ci-java.yaml

name: vaas-java-ci
on:
  push:
    branches:
      - main
    paths:
      - "java/**"
      - ".github/workflows/ci-java.yaml"
    tags:
      - "java*"
  pull_request:
    branches:
      - main
    paths:
      - "java/**"
      - ".github/workflows/ci-java.yaml"
  workflow_dispatch:
    inputs:
      environment:
        type: choice
        description: "Test environment"
        options:
          - production
          - staging
          - develop
        default: "production"

env:
  CLIENT_ID: ${{ secrets.CLIENT_ID }}
  CLIENT_SECRET: ${{secrets.CLIENT_SECRET}}
  VAAS_URL: "https://gateway.production.vaas.gdatasecurity.de"
  TOKEN_URL: "https://account.gdata.de/realms/vaas-production/protocol/openid-connect/token"
  VAAS_CLIENT_ID: ${{ secrets.VAAS_CLIENT_ID }}
  VAAS_USER_NAME: ${{ secrets.VAAS_USER_NAME }}
  VAAS_PASSWORD: ${{secrets.VAAS_PASSWORD}}

jobs:
  build-java:
    name: Build & Test Java 17 SDK
    runs-on: ubuntu-22.04

    steps:
      - name: checkout
        uses: actions/checkout@v4

      - name: Scan for Viruses
        uses: ./.github/actions/vaas-scan-action
        with:
          VAAS_CLIENT_ID: ${{ secrets.VAAS_SCAN_CLIENT_ID }}
          VAAS_CLIENT_SECRET: ${{ secrets.VAAS_SCAN_CLIENT_SECRET }}

      - name: set staging environment
        if: (inputs.environment == 'staging' || (startsWith(github.ref, 'refs/tags/java') && endsWith(github.ref, '-beta')))
        run: |
          echo "CLIENT_ID=${{ secrets.STAGING_CLIENT_ID }}" >> $GITHUB_ENV
          echo "CLIENT_SECRET=${{ secrets.STAGING_CLIENT_SECRET }}" >> $GITHUB_ENV
          echo "VAAS_URL=https://gateway.staging.vaas.gdatasecurity.de" >> $GITHUB_ENV
          echo "TOKEN_URL=https://account-staging.gdata.de/realms/vaas-staging/protocol/openid-connect/token" >> $GITHUB_ENV
          echo "VAAS_CLIENT_ID=${{ secrets.STAGING_VAAS_CLIENT_ID }}" >> $GITHUB_ENV
          echo "VAAS_USER_NAME=${{ secrets.STAGING_VAAS_USER_NAME }}" >> $GITHUB_ENV
          echo "VAAS_PASSWORD=${{ secrets.STAGING_VAAS_PASSWORD }}" >> $GITHUB_ENV

      - name: set develop environment
        if: (inputs.environment == 'develop' || (startsWith(github.ref, 'refs/tags/java') && endsWith(github.ref, '-alpha')))
        run: |
          echo "CLIENT_ID=${{ secrets.DEVELOP_CLIENT_ID }}" >> $GITHUB_ENV
          echo "CLIENT_SECRET=${{ secrets.DEVELOP_CLIENT_SECRET }}" >> $GITHUB_ENV
          echo "VAAS_URL=https://gateway.develop.vaas.gdatasecurity.de" >> $GITHUB_ENV
          echo "TOKEN_URL=https://account-staging.gdata.de/realms/vaas-develop/protocol/openid-connect/token" >> $GITHUB_ENV
          echo "VAAS_CLIENT_ID=${{ secrets.DEVELOP_VAAS_CLIENT_ID }}" >> $GITHUB_ENV
          echo "VAAS_USER_NAME=${{ secrets.DEVELOP_VAAS_USER_NAME }}" >> $GITHUB_ENV
          echo "VAAS_PASSWORD=${{ secrets.DEVELOP_VAAS_PASSWORD }}" >> $GITHUB_ENV

      - name: install Java
        uses: actions/setup-java@v4
        with:
          java-version: "17"
          distribution: "temurin"

      - name: setup Gradle
        uses: gradle/gradle-build-action@v3
        with:
          gradle-version: "8.6"

      - name: run tests
        uses: gradle/gradle-build-action@v3
        with:
          arguments: test --info
          gradle-version: "8.6"
          build-root-directory: java

      - name: publish local Maven package for examples
        uses: gradle/gradle-build-action@v3
        with:
          arguments: publishToLocalMaven
          gradle-version: "8.6"
          build-root-directory: java

      - name: run forSha256 example
        uses: gradle/gradle-build-action@v3
        with:
          arguments: sha256Scan
          gradle-version: "8.6"
          build-root-directory: java/examples/VaasExample

      - name: run forFile example
        env:
          SCAN_PATH: "build.gradle"      
        uses: gradle/gradle-build-action@v3
        with:
          arguments: fileScan
          gradle-version: "8.6"
          build-root-directory: java/examples/VaasExample

      - name: run forStream example
        env:
          SCAN_PATH: "build.gradle"      
        uses: gradle/gradle-build-action@v3
        with:
          arguments: streamScan
          gradle-version: "8.6"
          build-root-directory: java/examples/VaasExample

      - name: run forUrl example
        uses: gradle/gradle-build-action@v3
        with:
          arguments: urlScan
          gradle-version: "8.6"
          build-root-directory: java/examples/VaasExample 

      - name: run authentication example
        uses: gradle/gradle-build-action@v3
        with:
          arguments: authentication
          gradle-version: "8.6"
          build-root-directory: java/examples/VaasExample  

      - name: run config example
        env:
          SCAN_PATH: "build.gradle"
        uses: gradle/gradle-build-action@v3
        with:
          arguments: config
          gradle-version: "8.6"
          build-root-directory: java/examples/VaasExample

      - name: extract version
        if: startsWith(github.ref, 'refs/tags/java')
        run: |
          echo "RELEASE_VERSION=${GITHUB_REF#refs/*/java}" >> $GITHUB_ENV
          echo $RELEASE_VERSION

      - name: set version
        if: startsWith(github.ref, 'refs/tags/java')
        run: |
          sed -i "s/version = '[0-9]\+\.[0-9]\+\.[0-9]\+'/version = '$RELEASE_VERSION'/g" ./java/build.gradle

      - name: publish Maven package
        if: startsWith(github.ref, 'refs/tags/java')
        env:
          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGPASSWORD }}
          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGKEY }}
        uses: gradle/gradle-build-action@v3
        with:
          arguments: publishToMavenCentral
          gradle-version: "8.6"
          build-root-directory: java

      - name: zip and publish Maven package
        if: startsWith(github.ref, 'refs/tags/java')
        env:
          MAVEN_CENTRAL_BEARER_TOKEN: ${{ secrets.MAVEN_CENTRAL_BEARER_TOKEN }}
        working-directory: java/build/repos/releases
        run: |
          rm -rf de/gdata/vaas/*.xml*
          zip -r package.zip .
          curl --fail \
            --header "Authorization: Bearer ${MAVEN_CENTRAL_BEARER_TOKEN}" \
            --form bundle=@package.zip \
            https://central.sonatype.com/api/v1/publisher/upload?publishingType=AUTOMATIC

      - name: Microsoft Teams Notification
        uses: skitionek/notify-microsoft-teams@master
        if: failure()
        with:
          webhook_url: ${{ secrets.MSTEAMS_WEBHOOK }}
          title: "`Failed workflow on for VaaS-SDK vaas-java-ci`"
          job: ${{ toJson(job) }}
          steps: ${{ toJson(steps) }}

  codeql:
    runs-on: ubuntu-latest
    timeout-minutes: 360
    permissions:
      security-events: write
      actions: read
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: java-kotlin

      - name: Autobuild
        uses: github/codeql-action/autobuild@v3

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:java-kotlin"

      - name: Microsoft Teams Notification
        uses: skitionek/notify-microsoft-teams@master
        if: failure()
        with:
          webhook_url: ${{ secrets.MSTEAMS_WEBHOOK }}
          title: "`Failed codeql on for VaaS-SDK vaas-java-ci`"
          job: ${{ toJson(job) }}
          steps: ${{ toJson(steps) }}