analysis.yml

name: analysis
permissions: read-all
on: [ push, pull_request ]

env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
  ALLOWED_ENDPOINTS: >
    api.adoptium.net:443
    api.github.com:443
    caffeine.gradle-enterprise.cloud:443
    downloads.gradle.org:443
    downloads.gradle-dn.com:443
    github.com:443
    jcenter.bintray.com:443
    objects.githubusercontent.com:443
    plugins.gradle.org:443
    plugins-artifacts.gradle.org:443
    repo.maven.apache.org:443
    repo1.maven.org:443
    services.gradle.org:443

jobs:
  forbiddenApis:
    runs-on: ubuntu-latest
    env:
      JAVA_VERSION: 22
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: ${{ env.ALLOWED_ENDPOINTS }}
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Forbidden Apis
        uses: ./.github/actions/run-gradle
        with:
          java: ${{ env.JAVA_VERSION }}
          arguments: forbiddenApis -DforbiddenApis
          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}

  pmd:
    runs-on: ubuntu-latest
    env:
      JAVA_VERSION: 23
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: ${{ env.ALLOWED_ENDPOINTS }}
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Pmd
        uses: ./.github/actions/run-gradle
        with:
          java: ${{ env.JAVA_VERSION }}
          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
          arguments: pmdJavaPoet pmdMain pmdCodeGen pmdJmh pmdTest -Dpmd

  spotbugs:
    runs-on: ubuntu-latest
    env:
      JAVA_VERSION: 23
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: ${{ env.ALLOWED_ENDPOINTS }}
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Spotbugs
        uses: ./.github/actions/run-gradle
        with:
          java: ${{ env.JAVA_VERSION }}
          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
          arguments: >
            spotbugsJavaPoet spotbugsMain spotbugsCodeGen spotbugsJmh spotbugsTest -Dspotbugs