dev,ml]" || pip install \
            pytest pytest-asyncio pytest-cov aiosqlite fastapi uvicorn \
            "pydantic[email]" pydantic-settings sqlalchemy asyncpg alembic \
            redis httpx python-dotenv "python-jose[cryptography]" \
            "passlib[bcrypt]" bcrypt numpy scikit-learn pandas

      # AB-037C: Alembic drift enforcement gate. Proves migrations apply cleanly
      # against a fresh PG and that SQLAlchemy models match the head schema
      # (via env.py compare_server_default + compare_type flags, set in AB-037B).
      # Guards against the F1-F6 drift class reappearing — see
      # research/db_audit/ALEMBIC_DRIFT_RECON.md. Deliberately runs BEFORE the
      # pytest step so a drift/migration failure surfaces early with a clear
      # cause rather than manifesting as a downstream test failure.
      - name: Apply Alembic migrations + check for drift
        run: |
          cd src/backend
          PYTHONPATH=. alembic upgrade head
          PYTHONPATH=. alembic check
        env:
          DATABASE_URL: postgresql+asyncpg://forge:forge@localhost:5432/forge_test

      - name: Run tests
        run: |
          cd src/backend
          PYTHONPATH=. pytest tests/ -v \
            --cov=app --cov-branch --cov-report=xml --cov-report=term-missing \
            --junitxml=junit.xml
        env:
          DATABASE_URL: postgresql+asyncpg://forge:forge@localhost:5432/forge_test

      - name: Upload coverage
        uses: codecov/codecov-action@af09b5e394c93991b95a5e7646aeb90c1917f78f  # v5.5.1
        with:
          files: src/backend/coverage.xml
          flags: backend
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: false

      - name: Upload test results to Codecov (Test Analytics)
        if: ${{ !cancelled() }}
        uses: codecov/codecov-action@af09b5e394c93991b95a5e7646aeb90c1917f78f  # v5.5.1
        with:
          files: src/backend/junit.xml
          flags: backend
          token: ${{ secrets.CODECOV_TOKEN }}
          report_type: test_results

  # ==========================================================================
  # Test Job - Frontend Tests
  # ==========================================================================
  test-frontend:
    name: Test Frontend
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
        with:
          # Codecov needs HEAD + previous commit for diff coverage.
          fetch-depth: 2

      - name: Setup Node.js
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444  # v5.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          # v5 defaults package-manager-cache: true, which auto-invokes pnpm
          # (found via packageManager field in package.json) before pnpm has
          # been installed by the later "Setup pnpm" step. Our workflow caches
          # the pnpm store separately via actions/cache, so we disable this.
          package-manager-cache: false

      - name: Setup pnpm
        # v5 rejects both `version:` input AND package.json `packageManager`
        # being set. We defer to the packageManager field (single source of
        # truth for pnpm version, currently "pnpm@9.15.0").
        uses: pnpm/action-setup@b307475762933b98ed359c036b0e51f26b63b74b  # v5.0.0

      - name: Get pnpm store directory
        shell: bash
        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_OUTPUT
        id: pnpm-cache

      - name: Cache pnpm modules
        uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7  # v5.0.2
        with:
          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run frontend tests
        run: pnpm --filter @forge-works/frontend test:coverage

      - name: Upload frontend coverage
        uses: codecov/codecov-action@af09b5e394c93991b95a5e7646aeb90c1917f78f  # v5.5.1
        with:
          files: src/frontend/coverage/lcov.info
          flags: frontend
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: false

      - name: Upload test results to Codecov (Test Analytics)
        if: ${{ !cancelled() }}
        uses: codecov/codecov-action@af09b5e394c93991b95a5e7646aeb90c1917f78f  # v5.5.1
        with:
          files: src/frontend/junit.xml
          flags: frontend
          token: ${{ secrets.CODECOV_TOKEN }}
          report_type: test_results

  # ==========================================================================
  # Build Job - Docker & Frontend Build Verification
  # ==========================================================================
  build:
    name: Build
    runs-on: ubuntu-latest
    needs: [lint, test-backend, test-frontend]
    steps:
      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd  # v4.0.0

      - name: Build Backend Image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a  # v7.3.0
        with:
          context: src/backend
          file: src/backend/Dockerfile
          push: false
          tags: forge-works/backend:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Setup Node.js
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444  # v5.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}
          # v5 defaults package-manager-cache: true, which auto-invokes pnpm
          # (found via packageManager field in package.json) before pnpm has
          # been installed by the later "Setup pnpm" step. Our workflow caches
          # the pnpm store separately via actions/cache, so we disable this.
          package-manager-cache: false

      - name: Setup pnpm
        # v5 rejects both `version:` input AND package.json `packageManager`
        # being set. We defer to the packageManager field (single source of
        # truth for pnpm version, currently "pnpm@9.15.0").
        uses: pnpm/action-setup@b307475762933b98ed359c036b0e51f26b63b74b  # v5.0.0

      - name: Get pnpm store directory
        shell: bash
        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_OUTPUT
        id: pnpm-cache

      - name: Cache pnpm modules
        uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7  # v5.0.2
        with:
          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-store-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build Frontend
        run: pnpm --filter @forge-works/frontend build
        env:
          NODE_ENV: production

  # ==========================================================================
  # Java Job - Flink jobs build, format check (Spotless), bug detection (SpotBugs)
  # ==========================================================================
  java-build:
    name: Java Build (Flink)
    runs-on: ubuntu-latest
    strategy:
      matrix:
        module: [dr-predictor, event-router, insight-generator, pattern-matcher]
    steps:
      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0

      # Run Maven on JDK 21. Required by google-java-format 1.33.0, which references
      # com/sun/tools/javac/tree/JCTree$JCAnyPattern (only present on JDK 21+).
      # Spotless 3.x plugin itself wants JVM 17+. JDK 21 satisfies both.
      # Bytecode still targets Java 11 via <maven.compiler.source/target>11</> in each pom.
      - name: Setup JDK 21
        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165  # v5.0.0
        with:
          distribution: temurin
          java-version: "21"
          cache: maven

      - name: Verify (compile + test + Spotless check + SpotBugs check)
        run: |
          cd src/flink-jobs/${{ matrix.module }}
          mvn -B verify

  # ==========================================================================
  # All Checks Passed
  # ==========================================================================
  ci-success:
    name: CI Success
    runs-on: ubuntu-latest
    needs: [lint, security, owasp-dc, checkov, test-backend, test-frontend, build, java-build]
    if: always()
    steps:
      - name: Check all jobs passed
        run: |
          if [[ "${{ needs.lint.result }}" != "success" ]] || \
             [[ "${{ needs.security.result }}" != "success" ]] || \
             [[ "${{ needs.owasp-dc.result }}" != "success" ]] || \
             [[ "${{ needs.checkov.result }}" != "success" ]] || \
             [[ "${{ needs.test-backend.result }}" != "success" ]] || \
             [[ "${{ needs.test-frontend.result }}" != "success" ]] || \
             [[ "${{ needs.build.result }}" != "success" ]] || \
             [[ "${{ needs.java-build.result }}" != "success" ]]; then
            echo "One or more required jobs failed"
            exit 1
          fi
          echo "All CI checks passed!"