ci-cd-java.yml

name: ci-cd-java.yml

permissions:
  contents: read
  packages: read

on:
  workflow_call:
    inputs:
      # it is required for backwards compatibility with CI/CD pipelines that have not been yet fully migrated to shared workflows
      uploadJarArtifact:
        required: false
        type: boolean
        default: false
      performRelease:
        required: false
        type: boolean
        default: false
      workingDirectory:
        required: false
        type: string
        default: .
      imageName:
        required: false
        type: string
      runTestsInsideDocker:
        required: false
        type: boolean
        default: true

env:
  IMAGE_NAME_MIXED_CASE: "${{ github.repository }}"

jobs:
  build-check-test-push:
    name: Build, check, test, push
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          clean: 'true'
          fetch-depth: 2

      # Required since custom scripts from /scripts are being used
      - name: Resolve shared workflow ref
        id: resolve_shared_workflow_ref
        run: |
          set -euo pipefail
          SHARED_WORKFLOW_REF=$(grep -roh \
            'transitdata-shared-workflows/.github/workflows/[^@]*@[^ "'\'']*' \
            "${GITHUB_WORKSPACE}/.github/workflows/" 2>/dev/null \
            | sed 's/.*@//' | head -1 || true)

          if [[ -z "${SHARED_WORKFLOW_REF}" ]]; then
            echo "::warning::Could not detect shared workflow ref from caller workflows; falling back to main"
            SHARED_WORKFLOW_REF="main"
          fi

          echo "Resolved shared workflow ref: ${SHARED_WORKFLOW_REF}"
          echo "shared_workflow_ref=${SHARED_WORKFLOW_REF}" >> "$GITHUB_OUTPUT"

      - name: Checkout shared workflow scripts
        uses: actions/checkout@v4
        with:
          repository: HSLdevcom/transitdata-shared-workflows
          ref: ${{ steps.resolve_shared_workflow_ref.outputs.shared_workflow_ref }}
          path: .shared-workflows

      - name: Setup JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '25'
          cache: 'maven'

      - name: Validate Java version consistency
        working-directory: ${{ inputs.workingDirectory }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          JAVA_TOOL_OPTIONS: ""
          MAVEN_OPTS: ""
        run: python3 "${GITHUB_WORKSPACE}/.shared-workflows/scripts/validate_java_version_consistency.py"

      - name: Check code format and lint
        working-directory: ${{ inputs.workingDirectory }}
        run: |
          mvn spotless:check

      - name: Run unit tests inside Docker
        if: ${{ inputs.runTestsInsideDocker }}
        working-directory: ${{ inputs.workingDirectory }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_ACTOR: ${{ github.actor }}
          DOCKER_BUILDKIT: "1"
        run: |
          cat > /tmp/Dockerfile.test << DOCKERFILE
          # syntax=docker/dockerfile:1
          # check=error=true
          FROM ${TEST_BASE_IMAGE}
          WORKDIR /usr/app
          COPY . .
          COPY .mvn/settings.xml /root/.m2/settings.xml
          RUN --mount=type=secret,id=github_token \
              --mount=type=secret,id=github_actor \
              export GITHUB_TOKEN="\$(cat /run/secrets/github_token)" && \
              export GITHUB_ACTOR="\$(cat /run/secrets/github_actor)" && \
              ./mvnw -B test
          DOCKERFILE
          docker build \
            --secret id=github_token,env=GITHUB_TOKEN \
            --secret id=github_actor,env=GITHUB_ACTOR \
            -f /tmp/Dockerfile.test \
            .

      - name: Run unit tests outside Docker
        if: ${{ !inputs.runTestsInsideDocker }}
        working-directory: ${{ inputs.workingDirectory }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          JAVA_TOOL_OPTIONS: ""
          MAVEN_OPTS: ""
        run: mvn -B test

      - name: Run Integration tests (Testcontainers)
        working-directory: ${{ inputs.workingDirectory }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DOCKER_HOST: unix:///var/run/docker.sock
          TESTCONTAINERS_DOCKER_SOCKET_OVERRIDE: /var/run/docker.sock
          JAVA_TOOL_OPTIONS: ""
          MAVEN_OPTS: ""
        run: mvn -B verify

      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: true
          verbose: true

      - name: Upload test results to Codecov
        if: ${{ !cancelled() }}
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: true
          report_type: test_results

      - name: Build artifact
        working-directory: ${{ inputs.workingDirectory }}
        run: mvn package -Dmaven.test.skip
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload .jar artifact
        if: ${{ inputs.uploadJarArtifact }}
        uses: actions/upload-artifact@v4
        with:
          name: 'app.jar'
          path: '/app/app.jar'

      - name: Set Docker Image Name
        run: |
          OWNER="${GITHUB_REPOSITORY%%/*}"

          if [[ -n "${{ inputs.imageName }}" ]]; then
            IMAGE_NAME="${OWNER,,}/${{ inputs.imageName }}"
          else
            IMAGE_NAME="${GITHUB_REPOSITORY,,}"
          fi

          echo "IMAGE_NAME=${IMAGE_NAME}" >> "$GITHUB_ENV"

      - name: Build Docker Image
        uses: docker/build-push-action@v6
        with:
          context: ${{ inputs.workingDirectory }}
          push: 'false'
          tags: 'hsldevcom/${{ env.IMAGE_NAME }}:${{ github.sha }}'
          secrets: |
            github_token=${{ secrets.GITHUB_TOKEN }}
          build-args:
            GITHUB_ACTOR=${{ github.actor }}

      - name: Check if perform release
        id: perform_release
        run: |
          PERFORM_RELEASE=false
          if [[ "${GITHUB_REF}" == "refs/heads/main" || "${GITHUB_REF}" == "refs/heads/develop" || "${GITHUB_REF}" == "refs/heads/aks-dev" ]]; then
            PERFORM_RELEASE=true
          elif [[ "${GITHUB_REF}" == refs/tags/* ]]; then
            PERFORM_RELEASE=true
          elif [[ "${{ inputs.performRelease }}" == "true" ]]; then
            PERFORM_RELEASE=true
          fi
          echo "PERFORM_RELEASE=${PERFORM_RELEASE}" >> $GITHUB_ENV
          echo "Perform release: ${PERFORM_RELEASE}"

      - name: Extract Docker metadata
        if: ${{ env.PERFORM_RELEASE == 'true' }}
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=sha
            type=semver,pattern={{version}}
          labels: |
            org.opencontainers.image.title=${{ env.IMAGE_NAME }}
            org.opencontainers.image.vendor=hsldevcom

      - name: Setup Docker Buildx
        if: ${{ env.PERFORM_RELEASE == 'true' }}
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        if: ${{ env.PERFORM_RELEASE == 'true' }}
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_HUB_INFODEVOPS_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_INFODEVOPS_TOKEN }}

      - name: Build & Push Docker image
        if: ${{ env.PERFORM_RELEASE == 'true' }}
        uses: docker/build-push-action@v6
        with:
          context: ${{ inputs.workingDirectory }}
          push: ${{ env.PERFORM_RELEASE }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}