build.yaml

name: build

on:
  push:
    branches: ['trunk']
  pull_request:
    branches: ['trunk']
  workflow_dispatch:

jobs:
  build_multi_os:
    permissions:
      contents: read
    name: Build and test ${{matrix.os}}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 17 (Oracle)
        uses: actions/setup-java@v4
        with:
          java-version: 17
          distribution: oracle
          cache: maven

      - name: Display Java version
        run: java -version

      - name: Display Javac version
        run: javac -version

      - name: Display Maven version
        run: mvn -version

      - name: Build (Unix)
        if: matrix.os != 'windows-latest'
        run: mvn install -DskipTests=true -Dgpg.skip -B -V

      - name: Build (Windows)
        if: matrix.os == 'windows-latest'
        run: mvn --% install -DskipTests=true -Dgpg.skip -B -V # tell powershell to stop parsing with --% so it doesn't error with "Unknown lifecycle phase .skip"

      - name: Install Spice
        uses: ./.github/actions/setup-spice

      - name: Init and start spice app
        uses: ./.github/actions/start-spice-app

      - name: Test
        run: mvn test -B
        env:
          API_KEY: ${{ secrets.SPICE_CLOUD_QUICKSTART_API_KEY }}

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: test-results-${{ matrix.os }}
          path: target/surefire-reports/
          retention-days: 7

      - name: Upload coverage report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report-${{ matrix.os }}
          path: target/site/jacoco/
          retention-days: 7

  build:
    permissions:
      contents: read
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        java:
          # Microsoft OpenJDK (LTS versions only)
          - version: 11
            distribution: microsoft
          - version: 17
            distribution: microsoft
          - version: 21
            distribution: microsoft # LTS
          # Eclipse Temurin (Adoptium) - LTS and recent non-LTS
          - version: 21
            distribution: temurin # LTS
          - version: 23
            distribution: temurin # Non-LTS - released Sept 2024
          - version: 24
            distribution: temurin # Non-LTS - released March 2025
          # Oracle JDK (17 and later only)
          - version: 17
            distribution: oracle
          - version: 21
            distribution: oracle # LTS - support until 2031
          - version: 23
            distribution: oracle # Non-LTS - released Sept 2024
          - version: 24
            distribution: oracle # Non-LTS - released March 2025
          - version: 25
            distribution: oracle # LTS - released Sept 2025, support until 2033

    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK ${{ matrix.java.version }} (${{ matrix.java.distribution }})
        uses: actions/setup-java@v4
        with:
          java-version: ${{ matrix.java.version }}
          distribution: ${{ matrix.java.distribution }}
          cache: maven

      - name: Display Java version
        run: java -version

      - name: Display Javac version
        run: javac -version

      - name: Display Maven version
        run: mvn -version

      - name: Build
        run: mvn install -DskipTests=true -Dgpg.skip -B -V

      - name: Install Spice
        uses: ./.github/actions/setup-spice

      - name: Init and start spice app
        uses: ./.github/actions/start-spice-app

      - name: Test
        run: |
          EXTRA=""
          # JDK 23+ disables sun.misc.Unsafe memory methods by default (JEP 471).
          # Arrow/Netty still require them for off-heap memory allocation.
          if [ "${{ matrix.java.version }}" -ge 23 ] 2>/dev/null; then
            EXTRA="--sun-misc-unsafe-memory-access=allow"
          fi
          mvn test -B -DextraArgLine="$EXTRA"
        env:
          API_KEY: ${{ secrets.SPICE_CLOUD_QUICKSTART_API_KEY }}

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: test-results-jdk${{ matrix.java.version }}-${{ matrix.java.distribution }}
          path: target/surefire-reports/
          retention-days: 7

  quality:
    name: Code quality checks
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 17 (Oracle)
        uses: actions/setup-java@v4
        with:
          java-version: 17
          distribution: oracle
          cache: maven

      - name: Build
        run: mvn install -DskipTests=true -Dgpg.skip -B -V

      - name: Maven Enforcer
        run: mvn validate -B

      - name: SpotBugs
        run: mvn spotbugs:check -B

      - name: Checkstyle + API compatibility (japicmp vs latest release)
        run: mvn checkstyle:check japicmp:cmp -B

      - name: Cache OWASP Dependency-Check data
        uses: actions/cache@v4
        with:
          path: ~/.m2/repository/org/owasp/dependency-check-data
          key: dependency-check-data-${{ runner.os }}-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            dependency-check-data-${{ runner.os }}-

      # Split so network flakiness and the security gate can't mask each other:
      # the NVD data refresh may fail or time out without blocking CI, but when
      # it completes, the check below runs offline against that data and FAILS
      # the build on real CVSS >= 7 findings.
      #
      # The update is incremental and resumable: even a timed-out attempt makes
      # progress that actions/cache persists (the job still succeeds via the
      # skip path below), so cold caches converge to a warm one across runs.
      # Adding the NVD_API_KEY secret makes the update fast and the gate
      # effectively always-on.
      - name: OWASP NVD data update (best-effort)
        id: nvd-update
        continue-on-error: true
        timeout-minutes: 15
        env:
          NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
        run: |
          EXTRA=""
          if [ -n "$NVD_API_KEY" ]; then
            EXTRA="-DnvdApiKey=$NVD_API_KEY"
          fi
          mvn dependency-check:update-only -B $EXTRA

      # Gate only on a completed update: a partial database makes
      # dependency-check force a full re-download regardless of
      # autoUpdate=false, burning the timeout.
      - name: OWASP Dependency-Check (gating)
        if: steps.nvd-update.outcome == 'success'
        timeout-minutes: 10
        run: mvn dependency-check:check -B -DautoUpdate=false

      - name: OWASP gate skipped notice
        if: steps.nvd-update.outcome != 'success'
        run: echo "::warning::NVD data update did not complete — vulnerability gate skipped this run (add the NVD_API_KEY secret to make it always-on)"

      - name: Upload dependency-check report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: dependency-check-report
          path: target/dependency-check-report.html
          retention-days: 30

  e2e-chaos:
    permissions:
      contents: read
    name: E2E chaos (runtime restart, frozen peer)
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 17 (Oracle)
        uses: actions/setup-java@v4
        with:
          java-version: 17
          distribution: oracle
          cache: maven

      - name: Install Spice
        uses: ./.github/actions/setup-spice

      - name: Run chaos e2e tests
        env:
          SPICE_E2E_CHAOS: "1"
        run: mvn test -B -Dtest=ChaosE2ETest -DfailIfNoTests=true