pull_request.yml

name: 'pull request'

on: [pull_request, merge_group]

env:
  CI: 'true'
  GRADLE_OPTS: ${{ vars.GRADLE_OPTS }}

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: '21'

      - uses: gradle/actions/setup-gradle@v4
      - run: ./gradlew build
      - run: ./gradlew publishToMavenLocal --no-parallel
        env:
          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.SONATYPE_GPG_KEY }}
          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.SONATYPE_GPG_PASSPHRASE }}

  snyk_test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: snyk/actions/setup@master
      - uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: '21'

      - uses: gradle/actions/setup-gradle@v4
      - run: snyk-linux test --all-sub-projects --severity-threshold=high --configuration-matching='^(jvm|.*[rR]elease)?[rR]untimeClasspath$'
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
          SNYK_CFG_ORG: ${{ secrets.SNYK_CFG_ORG }}