build.yml

name: Build on PR

on:
  pull_request:
    branches: ["main"]

jobs:
  build:
    name: Build on Java ${{ matrix.java }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        java: ["11", "21"]
    permissions:
      id-token: write
      contents: read
      attestations: write
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK ${{ matrix.java }}
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: ${{ matrix.java }}

      - name: Setup Gradle and publish build scans
        uses: gradle/actions/setup-gradle@v3
        with:
          build-scan-publish: true
          build-scan-terms-of-use-url: "https://gradle.com/terms-of-service"
          build-scan-terms-of-use-agree: "yes"

      - name: Set TERM variable for gradle
        run: echo "TERM=dumb" >> $GITHUB_ENV

      - name: Display environment info
        run: |
          ./gradlew -v
          uname -a

      - name: Clean previous gradle builds
        run: ./gradlew clean -q -S

      - name: Build using gradle
        run: ./gradlew build -q -S

      - name: Remove Gradle cache lock file
        if: always()
        run: rm -rvf $HOME/.gradle/caches/modules-2/modules-2.lock

      - name: Archive artifacts
        uses: actions/upload-artifact@v4
        with:
          name: maven-artifacts
          path: build/libs/
          retention-days: 2
          compression-level: 9
          overwrite: true

      - name: Attest
        uses: actions/attest-build-provenance@v1.3.2
        with:
          subject-path: "build/libs/**/*"

  code-coverage:
    needs: build
    name: Test on Java 17
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          java-version: "17"
          distribution: "temurin"

      - name: Setup Gradle and publish build scans
        uses: gradle/actions/setup-gradle@v3
        with:
          cache-read-only: true
          build-scan-publish: true
          build-scan-terms-of-use-url: "https://gradle.com/terms-of-service"
          build-scan-terms-of-use-agree: "yes"

      - name: Display environment info
        run: |
          ./gradlew -v
          uname -a

      - name: Run tests with Gradle wrapper
        run: ./gradlew test -S

      - name: Remove Gradle cache lock file
        if: always()
        run: rm -rvf $HOME/.gradle/caches/modules-2/modules-2.lock

      - name: Branch Coverage | Codecov
        uses: codecov/codecov-action@v4.0.1
        with:
          codecov_yml_path: ./codecov.yml
          token: ${{ secrets.CODECOV_TOKEN }}
          slug: VenomVendor/NullDefense
          file: build/reports/jacoco/report.xml
          fail_ci_if_error: true

      - name: Branch Coverage | Codacy
        uses: codacy/codacy-coverage-reporter-action@v1.3.0
        with:
          project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
          coverage-reports: build/reports/jacoco/report.xml

      - name: Branch Coverage | Codeclimate 
        uses: paambaati/codeclimate-action@v8.0.0
        env:
          CC_TEST_REPORTER_ID: ${{ secrets.CODECLIMATE_PROJECT_TOKEN }}
          JACOCO_SOURCE_PATH: src/main/java
        with:
          coverageLocations: build/reports/jacoco/report.xml:jacoco

      - name: Archive code coverage results
        uses: actions/upload-artifact@v4
        with:
          name: code-coverage-report
          path: build/reports/
          retention-days: 3
          compression-level: 9