pr-build.yml

name: build and validate
on:
  push:
    branches:
      - main
  pull_request_target:
    branches:
      - main

jobs:
  build:
    runs-on: ubuntu-22.04
    steps:
      # Set fetch-depth: 0 to fetch commit history and tags for use in version calculation
      - name: Check out code
        uses: actions/checkout@v4
        with:
          ref: ${{github.event.pull_request.head.ref}}
          repository: ${{github.event.pull_request.head.repo.full_name}}
          fetch-depth: 0

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_READ_USER }}
          password: ${{ secrets.DOCKERHUB_READ_TOKEN }}

      - name: Build with Gradle
        uses: hypertrace/github-actions/gradle@main
        with:
          args: assemble dockerBuildImages

      - name: Run Trivy vulnerability scanner
        uses: hypertrace/github-actions/trivy-image-scan@main
        with:
          image: hypertrace/config-service
          output-mode: github

  validate-protos:
    runs-on: ubuntu-22.04
      # Set fetch-depth: 0 to fetch commit history and tags for use in version calculation
    steps:
      - name: Check out code
        uses: actions/checkout@v4
        with:
          ref: ${{github.event.pull_request.head.ref}}
          repository: ${{github.event.pull_request.head.repo.full_name}}
          fetch-depth: 0

      - name: Setup buf
        uses: bufbuild/buf-setup-action@v1
        with:
          github_token: ${{ github.token }}

      - name: Lint protos
        uses: bufbuild/buf-lint-action@v1

      - name: Check for breaking changes
        uses: bufbuild/buf-breaking-action@v1
        with:
          against: '.git#branch=origin/main'