ci.yml

name: Java CI
on:
  push:
    branches:
      - main
      - '[0-9]+.[0-9]+.x'
  pull_request:
    branches:
      - main
      - '[0-9]+.[0-9]+.x'
jobs:
  build:
    name: Build / JDK 25
    runs-on: ubuntu-latest
    permissions:
      checks: write
      contents: read
    env:
      TESTCONTAINERS_RYUK_DISABLED: true
    steps:
      # https://github.com/actions/virtual-environments/issues/709
      - name: Remove system JDKs
        run: |
          sudo rm -rf /usr/lib/jvm/*
          unset JAVA_HOME
          export PATH=$(echo "$PATH" | tr ':' '\n' | grep -v '/usr/lib/jvm' | paste -sd:)

      - name: Free disk space
        run: |
          sudo rm -rf "/usr/local/share/boost"
          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
          sudo rm -rf "/opt/ghc"
          sudo rm -rf "/usr/share/dotnet"
          sudo rm -rf "/usr/local/lib/android"
          sudo apt-get clean
          df -h

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Resolve Micronaut Core checkout cache key
        id: micronaut_core
        run: |
          set -euo pipefail
          sha="$(git ls-remote https://github.com/micronaut-projects/micronaut-core.git refs/heads/cdi-5.1.x | cut -f1)"
          test -n "${sha}"
          echo "sha=${sha}" >> "$GITHUB_OUTPUT"

      - name: Cache Micronaut Core included build checkout
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: checkouts/micronaut-core-cdi
          key: ${{ runner.os }}-micronaut-core-cdi-${{ steps.micronaut_core.outputs.sha }}
          restore-keys: |
            ${{ runner.os }}-micronaut-core-cdi-

      - name: Setup GraalVM CE
        uses: graalvm/setup-graalvm@bef4b0e916c7dd079bf60fb95d49139f67e32c5f # v1
        with:
          distribution: 'graalvm'
          java-version: '25'
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6

      - name: Optional setup step
        run: |
          [ -f ./setup.sh ] && ./setup.sh || [ ! -f ./setup.sh ]

      - name: Build with Gradle
        env:
          DEVELOCITY_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
          DEVELOCITY_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USERNAME }}
          DEVELOCITY_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
          GH_TOKEN_PUBLIC_REPOS_READONLY: ${{ secrets.GH_TOKEN_PUBLIC_REPOS_READONLY }}
          GH_USERNAME: ${{ secrets.GH_USERNAME }}
        run: |
          ./gradlew check docs --no-daemon --continue

      - name: Prepare publishing secrets
        if: success() && github.event_name == 'push'
        env:
          CENTRAL_SONATYPE_TOKEN_USERNAME: ${{ secrets.CENTRAL_SONATYPE_TOKEN_USERNAME }}
          CENTRAL_SONATYPE_TOKEN_PASSWORD: ${{ secrets.CENTRAL_SONATYPE_TOKEN_PASSWORD }}
          GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
        run: |
          set -euo pipefail
          project_version="$(sed -n 's/^projectVersion=//p' gradle.properties | head -n 1)"
          if [ "${project_version##*-}" != "SNAPSHOT" ]; then
            echo "PUBLISH_SNAPSHOT=false" >> "${GITHUB_ENV}"
            exit 0
          fi
          gpg_file="${RUNNER_TEMP}/gpg-private-key.asc"
          install -m 600 /dev/null "${gpg_file}"
          if [ -n "${GPG_PRIVATE_KEY}" ]; then
            printf '%s' "${GPG_PRIVATE_KEY}" > "${gpg_file}"
          fi
          {
            echo "GPG_FILE=${gpg_file}"
            echo "SONATYPE_USERNAME=${CENTRAL_SONATYPE_TOKEN_USERNAME}"
            echo "SONATYPE_PASSWORD=${CENTRAL_SONATYPE_TOKEN_PASSWORD}"
            echo "GPG_KEY_ID=${GPG_KEY_ID}"
            echo "GPG_PASSWORD=${GPG_PASSPHRASE}"
            echo "PUBLISH_SNAPSHOT=true"
          } >> "${GITHUB_ENV}"

      - name: Publish snapshot
        if: success() && github.event_name == 'push' && env.PUBLISH_SNAPSHOT == 'true'
        run: |
          set -euo pipefail
          test -n "${SONATYPE_USERNAME}"
          test -n "${SONATYPE_PASSWORD}"
          ./gradlew publishAllPublicationsToCentralSnapshotsRepository --no-daemon --continue

      - name: Publish Test Report
        if: always()
        uses: mikepenz/action-junit-report@bccf2e31636835cf0874589931c4116687171386 # v6
        with:
          check_name: Java CI / Test Report (25)
          report_paths: '**/build/test-results/test/TEST-*.xml'
          check_retries: 'true'

      - name: Upload documentation
        if: success() && github.event_name == 'push'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: docs-site
          path: build/docs
          if-no-files-found: error

      - name: Optional cleanup step
        run: |
          [ -f ./cleanup.sh ] && ./cleanup.sh || [ ! -f ./cleanup.sh ]

  publish-docs:
    name: Publish documentation
    needs: build
    if: github.event_name == 'push' && needs.build.result == 'success'
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: write
    steps:
      - name: Download documentation
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: docs-site
          path: docs-site

      - name: Publish to Github Pages
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail

          docs_branch="gh-pages"
          docs_dir="$(mktemp -d)"
          repository_url="https://github.com/${GITHUB_REPOSITORY}.git"
          askpass="$(mktemp)"

          cat > "${askpass}" <<'EOF'
          #!/usr/bin/env sh
          case "$1" in
            *Username*) printf '%s\n' 'x-access-token' ;;
            *Password*) printf '%s\n' "${GH_TOKEN}" ;;
            *) printf '\n' ;;
          esac
          EOF
          chmod 700 "${askpass}"
          trap 'rm -f "${askpass}"' EXIT

          git config --global user.email "${GITHUB_ACTOR}@users.noreply.github.com"
          git config --global user.name "${GITHUB_ACTOR}"

          if GIT_ASKPASS="${askpass}" GIT_TERMINAL_PROMPT=0 git ls-remote --exit-code --heads "${repository_url}" "${docs_branch}" > /dev/null 2>&1; then
            GIT_ASKPASS="${askpass}" GIT_TERMINAL_PROMPT=0 git clone --depth 1 --branch "${docs_branch}" "${repository_url}" "${docs_dir}"
          else
            git init "${docs_dir}"
            git -C "${docs_dir}" checkout -b "${docs_branch}"
            git -C "${docs_dir}" remote add origin "${repository_url}"
          fi

          find "${docs_dir}" -mindepth 1 -maxdepth 1 ! -name .git ! -name tck-results -exec rm -rf {} +
          cp -R docs-site/. "${docs_dir}/"
          touch "${docs_dir}/.nojekyll"

          git -C "${docs_dir}" add -A
          if git -C "${docs_dir}" diff --cached --quiet; then
            echo "No documentation changes to publish."
          else
            git -C "${docs_dir}" commit -m "Deploy docs for ${GITHUB_SHA}"
            GIT_ASKPASS="${askpass}" GIT_TERMINAL_PROMPT=0 git -C "${docs_dir}" push origin "${docs_branch}"
          fi