actions_build.yml

name: CI
on:
  push:
    branches:
      - "**"
    tags-ignore:
      # The release versions will be verified by 'publish-release.yml'
      - centraldogma-*
  pull_request:

concurrency:
  # Cancel the previous builds in the same PR.
  # Allow running concurrently for all non-PR commits.
  group: ci-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true

env:
  LC_ALL: "en_US.UTF-8"
  BUILD_JDK_VERSION: "25"

jobs:
  build:
    if: github.repository == 'line/centraldogma'
    runs-on: ${{ matrix.os }}
    timeout-minutes: 60
    env:
      GRADLE_OPTS: -Xmx1280m
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        java: [25]
        include:
          - java: 11
            os: ubuntu-latest
          - java: 17
            os: ubuntu-latest
            coverage: true
          - java: 17
            os: ubuntu-latest
            min-java: 11
          - java: 21
            os: ubuntu-latest
          - java: 25
            snapshot: true
            os: ubuntu-latest

    name: build-${{ matrix.os }}-jdk-${{ matrix.java }}${{ matrix.min-java && format('-min-java-{0}', matrix.min-java) || '' }}${{ matrix.coverage && '-coverage' || ''}}${{ matrix.snapshot && '-snapshot' || ''}}

    steps:
    - name: Set job name
      run: |
        JOB_NAME="build-${{ matrix.os }}-jdk-${{ matrix.java }}${{ matrix.min-java && format('-min-java-{0}', matrix.min-java) || '' }}${{ matrix.coverage && '-coverage' || ''}}${{ matrix.snapshot && '-snapshot' || ''}}"
        echo "JOB_NAME=$JOB_NAME" >> $GITHUB_ENV
      shell: bash
    - uses: actions/checkout@v4

    - id: setup-test-jdk
      if: ${{ matrix.java != env.BUILD_JDK_VERSION }}
      name: Set up test JDK ${{ matrix.java }}
      uses: actions/setup-java@v4
      with:
        distribution: 'zulu'
        java-version: ${{ matrix.java }}

    - id: setup-build-jdk
      name: Set up build JDK ${{ env.BUILD_JDK_VERSION }}
      uses: actions/setup-java@v4
      with:
        distribution: 'zulu'
        java-version: ${{ env.BUILD_JDK_VERSION }}

    - name: Setup Gradle
      uses: gradle/actions/setup-gradle@v5

    - name: Setup SSH test keys
      env:
        # ECDSA 256
        SSH_TEST_ECDSA_256_OPENSSH: ${{ secrets.SSH_TEST_ECDSA_256_OPENSSH }}
        SSH_TEST_ECDSA_256_OPENSSH_PASSWORD: ${{ secrets.SSH_TEST_ECDSA_256_OPENSSH_PASSWORD }}
        SSH_TEST_ECDSA_256_PEM: ${{ secrets.SSH_TEST_ECDSA_256_PEM }}
        SSH_TEST_ECDSA_256_PEM_PASSWORD: ${{ secrets.SSH_TEST_ECDSA_256_PEM_PASSWORD }}
        # ECDSA 384
        SSH_TEST_ECDSA_384_OPENSSH: ${{ secrets.SSH_TEST_ECDSA_384_OPENSSH }}
        SSH_TEST_ECDSA_384_OPENSSH_PASSWORD: ${{ secrets.SSH_TEST_ECDSA_384_OPENSSH_PASSWORD }}
        SSH_TEST_ECDSA_384_PEM: ${{ secrets.SSH_TEST_ECDSA_384_PEM }}
        SSH_TEST_ECDSA_384_PEM_PASSWORD: ${{ secrets.SSH_TEST_ECDSA_384_PEM_PASSWORD }}
        # ECDSA 521
        SSH_TEST_ECDSA_521_OPENSSH: ${{ secrets.SSH_TEST_ECDSA_521_OPENSSH }}
        SSH_TEST_ECDSA_521_OPENSSH_PASSWORD: ${{ secrets.SSH_TEST_ECDSA_521_OPENSSH_PASSWORD }}
        SSH_TEST_ECDSA_521_PEM: ${{ secrets.SSH_TEST_ECDSA_521_PEM }}
        SSH_TEST_ECDSA_521_PEM_PASSWORD: ${{ secrets.SSH_TEST_ECDSA_521_PEM_PASSWORD }}
        # ED25519
        SSH_TEST_ED25519_OPENSSH: ${{ secrets.SSH_TEST_ED25519_OPENSSH }}
        SSH_TEST_ED25519_OPENSSH_PASSWORD: ${{ secrets.SSH_TEST_ED25519_OPENSSH_PASSWORD }}
        # RSA
        SSH_TEST_RSA_OPENSSH: ${{ secrets.SSH_TEST_RSA_OPENSSH }}
        SSH_TEST_RSA_OPENSSH_PASSWORD: ${{ secrets.SSH_TEST_RSA_OPENSSH_PASSWORD }}
        SSH_TEST_RSA_PEM: ${{ secrets.SSH_TEST_RSA_PEM }}
        SSH_TEST_RSA_PEM_PASSWORD: ${{ secrets.SSH_TEST_RSA_PEM_PASSWORD }}
      run: |
        # Check if secrets are available (e.g., skip on forked PRs)
        if [ -z "$SSH_TEST_ECDSA_256_OPENSSH" ]; then
          echo " SSH Key Secrets are empty. Skipping SSH key setup."
          exit 0
        fi
        
        # Create the test resources directory
        TEST_RESOURCES_DIR="it/mirror/src/test/resources/com/linecorp/centraldogma/it/mirror/git"
        mkdir -p "$TEST_RESOURCES_DIR"
        
        # Write all SSH key files using environment variables
        # Using quotes ("$VAR") preserves newlines and prevents injection
        echo "$SSH_TEST_ECDSA_256_OPENSSH" > "$TEST_RESOURCES_DIR/ecdsa_256.openssh"
        echo "$SSH_TEST_ECDSA_256_OPENSSH_PASSWORD" > "$TEST_RESOURCES_DIR/ecdsa_256.openssh.password"
        echo "$SSH_TEST_ECDSA_256_PEM" > "$TEST_RESOURCES_DIR/ecdsa_256.pem"
        echo "$SSH_TEST_ECDSA_256_PEM_PASSWORD" > "$TEST_RESOURCES_DIR/ecdsa_256.pem.password"
        
        echo "$SSH_TEST_ECDSA_384_OPENSSH" > "$TEST_RESOURCES_DIR/ecdsa_384.openssh"
        echo "$SSH_TEST_ECDSA_384_OPENSSH_PASSWORD" > "$TEST_RESOURCES_DIR/ecdsa_384.openssh.password"
        echo "$SSH_TEST_ECDSA_384_PEM" > "$TEST_RESOURCES_DIR/ecdsa_384.pem"
        echo "$SSH_TEST_ECDSA_384_PEM_PASSWORD" > "$TEST_RESOURCES_DIR/ecdsa_384.pem.password"
        
        echo "$SSH_TEST_ECDSA_521_OPENSSH" > "$TEST_RESOURCES_DIR/ecdsa_521.openssh"
        echo "$SSH_TEST_ECDSA_521_OPENSSH_PASSWORD" > "$TEST_RESOURCES_DIR/ecdsa_521.openssh.password"
        echo "$SSH_TEST_ECDSA_521_PEM" > "$TEST_RESOURCES_DIR/ecdsa_521.pem"
        echo "$SSH_TEST_ECDSA_521_PEM_PASSWORD" > "$TEST_RESOURCES_DIR/ecdsa_521.pem.password"
        
        echo "$SSH_TEST_ED25519_OPENSSH" > "$TEST_RESOURCES_DIR/ed25519.openssh"
        echo "$SSH_TEST_ED25519_OPENSSH_PASSWORD" > "$TEST_RESOURCES_DIR/ed25519.openssh.password"
        
        echo "$SSH_TEST_RSA_OPENSSH" > "$TEST_RESOURCES_DIR/rsa.openssh"
        echo "$SSH_TEST_RSA_OPENSSH_PASSWORD" > "$TEST_RESOURCES_DIR/rsa.openssh.password"
        echo "$SSH_TEST_RSA_PEM" > "$TEST_RESOURCES_DIR/rsa.pem"
        echo "$SSH_TEST_RSA_PEM_PASSWORD" > "$TEST_RESOURCES_DIR/rsa.pem.password"
        
        # Set proper permissions for SSH keys
        find "$TEST_RESOURCES_DIR" -type f \( -name "*.openssh*" -o -name "*.pem*" \) -exec chmod 600 {} \; 2>/dev/null || true
        
        # Verify the files were created
        echo "=========================================="
        echo "SSH test key files verification:"
        echo "=========================================="
        ls -lh "$TEST_RESOURCES_DIR"
      shell: bash

    - name: Build with Gradle
      run: |
        JAVA_INSTALLATIONS="${{ steps.setup-build-jdk.outputs.path }}"
        if [ "${{ matrix.java }}" != "${{ env.BUILD_JDK_VERSION }}" ]; then
          JAVA_INSTALLATIONS="${JAVA_INSTALLATIONS},${{ steps.setup-test-jdk.outputs.path }}"
        fi
        
        ./gradlew --no-daemon --stacktrace -Pleak -PnoLint build \
        ${{ matrix.coverage && '-Pcoverage' || '' }} \
        -PflakyTests=false \
        -PbuildJdkVersion=${{ env.BUILD_JDK_VERSION }} \
        -PtestJavaVersion=${{ matrix.java }} \
        ${{ matrix.min-java && format('-PminimumJavaVersion={0}', matrix.min-java) || '' }} \
        -Porg.gradle.java.installations.paths="${JAVA_INSTALLATIONS}"
      shell: bash

    - if: ${{ matrix.snapshot && github.ref_name == 'main' }}
      name: Publish snapshots
      run: |
        ./gradlew --no-daemon --stacktrace --max-workers=1 publish
      env:
        # Should not use '-P' option with 'secrets' that can cause unexpected results
        # if secret values contains white spaces or new lines.
        ORG_GRADLE_PROJECT_ossrhUsername: ${{ secrets.OSSRH_USER_NAME }}
        ORG_GRADLE_PROJECT_ossrhPassword: ${{ secrets.OSSRH_PASSWORD }}
        ORG_GRADLE_PROJECT_signingKeyId: ${{ secrets.GPG_KEY_ID }}
        ORG_GRADLE_PROJECT_signingKey: ${{ secrets.GPG_PRIVATE_KEY }}
        ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.GPG_PASSWORD }}
      shell: bash

    - name: Summarize the failed tests
      if: failure()
      run: |
        # Build Java installations paths
        JAVA_INSTALLATIONS="${{ steps.setup-build-jdk.outputs.path }}"
        if [ "${{ matrix.java }}" != "${{ env.BUILD_JDK_VERSION }}" ]; then
          JAVA_INSTALLATIONS="${JAVA_INSTALLATIONS},${{ steps.setup-test-jdk.outputs.path }}"
        fi
        
        ./gradlew --no-daemon --stacktrace --max-workers=1 reportFailedTests \
        -PnoLint \
        -PflakyTests=false \
        -PbuildJdkVersion=${{ env.BUILD_JDK_VERSION }} \
        -PtestJavaVersion=${{ matrix.java }} \
        ${{ matrix.min-java && format('-PminimumJavaVersion={0}', matrix.min-java) || '' }} \
        -Porg.gradle.java.installations.paths="${JAVA_INSTALLATIONS}"
        
        SUMMARY_FILE="build/failed-tests-result.txt"
        if test -f "$SUMMARY_FILE"; then
          echo '### 🔴 Failed tests' >> $GITHUB_STEP_SUMMARY
          cat $SUMMARY_FILE >> $GITHUB_STEP_SUMMARY
        fi
      shell: bash

    - name: Dump stuck threads
      if: always()
      run: jps | grep -iv "jps" | grep -v 'Daemon' | awk '{ print $1 }' | xargs -I'{}' jstack -l {} || true
      shell: bash

    - name: Upload coverage to Codecov
      if: ${{ matrix.coverage }}
      uses: codecov/codecov-action@v3

    - name: Collect the test reports
      if: failure()
      run: |
        find . '(' \
        -name 'java_pid*.hprof' -or \
        -name 'hs_err_*.log' -or \
        -path '*/build/reports/tests' -or \
        -path '*/build/test-results' -or \
        -path '*/javadoc.options' ')' \
        -exec tar rf "reports-${{ env.JOB_NAME }}.tar" {} ';'
      shell: bash

    - name: Upload Artifact
      if: failure()
      uses: actions/upload-artifact@v4
      with:
        name: reports-${{ env.JOB_NAME }}
        path: reports-${{ env.JOB_NAME }}.tar
        retention-days: 3

  lint:
    if: github.repository == 'line/centraldogma'
    runs-on: ubuntu-latest
    timeout-minutes: 60
    env:
      GRADLE_OPTS: -Xmx1280m
    steps:
      - uses: actions/checkout@v4

      - id: setup-jdk
        name: Set up JDK ${{ env.BUILD_JDK_VERSION }}
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: ${{ env.BUILD_JDK_VERSION }}

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v5

      - name: Build with Gradle
        run: |
          ./gradlew --no-daemon --stacktrace lint
        shell: bash

  flaky-tests:
    if: github.repository == 'line/centraldogma'
    runs-on: ubuntu-latest
    timeout-minutes: 60
    env:
      GRADLE_OPTS: -Xmx1280m
    steps:
      - uses: actions/checkout@v4

      - id: setup-jdk
        name: Set up JDK ${{ env.BUILD_JDK_VERSION }}
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: ${{ env.BUILD_JDK_VERSION }}

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v5

      - name: Run flaky tests
        run: |
          ./gradlew --no-daemon --stacktrace check -PnoLint -PflakyTests=true
        shell: bash

  # Run WebApp end-to-end tests separately to avoid port conflicts.
  webapp-e2e:
    if: github.repository == 'line/centraldogma'
    runs-on: ubuntu-latest
    timeout-minutes: 60
    env:
      GRADLE_OPTS: -Xmx1280m
    steps:
      - uses: actions/checkout@v4

      - id: setup-jdk
        name: Set up JDK ${{ env.BUILD_JDK_VERSION }}
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: ${{ env.BUILD_JDK_VERSION }}

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v5

      - name: Run WebApp E2E tests
        run: |
          ./gradlew --no-daemon --stacktrace :webapp:testE2e
        shell: bash

  docker-build:
    if: github.repository == 'line/centraldogma'
    runs-on: ubuntu-latest
    timeout-minutes: 60
    env:
      GRADLE_OPTS: -Xmx1280m
    steps:
      - uses: actions/checkout@v4

      - id: setup-jdk
        name: Set up JDK ${{ env.BUILD_JDK_VERSION }}
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: ${{ env.BUILD_JDK_VERSION }}

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v5

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build Docker Image
        run: |
          ./gradlew :dist:docker --stacktrace -Pversion=test
          docker images

      - name: Test DockerCompose
        # Make sure Central Dogma docker container can be started and healthy.
        run: |
          docker compose -f dist/docker-compose-test.yml up --pull never --wait -d
          docker compose -f dist/docker-compose-test.yml down
        shell: bash

  site:
    if: github.repository == 'line/centraldogma'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install graphviz
        run: |
          sudo apt-get -y install graphviz

      - id: setup-jdk-25
        name: Set up JDK 25
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: '25'

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v5

      - name: Build the site
        run: |
          ./gradlew --no-daemon --stacktrace site