module.build.yml

name: "Module: Build"

on:
  ## Manual dispatch
  workflow_dispatch: {}

  ## Sub-workflow call
  workflow_call:
    inputs:
      runner:
        type: string
        required: false
        description: "Runner tag to use"
      graph:
        type: string
        required: false
        default: 'disabled'
        description: "Dependency graph mode"
      provenance:
        type: boolean
        required: false
        description: "Generate provenance"
      signing:
        type: boolean
        required: false
        description: "Sign artifacts"
      jvm:
        type: string
        required: false
        description: "JVM variant to build on"
      java_version:
        type: string
        required: false
        description: "Java version to build with"
    secrets:
      SONAR_TOKEN:
        required: true
        description: "SonarCloud token"
      CODECOV_TOKEN:
        required: true
        description: "Coverage reporting token"
      BUILDLESS_APIKEY:
        required: true
        description: "API key for build caching"

env:
  CI: true
  BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}

# Read-only permissions by default.
permissions:
  actions: read
  contents: read

# One active build per reference, per workflow.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  ## Stage: Build Library with Gradle
  build:
    name: "Build Library"
    runs-on: ${{ vars.RUNNER || inputs.runner || 'ubuntu-latest' }}
    permissions:
      contents: write
      id-token: write
      checks: write
      pull-requests: read
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
    steps:
      - name: "Setup: Harden Runner"
        uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
        with:
          disable-sudo: true
          egress-policy: audit
      - name: "Setup: Checkout"
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          fetch-depth: 0
      - name: "Setup: JDK ${{ inputs.java_version || vars.JVM_VERSION }}"
        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
        with:
          java-version: ${{ inputs.java_version || vars.JVM_VERSION }}
          distribution: ${{ inputs.jvm || vars.JVM_VARIANT || 'zulu' }}
      - name: "Setup: Buildless"
        uses: buildless/setup@30e82389418c7f17046606183bc4c78b2c8913e0 # v1.0.2
      - name: "Setup: Cache SonarCloud Packages"
        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
          restore-keys: ${{ runner.os }}-sonar
      - name: "Setup: Cache Gradle Packages"
        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
        with:
          path: ~/.gradle/caches
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}
          restore-keys: ${{ runner.os }}-gradle
      - name: "Build: Gradle"
        uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v2
        id: gradlebuild
        env:
          CI: true
          BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          cache-read-only: false
          dependency-graph: ${{ inputs.graph }}
          arguments: |
            build
            test
            check
            preMerge
            --scan
            --warning-mode=none
            --dependency-verification=lenient
            -Pci=true
      - name: "Report: Sonar"
        uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v2
        id: sonar
        continue-on-error: true
        env:
          CI: true
          BUILDLESS_APIKEY: ${{ secrets.BUILDLESS_APIKEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          cache-read-only: true
          arguments: |
            sonar
            --scan
            --warning-mode=none
            --dependency-verification=lenient
            -Pci=true
      - name: "Report: Provenance"
        id: hash
        run: |
          echo "hashes=$(sha256sum ./subprojects/*/build/libs/* | base64 -w0)" >> "$GITHUB_OUTPUT"
      - name: "Report: Tests"
        uses: dorny/test-reporter@9098107e2aa7ed7d1150f776ddea55f55c80016b # v1
        if: success() || failure()
        with:
          name: Library Tests
          path: ./subprojects/*/build/test-results/test/TEST-*.xml
          reporter: java-junit
          max-annotations: "0"
          fail-on-error: false
      - name: "Artifact: Libraries"
        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
        continue-on-error: true
        with:
          name: libraries-jvm
          path: |
            ./subprojects/*/build/libs/*.jar
      - name: "Artifact: Reports"
        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
        continue-on-error: true
        with:
          name: test-reports-jvm
          path: |
            ./build/reports/kover/merged/xml/report.xml
            ./subprojects/*/build/test-results/test/TEST-*.xml
      - name: "Report: Codecov"
        uses: codecov/codecov-action@54bcd8715eee62d40e33596ef5e8f0f48dbbccab # v4.1.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: ./build/reports/kover/merged/xml/report.xml

  ## Stage: Report Coverage
  coverage:
    name: "Tests & Coverage"
    needs: ['build']
    runs-on: ${{ vars.RUNNER || inputs.runner || 'ubuntu-latest' }}
    permissions:
      actions: read
      checks: write
      id-token: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
        with:
          egress-policy: audit

      - name: "Setup: Artifacts"
        uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
        with:
          name: test-reports-jvm

  ## Stage: Build Library with Gradle
  provenance:
    name: "Provenance"
    needs: ['build']
    permissions:
      actions: read
      id-token: write
      contents: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
    with:
      base64-subjects: "${{ needs.build.outputs.hashes }}"
      upload-assets: ${{ inputs.provenance }}