checks.yaml

name: "Checks"

on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main
  merge_group:
    branches:
      - main
    types:
      - checks_requested

permissions:
  contents: read

jobs:
  pr:
    name: Validate PR title
    if: contains(fromJSON('["pull_request", "pull_request_target"]'), github.event_name)
    runs-on: ubuntu-22.04
    permissions:
      pull-requests: read
    steps:
      - name: Conventional Commits Check
        if: contains(fromJSON('["pull_request", "pull_request_target"]'), github.event_name)
        id: conventional-commits
        uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017 # v5.5.3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          # Types include:
          #   - fix: fixes
          #   - feat: features and enhancements
          #   - chore: non-feature or enhancement (i.e. docs, ci, linting, automated, etc)
          types: |
            fix
            feat
            chore
            revert
          # Scopes include:
          #   - ci: anything related to ci
          #   - cmdline: changes to cmdline
          #   - docs: anything related solely to documentation
          #   - main: bot generated commits
          #   - sdk: changes to sdk
          #   - tests: test only changes
          #   - examples: examples only changes
          scopes: |
            ci
            cmdline
            docs
            main
            sdk
            tests
            examples

  mavenverify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
      - name: Cache Maven packages
        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: ~/.m2
          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
          restore-keys: ${{ runner.os }}-m2
      - name: Set up JDK
        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
        with:
          java-version: "17"
          distribution: "temurin"
          server-id: github
      - name: Cache SonarCloud packages
        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
          restore-keys: ${{ runner.os }}-sonar
      - name: Maven Test Coverage
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BUF_INPUT_HTTPS_USERNAME: opentdf-bot
          BUF_INPUT_HTTPS_PASSWORD: ${{ secrets.PERSONAL_ACCESS_TOKEN_OPENTDF }}
        run: mvn --batch-mode clean verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=opentdf_java-sdk -P coverage

  platform-integration:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout Java SDK
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up JDK
        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
        with:
          java-version: "17"
          distribution: "temurin"
          server-id: github
      - name: Build java SDK
        run: |
          mvn --batch-mode clean install -DskipTests
        env:
          BUF_INPUT_HTTPS_USERNAME: opentdf-bot
          BUF_INPUT_HTTPS_PASSWORD: ${{ secrets.PERSONAL_ACCESS_TOKEN_OPENTDF }}

      - name: Check out and start up platform with deps/containers
        id: run-platform
        uses: opentdf/platform/test/start-up-with-containers@main
        with:
          platform-ref: main

      - name: Get grpcurl
        run: go install github.com/fullstorydev/grpcurl/cmd/grpcurl@v1.8.9
      - name: Make sure that the platform is up
        run: |
          grpcurl -plaintext localhost:8080 list && \
          grpcurl -plaintext localhost:8080 kas.AccessService/PublicKey

      - name: Validate the SDK through the command line interface
        run: |
          printf 'here is some data to encrypt' > data

          java -jar target/cmdline.jar \
            --client-id=opentdf-sdk \
            --client-secret=secret \
            --platform-endpoint=http://localhost:8080 \
            -h\
            encrypt --kas-url=http://localhost:8080 --mime-type=text/plain --attr https://example.com/attr/attr1/value/value1 --autoconfigure=false -f data -m 'here is some metadata' > test.tdf

          java -jar target/cmdline.jar \
            --client-id=opentdf-sdk \
            --client-secret=secret \
            --platform-endpoint=http://localhost:8080 \
            -h\
            decrypt -f test.tdf > decrypted

          java -jar target/cmdline.jar \
            --client-id=opentdf-sdk \
            --client-secret=secret \
            --platform-endpoint=http://localhost:8080 \
            -h\
            metadata -f test.tdf > metadata

          if ! diff -q data decrypted; then
            printf 'decrypted data is incorrect [%s]' "$(< decrypted)"
            exit 1
          fi

          if [ "$(< metadata)" != 'here is some metadata' ]; then
            printf 'metadata is incorrect [%s]\n' "$(< metadata)"
            exit 1
          fi
        working-directory: cmdline

      - name: Encrypt/Decrypt Assertions
        run: |
          echo "basic assertions"
          echo 'here is some data to encrypt' > data

          ASSERTIONS='[{"id":"assertion1","type":"handling","scope":"tdo","appliesToState":"encrypted","statement":{"format":"json+stanag5636","schema":"urn:nato:stanag:5636:A:1:elements:json","value":"{\"ocl\":\"2024-10-21T20:47:36Z\"}"}}]'

          java -jar target/cmdline.jar \
            --client-id=opentdf-sdk \
            --client-secret=secret \
            --platform-endpoint=http://localhost:8080 \
            -h\
            encrypt --kas-url=http://localhost:8080 --mime-type=text/plain --with-assertions=$ASSERTIONS --autoconfigure=false -f data -m 'here is some metadata' > test.tdf

          java -jar target/cmdline.jar \
            --client-id=opentdf-sdk \
            --client-secret=secret \
            --platform-endpoint=http://localhost:8080 \
            -h\
            decrypt -f test.tdf > decrypted

          if ! diff -q data decrypted; then
            printf 'decrypted data is incorrect [%s]' "$(< decrypted)"
            exit 1
          fi

          HS256_KEY=$(openssl rand -base64 32)
          openssl genpkey -algorithm RSA -out rs_private_key.pem -pkeyopt rsa_keygen_bits:2048
          openssl rsa -pubout -in rs_private_key.pem -out rs_public_key.pem
          RS256_PRIVATE_KEY=$(awk '{printf "%s\\n", $0}' rs_private_key.pem)
          RS256_PUBLIC_KEY=$(awk '{printf "%s\\n", $0}' rs_public_key.pem)
          SIGNED_ASSERTIONS_HS256='[{"id":"assertion1","type":"handling","scope":"tdo","appliesToState":"encrypted","statement":{"format":"json+stanag5636","schema":"urn:nato:stanag:5636:A:1:elements:json","value":"{\"ocl\":\"2024-10-21T20:47:36Z\"}"},"signingKey":{"alg":"HS256","key":"'$HS256_KEY'"}}]'
          SIGNED_ASSERTION_VERIFICATON_HS256='{"keys":{"assertion1":{"alg":"HS256","key":"'$HS256_KEY'"}}}'
          SIGNED_ASSERTIONS_RS256='[{"id":"assertion1","type":"handling","scope":"tdo","appliesToState":"encrypted","statement":{"format":"json+stanag5636","schema":"urn:nato:stanag:5636:A:1:elements:json","value":"{\"ocl\":\"2024-10-21T20:47:36Z\"}"},"signingKey":{"alg":"RS256","key":"'$RS256_PRIVATE_KEY'"}}]'
          SIGNED_ASSERTION_VERIFICATON_RS256='{"keys":{"assertion1":{"alg":"RS256","key":"'$RS256_PUBLIC_KEY'"}}}'

          echo "hs256 assertions"

          java -jar target/cmdline.jar \
            --client-id=opentdf-sdk \
            --client-secret=secret \
            --platform-endpoint=http://localhost:8080 \
            -h\
            encrypt --kas-url=http://localhost:8080 --mime-type=text/plain --with-assertions="$SIGNED_ASSERTIONS_HS256" --autoconfigure=false -f data -m 'here is some metadata' > test.tdf

          java -jar target/cmdline.jar \
            --client-id=opentdf-sdk \
            --client-secret=secret \
            --platform-endpoint=http://localhost:8080 \
            -h\
            decrypt --with-assertion-verification-keys="$SIGNED_ASSERTION_VERIFICATON_HS256" -f test.tdf > decrypted

          if ! diff -q data decrypted; then
            printf 'decrypted data is incorrect [%s]' "$(< decrypted)"
            exit 1
          fi

          echo "rs256 assertions"

          java -jar target/cmdline.jar \
            --client-id=opentdf-sdk \
            --client-secret=secret \
            --platform-endpoint=http://localhost:8080 \
            -h\
            encrypt --kas-url=http://localhost:8080 --mime-type=text/plain --with-assertions "$SIGNED_ASSERTIONS_RS256" --autoconfigure=false -f data -m 'here is some metadata' > test.tdf

          java -jar target/cmdline.jar \
            --client-id=opentdf-sdk \
            --client-secret=secret \
            --platform-endpoint=http://localhost:8080 \
            -h\
            decrypt --with-assertion-verification-keys "$SIGNED_ASSERTION_VERIFICATON_RS256" -f test.tdf > decrypted

          if ! diff -q data decrypted; then
            printf 'decrypted data is incorrect [%s]' "$(< decrypted)"
            exit 1
          fi
        working-directory: cmdline

  platform-xtest:
    permissions:
      contents: read
      packages: read
      checks: write
      pull-requests: write
    uses: opentdf/tests/.github/workflows/xtest.yml@main
    with:
      focus-sdk: java
      java-ref: ${{ github.ref }} latest
      platform-ref: main latest

  ci:
    needs:
      - platform-integration
      - platform-xtest
      - mavenverify
      - pr
    runs-on: ubuntu-latest
    if: always()
    steps:
      - if: contains(needs.*.result, 'failure')
        run: echo "Failed due to ${{ contains(needs.*.result, 'failure') }}" && exit 1