scala.yml

name: Scala Build

on:
  workflow_dispatch:
  push:
    branches: [ main, development ]
  pull_request:
    branches: [ main, development ]
    paths-ignore:
      - 'doc/src/main/hugo/**'
      - '.github/workflows/gh-pages.yml'

jobs:
  scala-build:
    timeout-minutes: 60
    permissions:
      contents: read
      packages: read
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      RIDDLC_PATH: riddlc/native/target/scala-3.3.7/riddlc
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        platform: [JVM, Native, JS]
    steps:
    - name: Checkout Code
      uses: actions/checkout@v4

    - name: Set Up JDK 25
      uses: actions/setup-java@v4
      with:
        java-version: '25'
        distribution: temurin
        cache: sbt

    - name: Set Up SBT
      uses: sbt/setup-sbt@7e33f738678e47369c83dcb4b1d9c65d66eb3cdd # v1

    - name: Coursier Caching
      uses: coursier/cache-action@2addd381bd2c931f42d4b734b9d0c9b73aac16fb # v6

    - name: Configure sbt GitHub Packages credentials
      run: |
        mkdir -p ~/.sbt/1.0
        cat > ~/.sbt/1.0/github.sbt << 'EOF'
        credentials += Credentials(
          "GitHub Package Registry",
          "maven.pkg.github.com",
          "x-access-token",
          sys.env.getOrElse("GITHUB_TOKEN", "")
        )
        EOF

    - name: Cache SBT Build Outputs
      uses: actions/cache@v4
      with:
        path: |
          **/target/scala-3.3.7
          !**/target/scala-3.3.7/src_managed
          !**/target/scala-3.3.7/resource_managed
        key: ${{ runner.os }}-sbt-build-${{ matrix.platform }}-${{ hashFiles('**/*.sbt', 'project/**') }}
        restore-keys: |
          ${{ runner.os }}-sbt-build-${{ matrix.platform }}-
          ${{ runner.os }}-sbt-build-

    - name: Install LLVM and Clang (Native only)
      if: matrix.platform == 'Native'
      run: |
        sudo apt-get update && sudo apt-get install -y clang llvm
        echo CLANG: `which clang`
        echo LD64.LLD: `which ld64.lld`
        echo LLD: `which lld`
        clang --version

    - name: Install curl dev dependencies (Native only)
      if: matrix.platform == 'Native'
      run: |
        sudo apt-get update
        sudo apt-get install -y libcurl4-openssl-dev libidn2-dev

    - name: Build And Test ${{ matrix.platform }} Versions
      run: |
        sbt clean c${{ matrix.platform }} t${{ matrix.platform }} 

    - name: Publish Test Results
      uses: EnricoMi/publish-unit-test-result-action@12fa20e14d449d310778f2d0af1e3b2f57dde2a7 # v2
      if: always()
      continue-on-error: true  # Prevent workflow failure from permissions issues on PRs
      with:
        files: |
          **/target/test-reports/*.xml

    - name: Publish JVM RIDDL Libs & Test sbt-riddl plugin
      if: matrix.platform == 'JVM'
      env:
        RIDDLC_PATH: riddlc/jvm/target/universal/stage/bin/riddlc
      run: |
        sbt \
          utils/publishLocal \
          language/publishLocal \
          passes/publishLocal \
          commands/publishLocal \
          riddlLib/publishLocal \
          riddlc/stage \
          sbt-riddl/scripted

    - name: Package JVM Release Artifacts
      if: matrix.platform == 'JVM'
      run: |
        sbt "set every Compile/doc/sources := Seq.empty" "riddlc/Universal/packageBin" "riddlLib/Universal/packageBin"

    - name: Package Native Release Artifacts
      if: matrix.platform == 'Native'
      run: |
        sbt riddlcNative/nativeLink riddlLibNative/nativeLink

    - name: Package JS Release Artifacts
      if: matrix.platform == 'JS'
      run: |
        sbt riddlLibJS/fullLinkJS

    - name: Collect Release Artifacts (JVM)
      if: matrix.platform == 'JVM'
      uses: actions/upload-artifact@v4
      with:
        name: collect-release-artifacts-jvm
        retention-days: 30
        path: |
          riddlc/jvm/target/universal/riddlc.zip
          riddlLib/jvm/target/universal/riddlLib.zip

    - name: Collect Release Artifacts (Native)
      if: matrix.platform == 'Native'
      uses: actions/upload-artifact@v4
      with:
        name: collect-release-artifacts-native
        retention-days: 30
        path: |
          riddlc/native/target/scala-3.3.7/riddlc
          riddlLib/native/target/scala-3.3.7/libriddl-lib.a

    - name: Collect Release Artifacts (JS)
      if: matrix.platform == 'JS'
      uses: actions/upload-artifact@v4
      with:
        name: collect-release-artifacts-js
        retention-days: 30
        path: |
          riddlLib/js/target/scala-3.3.7/riddl-lib-opt/main.js

    - name: Cleanup Before Caching
      shell: bash
      run: |
        rm -rf "$HOME/.ivy2/local" || true
        find $HOME/.ivy2/cache                       -name "ivydata-*.properties" -delete || true
        find $HOME/.cache/coursier/v1                -name "ivydata-*.properties" -delete || true
        find $HOME/.sbt                              -name "*.lock"               -delete || true

  ebnf-grammar-validation:
    timeout-minutes: 5
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
    - name: Checkout Code
      uses: actions/checkout@v4

    - name: Set Up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.12'

    - name: Install Dependencies
      run: |
        pip install -r language/jvm/src/test/python/requirements.txt

    - name: Validate EBNF Grammar with TatSu (internal test files)
      run: |
        cd language/jvm/src/test/python
        python ebnf_tatsu_validator.py --verbose

    - name: Checkout riddl-examples
      uses: actions/checkout@v4
      with:
        repository: ossuminc/riddl-examples
        path: riddl-examples

    - name: Validate EBNF Grammar against riddl-examples
      run: |
        cd language/jvm/src/test/python
        python validate_external_riddl.py --repo ${{ github.workspace }}/riddl-examples

  dependency-check:
    timeout-minutes: 15
    permissions:
      contents: read
      security-events: write
    runs-on: ubuntu-latest
    steps:
    - name: Checkout Code
      uses: actions/checkout@v4

    - name: Run Dependency Check
      uses: dependency-check/Dependency-Check_Action@1e54355a8b4c8abaa8cc7d0b70aa655a3bb15a6c # main
      with:
        project: 'riddl'
        path: '.'
        format: 'SARIF'
        args: >
          --enableRetired
          --enableExperimental

    - name: Upload Dependency Check Results
      uses: github/codeql-action/upload-sarif@a4fda0891d53e117609b7ddb3570638c2c6d7c89 # v3
      with:
        sarif_file: reports/dependency-check-report.sarif