ci-cd.yml

# This workflow will build a Java project with Gradle, and cache/restore any dependencies to improve the workflow execution time
# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-java-with-gradle

# 权限声明，确保 workflow 有权限写 checks 和 security-events
permissions:
  contents: write
  packages: write
  checks: write
  security-events: write

name: Java CI with Gradle

on:
  push:
    branches: [ "main" ]
    tags:
      - 'v*'
    paths-ignore:
      - 'README.md'
      - 'LICENSE'
      - '.gitignore'
      - '.gitattributes'
      - 'picture'
      - '.dockerignore'
  pull_request:
    branches: [ "main" ]
  workflow_dispatch:

jobs:
  ci:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      matrix:
        java-version: ['17', '21', '25']
      fail-fast: false
    
    name: Build with Java ${{ matrix.java-version }}

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up JDK ${{ matrix.java-version }}
        uses: actions/setup-java@v4
        with:
          java-version: ${{ matrix.java-version }}
          distribution: 'temurin'
          cache: 'gradle'

      - name: Grant execute permission to gradlew
        run: chmod +x gradlew

      - name: Build and Test with Gradle
        run: |
          ./gradlew build --parallel
        env:
          GRADLE_OPTS: -Xmx4g -XX:MaxMetaspaceSize=1g

      - name: Publish Test Report
        uses: mikepenz/action-junit-report@v4
        if: success() || failure()
        with:
          report_paths: '**/build/test-results/test/TEST-*.xml'
          detailed_summary: true
          include_passed: true
          fail_on_failure: false

      - name: Run SonarQube Analysis
        if: matrix.java-version == '17' && github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
        run: |
          if [[ -n "${{ secrets.SONAR_TOKEN }}" ]]; then
            ORG="${{ secrets.SONAR_ORGANIZATION }}"
            ORG=${ORG:-default}
            HOST="${{ secrets.SONAR_HOST_URL }}"
            HOST=${HOST:-https://sonarcloud.io}

            ./gradlew sonarqube \
              -Dsonar.projectKey=keystone \
              -Dsonar.organization=$ORG \
              -Dsonar.host.url=$HOST \
              -Dsonar.login=${{ secrets.SONAR_TOKEN }} \
              -Dsonar.qualitygate.wait=true \
              -Dsonar.java.source=17
          else
            echo "Skipping SonarQube analysis - SONAR_TOKEN not configured"
          fi

      - name: Upload static analysis reports
        uses: actions/upload-artifact@v4
        if: success() || failure()
        with:
          name: static-analysis-reports-jdk-${{ matrix.java-version }}
          if-no-files-found: warn
          retention-days: 7
          path: |
            **/build/reports/checkstyle/**
            **/build/reports/spotbugs/**

  build-release:
    name: Build Github release
    runs-on: ubuntu-latest
    needs: ci
    if: startsWith(github.ref, 'refs/tags/v')

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Set up JDK 25
        uses: actions/setup-java@v4
        with:
          java-version: '25'
          distribution: 'temurin'
          cache: 'gradle'

      - name: Grant execute permission to gradlew
        run: chmod +x gradlew

      - name: Validate tag matches project version
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          VERSION=$(./gradlew -q properties | awk -F': ' '/^version:/ {print $2; exit}')
          if [ "$TAG" != "$VERSION" ]; then
            echo "Tag version ($TAG) does not match project version ($VERSION)"
            exit 1
          fi

      - name: Build release
        run: ./gradlew clean build -x test

      - name: Generate Changelog with git-cliff
        uses: orhun/git-cliff-action@v4
        id: git-cliff
        with:
          config: cliff.toml
          args: --latest --strip header

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          body: ${{ steps.git-cliff.outputs.content }}
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
          draft: false
          prerelease: false
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  build-docker:
    name: Push Docker image to multiple registries
    runs-on: ubuntu-latest
    needs: build-release
    if: startsWith(github.ref, 'refs/tags/v')
    concurrency: deploy-group

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Set up JDK 25
        uses: actions/setup-java@v4
        with:
          java-version: '25'
          distribution: 'temurin'
          cache: 'gradle'

      - name: Grant execute permission to gradlew
        run: chmod +x gradlew

      - name: Build application jar for Docker image
        run: ./gradlew :keystone-admin:bootJar -x test

      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}