build.yml

name: Build
on:
  push:
    branches:
      - master
      - branch-*
      - dogfood-*
  pull_request:
  workflow_dispatch:
  schedule:
    - cron: "30 1 * * 1-5" # Run Mon-Fri at 1:30 AM UTC

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  USE_DEVELOCITY: true
  DEVELOCITY_URL: https://develocity.sonar.build/
  MAVEN_OUTPUT_ARGS: "--errors --show-version"

jobs:
  build:
    runs-on: sonar-m-public
    name: Build
    permissions:
      id-token: write  # Required for Vault OIDC authentication
      contents: write  # Required for repository access and tagging
    outputs:
      build-number: ${{ steps.build-maven.outputs.BUILD_NUMBER }}
      deployed: ${{ steps.build-maven.outputs.deployed }}
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
        with:
          version: 2025.7.12
      - uses: SonarSource/ci-github-actions/build-maven@v1
        id: build-maven
        env:
          MAVEN_OPTS: "-Xmx8g"
        with:
          deploy-pull-request: true
          sonar-platform: none # Prevent analysis
          # Override artifactory roles for public repo using private access
          artifactory-reader-role: private-reader
          artifactory-deployer-role: qa-deployer
          use-develocity: ${{ env.USE_DEVELOCITY }}
          develocity-url: ${{ env.DEVELOCITY_URL }}
          maven-args: >
            --define maven.test.skip=true
            --define sonar.skip=true
            --projects !java-checks-test-sources/aws,!java-checks-test-sources/default,!java-checks-test-sources/java-17,!java-checks-test-sources/spring-3.2,!java-checks-test-sources/spring-web-4.0

  ruling-qa:
    strategy:
      fail-fast: false
      matrix:
        item:
          - { runner: sonar-m-public, profile: without-sonarqube-project, sq_version: LATEST_RELEASE }
          - { runner: sonar-m-public, profile: only-sonarqube-project, sq_version: LATEST_RELEASE }
          - { runner: github-windows-latest-m, profile: without-sonarqube-project, sq_version: LATEST_RELEASE }
          - { runner: github-windows-latest-m, profile: only-sonarqube-project, sq_version: LATEST_RELEASE }
    name: Ruling QA
    needs:
      - build
    if: ${{ needs.build.outputs.deployed }}
    runs-on: ${{ matrix.item.runner }}
    permissions:
      id-token: write
      contents: write
    env:
      BUILD_NUMBER: ${{ needs.build.outputs.build-number }}
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          submodules: recursive
      - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
        with:
          version: 2025.7.12
      - name: Select Java Version
        run: mise use java@21
      - name: Ensure Separate Job Cache Key
        uses: ./.github/actions/write-file
        with:
          file-path: target/just_for_cache_key_calculation/pom.xml
          content: ${{ github.job }}-${{ toJSON(matrix.item) }}
      - name: Configure Maven
        uses: SonarSource/ci-github-actions/config-maven@v1
        with:
          artifactory-reader-role: private-reader
          use-develocity: ${{ env.USE_DEVELOCITY }}
          develocity-url: ${{ env.DEVELOCITY_URL }}
      - name: Getting Vault Secrets
        id: secrets
        uses: SonarSource/vault-action-wrapper@v3
        with:
          secrets: |
            development/github/token/licenses-ro token | GITHUB_TOKEN;
      - name: Orchestrator Cache
        uses: ./.github/actions/orchestrator-cache
        with:
          sq-version: ${{ matrix.item.sq_version }}
      - name: Run ruling tests
        shell: bash # Set explicitly so Bash is used on Windows runners too.
        env:
          MAVEN_OPTS: "-Xmx3g"
          GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).GITHUB_TOKEN }}
        run: |
          cd its/ruling
          mvn package ${MAVEN_OUTPUT_ARGS} "-Pit-ruling,${{ matrix.item.profile }}" -Dsonar.runtimeVersion=${{ matrix.item.sq_version }} -Dmaven.test.redirectTestOutputToFile=false -Dparallel=methods -DuseUnlimitedThreads=true
      - name: Upload Actual Results On Failure
        if: failure()
        uses: ./.github/actions/upload-actual
        with:
          name: ${{ matrix.item.runner }}_${{ matrix.item.profile }}
          it-dir: its/ruling
          expected-dir: src/test/resources
          actual-dir: target/actual

  plugin-qa:
    strategy:
      fail-fast: false
      matrix:
        sq_version: ['LATEST_RELEASE', 'DEV']
        is_nightly:
          - ${{ github.event_name == 'schedule' }}
        exclude:
          - sq_version: DEV
            is_nightly: false
    name: Plugin QA
    needs:
      - build
    if: ${{ needs.build.outputs.deployed }}
    runs-on: sonar-m-public
    permissions:
      id-token: write
      contents: write
    env:
      BUILD_NUMBER: ${{ needs.build.outputs.build-number }}
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          submodules: recursive
      - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
        with:
          version: 2025.7.12
      - name: Select Java Version
        run: mise use java@21
      - name: Ensure Separate Job Cache Key
        uses: ./.github/actions/write-file
        with:
          file-path: target/just_for_cache_key_calculation/pom.xml
          content: ${{ github.job }}-${{ matrix.sq_version }}
      - name: Configure Maven
        uses: SonarSource/ci-github-actions/config-maven@v1
        with:
          artifactory-reader-role: private-reader
          use-develocity: ${{ env.USE_DEVELOCITY }}
          develocity-url: ${{ env.DEVELOCITY_URL }}
      - name: Getting Vault Secrets
        id: secrets
        uses: SonarSource/vault-action-wrapper@v3
        with:
          secrets: |
            development/github/token/licenses-ro token | GITHUB_TOKEN;
      - name: Orchestrator Cache
        uses: ./.github/actions/orchestrator-cache
        with:
          sq-version: ${{ matrix.sq_version }}
      - name: Plugin QA
        env:
          GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).GITHUB_TOKEN }}
        run: |
          cd its/plugin
          mvn package ${MAVEN_OUTPUT_ARGS} -Pit-plugin -Dsonar.runtimeVersion=${{ matrix.sq_version }} -Dmaven.test.redirectTestOutputToFile=false -Dparallel=classes -DuseUnlimitedThreads=true

  sanity:
    name: Sanity Test
    needs:
      - build
    if: ${{ needs.build.outputs.deployed }}
    runs-on: sonar-m-public
    permissions:
      id-token: write
      contents: write
    env:
      BUILD_NUMBER: ${{ needs.build.outputs.build-number }}
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
        with:
          version: 2025.7.12
      - uses: SonarSource/vault-action-wrapper@v3
        id: secrets
        with:
          secrets: |
            development/kv/data/next url | SONAR_HOST_URL;
            development/kv/data/next token | SONAR_TOKEN;
      - name: Ensure Separate Job Cache Key
        uses: ./.github/actions/write-file
        with:
          file-path: target/just_for_cache_key_calculation/pom.xml
          content: ${{ github.job }}
      - uses: SonarSource/ci-github-actions/config-maven@v1
        with:
          artifactory-reader-role: private-reader
          use-develocity: ${{ env.USE_DEVELOCITY }}
          develocity-url: ${{ env.DEVELOCITY_URL }}
      - name: Compile Test Sources
        env:
          SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }}
          SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }}
        working-directory: java-checks-test-sources
        run: |
          mvn clean compile --batch-mode
      - name: Sanity Test
        env:
          SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }}
          SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }}
          MAVEN_OPTS: "-Xmx8g"
        run: |
          mvn verify ${MAVEN_OUTPUT_ARGS} -f sonar-java-plugin/pom.xml -Psanity -Dtest=SanityTest

  test-analyze:
    name: Test Analyze
    needs:
      - build
    if: ${{ needs.build.outputs.deployed }}
    runs-on: sonar-l-public
    permissions:
      id-token: write
      contents: write
    env:
      BUILD_NUMBER: ${{ needs.build.outputs.build-number }}
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
        with:
          version: 2025.7.12
      - uses: SonarSource/vault-action-wrapper@v3
        id: secrets
        with:
          secrets: |
            development/kv/data/next url | SONAR_HOST_URL;
            development/kv/data/next token | SONAR_TOKEN;
      - uses: SonarSource/ci-github-actions/build-maven@v1
        with:
          deploy: false
          artifactory-reader-role: private-reader    # Override default public-reader
          artifactory-deployer-role: qa-deployer     # Override default public-deployer
          use-develocity: ${{ env.USE_DEVELOCITY }}
          develocity-url: ${{ env.DEVELOCITY_URL }}
          scanner-java-opts: '-Xmx2g'
        env:
          SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }}
          SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }}
          JAVA_TOOL_OPTIONS: "" # Set an empty value to avoid issues with runners hanging and significantly slowing down builds

  custom-rules-license-check:
    name: Custom Rules and License Check
    needs:
      - build
    if: ${{ needs.build.outputs.deployed }}
    runs-on: sonar-m-public
    permissions:
      id-token: write
      contents: write
    env:
      BUILD_NUMBER: ${{ needs.build.outputs.build-number }}
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
        with:
          version: 2025.7.12
      - uses: SonarSource/vault-action-wrapper@v3
        id: secrets
        with:
          secrets: |
            development/kv/data/next url | SONAR_HOST_URL;
            development/kv/data/next token | SONAR_TOKEN;
      - name: Ensure Separate Job Cache Key
        uses: ./.github/actions/write-file
        with:
          file-path: target/just_for_cache_key_calculation/pom.xml
          content: ${{ github.job }}
      - uses: SonarSource/ci-github-actions/config-maven@v1
        with:
          artifactory-reader-role: private-reader
          use-develocity: ${{ env.USE_DEVELOCITY }}
          develocity-url: ${{ env.DEVELOCITY_URL }}
        env:
          SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }}
          SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }}
          JAVA_TOOL_OPTIONS: "" # Set an empty value to avoid issues with runners hanging and significantly slowing down builds
      - name: Build Java Custom Rules Example
        env:
          SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }}
          SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }}
        working-directory: docs/java-custom-rules-example
        run: |
          mvn clean package -f pom_SQ_10_6_LATEST.xml --batch-mode
      - name: Check License Compliance
        run: |
          # See https://xtranet.sonarsource.com/display/DEV/Open+Source+Licenses
          mvn org.codehaus.mojo:license-maven-plugin:aggregate-add-third-party \
            --batch-mode \
            "-Dlicense.missingFile=${PWD}/missing-dep-licenses.properties" \
            -DuseMissingFile \
            "-Dlicense.overrideUrl=file://${PWD}/override-dep-licenses.properties"

  autoscan:
    name: Autoscan Tests
    needs:
      - build
    if: ${{ needs.build.outputs.deployed }}
    runs-on: sonar-m-public
    permissions:
      id-token: write
      contents: write
    env:
      BUILD_NUMBER: ${{ needs.build.outputs.build-number }}
      SQ_VERSION: LATEST_RELEASE
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      # For now, the autoscan job need to execute two mvn commands:
      #   * The build of java-checks-test-sources module which requires Java 24.
      #   * The tests using Orchestrator and SonarQube that, for now, fail to work using Java 24
      - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
        with:
          version: 2025.7.12
      - uses: SonarSource/vault-action-wrapper@v3
        id: secrets
        with:
          secrets: |
            development/kv/data/next url | SONAR_HOST_URL;
            development/kv/data/next token | SONAR_TOKEN;
            development/github/token/licenses-ro token | GITHUB_TOKEN;
      - name: Ensure Separate Job Cache Key
        uses: ./.github/actions/write-file
        with:
          file-path: target/just_for_cache_key_calculation/pom.xml
          content: ${{ github.job }}
      - uses: SonarSource/ci-github-actions/config-maven@v1
        with:
          artifactory-reader-role: private-reader
          use-develocity: ${{ env.USE_DEVELOCITY }}
          develocity-url: ${{ env.DEVELOCITY_URL }}
      - name: Compile Test Sources
        env:
          SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }}
          SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }}
        working-directory: java-checks-test-sources
        run: |
          mvn clean compile test-compile --batch-mode
      - name: Select Java 21
        run: mise use java@21
      - name: Orchestrator Cache
        uses: ./.github/actions/orchestrator-cache
        with:
          sq-version: ${{ env.SQ_VERSION }}
      - name: Run autoscan tests
        env:
          SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }}
          SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }}
          GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).GITHUB_TOKEN }}
        working-directory: its/autoscan
        run: >
          mvn clean package --batch-mode --errors --show-version
          --activate-profiles it-autoscan
          -Dsonar.runtimeVersion="$SQ_VERSION"
          -Dmaven.test.redirectTestOutputToFile=false
          -Dparallel=methods
          -DuseUnlimitedThreads=true
      - name: Upload Actual Results On Failure
        if: failure()
        uses: ./.github/actions/upload-actual
        with:
          name: autoscan
          it-dir: its/autoscan
          expected-dir: src/test/resources/autoscan/diffs
          actual-dir: target/actual/autoscan-diffs

  qa-os-win:
    name: Build and Unit Test on Windows
    # No dependency on build step, because we do not need the build number.
    runs-on: github-windows-latest-m
    permissions:
      id-token: write  # Required for Vault OIDC authentication
      contents: write  # Required for repository access and tagging
    steps:
      - name: Config Git
        run: git config --global core.autocrlf input
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
        with:
          version: 2025.7.12
      - name: Ensure Separate Job Cache Key
        uses: ./.github/actions/write-file
        with:
          file-path: target/just_for_cache_key_calculation/pom.xml
          content: ${{ github.job }}
      - name: Configure Maven
        uses: SonarSource/ci-github-actions/config-maven@v1
        with:
          artifactory-reader-role: private-reader
          use-develocity: ${{ env.USE_DEVELOCITY }}
          develocity-url: ${{ env.DEVELOCITY_URL }}
      - name: Run Maven
        run: mvn clean verify --batch-mode

  promote:
    needs:
      - build
      - ruling-qa
      - plugin-qa
      - sanity
      - test-analyze
      - custom-rules-license-check
      - autoscan
      - qa-os-win
    if: ${{ needs.build.outputs.deployed }}
    runs-on: sonar-s-public
    name: Promote
    permissions:
      id-token: write
      contents: write
    env:
      BUILD_NUMBER: ${{ needs.build.outputs.build-number }}
    steps:
      - uses: SonarSource/ci-github-actions/promote@v1
        with:
          promote-pull-request: true