build-sonar.yml

# Copyright © 2020 Cask Data, Inc.
#  Licensed under the Apache License, Version 2.0 (the "License"); you may not
#  use this file except in compliance with the License. You may obtain a copy of
#  the License at
#  http://www.apache.org/licenses/LICENSE-2.0
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
#  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
#  License for the specific language governing permissions and limitations under
#  the License.

# This workflow will build a Java project with Maven
# For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-maven
# Note: Any changes to this workflow would be used only after merging into develop
name: Build with test coverage for Sonar

on:
  push:
    branches: [ develop, release/** ]
  pull_request:
    branches: [ develop, release/** ]
    types: [opened, synchronize, reopened, labeled]

jobs:
  build-sonar:
    runs-on: k8s-runner-build

    # We allow builds:
    # 1) When it's a merge into a branch
    # 2) For PRs that are labeled as build and
    #  - It's a code change
    #  - A build label was just added
    # A bit complex, but prevents builds when other labels are manipulated
    if: >
      github.event_name == 'push'
      || (contains(github.event.pull_request.labels.*.name, 'build')
         && (github.event.action != 'labeled' || github.event.label.name == 'build')
         )

    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Cache
        uses: actions/cache@v4
        with:
          path: ~/.m2/repository11
          key: ${{ runner.os }}-maven-${{ github.workflow }}-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-${{ github.workflow }}

      - name: Build with Maven
        run: >-
          mvn clean verify -fae -T 2 -B -V -Dmaven.test.failure.ignore
          -Dmaven.repo.local=$HOME/.m2/repository11
          -DcloudBuild
          -Pcoverage,templates
          -Dmaven.wagon.http.retryHandler.count=3
          -Dmaven.wagon.httpconnectionManager.ttlSeconds=25

      - name: Archive build artifacts
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: reports-${{ github.run_id }}
          path: |
            **/target/rat.txt
            **/target/surefire-reports/*

      - name: Sonar Report on PR
        if: ${{ github.event_name == 'pull_request' }}
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          JAVA_HOME: /usr/lib/jvm/java-17-openjdk-amd64
        run: >-
          mvn org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -fae -T 2 -B -V
          -Dmaven.repo.local=$HOME/.m2/repository11
          -DcloudBuild
          -Pcoverage,templates
          -Dmaven.wagon.http.retryHandler.count=3
          -Dmaven.wagon.httpconnectionManager.ttlSeconds=25
          -Dsonar.pullrequest.key=${{ github.event.pull_request.number }}
          -Dsonar.pullrequest.branch=${{ github.event.pull_request.head.ref }}
          -Dsonar.pullrequest.base=${{ github.event.pull_request.base.ref }}

      - name: Sonar report
        if: ${{ github.event_name == 'push' }}
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          JAVA_HOME: /usr/lib/jvm/java-17-openjdk-amd64
          BRANCH: ${{ github.event.workflow_run.head_branch }}
        run: >-
          mvn org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -fae -T 2 -B -V
          -Dmaven.repo.local=$HOME/.m2/repository11
          -DcloudBuild
          -Pcoverage,templates
          -Dmaven.wagon.http.retryHandler.count=3
          -Dmaven.wagon.httpconnectionManager.ttlSeconds=25
          -Dsonar.branch.name=$BRANCH