build.yml

on:
  push:
    branches:
    - main
    - release-*
    - develop
    - feature-*
  pull_request:
    types: [opened, synchronize, reopened]
    branches:
    - main
    - release-*
    - develop
    - feature-*
  merge_group:
  workflow_dispatch:
name: Build and Test Code
jobs:
  build-artifacts:
    name: Build Java Artifacts
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    env:
      BUILD_SNAPSHOT: ${{ (github.event_name == 'push' || github.event_name == 'workflow_dispatch') &&
                          (github.ref_name == 'develop' || startsWith(github.ref_name, 'release-')) }}
    steps:
    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
      with:
        submodules: recursive
        filter: tree:0
    # -------------------------
    # Java Environment Setup
    # -------------------------
    - name: Set up Maven
      uses: stCarolas/setup-maven@07fbbe97d97ef44336b7382563d66743297e442f
      with:
        maven-version: 3.9.3
    - id: setup-java-deploy
      name: Set up JDK 11 (deploy)
      if: ${{ env.BUILD_SNAPSHOT == 'true' }}
      uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93
      with:
        java-version: 11
        distribution: 'temurin'
        cache: 'maven'
        server-id: ossrh # Value of the distributionManagement/repository/id field of the pom.xml
        server-username: MAVEN_USERNAME # env variable for username in deploy
        server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy
        gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }} # Value of the GPG private key to import
        gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase
    - name: Set up JDK 11 (build only)
      if:  ${{ steps.setup-java-deploy.outcome == 'skipped' }}
      uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93
      with:
        java-version: 11
        distribution: 'temurin'
        cache: 'maven'
    - name: Initialize CodeQL
      if: github.event_name == 'push'
      uses: github/codeql-action/init@379614612a29c9e28f31f39a59013eb8012a51f0
      with:
        languages: java
    # -------------------------
    # Maven Build
    # -------------------------
    - id: build-test-deploy
      name: Build, Test and DEPLOY SNAPSHOT Code
      if: ${{ env.BUILD_SNAPSHOT == 'true' }}
      run: |
        mvn -B -e -Pgpg -Prelease -Preporting deploy -Dmaven.deploy.skip=releases
      env:
        MAVEN_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
        MAVEN_CENTRAL_TOKEN: ${{ secrets.SONATYPE_PASSWORD }}
        MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
    - name: Build and Test Code
      if: ${{ steps.build-test-deploy.outcome == 'skipped' }}
      run: |
        mvn -B -e -Prelease -Preporting install
    - name: Perform CodeQL Analysis
      if: github.event_name == 'push'
      uses: github/codeql-action/analyze@379614612a29c9e28f31f39a59013eb8012a51f0
      with:
        upload: ${{ (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref_name == 'develop' && 'always' || 'never' }}
    - name: Test Website
      run: |
        # this needs to be run as a second build to ensure source is fully generated by the previous step
        mvn -B -e -Prelease -Preporting install site site:stage