build.yaml

name: Build

on:
  push:
    branches:
      - 'main'
  pull_request: {}
  # allow manual execution just in case
  workflow_dispatch:

jobs:
  build:

    runs-on: ubuntu-24.04
    timeout-minutes: 60

    permissions:
      # Cf. https://github.com/marketplace/actions/publish-test-results#permissions
      checks: write
      pull-requests: write
      # For detekt
      security-events: write

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
        with:
          node-version-file: '.nvmrc'
      - name: Set up JDK
        uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4
        with:
          distribution: 'temurin'
          java-version: '21'
      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@0bdd871935719febd78681f197cd39af5b6e16a6 # v4
      - name: Build
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: ./gradlew --build-cache build detektMain detektTest detektJsMain detektJsTest detektJvmMain detektJvmTest :koverHtmlReport :koverXmlReport -PciBuild=true
      - name: Publish test results
        uses: EnricoMi/publish-unit-test-result-action@170bf24d20d201b842d7a52403b73ed297e6645b # v2
        # Also report in case the build failed
        if: always()
        with:
          files: |
            **/test-results/**/*.xml
      - name: Archive test report
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4
        # Archive test reports for introspection even if the build failed. They are most useful in this situation.
        if: always()
        with:
          name: test-report
          path: |
            */build/test-results
            */build/reports
      - name: Report test coverage
        uses: madrapps/jacoco-report@7c362aca34caf958e7b1c03464bd8781db9f8da7 # v1.7.1
        with:
          paths: ${{ github.workspace }}/build/reports/kover/report.xml
          token: ${{ secrets.GITHUB_TOKEN }}
          title: JVM coverage report
          update-comment: true
        # We need to combine the SARIF files because GitHub has a limit of 20 runs. Our number of modules + targets
        # exceeds this limit. Therefore, we combine the individual runs in the SARIF files.
      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
        with:
          node-version-file: '.nvmrc'
      - name: Combine SARIF files
        run: |
          npx @microsoft/sarif-multitool merge --merge-runs --output-file merged.sarif  $(find . -iname '*.sarif*')
        env:
          # Disables globalization support.
          # This makes the @microsoft/sarif-multitool work without ICU package installed.
          # If not disabled, we get the following error:
          # > Process terminated.
          # > Couldn't find a valid ICU package installed on the system.
          # > Set the configuration flag System.Globalization.Invariant to true
          # > if you want to run with no globalization support.
          DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: 1
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3
        with:
          sarif_file: merged.sarif
          category: detekt

  test-model-api-gen-gradle:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - name: Set up JDK
        uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4
        with:
          distribution: 'temurin'
          java-version: '21'
      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@0bdd871935719febd78681f197cd39af5b6e16a6 # v4
      - name: Assemble
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: ./gradlew --build-cache assemble publishToMavenLocal -PciBuild=true
      - name: Test Model API Generator Gradle Plugin
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: model-api-gen-gradle-test/ci.sh

  test-model-client-js:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - name: Set up JDK
        uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4
        with:
          distribution: 'temurin'
          java-version: '21'
      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@0bdd871935719febd78681f197cd39af5b6e16a6 # v4
      - name: Assemble
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: ./gradlew --build-cache assemble publishToMavenLocal -PciBuild=true
      - name: Test Model Client JS API
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: model-client-js-test/ci.sh

  test-bulk-model-sync-gradle:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - name: Set up JDK
        uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4
        with:
          distribution: 'temurin'
          java-version: '21'
      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@0bdd871935719febd78681f197cd39af5b6e16a6 # v4
      - name: Assemble
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: ./gradlew --build-cache assemble publishToMavenLocal -PciBuild=true
      - name: Test Bulk Model Sync Gradle Plugin
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: bulk-model-sync-gradle-test/ci.sh