ci-cd.yml

name: "CI/CD"
on:
  pull_request:
  push:
    branches: [main]
  release:
    types:
      - published
  workflow_dispatch:

env:
  JDK_JAVA_OPTIONS: -XX:+PrintCommandLineFlags -Xss10M # JDK_JAVA_OPTIONS is _the_ env. variable to use for modern Java
  JVM_OPTS: -XX:+PrintCommandLineFlags -Xss10M # for Java 8 only (sadly, it is not modern enough for JDK_JAVA_OPTIONS)
  scala_212_version: "2.12.18"
  scala_213_version: "2.13.12"
  scala_3_version: "3.3.1"
  SonatypeUrl: 'https://finos.sonatype.app/platform/'
  SonatypeAppId: morphir-jvm
  SonatypeStage: 'build' 
  SonatypeScanTarget: '.' # depCache/coursier/v1/https/repo1.maven.org/maven2/
  ExcludeDirectory: " -D fileExcludes='*.class, **/website/, **/docs/, **/.*' "

# cancel older runs of a pull request;
# this will not cancel anything for normal git pushes
concurrency:
  group: cancel-old-pr-runs-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  lint:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout current branch
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Scala and Java
        uses: actions/setup-java@v4
        with:
          distribution: "temurin"
          java-version: "17"
      - name: Cache scala dependencies
        uses: coursier/cache-action@v6
      - name: Lint code
        run: ./mill Alias/run checkfmt

  test-jvm:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        java: ["11", "17"]
        scala: ["2.12.18","2.13.12", "3.3.1"]
    steps:
      - name: Checkout current branch
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Scala and Java
        uses: actions/setup-java@v4
        with:
          distribution: "temurin"
          java-version: ${{ matrix.java }}
      - name: Cache scala dependencies
        uses: coursier/cache-action@v6

      - name: Run JVM tests
        run: |
          ./mill -i -k -j 0 "morphir[${{matrix.scala}}].__.jvm.__.compile" + "morphir[${{matrix.scala}}].__.jvm.publishArtifacts" + "morphir[${{matrix.scala}}].__.jvm.__.test"

      - name: Cache JVM build output
        # when in master repo: all commits to main branch and all additional tags
        if: github.ref == 'refs/heads/main' || (github.ref != 'refs/heads/main' && startsWith( github.ref, 'refs/tags/') )
        uses: actions/cache/save@v4
        with:
          path: |
            out/morphir/${{matrix.scala}}/**/jvm/
            out/morphir/build/
          key: ${{ runner.os }}-mill-jvm-${{matrix.java}}-${{ matrix.scala }}-${{ github.sha }}-${{ hashFiles('out') }}

  test-js:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        java: ["17"] # Note there is no need ro actually run this for multiple JVM versions for JS
        scala: [ "2.12.18", "2.13.12", "3.3.1"]
    steps:
      - name: Checkout current branch
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Scala and Java
        uses: actions/setup-java@v4
        with:
          distribution: "temurin"
          java-version: ${{ matrix.java }}
      - name: Cache scala dependencies
        uses: coursier/cache-action@v6

      - name: Run JS tests
        run: |
          ./mill -i -k -j 0 "morphir[${{matrix.scala}}].__.js.__.compile" + "morphir[${{matrix.scala}}].__.js.publishArtifacts" + "morphir[${{matrix.scala}}].__.js.__.test"

      - name: Cache JS build output
        # when in master repo: all commits to main branch and all additional tags
        if: github.ref == 'refs/heads/main' || (github.ref != 'refs/heads/main' && startsWith( github.ref, 'refs/tags/') )
        uses: actions/cache/save@v4
        with:
          path: |
            out/morphir/${{matrix.scala}}/**/js/
          key: ${{ runner.os }}-mill-js-${{matrix.java}}-${{ matrix.scala }}-${{ github.sha}}-${{ hashFiles('out') }}

  test-native:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        java: ["11"] # Note there is no need ro actually run this for multiple JVM versions for native
        scala: ["2.12.18","2.13.12", "3.3.1"]
    steps:
      - name: Checkout current branch
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install libuv
        run: sudo apt-get update && sudo apt-get install -y libuv1-dev

      - name: Set up Clang
        uses: egor-tensin/setup-clang@v1
        with:
          version: latest
          platform: x64
      - name: Setup Scala and Java
        uses: actions/setup-java@v4
        with:
          distribution: "temurin"
          java-version: ${{ matrix.java }}

      - name: Run Native tests
        run: |
          ./mill -i -k -j 0 "morphir[${{matrix.scala}}].__.native.__.compile" + "morphir[${{matrix.scala}}].__.native.publishArtifacts" + "morphir[${{matrix.scala}}].__.native.__.test"

      - name: Cache Native build output
        # when in master repo: all commits to main branch and all additional tags
        if: github.ref == 'refs/heads/main' || (github.ref != 'refs/heads/main' && startsWith( github.ref, 'refs/tags/') )
        uses: actions/cache/save@v4
        with:
          path: |
            out/morphir/${{matrix.scala}}/**/native/
          key: ${{ runner.os }}-mill-native-${{matrix.java}}-${{ matrix.scala }}-${{ github.sha }}-${{ hashFiles('out') }}

  ############### SONATYPE SCAN ###############
  sonatype-scan:
    if: always()
    needs: [ci]
    runs-on: ubuntu-latest
    steps:
    - name: Cache scala dependencies
      uses: coursier/cache-action@v6

    - name: Get OUT cache
      uses: actions/cache/restore@v4
      with:
        path: out/
        key: ${{ runner.os }}-*
        
    - name: Copy Cache for SCA Scan
      run: |
        mkdir depCache/ #Create local copy of cache for Sonatype Scanner
        cp -r /home/runner/.cache/coursier/ depCache/
    # - name: Save resolvedIvyDeps.json
    #   run: ./mill show __.resolvedIvyDeps > depCache/resolvedIvyDeps.json
        
    # - name: Upload Dependency Cache (optional)
    #   uses: actions/upload-artifact@v4
    #   with:
    #     name: Dependency Cache
    #     path: depCache/
    
    - name: Sonatype Lifecycle SCA Scan
      uses: sonatype-nexus-community/iq-github-action@main
      with:
        username: ${{ secrets.SONATYPE_SCANNER_USERNAME }}
        password: ${{ secrets.SONATYPE_SCANNER_PASSWORD }}
        serverUrl: ${{ env.SonatypeUrl }}
        applicationId: ${{ env.SonatypeAppId }}
        stage: ${{ env.SonatypeStage }}
        target: ${{ env.SonatypeScanTarget }} ${{ env.ExcludeDirectory }}

    - name: Retrieve Sonatype SBOM (SPDX)
      if: always()
      run: |
        mkdir reports/
        iqCredentials="${{ secrets.SONATYPE_SCANNER_USERNAME }}:${{ secrets.SONATYPE_SCANNER_PASSWORD }}"
        echo 'Get internal app ID for public ID: '$SonatypeAppId
        res=$(curl -u $iqCredentials --location $SonatypeUrl'api/v2/applications?publicId='$SonatypeAppId)
        IFS='"' read -a array <<< "$res"
        echo 'Internal app ID: '${array[5]}
        internalID=${array[5]}
        curl -u $iqCredentials --location $SonatypeUrl'api/v2/spdx/'$internalID'/stages/'$SonatypeStage -H 'Accept: application/xml' > reports/$SonatypeAppId.spdx.json
        echo 'Sonatype SBOM (SPDX): '
        cat reports/$SonatypeAppId.spdx.json
        
    - name: Upload Sonatype SBOM (SPDX)
      if: always()
      uses: actions/upload-artifact@v4
      with:
        name: ${{ env.SonatypeAppId }} Sonatype SBOM (SPDX) 
        path: reports/
  #############################################               

  cd:    
    needs: [sonatype-scan, ci]

    runs-on: ubuntu-latest
    # when in primary repo: all commits to main branch and all additional tags
    if: github.repository == 'finos/morphir-jvm' && ( github.ref == 'refs/heads/main' || (github.ref != 'refs/heads/main' && startsWith( github.ref, 'refs/tags/') ) )      

    # only run one publish job for the same sha at the same time
    # e.g. when a main-branch push is also tagged
    concurrency: 
      group: ${{ github.workflow}}-publish-${{ github.sha }}

    env:
      PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }}
      PGP_SECRET: ${{ secrets.PGP_SECRET_BASE64 }}
      SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
      SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
      PUBLISH_AS_SNAPSHOT: true
      LANG: "en_US.UTF-8"
      LC_MESSAGES: "en_US.UTF-8"
      LC_ALL: "en_US.UTF-8"

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-java@v4
        with:
          java-version: "11"
          distribution: temurin

      - name: Cache scala dependencies
        uses: coursier/cache-action@v6

      - name: Install libuv
        run: sudo apt-get update && sudo apt-get install -y libuv1-dev

      - name: Restore Scala 2.12 JVM Build Output From Cache
        uses: actions/cache/restore@v4
        with:
          path: |
            out/morphir/2.12.18/**/jvm/
            out/morphir/build/
          key: ${{ runner.os }}-mill-jvm-11-2.12.18-${{ github.sha }}-${{ hashFiles('out') }}
          restore-keys: ${{ runner.os }}-mill-jvm-11-2.12.18-${{ github.sha }}-        

      - name: Restore Scala 2.13 JVM Build Output From Cache
        uses: actions/cache/restore@v4
        with:
          path: |
            out/morphir/2.13.12/**/jvm/
            out/morphir/build/
          key: ${{ runner.os }}-mill-jvm-11-2.13.12-${{ github.sha }}-${{ hashFiles('out') }}
          restore-keys: ${{ runner.os }}-mill-jvm-11-2.13.12-${{ github.sha }}-

      - name: Restore Scala 3.3 JVM Build Output From Cache
        uses: actions/cache/restore@v4
        with:
          path: |
            out/morphir/3.3.1/**/jvm/
          key: ${{ runner.os }}-mill-jvm-11-3.3.1-${{ github.sha }}-${{ hashFiles('out') }}
          restore-keys: ${{ runner.os }}-mill-jvm-11-3.3.1-${{ github.sha }}-

      - name: Restore Scala 2.12 JS Build Output From Cache
        uses: actions/cache/restore@v4
        with:
          path: |
            out/morphir/2.12.18/**/js/
          key: ${{ runner.os }}-mill-js-11-2.12.18-${{ github.sha }}-${{ hashFiles('out') }}
          restore-keys: ${{ runner.os }}-mill-js-11-2.12.18-${{ github.sha }}-            

      - name: Restore Scala 2.13 JS Build Output From Cache
        uses: actions/cache/restore@v4
        with:
          path: |
            out/morphir/2.13.12/**/js/
          key: ${{ runner.os }}-mill-js-11-2.13.12-${{ github.sha }}-${{ hashFiles('out') }}
          restore-keys: ${{ runner.os }}-mill-js-11-2.13.12-${{ github.sha }}-

      - name: Restore Scala 3.3 JS Build Output From Cache
        uses: actions/cache/restore@v4
        with:
          path: |
            out/morphir/3.3.1/**/js/
          key: ${{ runner.os }}-mill-js-11-3.3.1-${{ github.sha }}-${{ hashFiles('out') }}
          restore-keys: ${{ runner.os }}-mill-js-11-3.3.1-${{ github.sha }}-

      - name: Restore Scala 2.12 Native Build Output From Cache
        uses: actions/cache/restore@v4
        with:
          path: |
            out/morphir/2.12.18/**/native/
          key: ${{ runner.os }}-mill-native-11-2.12.18-${{ github.sha }}-${{ hashFiles('out') }}
          restore-keys: ${{ runner.os }}-mill-native-11-2.12.18-${{ github.sha }}-

      - name: Restore Scala 2.13 Native Build Output From Cache
        uses: actions/cache/restore@v4
        with:
          path: |
            out/morphir/2.13.12/**/native/
          key: ${{ runner.os }}-mill-native-11-2.13.12-${{ github.sha }}-${{ hashFiles('out') }}
          restore-keys: ${{ runner.os }}-mill-native-11-2.13.12-${{ github.sha }}-

      - name: Restore Scala 3.3 Native Build Output From Cache
        uses: actions/cache/restore@v4
        with:
          path: |
            out/morphir/3.3.1/**/native/
          key: ${{ runner.os }}-mill-native-11-3.3.1-${{ github.sha }}-${{ hashFiles('out') }}
          restore-keys: ${{ runner.os }}-mill-native-11-3.3.1-${{ github.sha }}-

      - name: Publish artifacts to Sonatype        
        run: ./mill -i -j 0 io.kipp.mill.ci.release.ReleaseModule/publishAll

  ci:
    runs-on: ubuntu-latest
    needs: [lint, test-jvm, test-js, test-native]
    steps:
      - name: Aggregate of lint, and all tests
        run: echo "ci passed"