cibuild.yml

name: 'CI Build'

on:
  push:
    branches-ignore:
    - 'dependabot/**'
    paths:
    - '**'
    - '!docs/**'
    - '!.github/**'
    - '.github/**/*ci*'
    - '!CONTRIBUTING.md'
    - '!DEV_README.md'
  pull_request:
    paths:
    - '**'
    - '!docs/**'
    - '!.github/**'
    - '.github/**/*ci*'
    - '!CONTRIBUTING.md'
    - '!DEV_README.md'

env:
  LC_ALL: en_US.UTF-8
  GRADLE_OPTS: >-
    -Dorg.gradle.parallel=true
  MAVEN_OPTS: >-
    -Dhttp.keepAlive=false
    -Dmaven.wagon.http.pool=false
    -Dmaven.wagon.http.retryHandler.count=3
    -Daether.connector.http.retryHandler.count=5
    -Daether.connector.http.reuseConnections=false
    -Daether.connector.http.connectionMaxTtl=25
    -Daether.connector.connectTimeout=120000
  BNDTOOLS_CORE_TEST_NOJUNITOSGI: true # This test is very flaky on CI
  GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
  GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
  P2_SIGN: true
  P2_SIGN_KEY: ${{ secrets.GPG_KEY_ID }}
  P2_SIGN_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
  P2_PUB_KEY: ${{ secrets.GPG_PUBLIC_KEY }}        
  SONATYPE_BEARER: ${{ secrets.SONATYPE_BEARER }}          

defaults:
  run:
    shell: bash

permissions:
  contents: read

jobs:
  build:
    strategy:
      fail-fast: ${{ (github.repository != 'bndtools/bnd') || ((github.ref != 'refs/heads/master') && (github.ref != 'refs/heads/next')) || (github.event_name == 'pull_request') }}
      matrix:
        os:
        - 'ubuntu-latest'
        java:
        - '21'
        - '25'
        runner:
        - '{0}' # 'xvfb-run --auto-servernum {0}'
        include:
        - os: 'ubuntu-latest'
          java: '17'
          runner: '{0}' # 'xvfb-run --auto-servernum {0}'
          canonical: ${{ (github.repository == 'bndtools/bnd') && ((github.ref == 'refs/heads/master') || (github.ref == 'refs/heads/next')) && (github.event_name != 'pull_request') }}
          fetch-depth: '0'
        - os: 'windows-latest'
          java: '17'
          runner: '{0}'
    name: Build JDK${{ matrix.java }} ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

    - name: Git Checkout
      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3
      with:
        fetch-depth: ${{ matrix.fetch-depth }}
    - name: Set up Java 8 + ${{ matrix.java }}
      uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165
      with:
        distribution: 'temurin'
        java-version: |
          8
          ${{ matrix.java }}
    - name: Set up Gradle
      uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2

    #- name: Cache cnf cache and ~/.bnd/urlcache/
    #  id: cache-cnf-cache
    #  uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684
    #  env:
    #      cache-name: cache-cnf-cache
    #  with:
    #    path: |
    #      "${{ github.workspace }}/cnf/cache"
    #      ~/.bnd/urlcache/
    #    key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/cnf/**/*.bnd', '**/cnf/**/*.mvn', '**/cnf/**/*.maven', '**/cnf/ext/*.*') }}

    - name: Build
      id: build
      run: |
        ${{ format(matrix.runner, './.github/scripts/ci-build.sh') }}

    - name: Configure settings.xml for Publish
      if: ${{ matrix.canonical }}
      uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165
      with:
        distribution: 'temurin'
        java-version: ${{ matrix.java }}
        server-id: bndtools.jfrog.io
        server-username: JFROG_USERNAME
        server-password: JFROG_PASSWORD
    - name: Publish
      id: publish
      if: ${{ matrix.canonical }}
      run: |
        ./.github/scripts/ci-publish.sh
      env:
        CANONICAL: ${{ matrix.canonical }}
        JFROG_USERNAME: ${{ secrets.JFROG_USERNAME }}
        JFROG_PASSWORD: ${{ secrets.JFROG_PASSWORD }}
    - name: Upload Test Reports
      if: ${{ always() && ((steps.build.outcome == 'success') || (steps.build.outcome == 'failure')) }}
      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
      with:
        name: Build_JDK${{ matrix.java }}_${{ matrix.os }}-test-reports
        path: |
          */generated/test-reports/*/TEST-*.xml
          maven/*/target/surefire-reports/TEST-*.xml
          gradle-plugins/*/build/test-results/*/TEST-*.xml
          gradle-plugins/build/reports/*
    - name: Publish PR p2 repo
      if: ${{ github.event_name }} == 'pull_request' && ${{ matrix.java }} == '17'  && ${{ matrix.os }}== 'ubuntu'
      run: |
        ls -laR org.bndtools.p2/*
        env | sort
        PR=${{ github.event.pull_request.number }}
        ARTIFACT_PATH="org.bndtools.p2/generated/org.bndtools.p2.jar"
        if [ -f "$ARTIFACT_PATH" ] && [ "$PR" != "" ]; then
          echo "artifact found - start upload check"
          if curl --silent --head --fail "https://bndtools.jfrog.io/artifactory/p2/pr/${PR}" > /dev/null; then
          echo "URL already existing - delete previous deployment"
          curl -s -X DELETE \
            -H "Authorization: Bearer ${{ secrets.JFROG_SNAPSHOT_TOKEN }}" \
            "https://bndtools.jfrog.io/artifactory/p2/pr/${PR}"
          fi
          echo "upload p2 repo to https://bndtools.jfrog.io/artifactory/p2/pr/${PR}"
          curl -s \
            -H "Authorization: Bearer ${{ secrets.JFROG_SNAPSHOT_TOKEN }}" \
            -H "X-Explode-Archive: true" \
            -T "$ARTIFACT_PATH" \
            "https://bndtools.jfrog.io/artifactory/p2/pr/${PR}/org.bndtools.p2.zip"
          if [ $? -eq 0 ]; then
            echo "upload successful"
          else
            echo "upload failed"
          fi
        else
          echo "Artifact $ARTIFACT_PATH not found, skipping upload."
        fi
      env:
        JFROG_SNAPSHOT_TOKEN: ${{ secrets.JFROG_SNAPSHOT_TOKEN }}