ci-report.yml

name: GH Actions CI reporting

on:
  workflow_run:
    workflows: [ "GH Actions CI" ]
    types: [ completed ]

defaults:
  run:
    shell: bash

permissions: { } # none, jobs are defining their own if they need any

env:
  COMMON_GRADLE_ARGS: "-Igradle/init.gradle"
  MIRROR_MAVEN_CENTRAL_URL: "https://maven-central.storage-download.googleapis.com/maven2/"
  MIRROR_MAVEN_CENTRAL_FALLBACK: "true"

jobs:
  publish-build-scans:
    name: Publish Develocity build scans
    if: github.repository == 'hibernate/hibernate-orm'
    runs-on: ubuntu-latest

    permissions:
      actions: read
      contents: read
      pull-requests: read

    steps:
      - name: Determine the branch for which the original action was triggered
        id: determine_branch_ref
        env:
          GH_TOKEN: ${{ github.token }}
          GH_EVENT: ${{ github.event.workflow_run.event }}
          FORK_OWNER: ${{ github.event.workflow_run.head_repository.owner.login }}
          REPO_OWNER: ${{ github.event.workflow_run.repository.owner.login }}
          REPO_FULL_NAME: ${{ github.event.workflow_run.repository.full_name }}
          HEAD_BRANCH_NAME: ${{ github.event.workflow_run.head_branch }}
        run: |
          BRANCH_NAME="$HEAD_BRANCH_NAME"
          if [ "$GH_EVENT" == "pull_request" ]; then
            if [ "$FORK_OWNER" != "$REPO_OWNER" ]; then
              BRANCH_NAME="$FORK_OWNER:$BRANCH_NAME"
            fi
            GH_RESPONSE=$(gh pr view "$BRANCH_NAME" --repo "$REPO_FULL_NAME" --json baseRefName)
            TARGET_BRANCH=$(echo "$GH_RESPONSE" | jq -r '.baseRefName')
            echo "::notice::PR target branch: $TARGET_BRANCH"
            echo "original_branch_ref=$TARGET_BRANCH" >> "$GITHUB_OUTPUT"
          else
            echo "::notice::Push event, using head branch: $BRANCH_NAME"
            echo "original_branch_ref=$BRANCH_NAME" >> "$GITHUB_OUTPUT"
          fi
      # Checkout the target branch so that the Develocity plugin version matches
      # the one that was used to produce the build scan data.
      - name: Check out target branch
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          ref: ${{ steps.determine_branch_ref.outputs.original_branch_ref }}
      - name: Set up JDK
        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
        with:
          distribution: 'temurin'
          java-version: '25'

      - name: Generate cache key
        id: cache-key
        env:
          CURRENT_BRANCH: ${{ github.repository != 'hibernate/hibernate-orm' && 'fork' || steps.determine_branch_ref.outputs.original_branch_ref || github.ref_name }}
        run: |
          CURRENT_MONTH=$(/bin/date -u "+%Y-%m")
          CURRENT_DAY=$(/bin/date -u "+%d")
          ROOT_CACHE_KEY="buildtool-cache"
          {
            echo "buildtool-monthly-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}"
            echo "buildtool-monthly-branch-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}"
            echo "buildtool-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}-${CURRENT_DAY}"
          }>> "$GITHUB_OUTPUT"
      - name: Restore Maven/Gradle Dependency/Dist Caches
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/.m2/repository/
            ~/.m2/wrapper/
            ~/.gradle/caches/modules-2
            ~/.gradle/wrapper/
          key: ${{ steps.cache-key.outputs.buildtool-cache-key }}
          restore-keys: |
            ${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}-
            ${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}-

      - name: Download GitHub Actions artifacts for the Develocity build scans
        id: downloadBuildScan
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: build-scan-data-*
          github-token: ${{ github.token }}
          repository: ${{ github.repository }}
          run-id: ${{ github.event.workflow_run.id }}
          path: /tmp/downloaded-build-scan-data/
        # Don't fail the build if there are no matching artifacts
        continue-on-error: true
      - name: Publish Develocity build scans for previous builds
        if: ${{ steps.downloadBuildScan.outcome != 'failure'}}
        run: |
          shopt -s nullglob # Don't run the loop below if there are no artifacts
          read -ra common_gradle_args <<< "$COMMON_GRADLE_ARGS"
          published=0
          failed=0
          mkdir -p ~/.gradle/
          for build_scan_data_directory in /tmp/downloaded-build-scan-data/*
          do
            rm -rf ~/.gradle/build-scan-data
            mv "$build_scan_data_directory" ~/.gradle/build-scan-data
            if ./gradlew "${common_gradle_args[@]}" --no-build-cache buildScanPublishPrevious; then
              published=$((published + 1))
            else
              echo "::warning::Failed to publish build scan from $(basename "$build_scan_data_directory")"
              failed=$((failed + 1))
            fi
          done
          echo "Published $published build scan(s), $failed failed"
        env:
          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY_PR }}

  publish-sonar-scans:
    name: Publish Sonar scan
    if: github.repository == 'hibernate/hibernate-orm'
    runs-on: ubuntu-latest

    permissions:
      actions: read
      contents: read
      pull-requests: read

    steps:
      - name: Determine the Branch Reference for which the original action was triggered
        id: determine_branch_ref
        env:
          GH_TOKEN: ${{ github.token }}
          GH_EVENT: ${{ github.event.workflow_run.event }}
          FORK_OWNER: ${{ github.event.workflow_run.head_repository.owner.login }}
          REPO_OWNER: ${{ github.event.workflow_run.repository.owner.login }}
          REPO_FULL_NAME: ${{ github.event.workflow_run.repository.full_name }}
          HEAD_BRANCH_NAME: ${{ github.event.workflow_run.head_branch }}
        run: |
          BRANCH_NAME="$HEAD_BRANCH_NAME"
          if [ "$GH_EVENT" == "pull_request" ]; then
            echo "::notice::Triggering workflow was executed for a pull request"
            
            if [ "$FORK_OWNER" != "$REPO_OWNER" ]; then
              BRANCH_NAME="$FORK_OWNER:$BRANCH_NAME"
            fi
            GH_RESPONSE=$(gh pr view "$BRANCH_NAME" --repo "$REPO_FULL_NAME" --json number,baseRefName)
            TARGET_BRANCH=$(echo "$GH_RESPONSE" | jq -r '.baseRefName')
            PR_ID=$(echo "$GH_RESPONSE" | jq -r '.number')

            echo "::notice::PR found. Target branch is: $TARGET_BRANCH"
            echo "::notice::          Pull Request number is: $PR_ID"
            echo "::notice::          Branch to merge is: $BRANCH_NAME"
            {
              echo "original_branch_ref=$TARGET_BRANCH"
              echo "pr_id=$PR_ID"
              echo "branch_to_merge=$BRANCH_NAME"
            } >> "$GITHUB_OUTPUT"
          else
            echo "::notice::Triggering workflow was executed for a push event? Using the head_branch value."
            echo "original_branch_ref=$BRANCH_NAME" >> "$GITHUB_OUTPUT"
          fi
      # Checkout target branch (from the main repository)
      - name: Check out target branch
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          # By default, a workflow that is triggered with on workflow_run would run on the main (default) branch.
          #  Different branches might have different versions of Develocity, and we want to make sure
          #  that we publish with the one that we built the scan with in the first place.
          ref: ${{ steps.determine_branch_ref.outputs.original_branch_ref }}
          fetch-depth: 0

        # Note: we need to check out the code with all the changes so that we have the sources,
        #  matching our compiled classes we'll pull from the build artifacts.
        #  We won't be running any builds from the checked out code,
        #  but we'll use the code to run the sonar scanner tool.
        #
        #  Only needed if we are analysing the PR,
        #  as otherwise the previous checkout already did the work.
      - name: Check out merged code (if PR)
        env:
          GH_TOKEN: ${{ github.token }}
          GH_EVENT: ${{ github.event.workflow_run.event }}
          GH_PR_ID: ${{steps.determine_branch_ref.outputs.pr_id}}
        run: |
          if [ "$GH_EVENT" == "pull_request" ]; then
            gh pr checkout "$GH_PR_ID"
          fi

          # so we aren't tempted to run a Gradle command!
          rm -rf gradlew*

      - name: Set up Java 25
        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
        with:
          java-version: 25
          distribution: temurin

      - name: Download coverage reports
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: build-results-data
          github-token: ${{ github.token }}
          repository: ${{ github.repository }}
          run-id: ${{ github.event.workflow_run.id }}
          path: .
          merge-multiple: 'true'
        # Don't fail the build if there are no matching artifacts
        continue-on-error: true

      - name: Install Sonar CLI
        run: |
          SONAR_HASH="8fbfb1eb546b734a60fc3e537108f06e389a8ca124fbab3a16236a8a51edcc15"
          SONAR_SCANNER_VERSION="8.0.1.6346"
          export SONAR_SCANNER_HOME="$HOME/.sonar/sonar-scanner-$SONAR_SCANNER_VERSION"
          curl --create-dirs --fail -sSLo "$HOME/.sonar/sonar-scanner.zip" https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-$SONAR_SCANNER_VERSION.zip
          DOWNLOADED_HASH=$(sha256sum "$HOME/.sonar/sonar-scanner.zip" | awk '{print $1}')
          if [ "$DOWNLOADED_HASH" == "$SONAR_HASH" ]; then
            echo "Successfully verified the file checksum"
          else
            echo "Error: Failed the file checksum verification. Expected: $SONAR_HASH but got $DOWNLOADED_HASH instead"
            exit 1
          fi
          unzip -o "$HOME/.sonar/sonar-scanner.zip" -d "$HOME/.sonar/"
          mv "$HOME/.sonar/sonar-scanner-$SONAR_SCANNER_VERSION"/* "$HOME/.sonar/" 

      - name: Sonar Analysis
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          GH_EVENT: ${{ github.event.workflow_run.event }}
          HEAD_BRANCH: ${{github.event.workflow_run.head_branch}}
          STEP_OUTPUT_BRANCH_TO_MERGE: ${{steps.determine_branch_ref.outputs.branch_to_merge}}
          STEP_OUTPUT_PR_ID: ${{steps.determine_branch_ref.outputs.pr_id}}
          STEP_OUTPUT_ORIGINAL_BRANCH_REF: ${{steps.determine_branch_ref.outputs.original_branch_ref}}
        run: |
          find . -name "*.exec" -type f
          EXTRA_ARGS=()
          if [ "$GH_EVENT" == "pull_request" ]; then
            echo "::notice::Triggering workflow was executed for a pull request"

            EXTRA_ARGS=(
              "-Dsonar.pullrequest.branch=$STEP_OUTPUT_BRANCH_TO_MERGE"
              "-Dsonar.pullrequest.key=$STEP_OUTPUT_PR_ID"
              "-Dsonar.pullrequest.base=$STEP_OUTPUT_ORIGINAL_BRANCH_REF"
              "-Dsonar.pullrequest.provider=GitHub"
              "-Dsonar.pullrequest.github.repository=hibernate/hibernate-orm"
            )
          else
            EXTRA_ARGS=("-Dsonar.branch.name=$HEAD_BRANCH")
          fi

          "$HOME/.sonar/bin/sonar-scanner" "${EXTRA_ARGS[@]}" \
              -Dsonar.host.url="https://sonarcloud.io" \
              -Dsonar.organization="hibernate" \
              -Dsonar.projectKey="hibernate_hibernate-orm" \
              -Dsonar.java.libraries="$(pwd)/target/sonar-dependencies/*.jar" \
              -Dsonar.coverage.jacoco.xmlReportPaths="$(pwd)/reporting/target/reports/jacoco/mergeCodeCoverageReport/mergeCodeCoverageReport.xml"