build.yml

name: Build

on:
  pull_request:
    paths-ignore:
      - '**-validation.yml'
      - '**.*ignore'
      - '**.md'
      - '**.txt'
      - '**/pr-**.yml'
      - '**/release.yml'
      - '**dependabot.yml'
  push:
    # Avoid useless runs.
    branches-ignore:
      # Dependabot creates both branch and PR. Avoid running twice.
      - 'dependabot/**'
      - 'pr/**'
      - 'pull/**'
      - 'wip/**'
    paths-ignore:
      - '**-validation.yml'
      - '**.*ignore'
      - '**.md'
      - '**.txt'
      - '**/pr-**.yml'
      - '**/release.yml'
      - '**dependabot.yml'

permissions:
  contents: write
  # required for all workflows (CodeQL)
  security-events: write
  # required for workflows in private repositories (CodeQL)
  actions: read
  # We appear to need write permission for both pull-requests and
  # issues to post a comment to a pull request.
  pull-requests: write
  issues: write

env:
  CI: true
  BUILD_NUMBER: ${{ github.run_number }}
  SCM_TAG: ${{ github.sha }}
  #GRADLE_OPTS: "-Dorg.gradle.daemon=false"
  GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED: true
  DEPENDENCY_GRAPH_INCLUDE_CONFIGURATIONS: "^(?!(classpath)).*"
  DEPENDENCY_GRAPH_INCLUDE_PROJECTS: "^:(?!(buildSrc|test|check)).*"

jobs:
  buildAndCheck:
    strategy:
      fail-fast: false
      matrix:
        java: [ '17' ]
        os: [ 'macos', 'ubuntu', 'windows' ]
        # CodeQL supports ['c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift']
        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
        language: [ 'java-kotlin' ]

    name: 'Build and check on ${{ matrix.os }}'
    timeout-minutes: 25
    runs-on: '${{ matrix.os }}-latest'
    if: ${{ !contains(github.event.head_commit.message, 'ci skip') }}

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
        with:
          disable-sudo: true
          egress-policy: audit

      # steps.v.outputs.run_url
      - id: v
        if: github.event_name == 'pull_request'
        run: |
          echo "run_url=${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" >> $GITHUB_OUTPUT

      - name: Checkout
        uses: actions/checkout@v4

      - name: 'Set up JDK ${{ matrix.java }}'
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '${{ matrix.java }}'

      - name: 'Cached KMP things (Konan, Node, Yarn, Binaryen)'
        uses: actions/cache@v4
        with:
          path: |
            ~/.konan
            ~/.gradle/yarn
            ~/.gradle/nodejs
            ~/.gradle/binaryen
            hashFiles('**/gradle/libs.versions.toml')
          key: ${{ runner.os }}-kmp-${{ hashFiles('**/*.gradle.kts', '**/gradle-wrapper.properties', '**/gradle/libs.versions.toml') }}
          #restore-keys: ${{ runner.os }}-kmp-

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v3
        with:
          gradle-version: 8.7
          gradle-home-cache-cleanup: true
          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
          dependency-graph: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && 'generate-and-submit' || 'disabled'}}
          artifact-retention-days: 1

      - name: Initialize CodeQL
        if: matrix.os == 'ubuntu'
        uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}

      - name: 'Build and check plugin itself'
        timeout-minutes: 15
        run: ./gradlew build assemble check --continue --stacktrace --scan

      - name: Upload sarif report (Detekt)
        if: (success() || failure()) &&
          (github.event_name == 'pull_request' || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev')
        uses: github/codeql-action/upload-sarif@v3
        continue-on-error: true
        with:
          sarif_file: build/detekt-merged.sarif
          category: detekt

      - name: 'Check "latest" setup example'
        timeout-minutes: 10
        working-directory: checks/latest
        run: ./gradlew check --continue --stacktrace --scan
        env:
          GITHUB_DEPENDENCY_GRAPH_ENABLED: false

      - name: 'Check "js-only" setup example'
        timeout-minutes: 10
        working-directory: checks/js-only
        run: ./gradlew check --continue --stacktrace --scan
        env:
          GITHUB_DEPENDENCY_GRAPH_ENABLED: false

      - name: Upload the build report
        if: success() || failure()
        uses: actions/upload-artifact@v4
        with:
          name: '${{ matrix.os }}-build-report'
          path: |
            **/build/logs/
            **/build/reports/
            **/build/output/
            build/*-merged.*
          compression-level: 9

      - name: Perform CodeQL Analysis
        if: matrix.os == 'ubuntu'
        timeout-minutes: 6
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:${{matrix.language}}"

      - name: "Post result in PR comment"
        uses: actions/github-script@v7
        if: github.event_name == 'pull_request' && failure()
        env:
          GITHUB_ACTION_RUN_URL: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number, owner: context.repo.owner, repo: context.repo.repo,
              body: '❌ ${{ github.workflow }} [failed](${{ steps.v.outputs.run_url }}) on ${{ matrix.os }}.'
            })