build.yml

name: CI

on:
  pull_request:
  merge_group:
  push:

permissions:
  security-events: write
  contents: read
  actions: read

jobs:
  build:
    strategy:
      matrix:
        os: [macos-latest, ubuntu-latest]
        java: [11, 17, 21]
      fail-fast: false

    runs-on: ${{ matrix.os }}

    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Set up cache for ~./m2/repository
        uses: actions/cache@v3
        with:
          path: ~/.m2/repository
          key: maven-${{ matrix.os }}-java${{ matrix.java }}-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            maven-${{ matrix.os }}-java${{ matrix.java }}-
            maven-${{ matrix.os }}-
      - name: Set up JDK
        uses: actions/setup-java@v3
        with:
          java-version: ${{ matrix.java }}
          distribution: 'adopt'
      - name: Build with Maven
        run: mvn --batch-mode clean install
      - uses: jwgmeligmeyling/spotbugs-github-action@master
        with:
          path: '**/spotbugsXml.xml'

  security-scan:
    uses: jenkins-infra/jenkins-security-scan/.github/workflows/jenkins-security-scan.yaml@v2
    with:
      java-cache: 'maven'
      java-version: 17

  deploy:
    needs: [build]
    runs-on: ubuntu-latest

    steps:
      - name: Check out
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - name: Set up JDK
        uses: actions/setup-java@v3
        with:
          distribution: 'adopt'
          java-version: 17

      - name: publish release package
        if: contains( github.ref, 'main' ) || contains( github.base_ref, 'main' )
        env:
          JENKINS_MAVEN_PASS: ${{ secrets.JENKINS_MAVEN_PASS }}
        run: ./mvnw -s .github/workflows/m2.settings.xml deploy -DskipTests=true