name: 'CI - PR'

on:
  pull_request:

env:
  MAIN_PATH: 'build-dir'
  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  MAVEN_THREADS: 'false'
  BUILD_NAME: 'stream-applications-${{ github.ref_name }}'
  BUILD_NUMBER: ${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}
  ARTIFACTORY_USERNAME: 'anonymous'
  ARTIFACTORY_PASSWORD: 'anonymous'
  SKIP_DEPLOY: 'true'
  TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db,aquasec/trivy-db,ghcr.io/aquasecurity/trivy-db
  TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db,aquasec/trivy-java-db,ghcr.io/aquasecurity/trivy-java-db

jobs:
  build:
    if: github.repository == 'spring-cloud/stream-applications'
    runs-on: ubuntu22-8-32-OSS
    steps:
      - name: 'Configure: checkout stream-applications@${{ github.ref_name }}'
        uses: actions/checkout@v3
      - name: 'Configure: checkout stream-applications@main'
        id: checkout-main
        uses: actions/checkout@v3
        with:
          ref: 'main'
          path: ${{ env.MAIN_PATH }}
      - name: 'Configure: Install gh cli'
        uses: ./.github/actions/install-gh
      - name: 'Configure: Ensure scripts are executable'
        shell: bash
        run: find . -type f -name "*.sh" -exec chmod a+x '{}' \;
      - name: 'Configure: Install Java'
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'liberica'
      - name: 'Configure: cache for maven dependencies'
        uses: actions/cache@v3
        with:
          path: ~/.m2/repository
          key: maven-repo-${{ hashFiles('**/pom.xml') }}-pr-${{ github.base_ref }}
          restore-keys: |
            maven-repo-${{ hashFiles('**/pom.xml') }}-pr-${{ github.base_ref }}
            maven-repo-${{ hashFiles('**/pom.xml') }}
            maven-repo-
      - name: 'Configure: Install xsltproc'
        uses: ./.github/actions/install-xsltproc
      - name: 'Action: Build Core'
        shell: bash
        env:
          VERBOSE: ${{ github.debug && 'true' || '' }}
        run: |
          ./build-core.sh "-T 1C package -Psnapshot"
      - name: 'Action: Build Apps'
        shell: bash
        env:
          VERBOSE: ${{ github.debug && 'true' || '' }}
        run: |
          ./build-apps.sh "-T 1C package -Psnapshot"
      - name: 'Configure: Install Trivy'
        uses: ./.github/actions/install-trivy
      - name: 'Action: Trivy scan'
        shell: bash
        run: |
          BUILD_DIR=$(realpath $MAIN_PATH)
          $BUILD_DIR/scan-folders.sh table
      - name: 'Upload: Error logs'
        if: ${{ failure() }}
        uses: actions/upload-artifact@v4
        with:
          name: 'modified-surefire-reports'
          path: '**/target/surefire-reports'
          retention-days: 7
          if-no-files-found: ignore
      - name: 'Built'
        shell: bash
        run: echo "::info ::Built"
