ci-cd-java.yml

name: ci-cd-java.yml

permissions: {}

on:
  workflow_call:
    inputs:
      performRelease:
        required: false
        type: boolean
        default: false
      workingDirectory:
        required: false
        type: string
        default: .
      imageName:
        required: false
        type: string
      runTestsInsideDocker:
        required: false
        type: boolean
        default: true

env:
  IMAGE_NAME_MIXED_CASE: "${{ github.repository }}"

jobs:
  ci:
    name: Build, check, test
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          clean: 'true'
          fetch-depth: 2
          persist-credentials: false

      # Required since custom scripts from /scripts are being used
      - name: Resolve shared workflow ref
        id: resolve_shared_workflow_ref
        run: |
          set -euo pipefail
          SHARED_WORKFLOW_REF=$(grep -roh \
            'transitdata-shared-workflows/.github/workflows/[^@]*@[^ "'\'']*' \
            "${GITHUB_WORKSPACE}/.github/workflows/" 2>/dev/null \
            | sed 's/.*@//' | head -1 || true)

          if [[ -z "${SHARED_WORKFLOW_REF}" ]]; then
            echo "::warning::Could not detect shared workflow ref from caller workflows; falling back to main"
            SHARED_WORKFLOW_REF="main"
          fi

          echo "Resolved shared workflow ref: ${SHARED_WORKFLOW_REF}"
          echo "shared_workflow_ref=${SHARED_WORKFLOW_REF}" >> "$GITHUB_OUTPUT"

      - name: Checkout shared workflow scripts
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          repository: HSLdevcom/transitdata-shared-workflows
          ref: ${{ steps.resolve_shared_workflow_ref.outputs.shared_workflow_ref }}
          path: .shared-workflows
          persist-credentials: false

      - name: Setup JDK
        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
        with:
          distribution: 'temurin'
          java-version: '25'
          cache: 'maven'

      - name: Validate Java version consistency
        working-directory: ${{ inputs.workingDirectory }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          JAVA_TOOL_OPTIONS: ""
          MAVEN_OPTS: ""
        run: python3 "${GITHUB_WORKSPACE}/.shared-workflows/scripts/validate_java_version_consistency.py"

      - name: Check code format and lint
        working-directory: ${{ inputs.workingDirectory }}
        run: |
          mvn spotless:check

      - name: Run unit tests inside Docker
        if: ${{ inputs.runTestsInsideDocker }}
        working-directory: ${{ inputs.workingDirectory }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_ACTOR: ${{ github.actor }}
          DOCKER_BUILDKIT: "1"
        run: |
          cat > /tmp/Dockerfile.test << DOCKERFILE
          # syntax=docker/dockerfile:1
          # check=error=true
          FROM ${TEST_BASE_IMAGE}
          WORKDIR /usr/app
          COPY . .
          COPY .mvn/settings.xml /root/.m2/settings.xml
          RUN --mount=type=secret,id=github_token \
              --mount=type=secret,id=github_actor \
              export GITHUB_TOKEN="\$(cat /run/secrets/github_token)" && \
              export GITHUB_ACTOR="\$(cat /run/secrets/github_actor)" && \
              ./mvnw -B test
          DOCKERFILE
          docker build \
            --secret id=github_token,env=GITHUB_TOKEN \
            --secret id=github_actor,env=GITHUB_ACTOR \
            -f /tmp/Dockerfile.test \
            .

      - name: Run unit tests outside Docker
        if: ${{ !inputs.runTestsInsideDocker }}
        working-directory: ${{ inputs.workingDirectory }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          JAVA_TOOL_OPTIONS: ""
          MAVEN_OPTS: ""
        run: mvn -B test

      - name: Run Integration tests (Testcontainers)
        working-directory: ${{ inputs.workingDirectory }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DOCKER_HOST: unix:///var/run/docker.sock
          TESTCONTAINERS_DOCKER_SOCKET_OVERRIDE: /var/run/docker.sock
          JAVA_TOOL_OPTIONS: ""
          MAVEN_OPTS: ""
        run: mvn -B verify

      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: true
          verbose: true

      - name: Upload test results to Codecov
        if: ${{ !cancelled() }}
        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: true
          report_type: test_results

  release:
    name: Build & push Docker image
    needs: ci
    if: >-
      github.ref == 'refs/heads/main' ||
      startsWith(github.ref, 'refs/tags/') ||
      inputs.performRelease == true
    runs-on: ubuntu-latest
    environment: docker-hub-release
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          clean: 'true'
          persist-credentials: false

      - name: Set Docker Image Name
        env:
          IMAGE_NAME_INPUT: ${{ inputs.imageName }}
        run: |
          OWNER="${GITHUB_REPOSITORY%%/*}"

          if [[ -n "${IMAGE_NAME_INPUT}" ]]; then
            IMAGE_NAME="${OWNER,,}/${IMAGE_NAME_INPUT}"
          else
            IMAGE_NAME="${GITHUB_REPOSITORY,,}"
          fi

          echo "IMAGE_NAME=${IMAGE_NAME}" >> "$GITHUB_ENV"

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          images: ${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=sha
            type=semver,pattern={{version}}
          labels: |
            org.opencontainers.image.title=${{ env.IMAGE_NAME }}
            org.opencontainers.image.vendor=hsldevcom

      - name: Login to Docker Hub
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_HUB_INFODEVOPS_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_INFODEVOPS_TOKEN }}

      - name: Build & Push Docker image
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
        with:
          context: ${{ inputs.workingDirectory }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          secrets: |
            github_token=${{ secrets.GITHUB_TOKEN }}
            github_actor=${{ github.actor }}