checks.yaml

name: "Checks"

on:
  pull_request:
    branches:
      - main
      - 'release/**'
  push:
    branches:
      - main
  merge_group:
    branches:
      - main
    types:
      - checks_requested

permissions:
  contents: read

jobs:
  pr:
    name: Validate PR title
    if: contains(fromJSON('["pull_request", "pull_request_target"]'), github.event_name)
    runs-on: ubuntu-22.04
    permissions:
      pull-requests: read
    steps:
      - name: Conventional Commits Check
        if: contains(fromJSON('["pull_request", "pull_request_target"]'), github.event_name)
        id: conventional-commits
        uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017 # v5.5.3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          # Types include:
          #   - fix: fixes
          #   - feat: features and enhancements
          #   - chore: non-feature or enhancement (i.e. docs, ci, linting, automated, etc)
          types: |
            fix
            feat
            chore
            revert
          # Scopes include:
          #   - ci: anything related to ci
          #   - cmdline: changes to cmdline
          #   - docs: anything related solely to documentation
          #   - main: bot generated commits
          #   - sdk: changes to sdk
          #   - tests: test only changes
          #   - examples: examples only changes
          #   - release/v0.\d+: release-please release branch PRs
          scopes: |
            ci
            cmdline
            docs
            main
            sdk
            tests
            examples
            release/v0\.\d+

  mavenverify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
      - name: Cache Maven packages
        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: ~/.m2
          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
          restore-keys: ${{ runner.os }}-m2
      - name: Set up JDK
        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
        with:
          java-version: "17"
          distribution: "temurin"
          server-id: github
      - name: Cache SonarCloud packages
        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
          restore-keys: ${{ runner.os }}-sonar
      - name: Generate sources
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BUF_INPUT_HTTPS_USERNAME: opentdf-bot
          BUF_INPUT_HTTPS_PASSWORD: ${{ secrets.PERSONAL_ACCESS_TOKEN_OPENTDF }}
        run: mvn clean --batch-mode clean generate-sources
      - name: Tests and enforcer (fips)
        run: |
          # install the sdk-fips-bc jar so that FIPS mode tests work
          mvn --batch-mode install -pl sdk-fips-bc -am \
            -Dmaven.antrun.skip \
            -Dmaven.test.skip
          mvn --batch-mode test enforcer:enforce -P 'fips,!non-fips' \
            -Dmaven.antrun.skip
      - name: Tests with coverage and javadoc (non-fips)
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: |
          mvn --batch-mode verify \
            org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \
            -Dmaven.antrun.skip -Dsonar.projectKey=opentdf_java-sdk \
            -P 'coverage,non-fips,!fips'

  platform-integration:
    name: "Platform Integration ${{ matrix.label }}"
    runs-on: ubuntu-22.04
    strategy:
      matrix:
        include:
          - label: ""
            maven_profile: ""
          - label: " (FIPS)"
            maven_profile: "-P 'fips,!non-fips'"
    steps:
      - name: Checkout Java SDK
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up JDK
        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
        with:
          java-version: "17"
          distribution: "temurin"
          server-id: github

      - name: Check out and start up platform with deps/containers
        id: run-platform
        uses: opentdf/platform/test/start-up-with-containers@main
        with:
          platform-ref: main

      - name: Get grpcurl
        run: go install github.com/fullstorydev/grpcurl/cmd/grpcurl@v1.8.9
      - name: Make sure that the platform is up
        run: |
          grpcurl -plaintext localhost:8080 list && \
          grpcurl -plaintext localhost:8080 kas.AccessService/PublicKey

      - name: Build java SDK${{ matrix.label }}
        run: |
          mvn --batch-mode clean install -pl cmdline -am ${{ matrix.maven_profile }} -DskipTests
        env:
          BUF_INPUT_HTTPS_USERNAME: opentdf-bot
          BUF_INPUT_HTTPS_PASSWORD: ${{ secrets.PERSONAL_ACCESS_TOKEN_OPENTDF }}

      - name: Validate the SDK through the command line interface${{ matrix.label }}
        run: |
          ../.github/scripts/verify_cmdline_roundtrip.sh
        working-directory: cmdline

      - name: Encrypt/Decrypt Assertions${{ matrix.label }}
        run: |
          ../.github/scripts/verify_assertions_basic.sh
          ../.github/scripts/verify_assertions_hs256.sh
          ../.github/scripts/verify_assertions_rs256.sh
        working-directory: cmdline


  platform-xtest:
    permissions:
      contents: read
      packages: read
      checks: write
      pull-requests: write
    uses: opentdf/tests/.github/workflows/xtest.yml@main
    with:
      focus-sdk: java
      java-ref: ${{ github.ref }} latest
      platform-ref: main latest

  ci:
    needs:
      - platform-integration
      - platform-xtest
      - mavenverify
      - pr
    runs-on: ubuntu-latest
    if: always()
    steps:
      - if: contains(needs.*.result, 'failure')
        run: echo "Failed due to ${{ contains(needs.*.result, 'failure') }}" && exit 1