ci.yml

name: GH Actions CI

on:
  pull_request:
    branches:
      - '8.0'
      # Ignore dependabot PRs that are not just about build dependencies or workflows;
      # we'll reject such PRs and send one ourselves.
      - '!dependabot/**'
      - 'dependabot/maven/build-dependencies-**'
      - 'dependabot/github_actions/workflow-actions-**'

permissions: { } # none

# See https://github.com/hibernate/hibernate-orm/pull/4615 for a description of the behavior we're getting.
concurrency:
  # Consider that two builds are in the same concurrency group (cannot run concurrently)
  # if they use the same workflow and are about the same branch ("ref") or pull request.
  group: "workflow = ${{ github.workflow }}, ref = ${{ github.event.ref }}, pr = ${{ github.event.pull_request.id }}"
  # Cancel previous builds in the same concurrency group even if they are in progress
  # for pull requests or pushes to forks (not the upstream repository).
  cancel-in-progress: ${{ github.event_name == 'pull_request' || github.repository != 'hibernate/hibernate-orm' }}

env:
  COMMON_GRADLE_ARGS: "-Igradle/init.gradle"
  MIRROR_MAVEN_CENTRAL_URL: "https://maven-central.storage-download.googleapis.com/maven2/"
  MIRROR_MAVEN_CENTRAL_FALLBACK: "true"

jobs:

  # Main job for h2/docker DBs.
  build:
    permissions:
      contents: read
    name: OpenJDK 25 - ${{matrix.rdbms}}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - rdbms: h2
          - rdbms: hsqldb
          - rdbms: mysql
          - rdbms: mariadb
          - rdbms: postgresql
          - rdbms: spannerpgsql
          - rdbms: spanner
          - rdbms: edb
          - rdbms: oracle
          - rdbms: db2
          - rdbms: mssql
          - rdbms: sybase
    # Running with CockroachDB requires at least 2-4 vCPUs, which we don't have on GH Actions runners
    #          - rdbms: cockroachdb
    # Running with HANA requires at least 8GB memory just for the database, which we don't have on GH Actions runners
    #          - rdbms: hana
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Reclaim Disk Space
        run: .github/ci-prerequisites.sh
      - name: Start database
        env:
          RDBMS: ${{ matrix.rdbms }}
        run: ci/database-start.sh
      - name: Set up Java 25
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: 'temurin'
          java-version: '25'

      - name: Generate cache key
        id: cache-key
        env:
          CURRENT_BRANCH: ${{ github.repository != 'hibernate/hibernate-orm' && 'fork' || github.base_ref || github.ref_name }}
        run: |
          CURRENT_MONTH=$(/bin/date -u "+%Y-%m")
          CURRENT_DAY=$(/bin/date -u "+%d")
          ROOT_CACHE_KEY="buildtool-cache"
          {
            echo "buildtool-monthly-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}"
            echo "buildtool-monthly-branch-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}"
            echo "buildtool-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}-${CURRENT_DAY}"
          } >> "$GITHUB_OUTPUT"
      - name: Cache Maven/Gradle Dependency/Dist Caches
        id: cache-maven
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        # if it's not a pull request, we restore and save the cache
        if: github.event_name != 'pull_request'
        with:
          path: |
            ~/.m2/repository/
            ~/.m2/wrapper/
            ~/.gradle/caches/
            !~/.gradle/caches/build-cache-*
            ~/.gradle/wrapper/
          # A new cache will be stored daily. After that first store of the day, cache save actions will fail because the cache is immutable, but it's not a problem.
          # The whole cache is dropped monthly to prevent unlimited growth.
          # The cache is per branch but in case we don't find a branch for a given branch, we will get a cache from another branch.
          key: ${{ steps.cache-key.outputs.buildtool-cache-key }}
          restore-keys: |
            ${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}-
            ${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}-
      - name: Restore Maven/Gradle Dependency/Dist Caches
        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        # if it is a pull request, we restore the cache, but we don't save it
        if: github.event_name == 'pull_request'
        with:
          path: |
            ~/.m2/repository/
            ~/.m2/wrapper/
            ~/.gradle/caches/
            !~/.gradle/caches/build-cache-*
            ~/.gradle/wrapper/
          key: ${{ steps.cache-key.outputs.buildtool-cache-key }}
          restore-keys: |
            ${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}-
            ${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}-

      - name: Run build script
        run: |
          read -ra common_gradle_args <<< "$COMMON_GRADLE_ARGS"
          ./ci/build-github.sh "${common_gradle_args[@]}"
        shell: bash
        env:
          RDBMS: ${{ matrix.rdbms }}
          # For jobs running on 'push', publish build scan and cache immediately.
          # This won't work for pull requests, since they don't have access to secrets.
          POPULATE_REMOTE_GRADLE_CACHE: ${{ github.event_name == 'push' && github.repository == 'hibernate/hibernate-orm' && 'true' || 'false' }}
          DEVELOCITY_ACCESS_KEY: "${{ secrets.DEVELOCITY_ACCESS_KEY }}"

      # For jobs running on 'pull_request', upload build scan data.
      # The actual publishing must be done in a separate job (see ci-report.yml).
      # We don't write to the remote cache as that would be unsafe.
      - name: Upload GitHub Actions artifact for the Develocity build scan
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: "${{ github.event_name == 'pull_request' && !cancelled() }}"
        with:
          name: build-scan-data-${{ matrix.rdbms }}
          path: ~/.gradle/build-scan-data
      - name: Store coverage report
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: build-coverage-data-${{ matrix.rdbms }}
          retention-days: 1
          path: |
            ./**/target/jacoco/*.exec
      - name: Store build results
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: "${{ matrix.rdbms == 'h2' }}"
        with:
          name: build-compilation-data
          retention-days: 1
          path: |
            ./**/target/resources/
            ./**/target/classes/
            ./**/target/generated/
            .gradle/caches/build-cache-*
      - name: Upload test reports (if Gradle failed)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: failure()
        with:
          name: test-reports-java11-${{ matrix.rdbms }}
          path: |
            ./**/target/reports/tests/
      - name: Omit produced artifacts from build cache
        run: ./ci/before-cache.sh

  # Job for builds on Oracle TP infrastructure.
  # This is untrusted, even for pushes, see below.
  otp:
    permissions:
      contents: read
    name: GraalVM 25 - ${{matrix.rdbms}}
    runs-on: [ self-hosted, Linux, X64, OracleTestPilot ]
    if: github.repository == 'hibernate/hibernate-orm'
    strategy:
      fail-fast: false
      matrix:
        include:
          - rdbms: autonomous-transaction-processing-serverless-26ai
          - rdbms: autonomous-transaction-processing-serverless-19c
          - rdbms: base-database-service-19c
          - rdbms: base-database-service-21c
          - rdbms: base-database-service-26ai
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Set up Java 25
        uses: graalvm/setup-graalvm@bef4b0e916c7dd079bf60fb95d49139f67e32c5f # v1.5.3
        with:
          distribution: 'graalvm'
          java-version: '25'
      - name: Generate cache key
        id: cache-key
        env:
          CURRENT_BRANCH: ${{ github.repository != 'hibernate/hibernate-orm' && 'fork' || github.base_ref || github.ref_name }}
        run: |
          CURRENT_MONTH=$(/bin/date -u "+%Y-%m")
          CURRENT_DAY=$(/bin/date -u "+%d")
          ROOT_CACHE_KEY="buildtool-cache-oracle-test-pilot"
          { 
            echo "buildtool-monthly-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}"
            echo "buildtool-monthly-branch-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}"
            echo "buildtool-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}-${CURRENT_DAY}"
          } >> "$GITHUB_OUTPUT"
      - name: Cache Maven/Gradle Dependency/Dist Caches
        id: cache-maven
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        # if it's not a pull request, we restore and save the cache
        if: github.event_name != 'pull_request'
        with:
          path: |
            ~/.m2/repository/
            ~/.m2/wrapper/
            ~/.gradle/caches/
            !~/.gradle/caches/build-cache-*
            ~/.gradle/wrapper/
          # A new cache will be stored daily. After that first store of the day, cache save actions will fail because the cache is immutable, but it's not a problem.
          # The whole cache is dropped monthly to prevent unlimited growth.
          # The cache is per branch but in case we don't find a branch for a given branch, we will get a cache from another branch.
          key: ${{ steps.cache-key.outputs.buildtool-cache-key }}
          restore-keys: |
            ${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}-
            ${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}-
      - name: Restore Maven/Gradle Dependency/Dist Caches
        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        # if it is a pull request, we restore the cache, but we don't save it
        if: github.event_name == 'pull_request'
        with:
          path: |
            ~/.m2/repository/
            ~/.m2/wrapper/
            ~/.gradle/caches/
            !~/.gradle/caches/build-cache-*
            ~/.gradle/wrapper/
          key: ${{ steps.cache-key.outputs.buildtool-cache-key }}
          restore-keys: |
            ${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}-
            ${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}-

      - id: create_database
        uses: oracle-actions/setup-testpilot@aec84678697e1648ddb8e8a480cf3ceda746ce5c # v1.0.24
        with:
          oci-service: ${{ matrix.rdbms }}
          action: create
          user: hibernate_orm_test_1,hibernate_orm_test_2,hibernate_orm_test_3,hibernate_orm_test_4,hibernate_orm_test_5,hibernate_orm_test_6,hibernate_orm_test_7,hibernate_orm_test_8

      - name: Run build script
        env:
          RDBMS: ${{ matrix.rdbms }}
          RUNID: ${{ github.run_number }}
          TESTPILOT_CONNECTION_STRING_SUFFIX: ${{ steps.create_database.outputs.connection_string_suffix }}
          TESTPILOT_PASSWORD: ${{ steps.create_database.outputs.database_password }}
          API_HOST: ""
          TESTPILOT_CLIENT_ID: ""
          TESTPILOT_TOKEN: ""
          # Needed for TFO (TCP fast open)
          LD_PRELOAD: /home/ubuntu/ojdbc_tfo/ojdbc17/23.26.2.0.0/libtfojdbc1.so
          LD_LIBRARY_PATH: /home/ubuntu/ojdbc_tfo/ojdbc17/23.26.2.0.0
          # maximum number of worker (upper limit to maxParallelForks property, otherwise number of available CPUs)
          GRADLE_OPTS: "-Dorg.gradle.workers.max=8"
          # Better control of RAM for Gradle, must be aligned with gradle.properties
          # Daemon:
          ORG_GRADLE_JVMARGS: "-Dlog4j2.disableJmx -Xmx4g -XX:MaxMetaspaceSize=256m -XX:+HeapDumpOnOutOfMemoryError -Duser.language=en -Duser.country=US -Duser.timezone=UTC -Dfile.encoding=UTF-8"
          # Java compiler:
          ORG_GRADLE_PROJECT_toolchain.compiler.jvmargs: "-Dlog4j2.disableJmx=true -Xmx4g -XX:MaxMetaspaceSize=256m -XX:+HeapDumpOnOutOfMemoryError -Duser.language=en -Duser.country=US -Duser.timezone=UTC -Dfile.encoding=UTF-8"
          # Gradle workers (Tests...)
          ORG_GRADLE_PROJECT_toolchain.launcher.jvmargs: "-Dlog4j2.disableJmx=true -Xmx3g -XX:MaxMetaspaceSize=448m -XX:+HeapDumpOnOutOfMemoryError -Duser.language=en -Duser.country=US -Duser.timezone=UTC -Dfile.encoding=UTF-8"
        run: |
          read -ra common_gradle_args <<< "$COMMON_GRADLE_ARGS"
          ./ci/build-github.sh "${common_gradle_args[@]}"
        shell: bash

      - uses: oracle-actions/setup-testpilot@aec84678697e1648ddb8e8a480cf3ceda746ce5c # v1.0.24
        if: always()
        with:
          oci-service: ${{ matrix.rdbms }}
          action: delete
          user: hibernate_orm_test_1,hibernate_orm_test_2,hibernate_orm_test_3,hibernate_orm_test_4,hibernate_orm_test_5,hibernate_orm_test_6,hibernate_orm_test_7,hibernate_orm_test_8

      # Upload build scan data.
      # The actual publishing must be done in a separate job (see ci-report.yml).
      # We don't write to the remote cache as that would be unsafe.
      # That's even on push, because we do not trust Oracle Test Pilot runners to hold secrets: they are shared infrastructure.
      - name: Upload GitHub Actions artifact for the Develocity build scan
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: "${{ !cancelled() }}"
        with:
          name: build-scan-data-${{ matrix.rdbms }}
          path: ~/.gradle/build-scan-data
      - name: Store coverage report
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: build-coverage-data-${{ matrix.rdbms }}
          retention-days: 1
          path: |
            ./**/target/jacoco/*.exec
      - name: Upload test reports (if Gradle failed)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: failure()
        with:
          name: test-reports-java11-${{ matrix.rdbms }}
          path: |
            ./**/target/reports/tests/
      - name: Omit produced artifacts from build cache
        run: ./ci/before-cache.sh

  # Main job for h2/docker DBs.
  tck-runner:
    permissions:
      contents: read
    name: OpenJDK 25 - Jakarta Persistence TCK 4.0
    runs-on: ubuntu-latest
    # The TCK runs pretty fast usually, and if it doesn't,
    # then something is seriously wrong and needs to be analyzed manually
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          - rdbms: postgresql
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Reclaim Disk Space
        run: .github/ci-prerequisites.sh
      - name: Start database
        env:
          RDBMS: ${{ matrix.rdbms }}
        run: ci/database-start.sh
      - name: Set up Java 25
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: 'temurin'
          java-version: '25'

      - name: Generate cache key
        id: cache-key
        env:
          CURRENT_BRANCH: ${{ github.repository != 'hibernate/hibernate-orm' && 'fork' || github.base_ref || github.ref_name }}
        run: |
          CURRENT_MONTH=$(/bin/date -u "+%Y-%m")
          CURRENT_DAY=$(/bin/date -u "+%d")
          ROOT_CACHE_KEY="buildtool-cache-tck-run"
          {
            echo "buildtool-monthly-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}"
            echo "buildtool-monthly-branch-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}"
            echo "buildtool-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}-${CURRENT_DAY}"
          } >> "$GITHUB_OUTPUT"
      - name: Cache Maven/Gradle Dependency/Dist Caches
        id: cache-maven
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        # if it's not a pull request, we restore and save the cache
        if: github.event_name != 'pull_request'
        with:
          path: |
            ~/.m2/repository/
            ~/.m2/wrapper/
            ~/.gradle/caches/
            !~/.gradle/caches/build-cache-*
            ~/.gradle/wrapper/
          # A new cache will be stored daily. After that first store of the day, cache save actions will fail because the cache is immutable, but it's not a problem.
          # The whole cache is dropped monthly to prevent unlimited growth.
          # The cache is per branch but in case we don't find a branch for a given branch, we will get a cache from another branch.
          key: ${{ steps.cache-key.outputs.buildtool-cache-key }}
          restore-keys: |
            ${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}-
            ${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}-
      - name: Restore Maven/Gradle Dependency/Dist Caches
        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        # if it is a pull request, we restore the cache, but we don't save it
        if: github.event_name == 'pull_request'
        with:
          path: |
            ~/.m2/repository/
            ~/.m2/wrapper/
            ~/.gradle/caches/
            !~/.gradle/caches/build-cache-*
            ~/.gradle/wrapper/
          key: ${{ steps.cache-key.outputs.buildtool-cache-key }}
          restore-keys: |
            ${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}-
            ${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}-

      - name: Run build script
        run: |
          read -ra common_gradle_args <<< "$COMMON_GRADLE_ARGS"
          ci/build-tck-github.sh "${common_gradle_args[@]}"
        shell: bash
        env:
          RDBMS: ${{ matrix.rdbms }}
          # For jobs running on 'push', publish build scan and cache immediately.
          # This won't work for pull requests, since they don't have access to secrets.
          POPULATE_REMOTE_GRADLE_CACHE: ${{ github.event_name == 'push' && github.repository == 'hibernate/hibernate-orm' && 'true' || 'false' }}
          DEVELOCITY_ACCESS_KEY: "${{ secrets.DEVELOCITY_ACCESS_KEY }}"

      # For jobs running on 'pull_request', upload build scan data.
      # The actual publishing must be done in a separate job (see ci-report.yml).
      # We don't write to the remote cache as that would be unsafe.
      - name: Upload GitHub Actions artifact for the Develocity build scan
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        if: "${{ github.event_name == 'pull_request' && !cancelled() }}"
        with:
          name: build-scan-data-${{ matrix.rdbms }}-tck-run
          path: ~/.gradle/build-scan-data
      - name: Store coverage report
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: build-coverage-data-${{ matrix.rdbms }}-tck-run
          retention-days: 1
          path: |
            ./**/target/jacoco/*.exec
      - name: Upload test reports (if Gradle failed)
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        if: failure()
        with:
          name: test-reports-java25-${{ matrix.rdbms }}-tck-run
          path: |
            ./**/target/reports/tests/
      - name: Omit produced artifacts from build cache
        run: ./ci/before-cache.sh

  # Static code analysis check
  format_checks:
    permissions:
      contents: read
    name: Static code analysis
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Reclaim disk space and sanitize user home
        run: .github/ci-prerequisites-atlas.sh
      - name: Set up Java 25
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          distribution: 'temurin'
          java-version: '25'

      - name: Generate cache key
        id: cache-key
        env:
          CURRENT_BRANCH: ${{ github.repository != 'hibernate/hibernate-orm' && 'fork' || github.base_ref || github.ref_name }}
        run: |
          CURRENT_MONTH=$(/bin/date -u "+%Y-%m")
          CURRENT_DAY=$(/bin/date -u "+%d")
          ROOT_CACHE_KEY="buildtool-cache"
          {
            echo "buildtool-monthly-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}"
            echo "buildtool-monthly-branch-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}"
            echo "buildtool-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}-${CURRENT_DAY}"
          } >> "$GITHUB_OUTPUT"
      - name: Cache Maven/Gradle Dependency/Dist Caches
        id: cache-maven
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        # if it's not a pull request, we restore and save the cache
        if: github.event_name != 'pull_request'
        with:
          path: |
            ~/.m2/repository/
            ~/.m2/wrapper/
            ~/.gradle/caches/
            !~/.gradle/caches/build-cache-*
            ~/.gradle/wrapper/
          # A new cache will be stored daily. After that first store of the day, cache save actions will fail because the cache is immutable, but it's not a problem.
          # The whole cache is dropped monthly to prevent unlimited growth.
          # The cache is per branch but in case we don't find a branch for a given branch, we will get a cache from another branch.
          key: ${{ steps.cache-key.outputs.buildtool-cache-key }}
          restore-keys: |
            ${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}-
            ${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}-
      - name: Restore Maven/Gradle Dependency/Dist Caches
        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        # if it is a pull request, we restore the cache, but we don't save it
        if: github.event_name == 'pull_request'
        with:
          path: |
            ~/.m2/repository/
            ~/.m2/wrapper/
            ~/.gradle/caches/
            !~/.gradle/caches/build-cache-*
            ~/.gradle/wrapper/
          key: ${{ steps.cache-key.outputs.buildtool-cache-key }}
          restore-keys: |
            ${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}-
            ${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}-    

      - name: Run build script
        run: |
          read -ra common_gradle_args <<< "$COMMON_GRADLE_ARGS"
          ./gradlew "${common_gradle_args[@]}" formatChecks
        env:
          # For jobs running on 'push', publish build scan and cache immediately.
          # This won't work for pull requests, since they don't have access to secrets.
          POPULATE_REMOTE_GRADLE_CACHE: ${{ github.event_name == 'push' && github.repository == 'hibernate/hibernate-orm' && 'true' || 'false' }}
          DEVELOCITY_ACCESS_KEY: "${{ secrets.DEVELOCITY_ACCESS_KEY }}"

      # For jobs running on 'pull_request', upload build scan data.
      # The actual publishing must be done in a separate job (see ci-report.yml).
      # We don't write to the remote cache as that would be unsafe.
      - name: Upload GitHub Actions artifact for the Develocity build scan
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: "${{ github.event_name == 'pull_request' && !cancelled() }}"
        with:
          name: build-scan-data-sca
          path: ~/.gradle/build-scan-data

      - name: Upload test reports (if Gradle failed)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: failure()
        with:
          name: test-reports-java11-sca
          path: |
            ./**/target/reports/tests/
      - name: Omit produced artifacts from build cache
        run: ./ci/before-cache.sh

  prepare-sonar-bundle:
    name: Prepare build bundle for Sonar scanner
    needs:
      - build
      - otp
    if: |
      always() && !cancelled()
      && needs.build.result != 'cancelled' && needs.otp.result != 'cancelled'
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up JDK 25
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: '25'
          distribution: 'temurin'

      - name: Generate cache key
        id: cache-key
        env:
          CURRENT_BRANCH: ${{ github.repository != 'hibernate/hibernate-orm' && 'fork' || github.base_ref || github.ref_name }}
        run: |
          CURRENT_MONTH=$(/bin/date -u "+%Y-%m")
          CURRENT_DAY=$(/bin/date -u "+%d")
          ROOT_CACHE_KEY="buildtool-cache"
          {
            echo "buildtool-monthly-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}"
            echo "buildtool-monthly-branch-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}"
            echo "buildtool-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}-${CURRENT_DAY}"
          } >> "$GITHUB_OUTPUT"
      - name: Restore Maven/Gradle Dependency/Dist Caches
        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/.m2/repository/
            ~/.m2/wrapper/
            ~/.gradle/caches/
            !~/.gradle/caches/build-cache-*
            ~/.gradle/wrapper/
          key: ${{ steps.cache-key.outputs.buildtool-cache-key }}
          restore-keys: |
            ${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}-
            ${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}-

      - name: Download compilation results
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
        with:
          name: build-compilation-data
          path: .
        # Don't fail the build if there are no matching artifacts (the build will re-compile things then)
        continue-on-error: true

      - name: Download coverage reports
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
        with:
          pattern: build-coverage-data*
          path: .
          merge-multiple: 'true'
        # Don't fail the build if there are no matching artifacts
        continue-on-error: true

      - name: Merge Jacoco Reports
        run: |
          read -ra common_gradle_args <<< "$COMMON_GRADLE_ARGS"
          ./gradlew "${common_gradle_args[@]}" mergeCodeCoverageReport copyDependenciesSonar --no-parallel

      - name: Store build info for Sonar scanning
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: build-results-data
          retention-days: 1
          path: |
            ./**/target/jacoco/*.exec
            ./**/target/classes/
            ./**/target/generated/
            ./**/target/resources/
            ./**/target/reports/
            ./**/target/sonar-dependencies/