backend_build_test_libraries.yml

name: Backend - Build libraries and run tests

permissions:
  contents: read

on:
  workflow_call:
    outputs:
      build_artifact_name:
        description: Build artifact this workflow produces that can be retrieved with the 'download-artifact' action
        value: backend-build-output
      contents_sha:
        description: Git contents SHA for backend (git rev-parse HEAD:backend)
        value: ${{ jobs.compute_contents_sha.outputs.contents_sha }}

  workflow_dispatch:

jobs:
  compute_contents_sha:
    runs-on: ubuntu-latest
    outputs:
      contents_sha: ${{ steps.compute.outputs.contents_sha }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Compute backend contents hash
        id: compute
        run: |
          echo "contents_sha=$(git rev-parse HEAD:backend)" >> "$GITHUB_OUTPUT"

  check_cache:
    runs-on: ubuntu-latest
    needs:
      - compute_contents_sha
    outputs:
      cache-hit: ${{ steps.restore_cache.outputs.cache-hit }}
      cache-key: backend-libraries-contents-${{ needs.compute_contents_sha.outputs.contents_sha }}
      contents_sha: ${{ needs.compute_contents_sha.outputs.contents_sha }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Restore backend libraries from build cache
        id: restore_cache
        uses: actions/cache/restore@v4
        with:
          path: |
            backend/**/build
          key: backend-libraries-contents-${{ needs.compute_contents_sha.outputs.contents_sha }}
      # Even in case of a cache hit, artifact must be pulled from cache and uploaded to
      # the artifact registry to be available to subsequent jobs
      - name: Upload built libraries
        if: ${{ steps.restore_cache.outputs.cache-hit == 'true' }}
        uses: actions/upload-artifact@v4
        with:
          name: backend-build-output
          retention-days: 1
          path: |
            backend/**/build

  build_libraries:
    if: ${{ needs.check_cache.outputs.cache-hit != 'true' }}
    needs:
      - check_cache
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Compute backend contents hash
        run: |
          echo "contents_hash=$(git rev-parse HEAD:backend)" >> $GITHUB_ENV

      - uses: actions/setup-java@v4
        with:
          distribution: "temurin"
          java-version: "21"
          cache: gradle
      - name: Build libraries
        run: ./gradlew assemble

      - name: Upload built libraries
        uses: actions/upload-artifact@v4
        with:
          name: backend-build-output
          retention-days: 1
          path: |
            backend/**/build
  determine-tests:
    if: ${{ needs.check_cache.outputs.cache-hit != 'true' }}
    runs-on: ubuntu-latest
    needs:
      - check_cache
    outputs:
      unit_test_matrix: ${{ steps.set_test_matrices.outputs.unit_test_matrix }}
      integration_test_matrix: ${{ steps.set_test_matrices.outputs.integration_test_matrix }}
      security_test_matrix: ${{ steps.set_test_matrices.outputs.security_test_matrix }}
    env:
      UNIT_TESTS_MATRIX: "/tmp/unit_tests_matrix"
      INTEGRATION_TESTS_MATRIX: "/tmp/integration_tests_matrix"
      SECURITY_TESTS_MATRIX: "/tmp/security_tests_matrix"
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: "Setup jq"
        uses: dcarbone/install-jq-action@v3

      # Computing the test matrices takes ~2 minutes in GHA, so cache them with a cache key based on all the Gradle files
      - name: Cache test definitions
        id: cache-test-definitions
        uses: actions/cache@v4
        with:
          path: |
            ${{ env.UNIT_TESTS_MATRIX }}
            ${{ env.INTEGRATION_TESTS_MATRIX }}
            ${{ env.SECURITY_TESTS_MATRIX }}
          key: testdefinitions-${{ hashFiles('**/*.gradle', '**/*.gradle.kts', '**/gradle.properties', '**/gradle-wrapper.properties') }}
      - name: Make test matrices
        id: make_test_matrices
        if: steps.cache-test-definitions.outputs.cache-hit != 'true'
        run: |
          UNIT_TESTS_FILE='/tmp/unit_tests'
          INTEGRATION_TESTS_FILE='/tmp/integration_tests'
          SECURITY_TESTS_FILE='/tmp/security_tests'
          DRY_RUN=$(./gradlew :backend:testAll :backend:securityTestingAll :backend:integrationTestingAll --dry-run)
          touch $UNIT_TESTS_FILE $INTEGRATION_TESTS_FILE $SECURITY_TESTS_FILE
          while IFS= read -r line; do
            if [[ $line =~ (:[^[:space:]]+:test)\  ]]; then
              echo "$line" | cut -d ' ' -f 1 >> $UNIT_TESTS_FILE
            elif [[ $line =~ (:[^[:space:]]+:integrationTesting)\  ]]; then
              echo "$line" | cut -d ' ' -f 1 >> $INTEGRATION_TESTS_FILE
            elif [[ $line =~ (:[^[:space:]]+:securityTesting)\  ]]; then
              echo "$line" | cut -d ' ' -f 1 >> $SECURITY_TESTS_FILE
            fi
          done <<< "$DRY_RUN"
          cat $UNIT_TESTS_FILE | jq -R -s -c 'split("\n")[:-1]' > $UNIT_TESTS_MATRIX
          cat $INTEGRATION_TESTS_FILE | jq -R -s -c 'split("\n")[:-1]' > $INTEGRATION_TESTS_MATRIX
          cat $SECURITY_TESTS_FILE | jq -R -s -c 'split("\n")[:-1]' > $SECURITY_TESTS_MATRIX
      - name: Set test matrices
        id: set_test_matrices
        run: |
          echo "unit_test_matrix=$(cat $UNIT_TESTS_MATRIX)" >> $GITHUB_OUTPUT
          echo "integration_test_matrix=$(cat $INTEGRATION_TESTS_MATRIX)" >> $GITHUB_OUTPUT
          echo "security_test_matrix=$(cat $SECURITY_TESTS_MATRIX)" >> $GITHUB_OUTPUT
  # Run the following test suites in parallel
  unit-testing:
    needs: [determine-tests, check_cache, build_libraries]
    if: ${{ needs.check_cache.outputs.cache-hit != 'true' }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        unit_test_suite: ${{ fromJson(needs.determine-tests.outputs.unit_test_matrix) }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: "temurin"
          java-version: "21"
          cache: gradle
      - name: Download built libraries
        uses: actions/download-artifact@v4
        with:
          name: backend-build-output
          path: .
      - name: Run Unit Tests
        run: ./gradlew ${{ matrix.unit_test_suite }}

  integration-testing:
    runs-on: ubuntu-latest
    needs: [determine-tests, check_cache, build_libraries]
    if: ${{ needs.check_cache.outputs.cache-hit != 'true' }}
    strategy:
      matrix:
        integration_test_suite: ${{ fromJson(needs.determine-tests.outputs.integration_test_matrix) }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: "temurin"
          java-version: "21"
          cache: gradle
      - name: Download built libraries
        uses: actions/download-artifact@v4
        with:
          name: backend-build-output
          path: .
      - name: Run integration test suite
        run: ./gradlew ${{ matrix.integration_test_suite }}

  integration-testing-mysql:
    runs-on: ubuntu-latest
    needs: [check_cache, build_libraries]
    if: ${{ needs.check_cache.outputs.cache-hit != 'true' }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: "temurin"
          java-version: "21"
          cache: gradle
      - name: Download built libraries
        uses: actions/download-artifact@v4
        with:
          name: backend-build-output
          path: .
      - name: Run MySQL integration test (verzoek)
        run: ./gradlew :backend:zgw:verzoek:integrationTestingMysql

  security-testing:
    needs: [determine-tests, check_cache, build_libraries]
    strategy:
      matrix:
        security_test_suite: ${{ fromJson(needs.determine-tests.outputs.security_test_matrix) }}
    if: |
      github.ref_type == 'branch' &&
      (
        startsWith(github.ref_name, 'development/') ||
        startsWith(github.ref_name, 'rc/') ||
        startsWith(github.ref_name, 'release/') ||
        github.ref_name == 'next-minor' ||
        github.ref_name == 'next-major'
      )
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: "temurin"
          java-version: "21"
          cache: gradle
      - name: Download built libraries
        uses: actions/download-artifact@v4
        with:
          name: backend-build-output
          path: .
      - name: Run Security Tests
        run: ./gradlew ${{ matrix.security_test_suite }}

  cache-libraries-build:
    runs-on: ubuntu-latest
    # Run if security-testing was either successful or skipped
    if: >
      always() &&
      needs.unit-testing.result == 'success' &&
      needs.integration-testing.result == 'success' &&
      needs.integration-testing-mysql.result == 'success' &&
      (needs.security-testing.result == 'success' || needs.security-testing.result == 'skipped')
    needs:
      - check_cache
      - unit-testing
      - integration-testing
      - integration-testing-mysql
      - security-testing
      - build_libraries
    steps:
      - name: Download built libraries
        uses: actions/download-artifact@v4
        with:
          name: backend-build-output
          path: .
      - name: Cache built backend libraries
        uses: actions/cache/save@v4
        with:
          path: |
            backend/**/build
          key: ${{ needs.check_cache.outputs.cache-key }}