zxc-verify-gradle-build-determinism.yaml

# SPDX-License-Identifier: Apache-2.0
name: "ZXC: Verify Gradle Build Determinism"
# Here, the ZXC prefix:
# Z - Ensures sort order such that this script appears at the bottom of the UI
# X - Indicates it's not for direct user consumption
# C - Indicates this is a 'workflow_call' based reusable workflow
on:
  workflow_call:
    inputs:
      ref:
        description: "The branch, tag, or commit to checkout:"
        type: string
        required: false
        default: ""
      java-distribution:
        description: "Java JDK Distribution:"
        type: string
        required: false
        default: "temurin"
      java-version:
        description: "Java JDK Version:"
        type: string
        required: false
        default: "21.0.6"

  workflow_dispatch:
    inputs:
      ref:
        description: "The branch, tag, or commit to checkout:"
        type: string
        required: false
        default: ""
      java-distribution:
        description: "Java JDK Distribution:"
        type: string
        required: false
        default: "temurin"
      java-version:
        description: "Java JDK Version:"
        type: string
        required: false
        default: "21.0.6"

defaults:
  run:
    shell: bash

permissions:
  id-token: write
  contents: read

env:
  GRADLE_MANIFEST_PATH: ${{ github.workspace }}/.manifests/gradle
  GRADLE_MANIFEST_GENERATOR: .github/workflows/support/scripts/generate-gradle-artifact-baseline.sh
  LC_ALL: C.UTF-8

jobs:
  generate-baseline:
    name: Generate Baseline
    runs-on: hiero-block-node-linux-medium
    outputs:
      sha: ${{ steps.commit.outputs.sha }}
      path: ${{ steps.baseline.outputs.path }}
      file: ${{ steps.baseline.outputs.file }}
      name: ${{ steps.baseline.outputs.name }}

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ inputs.ref }}

      - name: Setup Java
        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
        with:
          distribution: ${{ inputs.java-distribution }}
          java-version: ${{ inputs.java-version }}

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@94baf225fe0a508e581a564467443d0e2379123b # v4.3.0
        with:
          cache-disabled: true

      - name: Authenticate to Google Cloud
        id: google-auth
        uses: google-github-actions/auth@71f986410dfbc7added4569d411d040a91dc6935 # v2.1.8
        with:
          workload_identity_provider: "projects/235822363393/locations/global/workloadIdentityPools/hedera-builds-pool/providers/hedera-builds-gh-actions"
          service_account: "swirlds-automation@hedera-registry.iam.gserviceaccount.com"

      - name: Setup Google Cloud SDK
        uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a # v2.1.4

      - name: Retrieve Commit Hash
        id: commit
        run: echo "sha=$(git rev-parse HEAD)" >> "${GITHUB_OUTPUT}"

      - name: Baseline Existence Check
        id: baseline
        run: |
          BASELINE_NAME="${{ steps.commit.outputs.sha }}.tar.gz"
          BASELINE_PATH="gs://hedera-ci-ephemeral-artifacts/${{ github.repository }}/gradle/baselines"
          BASELINE_FILE="${BASELINE_PATH}/${BASELINE_NAME}"
          BASELINE_EXISTS="false"

          if gsutil ls "${BASELINE_FILE}" >/dev/null 2>&1; then
             BASELINE_EXISTS="true"
          fi

          echo "exists=${BASELINE_EXISTS}" >> "${GITHUB_OUTPUT}"
          echo "path=${BASELINE_PATH}" >> "${GITHUB_OUTPUT}"
          echo "name=${BASELINE_NAME}" >> "${GITHUB_OUTPUT}"
          echo "file=${BASELINE_FILE}" >> "${GITHUB_OUTPUT}"

      - name: Build Artifacts
        id: gradle-build
        if: ${{ steps.baseline.outputs.exists == 'false' && !failure() && !cancelled() }}
        run: ./gradlew assemble

      - name: Generate Manifest
        id: manifest
        env:
          MANIFEST_PATH: ${{ env.GRADLE_MANIFEST_PATH }}
        if: ${{ steps.baseline.outputs.exists == 'false' && !failure() && !cancelled() }}
        run: ${{ env.GRADLE_MANIFEST_GENERATOR }}

      - name: Upload Baseline
        if: ${{ steps.baseline.outputs.exists == 'false' && !failure() && !cancelled() }}
        run: gsutil cp "${{ steps.manifest.outputs.file }}" "${{ steps.baseline.outputs.file }}"

  verify-artifacts:
    name: "Verify Artifacts (${{ join(matrix.os, ', ') }})"
    runs-on: ${{ matrix.os }}
    needs:
      - generate-baseline
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-24.04
          - ubuntu-22.04
          - hiero-block-node-linux-medium
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
        with:
          egress-policy: audit

      - name: Standardize Git Line Endings
        run: |
          git config --global core.autocrlf false
          git config --global core.eol lf

      - name: Checkout Code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ inputs.ref }}

      - name: Setup Python
        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
        with:
          python-version: 3.9

      - name: Setup Java
        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
        with:
          distribution: ${{ inputs.java-distribution }}
          java-version: ${{ inputs.java-version }}

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@94baf225fe0a508e581a564467443d0e2379123b # v4.3.0
        with:
          cache-disabled: true

      - name: Authenticate to Google Cloud
        id: google-auth
        uses: google-github-actions/auth@71f986410dfbc7added4569d411d040a91dc6935 # v2.1.8
        with:
          workload_identity_provider: "projects/235822363393/locations/global/workloadIdentityPools/hedera-builds-pool/providers/hedera-builds-gh-actions"
          service_account: "swirlds-automation@hedera-registry.iam.gserviceaccount.com"

      - name: Setup Google Cloud SDK
        uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a # v2.1.4
        env:
          CLOUDSDK_PYTHON: ${{ format('{0}{1}', env.pythonLocation, runner.os == 'Windows' && '\python.exe' || '/bin/python3') }}

      - name: Download Baseline
        env:
          CLOUDSDK_PYTHON: ${{ format('{0}{1}', env.pythonLocation, runner.os == 'Windows' && '\python.exe' || '/bin/python3') }}
        run: |
          mkdir -p "${GRADLE_MANIFEST_PATH}"
          cd "${GRADLE_MANIFEST_PATH}"
          gsutil cp "${{ needs.generate-baseline.outputs.file }}" .
          tar -xzf "${{ needs.generate-baseline.outputs.name }}"

      - name: Build Artifacts
        id: gradle-build
        run: ./gradlew assemble --no-build-cache

      - name: Regenerate Manifest
        id: regen-manifest
        env:
          MANIFEST_PATH: ${{ env.GRADLE_MANIFEST_PATH }}/regenerated
        run: ${{ env.GRADLE_MANIFEST_GENERATOR }}

      - name: Validate Applications
        working-directory: ${{ github.workspace }}/server/build/libs
        run: sha256sum -c "${GRADLE_MANIFEST_PATH}/applications.sha256"

      - name: Compare Application Manifests
        run: |
          if ! diff -u "${GRADLE_MANIFEST_PATH}/applications.sha256" "${{ steps.regen-manifest.outputs.applications }}" >/dev/null 2>&1; then
            echo "::group::Application Manifest Differences"
            diff -u "${GRADLE_MANIFEST_PATH}/applications.sha256" "${{ steps.regen-manifest.outputs.applications }}"
            echo "::endgroup::"
            exit 1
          fi

      - name: Publish Manifests
        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        if: ${{ steps.regen-manifest.conclusion == 'success' && failure() && !cancelled() }}
        with:
          name: Gradle Manifests [${{ join(matrix.os, ', ') }}]
          path: ${{ env.GRADLE_MANIFEST_PATH }}/**