ci.yml

name: Continuous Integration

on:
  workflow_dispatch:
  pull_request:
    branches:
      - main
    types:
      - opened
      - edited
      - synchronize
    paths:
      - 'src/**'
      - '**gradle**'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  scan-sonar:
    runs-on: ubuntu-22.04
    environment: ci

    steps:
      - name: "Checkout the source code"
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
        with:
          fetch-depth: 0

      - name: "Set up JDK 21"
        uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0
        with:
          java-version: 21
          distribution: temurin

      - name: "Cache Gradle packages"
        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
        with:
          path: ~/.gradle/caches
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}
          restore-keys: ${{ runner.os }}-gradle

      - name: "Cache SonarCloud packages"
        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
          restore-keys: ${{ runner.os }}-sonar

      - name: "Build and analyze"
        run: ./gradlew build jacocoTestReport sonar --info
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  scan-cve:
    uses: ./.github/workflows/scan-cve.yml
    secrets: inherit