ci-pr.yml

name: CI/CD - Tests and Coverage

on:
  push:
    branches: [ master, dev/*, develop ]
  pull_request:
    branches: [ master ]

permissions:
  contents: read
  pull-requests: write
  checks: write
  statuses: write

jobs:
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    
    strategy:
      matrix:
        java-version: [ 17, 21 ]
        os: [ ubuntu-latest ]
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up JDK ${{ matrix.java-version }}
        uses: actions/setup-java@v4
        with:
          java-version: ${{ matrix.java-version }}
          distribution: 'corretto'

      - name: Cache Maven dependencies
        uses: actions/cache@v4
        with:
          path: ~/.m2
          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
          restore-keys: ${{ runner.os }}-m2

      - name: Setup virtual display for JavaFX tests
        run: |
          sudo apt-get update
          sudo apt-get install -y xvfb
          export DISPLAY=:99
          Xvfb :99 -screen 0 1024x768x24 > /dev/null 2>&1 &

      - name: Run tests with coverage
        run: |
          export DISPLAY=:99
          mvn clean test -Dmaven.test.failure.ignore=false -Dheadless=true
        env:
          MAVEN_OPTS: "-Xmx1024m"

      - name: Generate JaCoCo coverage reports
        run: |
          mvn org.jacoco:jacoco-maven-plugin:0.8.8:report -pl jlmap-fx,jlmap-vaadin

      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@v4
        with:
          files: |
            ./jlmap-fx/target/site/jacoco/jacoco.xml
            ./jlmap-vaadin/target/site/jacoco/jacoco.xml
          flags: unittests
          name: codecov-umbrella
          fail_ci_if_error: false
          verbose: true
          token: ${{ secrets.CODECOV_TOKEN }}
        if: matrix.java-version == '17'

      - name: Generate test summary
        uses: dorny/test-reporter@v1
        if: success() || failure()
        with:
          name: Test Results (Java ${{ matrix.java-version }})
          path: '**/target/surefire-reports/TEST-*.xml'
          reporter: java-junit
          fail-on-error: false

      - name: Comment coverage on PR
        if: github.event_name == 'pull_request' && matrix.java-version == '17'
        uses: madrapps/jacoco-report@v1.6.1
        with:
          paths: |
            ${{ github.workspace }}/jlmap-fx/target/site/jacoco/jacoco.xml
            ${{ github.workspace }}/jlmap-vaadin/target/site/jacoco/jacoco.xml
          token: ${{ secrets.GITHUB_TOKEN }}
          min-coverage-overall: 70
          min-coverage-changed-files: 80
          title: 'Code Coverage Report'
          update-comment: true

      - name: Publish test results
        uses: EnricoMi/publish-unit-test-result-action@v2
        if: always()
        with:
          files: '**/target/surefire-reports/TEST-*.xml'
          check_name: 'Test Results (Java ${{ matrix.java-version }})'
          comment_title: 'Test Results (Java ${{ matrix.java-version }})'
          fail_on: 'nothing'

      - name: Upload test artifacts
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: test-results-java-${{ matrix.java-version }}
          path: |
            **/target/surefire-reports/
            **/target/site/jacoco/
          retention-days: 30

  sonarqube:
    runs-on: ubuntu-latest
    needs: test
    if: github.event_name == 'pull_request' || github.ref_name == 'master'
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: 17
          distribution: 'corretto'

      - name: Cache SonarQube packages
        uses: actions/cache@v4
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
          restore-keys: ${{ runner.os }}-sonar

      - name: Cache Maven dependencies
        uses: actions/cache@v4
        with:
          path: ~/.m2
          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
          restore-keys: ${{ runner.os }}-m2

      - name: Setup virtual display for JavaFX tests
        run: |
          sudo apt-get update
          sudo apt-get install -y xvfb
          export DISPLAY=:99
          Xvfb :99 -screen 0 1024x768x24 > /dev/null 2>&1 &

      - name: Build and analyze with SonarQube
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          DISPLAY: :99
        run: |
          mvn clean verify sonar:sonar \
            -Dsonar.projectKey=makbn_java_leaflet \
            -Dsonar.organization=makbn \
            -Dsonar.host.url=https://sonarcloud.io \
            -Dsonar.coverage.jacoco.xmlReportPaths=**/target/site/jacoco/jacoco.xml
        if: env.SONAR_TOKEN != null

  security-scan:
    runs-on: ubuntu-latest
    needs: test
    permissions:
      security-events: write
      actions: read
      contents: read
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: 17
          distribution: 'corretto'

      - name: Cache Maven dependencies
        uses: actions/cache@v4
        with:
          path: ~/.m2
          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
          restore-keys: ${{ runner.os }}-m2

      - name: Run dependency check
        run: |
          mvn org.owasp:dependency-check-maven:check -DfailBuildOnCVSS=8

      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: target/dependency-check-report.sarif

  build-status:
    runs-on: ubuntu-latest
    needs: [ test, sonarqube, security-scan ]
    if: always()
    
    steps:
      - name: Check build status
        run: |
          if [[ "${{ needs.test.result }}" == "success" ]]; then
            echo "✅ Tests passed"
          else
            echo "❌ Tests failed"
            exit 1
          fi
          
          if [[ "${{ needs.sonarqube.result }}" == "success" || "${{ needs.sonarqube.result }}" == "skipped" ]]; then
            echo "✅ Code quality check passed or skipped"
          else
            echo "⚠️ Code quality check failed"
          fi
          
          if [[ "${{ needs.security-scan.result }}" == "success" ]]; then
            echo "🔒 Security scan passed"
          else
            echo "⚠️ Security scan failed"
          fi