maven.yml

name: Java CI with Maven

on:
  push:
    branches: [ "main", "release/**" ]
  pull_request:
    branches: [ "main", "release/**" ]

permissions:
  contents: read
  checks: write

concurrency:
  group: ${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
        jdk: [17]

    runs-on: ${{ matrix.os }}

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
      with:
        # egress-policy: audit
        egress-policy: block
        disable-sudo: true
        allowed-endpoints: >
          archive.ics.uci.edu:80
          auth.docker.io:443
          build.shibboleth.net:443
          eastus.data.mcr.microsoft.com:443
          api.github.com:443
          github.com:443
          mcr.microsoft.com:443
          nodejs.org:443
          oss.sonatype.org:443
          production.cloudflare.docker.com:443
          registry-1.docker.io:443
          registry.npmjs.org:443
          repo.maven.apache.org:443
          westus.data.mcr.microsoft.com:443
          westus2.data.mcr.microsoft.com:443
          www.ims.uni-stuttgart.de:443
          zoidberg.ukp.informatik.tu-darmstadt.de:443

    - name: Checkout repository
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        ref: ${{ github.head_ref || github.ref }}

    - name: Set up JDK ${{ matrix.jdk }}
      uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
      with:
        java-version: ${{ matrix.jdk }}
        distribution: 'temurin'
        cache: maven
        server-id: ukp-oss-snapshots
        server-username: MAVEN_USERNAME
        server-password: MAVEN_PASSWORD

    - name: Set up Maven
      uses: stCarolas/setup-maven@d6af6abeda15e98926a57b5aa970a96bb37f97d1 # v5
      with:
        maven-version: 3.9.9

    - name: Set up cache date
      run: echo "CACHE_DATE=$(date +'%Y-%m-%d')" >> $GITHUB_ENV

    - name: Cache Maven repository
      id: maven-cache
      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
      with:
        path: ~/.m2/repository
        key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}-${{ env.CACHE_DATE }}
        restore-keys: |
          ${{ runner.os }}-maven-

    - name: Cache Docker layers
      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
      with:
        path: /var/lib/docker
        key: docker-cache-${{ runner.os }}-${{ github.sha }}
        restore-keys: |
          docker-cache-${{ runner.os }}-

    - name: Cache DKPro Core Dataset Cache
      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
      with:
        path: cache
        key: dkpro-dataset-cache-${{ runner.os }}-${{ github.sha }}
        restore-keys: |
          dkpro-dataset-cache-${{ runner.os }}-

    - name: Cache Nodejs
      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
      with:
        path: nodejs
        key: nodejs-cache-${{ runner.os }}-${{ github.sha }}
        restore-keys: |
          nodejs-cache-${{ runner.os }}-

    - name: Build with Maven
      if: "!(matrix.os == 'ubuntu-latest' && github.event_name != 'pull_request')"
      run: mvn --show-version --batch-mode --no-transfer-progress clean verify

    - name: Build with Maven and publish artifacts
      if: matrix.os == 'ubuntu-latest' && github.event_name != 'pull_request'
      env:
        # `MAVEN_USERNAME` and `MAVEN_PASSWORD` are used in `~/.m2/settings.xml` created by `setup-java` action
        MAVEN_USERNAME: ${{ secrets.UKP_MAVEN_USER }}
        MAVEN_PASSWORD: ${{ secrets.UKP_MAVEN_TOKEN }}
      run: mvn --show-version --batch-mode --errors --no-transfer-progress -DdeployAtEnd=true -DskipTests clean deploy

    - name: Publish Test Report
      uses: mikepenz/action-junit-report@v5
      if: success() || failure() # always run even if the previous step fails
      with:
        report_paths: '**/target/surefire-reports/TEST-*.xml'

    - name: Capture build artifacts
      if: matrix.os == 'ubuntu-latest'
      uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
      with:
        name: build-artifacts
        path: inception/inception-app-webapp/target/inception-app-webapp-*-standalone.jar