gradle-build.yml

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.
# This workflow will build a Java project with Gradle and cache/restore any dependencies to improve the workflow execution time
# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-java-with-gradle

name: ci

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

permissions:
  contents: write
  # Note that this permission will not be available if the PR is from a forked repository

jobs:
  build:

    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4
    - name: Set up java
      uses: actions/setup-java@v4
      with:
        java-version: '17'
        distribution: 'temurin'
        cache: 'gradle'
    - name: Validate gradle wrapper
      uses: gradle/wrapper-validation-action@v2
    - name: Setup Gradle to generate and submit dependency graphs
      uses: gradle/gradle-build-action@v3
      with:
        dependency-graph: generate-and-submit
    - name: Build
      uses: gradle/gradle-build-action@v3
      with:
        arguments: build

  dependency-review:
    needs: build
    runs-on: ubuntu-latest
    steps:
    - name: Perform dependency review
      uses: actions/dependency-review-action@v4
      with:
        fail-on-severity: high
        allow-ghsas: GHSA-h3qr-39j9-4r5v
        base-ref: ${{ github.event.pull_request.base.sha || 'main' }}
        head-ref: ${{ github.event.pull_request.head.sha || github.ref }}

  publish:
    needs: [ build ]
    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up java
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'temurin'
          cache: 'gradle'
      - name: Publish
        uses: gradle/gradle-build-action@v3
        env:
          # variables used by build.gradle.kts for signing / publishing (without 'ORG_GRADLE_PROJECT_' prefix)
          ORG_GRADLE_PROJECT_signingKeyId: ${{ secrets.OSSRH_GPG_SECRET_KEY_ID }}
          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.OSSRH_GPG_SECRET_KEY }}
          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.OSSRH_GPG_SECRET_PASSWORD }}
          ORG_GRADLE_PROJECT_ossrhUsername: ${{ secrets.OSSRH_USERNAME }}
          ORG_GRADLE_PROJECT_ossrhPassword: ${{ secrets.OSSRH_PASSWORD }}
        with:
          arguments: publish