name: CI

on:
  push:
    branches:
      - 'main'
      - '1.1.x'
    paths-ignore:
      - '.github/**'
  schedule:
    - cron: '0 11 * * *' # Once per day at 11am UTC
  workflow_dispatch:
    inputs:
      run-trivy-scan:
        description: 'Run Trivy scan ?'
        default: true
        required: false
        type: boolean

env:
  GCHAT_WEBHOOK_URL: ${{ secrets.SPRING_RELEASE_GCHAT_WEBHOOK_URL }}
  DEVELOCITY_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_SECRET_ACCESS_KEY }}
  COMMIT_OWNER: ${{ github.event.pusher.name }}
  COMMIT_SHA: ${{ github.sha }}
  ARTIFACTORY_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }}
  ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
  GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}

jobs:
  prerequisites:
    name: Pre-requisites for building
    runs-on: ubuntu-latest
    if: github.repository == 'spring-projects/spring-pulsar'
    outputs:
      runjobs: ${{ steps.continue.outputs.runjobs }}
      project_version: ${{ steps.continue.outputs.project_version }}
      boot_version: ${{ steps.continue.outputs.boot_version }}
    steps:
      - uses: actions/checkout@v4
      - id: continue
        name: Determine if should continue
        run: |
          # Run jobs if in upstream repository
          echo "runjobs=true" >>$GITHUB_OUTPUT
          # Extract version from gradle.properties
          version=$(cat gradle.properties | grep "version=" | awk -F'=' '{print $2}')
          echo "project_version=$version" >>$GITHUB_OUTPUT
          bootVersion=$(cat gradle/libs.versions.toml | grep "spring-boot = \"" | cut -d '"' -f2)
          echo "boot_version=$bootVersion" >>$GITHUB_OUTPUT
  build_jdk_17:
    name: Build (JDK 17)
    needs: [prerequisites]
    runs-on: ubuntu-latest
    if: needs.prerequisites.outputs.runjobs
    steps:
      - uses: actions/checkout@v4
      - uses: spring-io/spring-gradle-build-action@v2
      - name: Build and run unit tests
        run: |
          ./gradlew clean build -x integrationTest \
              --continue --scan \
              -PartifactoryUsername="$ARTIFACTORY_USERNAME" -PartifactoryPassword="$ARTIFACTORY_PASSWORD"
      - name: Run integration tests
        run: |
          ./gradlew integrationTest --rerun-tasks -DdownloadRabbitConnector=true --scan
      - name: Capture test results
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: test-results
          path: '*/build/reports/tests/**/*.*'
          retention-days: 3
  check_samples:
    name: Check Sample Apps
    needs: [prerequisites]
    strategy:
      matrix:
        springBootVersion: [ "${{ needs.prerequisites.outputs.boot_version }}" ]
    runs-on: ubuntu-latest
    if: needs.prerequisites.outputs.runjobs
    steps:
      - uses: actions/checkout@v4
      - uses: spring-io/spring-gradle-build-action@v2
      - name: Run all sample app tests
        env:
          LOCAL_REPOSITORY_PATH: ${{ github.workspace }}/build/publications/repos
          VERSION: ${{ needs.prerequisites.outputs.project_version }}
          BOOT_VERSION: ${{ matrix.springBootVersion }}
          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.GPG_PRIVATE_KEY }}
          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.GPG_PASSPHRASE }}
        run: |
          ./gradlew publishMavenJavaPublicationToLocalRepository
          ./gradlew \
              --init-script ./spring-pulsar-sample-apps/sample-apps-check-ci.gradle \
              -PlocalRepositoryPath="$LOCAL_REPOSITORY_PATH" \
              -PspringPulsarVersion="$VERSION" \
              -PspringBootVersion="$BOOT_VERSION" \
              -PsampleTests \
              :runAllSampleTests
  scan:
    needs: [prerequisites]
    if: ${{ needs.prerequisites.outputs.runjobs && !contains(inputs.run-trivy-scan, 'false') }}
    uses: ./.github/workflows/trivy-scan.yml
  deploy_artifacts:
    name: Deploy Artifacts
    needs: [build_jdk_17, check_samples, scan]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: spring-io/spring-gradle-build-action@v2
      - name: Deploy artifacts
        env:
          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.GPG_PRIVATE_KEY }}
          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.GPG_PASSPHRASE }}
          OSSRH_TOKEN_USERNAME: ${{ secrets.OSSRH_S01_TOKEN_USERNAME }}
          OSSRH_TOKEN_PASSWORD: ${{ secrets.OSSRH_S01_TOKEN_PASSWORD }}
        run: |
          ./gradlew publishArtifacts finalizeDeployArtifacts \
              --stacktrace \
              -PossrhUsername="$OSSRH_TOKEN_USERNAME" -PossrhPassword="$OSSRH_TOKEN_PASSWORD" \
              -PartifactoryUsername="$ARTIFACTORY_USERNAME" -PartifactoryPassword="$ARTIFACTORY_PASSWORD"
  deploy_docs_antora:
    name: Deploy Antora Docs
    needs: [build_jdk_17, check_samples, scan]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: spring-io/spring-gradle-build-action@v2
      - name: Run Antora
        run: |
          ./gradlew antora
      - name: Publish Docs
        uses: spring-io/spring-doc-actions/rsync-antora-reference@v0.0.20
        with:
          docs-username: ${{ secrets.DOCS_USERNAME }}
          docs-host: ${{ secrets.DOCS_HOST }}
          docs-ssh-key: ${{ secrets.DOCS_SSH_KEY }}
          docs-ssh-host-key: ${{ secrets.DOCS_SSH_HOST_KEY }}
          site-path: spring-pulsar-docs/build/site
      - name: Bust Clouflare Cache
        uses: spring-io/spring-doc-actions/bust-cloudflare-antora-cache@v0.0.20
        with:
          context-root: spring-pulsar
          cloudflare-zone-id: ${{ secrets.CLOUDFLARE_ZONE_ID }}
          cloudflare-cache-token: ${{ secrets.CLOUDFLARE_CACHE_TOKEN }}
  perform_release:
    name: Perform Release
    needs: [prerequisites, deploy_artifacts, deploy_docs_antora]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    timeout-minutes: 120
    if: ${{ !endsWith(needs.prerequisites.outputs.project_version, '-SNAPSHOT') }}
    env:
      REPO: ${{ github.repository }}
      BRANCH: ${{ github.ref_name }}
      VERSION: ${{ needs.prerequisites.outputs.project_version }}
    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
      - uses: spring-io/spring-gradle-build-action@v2
      - name: Wait for Artifactory artifacts (milestone)
        if: ${{ contains(needs.prerequisites.outputs.project_version, '-RC') || contains(needs.prerequisites.outputs.project_version, '-M') }}
        run: |
          echo "Wait for artifacts of $REPO@$VERSION to appear on Artifactory."
          until curl -f -s https://repo.spring.io/artifactory/milestone/org/springframework/pulsar/spring-pulsar/$VERSION/ > /dev/null
          do
            sleep 30
            echo "."
          done
          echo "Artifacts for $REPO@$VERSION have been released to Artifactory."
      - name: Wait for Maven Central artifacts (GA)
        if: ${{ !contains(needs.prerequisites.outputs.project_version, '-SNAPSHOT') && !contains(needs.prerequisites.outputs.project_version, '-RC') && !contains(needs.prerequisites.outputs.project_version, '-M') }}
        run: |
          echo "Wait for artifacts of $REPO@$VERSION to appear on Maven Central."
          until curl -f -s https://repo1.maven.org/maven2/org/springframework/pulsar/spring-pulsar/$VERSION/ > /dev/null
          do
            sleep 30
            echo "."
          done
          echo "Artifacts for $REPO@$VERSION have been released to Maven Central."
      - name: Setup git for release tagging
        run: |
          git config user.name 'github-actions[bot]'
          git config user.email 'github-actions[bot]@users.noreply.github.com'
      - name: Tag release
        run: |
          echo "Tagging $REPO@$VERSION release."
          git tag v$VERSION
          git push --tags origin
      - name: Changelog Config File
        run: |
          repositoryTeam=$(gh api repos/$GITHUB_REPOSITORY/collaborators --jq 'map(select(.role_name == "admin") | .login) | tostring')
          repositoryTeam=$(sed 's/"//g' <<< ${repositoryTeam:1:-1})
          repositoryVisibility=$(gh repo view --json visibility --jq .[])
          repositoryVisibility=$([[ $repositoryVisibility = 'PUBLIC' ]] && echo 'true' || echo 'false')
          echo "changelog.contributors.exclude.names=$repositoryTeam" > changelog.properties
          echo "changelog.issues.generate-links=$repositoryVisibility" >> changelog.properties
      - name: Generate Changelog
        uses: spring-io/github-changelog-generator@v0.0.12
        with:
          milestone: ${{ env.VERSION }}
          token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
          config-file: changelog.properties
      - name: GitHub Release
        run: |
          RELEASE_URL=$(gh release create v${{ env.VERSION }} -F changelog.md ${{ (contains(env.VERSION, '-M') || contains(env.VERSION, '-RC')) && '--prerelease' || '' }})
          echo "::notice title=Release Page::$RELEASE_URL"
      - name: Close Milestone
        run: |
          MILESTONE_ID=$(gh api repos/$GITHUB_REPOSITORY/milestones --jq '.[] | select(.title == "${{ env.VERSION }}") | .number')
          if [ $MILESTONE_ID ]; then
            gh api -X PATCH repos/$GITHUB_REPOSITORY/milestones/$MILESTONE_ID -f state='closed' --silent
          fi
      - name: Announce Release in Chat
        if: env.GCHAT_WEBHOOK_URL
        run: |
          curl -X POST '${{ env.GCHAT_WEBHOOK_URL }}' \
              -H 'Content-Type: application/json' \
              -d '{ text: "${{ github.event.repository.name }}-announcing `${{ env.VERSION }}`"}'
      - name: Update next snapshot version
        run: |
          echo "Updating $REPO@$VERSION to next snapshot version."
          ./gradlew :updateToSnapshotVersion
          git commit -am "[Release $VERSION] Next development version"
          git push