ci-cd-kotlin.yml

name: ci-cd-kotlin.yml

permissions: {}

on:
  workflow_call:
    inputs:
      performRelease:
        required: false
        type: boolean
        default: false
      runTestsInsideDocker:
        required: false
        type: boolean
        default: true
      hasIntegrationTests:
        required: false
        type: boolean
        default: false

env:
  IMAGE_NAME_MIXED_CASE: "${{ github.repository }}"

jobs:
  ci:
    name: Build, check, test
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          clean: 'true'
          fetch-depth: 2
          persist-credentials: false

      # Required since custom scripts from /scripts are being used
      - name: Resolve shared workflow ref
        run: |
          set -euo pipefail
          SHARED_WORKFLOW_REF=$(grep -roh \
            'transitdata-shared-workflows/.github/workflows/[^@]*@[^ "'\'']*' \
            "${GITHUB_WORKSPACE}/.github/workflows/" 2>/dev/null \
            | sed 's/.*@//' | head -1 || true)

          if [[ -z "${SHARED_WORKFLOW_REF}" ]]; then
            echo "::warning::Could not detect shared workflow ref from caller workflows; falling back to main"
            SHARED_WORKFLOW_REF="main"
          fi

          echo "Resolved shared workflow ref: ${SHARED_WORKFLOW_REF}"
          echo "SHARED_WORKFLOW_REF=${SHARED_WORKFLOW_REF}" >> "$GITHUB_ENV"

      - name: Checkout shared workflow scripts
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          repository: HSLdevcom/transitdata-shared-workflows
          ref: ${{ env.SHARED_WORKFLOW_REF }}
          path: .shared-workflows
          persist-credentials: false

      - name: Setup JDK
        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
        with:
          distribution: 'temurin'
          java-version: '25'
          cache: 'gradle'

      - name: Validate Java version consistency
        env:
          JAVA_TOOL_OPTIONS: ""
        run: python3 "${GITHUB_WORKSPACE}/.shared-workflows/scripts/validate_java_version_consistency.py"

      - name: Check code format and lint
        run: ./gradlew spotlessCheck
        env:
          GITHUB_ACTOR: ${{ github.actor }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Run unit tests inside Docker
        if: ${{ inputs.runTestsInsideDocker }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_ACTOR: ${{ github.actor }}
          DOCKER_BUILDKIT: "1"
        run: |
          cat > /tmp/Dockerfile.test << DOCKERFILE
          # syntax=docker/dockerfile:1
          # check=error=true
          FROM ${TEST_BASE_IMAGE}
          WORKDIR /usr/app
          COPY . .
          RUN --mount=type=secret,id=github_token \
              --mount=type=secret,id=github_actor \
              export GITHUB_TOKEN="\$(cat /run/secrets/github_token)" && \
              export GITHUB_ACTOR="\$(cat /run/secrets/github_actor)" && \
              ./gradlew test --stacktrace --no-daemon
          DOCKERFILE
          docker build \
            --secret id=github_token,env=GITHUB_TOKEN \
            --secret id=github_actor,env=GITHUB_ACTOR \
            -f /tmp/Dockerfile.test \
            .

      - name: Run unit tests
        if: ${{ inputs.hasIntegrationTests == false }}
        env:
          GITHUB_ACTOR: ${{ github.actor }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: ./gradlew test jacocoTestReport --stacktrace

      - name: Run unit tests and integration tests
        if: ${{ inputs.hasIntegrationTests }}
        env:
          GITHUB_ACTOR: ${{ github.actor }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: ./gradlew test integrationTest jacocoTestReport --stacktrace

      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: true
          verbose: true

      - name: Upload test results to Codecov
        if: ${{ !cancelled() }}
        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: true
          report_type: test_results

      - name: Build artifact
        run: ./gradlew build -x test
        env:
          GITHUB_ACTOR: ${{ github.actor }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  release:
    name: Build & push Docker image
    needs: ci
    if: >-
      github.ref == 'refs/heads/main' ||
      startsWith(github.ref, 'refs/tags/') ||
      inputs.performRelease == true
    runs-on: ubuntu-latest
    environment: docker-hub-release
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          clean: 'true'
          persist-credentials: false

      - name: Lowercase Docker Image Name
        run: |
          echo "IMAGE_NAME=${IMAGE_NAME_MIXED_CASE,,}" >> "${GITHUB_ENV}"

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          images: ${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=sha
            type=semver,pattern={{version}}
          labels: |
            org.opencontainers.image.title=${{ env.IMAGE_NAME }}
            org.opencontainers.image.vendor=hsldevcom

      - name: Login to Docker Hub
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_HUB_INFODEVOPS_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_INFODEVOPS_TOKEN }}

      - name: Build & Push Docker image
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}