build

name: build

on:
  pull_request: {}
  workflow_dispatch: {}
  push:
    branches:
      - 'master'
    tags-ignore:
      - '**'

env:
  GRADLE_OPTS: "-Dorg.gradle.jvmargs=-Xmx2g -Dorg.gradle.daemon=false -Dkotlin.incremental=false"

jobs:
  jvm:
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        java-version:
          - 8
          - 11
          - 17
          - 19

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Validate Gradle Wrapper
        uses: gradle/actions/wrapper-validation@v3

      - name: Configure JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 19

      - name: Test
        run: |
          ./gradlew -Dkjs=false -Dknative=false -Dkwasm=false -Dtest.java.version=${{ matrix.java-version }} build --stacktrace

  emulator:
    runs-on: ubuntu-latest
    steps:
      # https://github.blog/changelog/2023-02-23-hardware-accelerated-android-virtualization-on-actions-windows-and-linux-larger-hosted-runners/
      - name: Enable KVM group perms
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm
          ls /dev/kvm
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 19

      - uses: gradle/actions/setup-gradle@v3

      - uses: reactivecircus/android-emulator-runner@v2
        with:
          api-level: 24
          script: ./gradlew :okio-assetfilesystem:connectedCheck

  loom:
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Validate Gradle Wrapper
        uses: gradle/actions/wrapper-validation@v3

      - name: Configure JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 19

      - name: Test
        run: |
          ./gradlew -DloomEnabled=true build

  all-platforms:
    runs-on: ${{ matrix.os }}

    strategy:
      fail-fast: false
      matrix:
        os: [ macos-14, ubuntu-latest, windows-latest ]

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Validate Gradle Wrapper
        uses: gradle/actions/wrapper-validation@v3

      - name: Configure JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 19

      - name: Test
        if: matrix.os != 'windows-latest'
        run: |
          ./gradlew build

      - name: Test (No WASM)
        if: matrix.os == 'windows-latest'
        run: |
          ./gradlew build -Dkwasm=false

      - name: Save Test Reports
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: test-reports
          path: '**/build/reports'

  publish:
    runs-on: macos-14
    if: github.repository == 'square/okio' && github.ref == 'refs/heads/master'
    needs: [jvm, all-platforms, emulator]

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Configure JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 19

      - name: Upload Artifacts
        run: |
          ./gradlew clean publish --stacktrace
        env:
          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_NEXUS_USERNAME }}
          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_NEXUS_PASSWORD }}
          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.ARTIFACT_SIGNING_PRIVATE_KEY }}

  publish-website:
    runs-on: ubuntu-latest
    if: github.repository == 'square/okio' && github.ref == 'refs/heads/master'
    needs: [jvm, all-platforms, emulator]

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Configure JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 19

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: 3.8

      - name: Prepare docs
        run: .buildscript/prepare_mkdocs.sh

      - name: Build mkdocs
        run: |
          pip3 install mkdocs-material mkdocs-macros-plugin
          mkdocs build

      - name: Restore 1.x docs
        run: .buildscript/restore_v1_docs.sh

      - name: Deploy docs
        if: success()
        uses: JamesIves/github-pages-deploy-action@releases/v3
        with:
          GITHUB_TOKEN: ${{ secrets.GH_CLIPPY_TOKEN }}
          BRANCH: gh-pages
          FOLDER: site
          SINGLE_COMMIT: true


CI

name: CI

on:
  pull_request:
  push:
    branches:
      - 'master'

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4.1.7

      - name: Setup Java ${{ matrix.jdk-version }}
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 17

      - name: Set up Python 3.8
        uses: actions/setup-python@v5
        with:
          python-version: 3.8

      - name: Install Python modules
        run: |
          python -m pip install --upgrade pip
          if [ -f scripts/requirements.txt ]; then pip install -r scripts/requirements.txt; fi

      - uses: actions/cache@v4.0.2
        id: gradle-wrapper-cache
        with:
          path: ~/.gradle/wrapper
          key: ${{ runner.os }}-gradlewrapper-${{ hashFiles('gradle/wrapper/*') }}
          restore-keys: ${{ runner.os }}-gradlewrapper-

      - name: Cache Gradle packages
        uses: actions/cache@v4.0.2
        with:
          path: ~/.gradle/caches
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}
          restore-keys: ${{ runner.os }}-gradle

      - name: Maven cache
        uses: actions/cache@v4.0.2
        with:
          path: ~/.m2
          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
          restore-keys: ${{ runner.os }}-m2

      - name: Grant execute permission for gradlew
        run: chmod +x gradlew

      - name: Check
        run: |
          ./gradlew --info --no-watch-fs check

      - name: Publish Locally
        run: |
          ./gradlew --info --no-watch-fs publishToMavenLocal --warning-mode all

      - name: Clone dgs-examples-java
        uses: actions/checkout@v4.1.7
        with:
          repository: Netflix/dgs-examples-java
          path: build/examples/dgs-examples-java

      - name: Clone dgs-examples-kotlin
        uses: actions/checkout@v4.1.7
        with:
          repository: Netflix/dgs-examples-kotlin
          path: build/examples/dgs-examples-kotlin

      - name: Build Examples
        run: |
          find /home/runner/.m2/repository/ -type f -name "*graphql-dgs-codegen-gradle*"
          ./scripts/test-examples.py -v -k --path=./build/examples

      - name: Upload JUnit Tests
        uses: actions/upload-artifact@v4  # upload test results
        if: success() || failure()        # run this step even if previous step failed
        with:
          name: test-results
          path: '**/test-results/**/*.xml'


Publish to NetflixOSS and Maven Central

name: "Publish to NetflixOSS and Maven Central"
on:
  push:
    tags:
      - v*.*.*
      - v*.*.*-rc.*

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4.1.7
      - name: Setup jdk 8
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 8
      - uses: actions/cache@v4.0.2
        id: gradle-cache
        with:
          path: ~/.gradle/caches
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/gradle/dependency-locks/*.lockfile') }}
          restore-keys: |
            - ${{ runner.os }}-gradle-
      - uses: actions/cache@v4.0.2
        id: gradle-wrapper-cache
        with:
          path: ~/.gradle/wrapper
          key: ${{ runner.os }}-gradlewrapper-${{ hashFiles('gradle/wrapper/*') }}
          restore-keys: |
            - ${{ runner.os }}-gradlewrapper-
      - name: Publish candidate
        if: contains(github.ref, '-rc.')
        run: ./gradlew --info --stacktrace --no-watch-fs -Prelease.useLastTag=true candidate
        env:
          NETFLIX_OSS_SIGNING_KEY: ${{ secrets.ORG_SIGNING_KEY }}
          NETFLIX_OSS_SIGNING_PASSWORD: ${{ secrets.ORG_SIGNING_PASSWORD }}
          NETFLIX_OSS_REPO_USERNAME: ${{ secrets.ORG_NETFLIXOSS_USERNAME }}
          NETFLIX_OSS_REPO_PASSWORD: ${{ secrets.ORG_NETFLIXOSS_PASSWORD }}
      - name: Publish release
        if: (!contains(github.ref, '-rc.'))
        run: ./gradlew --info --no-watch-fs -Prelease.useLastTag=true final
        env:
          NETFLIX_OSS_SONATYPE_USERNAME: ${{ secrets.ORG_SONATYPE_USERNAME }}
          NETFLIX_OSS_SONATYPE_PASSWORD: ${{ secrets.ORG_SONATYPE_PASSWORD }}
          NETFLIX_OSS_SIGNING_KEY: ${{ secrets.ORG_SIGNING_KEY }}
          NETFLIX_OSS_SIGNING_PASSWORD: ${{ secrets.ORG_SIGNING_PASSWORD }}
          NETFLIX_OSS_REPO_USERNAME: ${{ secrets.ORG_NETFLIXOSS_USERNAME }}
          NETFLIX_OSS_REPO_PASSWORD: ${{ secrets.ORG_NETFLIXOSS_PASSWORD }}


Release Drafter

name: Release Drafter

on:
  push:
    # branches to consider in the event; optional, defaults to all
    branches:
      - master
  # pull_request event is required only for autolabeler
  pull_request:
    # Only following types are handled by the action, but one can default to all as well
    types: [ opened, reopened, synchronize ]

jobs:
  update_release_draft:
    runs-on: ubuntu-latest
    steps:
      - uses: release-drafter/release-drafter@v6
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


Update Gradle Wrapper

name: Update Gradle Wrapper

on:
  schedule:
    - cron: "0 0 * * *"
  workflow_dispatch:

jobs:
  update-gradle-wrapper:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4.1.7
      - name: Set up JDK 1.8
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 8
      - name: Update Gradle Wrapper
        uses: gradle-update/update-gradle-wrapper-action@v1


Test Report

name: 'Test Report'
on:
  workflow_run:
    workflows: ['CI']                     # runs after CI workflow
    types:
      - completed
jobs:
  report:
    runs-on: ubuntu-latest
    steps:
    - uses: dorny/test-reporter@v1
      with:
        artifact: test-results                  # Artifact name, ref CI Job
        name: JUnit Tests
        path: '**/build/test-results/**/*.xml'  # Path to test results (inside artifact .zip)
        reporter: java-junit                    # Format of test results.
        list-suites: 'failed'                   # Only include failed test to reduce the size of the report.
        list-tests: 'failed'
        max-annotations: '50'
        only-summary: 'true'


Close stale threads

name: "Close stale threads"
on:
  schedule:
  - cron: "0 0 * * *"

jobs:
  default:
    timeout-minutes: 1
    runs-on: ubuntu-latest
    steps:
    - uses: actions/stale@v9.0.0
      with:
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        stale-pr-message: 'This pull request has been marked as stale because it has been open 1 year with no activity. Remove stale label or comment or this will be closed in 7 days'
        stale-pr-label: 'stale'
        exempt-issue-labels: 'blocked-external'
        days-before-stale: 365
        days-before-close: 7
        days-before-issue-close: -1


Gradle Check

name: Gradle Check

on:
  pull_request:
  push:
    branches:
      - master
      - main

jobs:
  build:
    strategy:
      matrix:
        os:
          - macOS-latest
          # - windows-latest
          - ubuntu-latest

    runs-on: ${{matrix.os}}

    steps:
      - name: Checkout the repo
        uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: zulu
          java-version: 17

      - name: Configure gradle
        uses: gradle/gradle-build-action@v2

      - name: Configure node with npm
        uses: actions/setup-node@v4
        with:
          node-version: '18'
          cache: 'npm'

      - name: Install npm dependencies
        run: npm install -g purs-tidy spago purescript

      - name: Gradle Check
        run: ./gradlew check


Publish

name: Publish

on:
  push:
    tags:
      - 'v*'

jobs:
  build:
    strategy:
      matrix:
        os: [ubuntu-latest]

    runs-on: ${{matrix.os}}

    steps:
      - name: Checkout the repo
        uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: zulu
          java-version: 17

      - name: Configure gradle
        uses: gradle/gradle-build-action@v2

      - name: Configure node with npm
        uses: actions/setup-node@v4
        with:
          node-version: '18'
          cache: 'npm'

      - name: Install Purs-Tidy
        run: npm install -g purs-tidy

      - name: Gradle Publish Plugin
        run: |
          VERSION=$(git describe --tags --match='v*')
          ./gradlew :publishPlugin -PintellijPublishToken="${{ secrets.INTELLIJPUBLISHTOKEN }}" -PpublishChannels=Stable -Pversion="$VERSION"


Build Release Candidate

# This is a basic workflow that is manually triggered

name: Build Release Candidate

env:
  # The name of the main module repository
  main_project_module: app

# Controls when the action will run. Workflow runs when manually triggered using the UI
# or API.
on:
  workflow_dispatch:

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  # This workflow contains a single job called "greet"
  greet:
    # The type of runner that the job will run on
    runs-on: ubuntu-latest

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
    # Runs a single command using the runners shell
    - uses: actions/checkout@v3

    # Set Repository Name As Env Variable
    - name: Set repository name as env variable
      run: echo "repository_name=$(echo '${{ github.repository }}' | awk -F '/' '{print $2}')" >> $GITHUB_ENV

    - name: Set Up JDK
      uses: actions/setup-java@v3
      with:
        distribution: 'zulu' # See 'Supported distributions' for available options
        java-version: '17'
        cache: 'gradle'

    - name: Change wrapper permissions
      run: chmod +x ./gradlew

    - name: Decode Keystore
      id: decode_keystore
      uses: timheuer/base64-to-file@v1
      with:
        fileName: 'dhis_keystore.jks'
        encodedString: ${{ secrets.KEYSTORE }}
    - name: build prod
      run: ./gradlew app:assembleDhisRelease
      env:
        SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
        SIGNING_KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
        SIGNING_KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
        SIGNING_STORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
        SIGNING_KEYSTORE_PATH: ${{ steps.decode_keystore.outputs.filePath }}

    - name: Read version name from file
      working-directory: ./gradle
      id: read-version
      run: echo "::set-output name=vName::$(grep 'vName' libs.versions.toml | awk -F' = ' '{print $2}' | tr -d '"')"

    # Upload Artifact Build
    - name: Upload Android artifacts
      uses: actions/upload-artifact@v3
      with:
        name: ${{ env.repository_name }} - Android APK
        path: ${{ env.main_project_module }}/build/outputs/apk/dhis/release/dhis2-v${{ steps.read-version.outputs.vName }}.apk


Continuous Delivery

name: Continuous Delivery

env:

  main_project_module: app

on:
  workflow_dispatch:
  push:
    branches:
      - main
      - develop
      - release/*

jobs:
  deployment_job:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Set Current Date
      - name: Set current date
        id: date
        run: echo "date=$(date +'%Y-%m-%d')" >> "$GITHUB_OUTPUT"

      # Set Repository Name As Env Variable
      - name: Set repository name as env variable
        run: echo "repository_name=$(echo '${{ github.repository }}' | awk -F '/' '{print $2}')" >> $GITHUB_ENV

      - name: Set Up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: '17'
          cache: 'gradle'

      - name: Change wrapper permissions
        run: chmod +x ./gradlew

      # Create APK Debug
      - name: Build apk debug project (APK) - ${{ env.main_project_module }} module
        run: ./gradlew assembleDhisDebug

      - name: Read version name from file
        working-directory: ./gradle
        id: read-version
        run: echo "vName=$(grep 'vName' libs.versions.toml | awk -F' = ' '{print $2}' | tr -d '"')" >> "$GITHUB_OUTPUT"

      # Upload Artifact Build
      - name: Upload Android artifacts
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.repository_name }} - Android APK - ${{ steps.date.outputs.date }}
          path: ${{ env.main_project_module }}/build/outputs/apk/dhis/debug/dhis2-v${{ steps.read-version.outputs.vName }}-training.apk


Continuous Integration

name: Continuous Integration

env:
  # The name of the main module repository
  main_project_module: app

on:
  push:
    branches:
     - main
     - develop
     - release/*
  pull_request:
    branches:
     - main
     - develop
     - release/*

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

jobs:
  ci_job:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Set Up JDK
        uses: actions/setup-java@v3
        with:
          distribution: 'zulu' # See 'Supported distributions' for available options
          java-version: '17'
          cache: 'gradle'

      - name: Change wrapper permissions
        run: chmod +x ./gradlew

      # Run check style
      - name: Kotlin checkstyle
        run: ./gradlew ktlintCheck

      # Running unit tests on app module
      - name: Run app module tests
        run: ./gradlew :app:testDhisDebugUnitTest

      # Running unit tests on all other modules
      - name: Run all modules tests
        run: ./gradlew testDebugUnitTest

      # Run Build Project
      #- name: Build gradle project
       # run: ./gradlew build

  deployment_job:
    runs-on: ubuntu-latest
    needs: ci_job
    if: github.event_name == 'pull_request' && needs.ci_job.result == 'success'
    steps:
      - uses: actions/checkout@v3

      # Set Current Date As Env Variable
      - name: Set current date as env variable
        run: echo "date_today=$(date +'%Y-%m-%d')" >> $GITHUB_ENV

      # Set Repository Name As Env Variable
      - name: Set repository name as env variable
        run: echo "repository_name=$(echo '${{ github.repository }}' | awk -F '/' '{print $2}')" >> $GITHUB_ENV

      - name: Set Up JDK
        uses: actions/setup-java@v3
        with:
          distribution: 'zulu' # See 'Supported distributions' for available options
          java-version: '17'
          cache: 'gradle'

      - name: Change wrapper permissions
        run: chmod +x ./gradlew

      # Create APK Debug
      - name: Build apk debug project (APK) - ${{ env.main_project_module }} module
        run: ./gradlew assembleDhisDebug

      - name: Read version name from file
        working-directory: ./gradle
        id: read-version
        run: echo "::set-output name=vName::$(grep 'vName' libs.versions.toml | awk -F' = ' '{print $2}' | tr -d '"')"

      # Upload Artifact Build
      - name: Upload Android artifacts
        uses: actions/upload-artifact@v3
        with:
          name: ${{ env.repository_name }} - Android APK
          path: ${{ env.main_project_module }}/build/outputs/apk/dhis/debug/dhis2-v${{ steps.read-version.outputs.vName }}-training.apk


Deploy Release

name: Deploy Release

env:
  main_project_module: app

on:
  workflow_dispatch:
    inputs:
      github_release:
        description: 'enable github release'
        required: true
        type: boolean
      google_play_release:
        description: 'enable google play release'
        required: true
        type: boolean
      release_tag_name:
        description: 'tag'
        required: true
        type: string
      is_patch:
        description: 'Is the new version a patch'
        required: true
        type: boolean
        default: false

jobs:
  Build-Apk:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - name: Set repository name as env variable
      run: echo "repository_name=$(echo '${{ github.repository }}' | awk -F '/' '{print $2}')" >> $GITHUB_ENV
    - name: Read version name from file
      working-directory: ./gradle
      id: read-version
      run: echo "::set-output name=vName::$(grep 'vName' libs.versions.toml | awk -F' = ' '{print $2}' | tr -d '"')"
    - name: Set Up JDK
      uses: actions/setup-java@v3
      with:
        distribution: 'zulu' # See 'Supported distributions' for available options
        java-version: '17'
        cache: 'gradle'
    - name: Change wrapper permissions
      run: chmod +x ./gradlew
    - name: Decode Keystore
      id: decode_keystore
      uses: timheuer/base64-to-file@v1
      with:
        fileName: 'dhis_keystore.jks'
        encodedString: ${{ secrets.KEYSTORE }}
    - name: Build release apk
      run: ./gradlew app:assembleRelease app:assembleDhisDebug
      env:
        SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
        SIGNING_KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
        SIGNING_KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
        SIGNING_STORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
        SIGNING_KEYSTORE_PATH: ${{ steps.decode_keystore.outputs.filePath }}

    - name: Upload to Play Store
      if: ${{ inputs.google_play_release }}
      uses: r0adkll/upload-google-play@v1
      with:
        serviceAccountJsonPlainText: ${{ secrets.SERVICE_ACCOUNT_JSON }}
        packageName: com.dhis2
        releaseFiles: ${{ env.main_project_module }}/build/outputs/apk/dhisPlayServices/release/dhis2-v${{ steps.read-version.outputs.vName }}-googlePlay.apk
        track: alpha
        whatsNewDirectory: whatsnew

    - name: Github Patch Release
      if: ${{ (inputs.github_release == true) && (inputs.is_patch == true) }}
      uses: ncipollo/release-action@v1
      with:
        allowUpdates: true
        draft: true
        generateReleaseNotes: true
        name: "Android Capture App for DHIS 2 (v${{ inputs.release_tag_name }}) - Patch version"
        tag: ${{ inputs.release_tag_name }}
        artifacts: ${{ env.main_project_module }}/build/outputs/apk/dhis/release/dhis2-v${{ steps.read-version.outputs.vName }}.apk,${{ env.main_project_module }}/build/outputs/apk/dhisPlayServices/release/dhis2-v${{ steps.read-version.outputs.vName }}-googlePlay.apk,${{ env.main_project_module }}/build/outputs/apk/dhis/debug/dhis2-v${{ steps.read-version.outputs.vName }}-training.apk

    - name: Github New Release
      if: ${{ (inputs.github_release == true) && (inputs.is_patch == false) }}
      uses: ncipollo/release-action@v1
      with:
        allowUpdates: true
        draft: true
        bodyFile: "RELEASE.md"
        name: "Android Capture App for DHIS 2 (v${{ inputs.release_tag_name }})"
        tag: ${{ inputs.release_tag_name }}
        artifacts: ${{ env.main_project_module }}/build/outputs/apk/dhis/release/dhis2-v${{ steps.read-version.outputs.vName }}.apk,${{ env.main_project_module }}/build/outputs/apk/dhisPlayServices/release/dhis2-v${{ steps.read-version.outputs.vName }}-googlePlay.apk,${{ env.main_project_module }}/build/outputs/apk/dhis/debug/dhis2-v${{ steps.read-version.outputs.vName }}-training.apk


Publish libraries

# This is a basic workflow that is manually triggered

name: Publish libraries

# Controls when the action will run. Workflow runs when manually triggered using the UI
# or API.
on:
  workflow_dispatch:
    # Inputs the workflow accepts.
    inputs:
      name:
        # Friendly description to be shown in the UI instead of 'name'
        description: 'Person to greet'
        # Default value if no value is explicitly provided
        default: 'World'
        # Input has to be provided for the workflow to run
        required: true
        # The data type of the input
        type: string

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  # This workflow contains a single job called "greet"
  greet:
    # The type of runner that the job will run on
    runs-on: ubuntu-latest

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
    # Runs a single command using the runners shell
    - name: Send greeting
      run: echo "Hello ${{ inputs.name }}"


Generate notes

name: Generate notes

on:
  workflow_dispatch:
    # Inputs the workflow accepts.
    inputs:
      filter_id:
        description: 'Please, provide the Jira filter id'
        required: true
        type: string

env:
  FILTER_ID: ${{ inputs.filter_id }}

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  generate_notes:
    runs-on: ubuntu-latest

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:

      - uses: actions/checkout@v3
      # Generate github release notes
      - name: Generate release notes
        working-directory: ./scripts
        run: python3 generateReleaseNotes.py

      - name: setup git config
        run: |
          # setup the username and email.
          git config user.name "GitHub Actions Bot"
          git config user.email "<android@dhis2.org>"

      - name: Commit changes
        run: |
          # Commit and push
          git commit -am "Update release notes"
          git push


Release start

# This is a basic workflow that is manually triggered

name: Release start

# Controls when the action will run. Workflow runs when manually triggered using the UI
# or API.
on:
  workflow_dispatch:
    # Inputs the workflow accepts.
    inputs:
      release_version_name:
        description: 'New release version name'
        required: true
        type: string

      development_version_name:
        description: 'Development version name'
        required: true
        type: string

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  create_branch:
    # The type of runner that the job will run on
    runs-on: ubuntu-latest

    steps:
    - name: Check out code
      uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: 3.12.1

    - name: setup git config
      run: |
        # setup the username and email.
        git config user.name "GitHub Actions Bot"
        git config user.email "<android@dhis2.org>"

      # override vName with new version
    - name: Create release branch
      run: git checkout -b release/${{ inputs.release_version_name }}

    - name: Run Python script to update release branch version
      run: python scripts/updateVersionName.py ${{ inputs.release_version_name }}

    - name: Push
      run: |
        git add .
        git commit -m "Update version to ${{ inputs.release_version_name }}"
        git push origin release/${{ inputs.release_version_name }}

  update_version:
    # The type of runner that the job will run on
    runs-on: ubuntu-latest

    steps:
      - name: Check out code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: 3.12.1

      - name: setup git config
        run: |
          # setup the username and email.
          git config user.name "GitHub Actions Bot"
          git config user.email "<android@dhis2.org>"

      - name: Create release branch
        run: git checkout -b update_version_to${{ inputs.development_version_name }}

      - name: Run Python script to update base branch version
        run: python scripts/updateVersionName.py ${{ inputs.development_version_name }}

      - name: Commit and Push Changes
        run: |
          git add .
          git commit -m "Update version to ${{ inputs.development_version_name }}"
          git push origin update_version_to${{ inputs.development_version_name }}

      - name: create pull request
        run: gh pr create -B develop -H update_version_to${{ inputs.development_version_name }} --title 'Merge update_version_to${{ inputs.development_version_name }} into develop' --body 'Created by Github action'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}


Reposilite CI

# GitHub Actions workflow to automatically build and test Reposilite.
name: "Reposilite CI"

on:
  push:
    branches: [ "main", "3.0" ]
  pull_request:
    branches: [ "main", "3.0" ]

jobs:
  build:
    name: "Build with JDK ${{ matrix.java-version }}"
    runs-on: ubuntu-latest
    strategy:
      matrix:
        # Use 11 LTS releases and the latest one
        java-version: [ 11, 21 ]
    steps:
    - name: "Checkout repository"
      uses: actions/checkout@v3

    - name: "Fetch git tags" # Required for axion-release-plugin
      run: git fetch --tags --unshallow

    - name: "Validate gradle wrapper"
      uses: gradle/wrapper-validation-action@v1

    - name: "Set up Java ${{ matrix.java-version }}"
      uses: actions/setup-java@v3
      with:
        java-version: "${{ matrix.java-version }}"
        distribution: "liberica"

    - name: "Grant execute permission for gradlew"
      run: chmod +x gradlew

    - name: "Gradle build"
      uses: gradle/gradle-build-action@v2
      with:
        arguments: ":reposilite-backend:testCoverage"

    - name: "Upload coverage to Codecov"
      uses: codecov/codecov-action@v2
      with:
        files: "./reposilite-backend/build/reports/jacoco/reposilite-backend-report.xml"
        fail_ci_if_error: false


Publish releases

# GitHub Actions workflow to publish new releases.
name: "Publish releases"
on: workflow_dispatch

env:
  JAVA_VERSION: 21

jobs:
  github:
    name: "GitHub"
    runs-on: ubuntu-latest
    permissions:
      contents: write
    outputs:
      version: "${{ steps.version.outputs.version }}"
    steps:
      - name: "Checkout repository"
        uses: actions/checkout@v3

      - name: "Fetch git tags" # Required for axion-release-plugin
        run: git fetch --tags --unshallow

      - name: "Set up Java ${{ env.JAVA_VERSION }}"
        uses: actions/setup-java@v3
        with:
          java-version: "${{ env.JAVA_VERSION }}"
          distribution: "liberica"

      - name: "Grant execute permission for gradlew"
        run: chmod +x gradlew

      - name: "Release new version"
        run: |
          git config user.name 'github-actions[bot]'
          git config user.email 'github-actions[bot]@users.noreply.github.com'
          ./gradlew release

      - name: "Get current version"
        id: version
        run: echo "::set-output name=version::$(./gradlew -q -Prelease.quiet cV)"

  maven:
    name: "Maven"
    runs-on: ubuntu-latest
    needs: [ github ]
    steps:
      - name: "Checkout repository"
        uses: actions/checkout@v3
        with:
          ref: "refs/tags/${{ needs.github.outputs.version }}"

      - name: "Fetch git tags" # Required for axion-release-plugin
        run: git fetch --tags --unshallow

      - name: "Set up Java ${{ env.JAVA_VERSION }}"
        uses: actions/setup-java@v3
        with:
          java-version: "${{ env.JAVA_VERSION }}"
          distribution: "adopt"

      - name: "Grant execute permission for gradlew"
        run: chmod +x gradlew

      - name: "Gradle publish"
        uses: gradle/gradle-build-action@v2
        with:
          arguments: "shadowJar publish"
        env:
          MAVEN_NAME: ${{ secrets.MAVEN_NAME }}
          MAVEN_TOKEN: ${{ secrets.MAVEN_TOKEN }}

  docker:
    name: "Docker"
    runs-on: ubuntu-latest
    needs: [ github ]
    steps:
      - name: "Checkout repository"
        uses: actions/checkout@v3
        with:
          ref: "refs/tags/${{ needs.github.outputs.version }}"

      - name: "Fetch git tags" # Required for axion-release-plugin
        run: git fetch --tags --unshallow

      - name: "Set up QEMU"
        uses: docker/setup-qemu-action@v2

      - name: "Set up Docker Buildx"
        uses: docker/setup-buildx-action@v2

      - name: "Login to DockerHub"
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: "Login to GitHub Container Registry"
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: "Build and push"
        id: docker_build
        uses: docker/build-push-action@v3
        with:
          context: .
          platforms: "linux/amd64,linux/arm64"
          push: true
          tags: |
            dzikoysk/reposilite:latest
            dzikoysk/reposilite:${{ needs.github.outputs.version }}
            ghcr.io/dzikoysk/reposilite:latest
            ghcr.io/dzikoysk/reposilite:${{ needs.github.outputs.version }}


Publish snapshots

# GitHub Actions workflow to automatically publish snapshot builds.
name: "Publish snapshots"
on:
  push:
    branches: [ "main" ]

env:
  JAVA_VERSION: 21

jobs:
  maven:
    name: "Maven"
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout repository"
        uses: actions/checkout@v3

      - name: "Fetch git tags" # Required for axion-release-plugin
        run: git fetch --tags --unshallow

      - name: "Set up Java ${{ env.JAVA_VERSION }}"
        uses: actions/setup-java@v3
        with:
          java-version: "${{ env.JAVA_VERSION }}"
          distribution: "liberica"

      - name: "Grant execute permission for gradlew"
        run: chmod +x gradlew

      - name: "Gradle publish"
        uses: gradle/gradle-build-action@v2
        with:
          arguments: "shadowJar publish"
        env:
          MAVEN_NAME: ${{ secrets.MAVEN_NAME }}
          MAVEN_TOKEN: ${{ secrets.MAVEN_TOKEN }}

  docker:
    name: "Docker"
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout repository"
        uses: actions/checkout@v3

      - name: "Fetch Git tags" # Required for axion-release-plugin
        run: git fetch --tags --unshallow

      - name: "Set up QEMU"
        uses: docker/setup-qemu-action@v2

      - name: "Set up Docker Buildx"
        uses: docker/setup-buildx-action@v2

      - name: "Login to DockerHub"
        uses: docker/login-action@v2
        with:
          username: "${{ secrets.DOCKERHUB_USERNAME }}"
          password: "${{ secrets.DOCKERHUB_TOKEN }}"

      - name: "Login to GitHub Container Registry"
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: "${{ github.repository_owner }}"
          password: "${{ secrets.GITHUB_TOKEN }}"

      - name: "Build and push"
        id: docker_build
        uses: docker/build-push-action@v3
        with:
          context: .
          push: true
          tags: |
            dzikoysk/reposilite:nightly
            ghcr.io/dzikoysk/reposilite:nightly


build

name: build

on:
  pull_request:
    branches:
      - master

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  build:
    timeout-minutes: 20
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK
        uses: actions/setup-java@v3
        with:
          distribution: 'temurin'
          java-version: 17

      - name: Setup Gradle
        uses: gradle/gradle-build-action@v2

      - name: Set up Nodejs
        uses: actions/setup-node@v3
        with:
          node-version: 20

      - name: Grant execute permission for gradlew
        run: chmod +x gradlew

      - name: Build with Gradle
        run: ./gradlew build

      - name: Archive test-results
        if: always()
        uses: actions/upload-artifact@v1.0.0
        with:
          name: Test-Results
          path: core/build/reports/tests/allTests

      - name: Archive server log
        if: always()
        uses: actions/upload-artifact@v1.0.0
        with:
          name: Server-Logs
          path: test-server/build/server.log

      - name: Install Node
        uses: actions/setup-node@v3
        with:
          node-version: 18

      - name: Find
        run: find .

      - name: Install dependencies
        run: npm ci
        working-directory: ./headless-demo

      - name: Install Playwright Browsers
        run: npx playwright install --with-deps
        working-directory: ./headless-demo

      - name: Run Playwright tests
        run: npx playwright test
        working-directory: ./headless-demo

      - name: Upload Playwright Results
        uses: actions/upload-artifact@v3
        if: always()
        with:
          name: playwright-report
          path: headless-demo/playwright-report/
          retention-days: 30

      - name: Build with 11ty
        working-directory: ./www
        run: export NODE_OPTIONS=--openssl-legacy-provider && npm install && npm run build

  update_api:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK
        uses: actions/setup-java@v3
        with:
          distribution: 'temurin'
          java-version: 17

      - name: Setup Gradle
        uses: gradle/gradle-build-action@v2

      - name: Grant execute permission for gradlew
        run: chmod +x gradlew

      - name: Dump API
        run: ./gradlew apiDump

      - name: Commit new API files
        uses: stefanzweifel/git-auto-commit-action@v4
        with:
          commit_message: Update API files
          file_pattern: "**/api/*.api"


publish libs

name: publish libs

on:
  push:
    branches:
      - master

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4

    - name: Set up JDK
      uses: actions/setup-java@v3
      with:
        distribution: 'temurin'
        java-version: 17

    - name: Setup Gradle
      uses: gradle/gradle-build-action@v2

    - name: Grant execute permission for gradlew
      run: chmod +x gradlew

    - name: Build with Gradle
      run: ./gradlew build

    - name: Archive test-results
      if: always()
      uses: actions/upload-artifact@v1.0.0
      with:
        name: Test-Results
        path: core/build/reports/tests/allTests

    - name: Archive server log
      if: always()
      uses: actions/upload-artifact@v1.0.0
      with:
        name: Server-Logs
        path: test-server/build/server.log

    - name: Publish with Gradle
      run: ./gradlew publish
      env: # Or as an environment variable
        GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}
        GPG_SIGNING_PASSPHRASE: ${{ secrets.GPG_SIGNING_PASSPHRASE }}
        OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
        OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}


release

name: release

on:
  release:
    types: [published]

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK
        uses: actions/setup-java@v3
        with:
          distribution: 'temurin'
          java-version: 17

      - name: Setup Gradle
        uses: gradle/gradle-build-action@v2

      - name: Grant execute permission for gradlew
        run: chmod +x gradlew

      - name: Publish with Gradle
        run: ./gradlew publish
        env: # Or as an environment variable
          GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}
          GPG_SIGNING_PASSPHRASE: ${{ secrets.GPG_SIGNING_PASSPHRASE }}
          OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
          OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}

      - name: Set up Nodejs
        uses: actions/setup-node@v3
        with:
          node-version: 20

      - name: Generating API docs
        run: ./gradlew dokkaHtmlMultiModule

      - name: Build Demos
        run: ./gradlew build metadataToWww

      - name: Build Webpage
        working-directory: ./www
        run: export NODE_OPTIONS=--openssl-legacy-provider && npm install && npm run build

      - name: Copy api docs to webpage
        run: mkdir -p ./www/_site/api && cp -r ./api/* ./www/_site/api

      - name: Copy headless-demo files to webpage
        run: mkdir -p ./www/_site/headless-demo && cp ./headless-demo/build/dist/js/productionExecutable/* ./www/_site/headless-demo

      - name: Copy snippets files to webpage
        run: mkdir -p ./www/_site/snippets && cp ./snippets/build/dist/js/productionExecutable/* ./www/_site/snippets

      - name: Copy example distributions to webpage
        run: >
          for directory in `ls ./examples/* -d`; do
            name=`basename $directory`;
            mkdir -p ./www/_site/examples/$name;
            cp ./examples/$name/build/dist/js/productionExecutable/* ./www/_site/examples/$name;
          done

      - name: Releasing www page
        if: success()
        uses: crazy-max/ghaction-github-pages@v2
        with:
          repo: jwstegemann/fritz2-web
          target_branch: master
          keep_history: false
          jekyll: false
          fqdn: www.fritz2.dev
          build_dir: ./www/_site
        env:
          GH_PAT: ${{ secrets.FRITZ2_WEB_TOKEN }}


publish www

name: publish www

on:
  workflow_dispatch:
  workflow_call:
  push:
    branches:
      - master

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK
        uses: actions/setup-java@v3
        with:
          distribution: 'temurin'
          java-version: 17

      - name: Setup Gradle
        uses: gradle/gradle-build-action@v2

      - name: Set up Nodejs 20
        uses: actions/setup-node@v3
        with:
          node-version: 20

      - name: Grant execute permission for gradlew
        run: chmod +x gradlew

      - name: Generating API docs
        run: ./gradlew dokkaHtmlMultiModule

      - name: Build Demos
        run: ./gradlew build metadataToWww

      - name: Build Webpage
        working-directory: ./www
        run: export NODE_OPTIONS=--openssl-legacy-provider && npm install && npm run build

      - name: Copy api docs to webpage
        run: mkdir -p ./www/_site/api && cp -r ./api/* ./www/_site/api

      - name: Copy headless-demo files to webpage
        run: mkdir -p ./www/_site/headless-demo && cp ./headless-demo/build/dist/js/productionExecutable/* ./www/_site/headless-demo

      - name: Copy snippets files to webpage
        run: mkdir -p ./www/_site/snippets && cp ./snippets/build/dist/js/productionExecutable/* ./www/_site/snippets

      - name: Copy example distributions to webpage
        run: >
          for directory in `ls ./examples/* -d`; do
            name=`basename $directory`;
            mkdir -p ./www/_site/examples/$name;
            cp ./examples/$name/build/dist/js/productionExecutable/* ./www/_site/examples/$name;
          done

      - name: Deploy to GitHub Pages
        if: success()
        uses: crazy-max/ghaction-github-pages@v2
        with:
          target_branch: gh-pages
          jekyll: false
          fqdn: next.fritz2.dev
          build_dir: ./www/_site
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


CI

name: CI

on:
  pull_request:
    paths-ignore:
      - '.idea/**'
      - '.github/ISSUE_TEMPLATE/**'
      - '.gitattributes'
      - '.gitignore'
      - '*.md'
      - 'LICENSE'
      - 'custom-game-area/**'
      - 'wiki/**'
  push:
    branches:
      - master
    paths-ignore:
      - '.idea/**'
      - '.github/**'
      - '.gitattributes'
      - '.gitignore'
      - '*.md'
      - 'LICENSE'
      - 'renovate.json'
      - 'custom-game-area/**'
      - 'FUNDING.yml'
      - 'wiki/**'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  JAVA_VERSION: 17
  JAVA_DISTRO: 'temurin'
  VERSION_CODE: '${{ github.run_number }}'

jobs:
  build:
    runs-on: macos-14
    if: github.ref != 'refs/heads/master'
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: ${{ env.JAVA_VERSION }}
          distribution: ${{ env.JAVA_DISTRO }}
          cache: 'gradle'

      - name: Determine Version Name
        shell: bash
        run: |
          VERSION_NAME=$VERSION_CODE
          echo "FGA_VERSION_CODE=$VERSION_CODE" >>${GITHUB_ENV}
          echo "FGA_VERSION_NAME=$VERSION_NAME" >>${GITHUB_ENV}

      - name: Build Android Package
        run: ./gradlew assembleCi --scan --parallel --no-daemon

      - name: Upload APK
        uses: actions/upload-artifact@v4
        with:
          name: apk
          path: app/build/outputs/apk/ci/app-ci.apk

      - name: Upload De-obfuscation mapping file
        uses: actions/upload-artifact@v4
        with:
          name: mapping-ci
          path: app/build/outputs/mapping/ci/mapping.txt

  play_store:
    runs-on: macos-14
    if: github.ref == 'refs/heads/master'
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: ${{ env.JAVA_VERSION }}
          distribution: ${{ env.JAVA_DISTRO }}
          cache: 'gradle'

      - name: Determine Version Name
        shell: bash
        run: |
          VERSION_NAME=$VERSION_CODE
          echo "FGA_VERSION_CODE=$VERSION_CODE" >>${GITHUB_ENV}
          echo "FGA_VERSION_NAME=$VERSION_NAME" >>${GITHUB_ENV}

      - name: Decrypt keystore (GPG)
        env:
          GPG_KEYSTORE: ${{ secrets.GPG_KEYSTORE }}
        working-directory: ./app
        run: gpg --quiet --batch --yes --decrypt --passphrase="$GPG_KEYSTORE" --output fgautomata.keystore fgautomata.keystore.gpg

      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.2'
          bundler-cache: true

      - name: Deploy to Play Store
        uses: maierj/fastlane-action@v3.1.0
        with:
          lane: 'deploy'
        env:
          SUPPLY_JSON_KEY_DATA: ${{ secrets.SERVICE_ACCOUNT_NEW_APP }}
          KEYSTORE_PASS: ${{ secrets.KEYSTORE_PASS }}

      - name: Upload Bundle
        uses: actions/upload-artifact@v4
        with:
          name: bundle
          path: app/build/outputs/bundle/release/app-release.aab

      - name: Upload De-obfuscation mapping file
        uses: actions/upload-artifact@v4
        with:
          name: mapping-release
          path: app/build/outputs/mapping/release/mapping.txt

  # Release master branch
  github_release:
    needs: play_store
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/master'
    steps:
      - uses: actions/checkout@v4
      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.2'
          bundler-cache: true
      - name: Download Universal APK
        uses: maierj/fastlane-action@v3.1.0
        with:
          lane: 'download_apk'
          options: '{ "version_code": "$VERSION_CODE" }'
        env:
          SUPPLY_JSON_KEY_DATA: ${{ secrets.SERVICE_ACCOUNT_NEW_APP }}
      - name: zip APK
        run: zip FGA-apk-${VERSION_CODE}.zip *.apk
      - name: Create tag
        uses: mathieudutour/github-tag-action@v6.2
        with:
          custom_tag: ${{ env.VERSION_CODE }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
      - name: Create release
        uses: ncipollo/release-action@v1.14.0
        with:
          generateReleaseNotes: true
          artifacts: 'FGA-apk-${{ env.VERSION_CODE }}.zip'
          tag: 'v${{ env.VERSION_CODE }}'
          name: 'FGA ${{ env.VERSION_CODE }}'
          prerelease: true


Close issues with insufficient info

name: Close issues with insufficient info
on:
  issues:
    types: [opened]
jobs:
  labelCheck:
    if: >-
          github.event.issue.user.id != 10654537 && github.event.issue.user.id != 12360257 &&
          join(github.event.issue.labels) == ''
    runs-on: ubuntu-latest
    steps:
      - name: Close Issue
        uses: peter-evans/close-issue@v3
        with:
          comment: |
            It seems like you have not used one of the issue templates when creating this issue.

            Please go back to [this page](https://github.com/Fate-Grand-Automata/FGA/issues/new/choose) and create a new issue.

            This action was performed automatically.
      - name: Lock Issue
        uses: OSDKDev/lock-issues@v1.1
        with:
          repo-token: "${{ secrets.GITHUB_TOKEN }}"
      - name: Label Issue
        uses: actions-ecosystem/action-add-labels@v1
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          labels: insufficient info


Publish wiki

name: Publish wiki

on:
  push:
    branches:
      - master
    paths:
      - 'wiki/**'
      - '.github/workflows/publish-wiki.yml'
  workflow_dispatch:

concurrency:
  group: publish-wiki
  cancel-in-progress: true
permissions:
  contents: write
jobs:
  publish-wiki:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: Andrew-Chen-Wang/github-wiki-action@v4


Build

name: Build

on:
  push:
    branches: [master]

jobs:
  publish:
    name: Build the artifacts
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Check out code
        uses: actions/checkout@v4
        with:
          submodules: true
          token: ${{ secrets.PAT_GITHUB }}

      - name: Get Renderer ref
        id: renderer-ref
        run: echo "REF_VALUE=$(cat .rive_renderer)" >> $GITHUB_OUTPUT

      - name: Rive Renderer Repo
        uses: actions/checkout@v4
        with:
          submodules: true
          repository: ${{ secrets.RIVE_RENDERER_REPO }}
          token: ${{ secrets.PAT_GITHUB }}
          path: ./submodules/pls
          ref: ${{ steps.renderer-ref.outputs.REF_VALUE }}

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v2
        with:
          aws-region: us-west-2
          role-to-assume: ${{ secrets.ACTIONS_ROLE }}

      - name: Update Java
        uses: actions/setup-java@v4
        with:
          distribution: "zulu"
          java-version: "17"

      - name: Setup Android SDK
        uses: android-actions/setup-android@v3

      - name: Install NDK & tools
        # Starts from: pwd => /home/runner/work/rive/rive
        # ANDROID_HOME => /usr/local/lib/android/sdk
        run: |
          set -x
          echo "y" | sdkmanager --install 'build-tools;34.0.0' platform-tools --sdk_root=${ANDROID_SDK_ROOT}
          cd ${ANDROID_HOME}
          wget -q https://dl.google.com/android/repository/android-ndk-r25b-linux.zip
          unzip -q android-ndk-r25b-linux.zip
          echo "y" | sdkmanager --install 'cmake;3.22.1' --channel=0 --sdk_root=${ANDROID_SDK_ROOT}

      - name: Installing pre-requisites
        run: |
          set -x
          # Install some dependencies & premake5
          sudo apt update && sudo apt-get -y install clang libgl1-mesa-dev libvorbis-dev libvpx-dev ninja-build python3-pip
          wget -q https://github.com/premake/premake-core/releases/download/v5.0.0-alpha15/premake-5.0.0-alpha15-linux.tar.gz
          tar -xf premake-5.0.0-alpha15-linux.tar.gz
          sudo mv premake5 /usr/local/bin

      - name: Build Android
        env:
          # ANDROID_SDK_ROOT has been in the env by 'setup-android' above
          #   and is => /usr/local/lib/android/sdk
          NDK_PATH: ${{ env.ANDROID_SDK_ROOT }}/android-ndk-r25b
        run: ./gradlew kotlin:assembleRelease


Release

name: Release

on:
  workflow_dispatch:
    inputs:
      major:
        description: "Major"
        type: boolean
        default: false
      minor:
        description: "Minor"
        type: boolean
        default: false

jobs:
  publish:
    name: Release build and publish
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Check out code
        uses: actions/checkout@v4
        with:
          submodules: true
          token: ${{ secrets.PAT_GITHUB }}

      - name: Get Renderer ref
        id: renderer-ref
        run: echo "REF_VALUE=$(cat .rive_renderer)" >> $GITHUB_OUTPUT

      - name: Rive Renderer Repo
        uses: actions/checkout@v4
        with:
          submodules: true
          repository: ${{ secrets.RIVE_RENDERER_REPO }}
          token: ${{ secrets.PAT_GITHUB }}
          path: ./submodules/pls
          ref: ${{ steps.renderer-ref.outputs.REF_VALUE }}

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v2
        with:
          aws-region: us-west-2
          role-to-assume: ${{ secrets.ACTIONS_ROLE }}

      - name: Update Java
        uses: actions/setup-java@v4
        with:
          distribution: "zulu"
          java-version: "17"

      - name: Setup Android SDK
        uses: android-actions/setup-android@v3

      - name: Install NDK & tools
        # Starts from: pwd => /home/runner/work/rive/rive
        # ANDROID_HOME => /usr/local/lib/android/sdk
        run: |
          set -x
          echo "y" | sdkmanager --install 'build-tools;34.0.0' platform-tools --sdk_root=${ANDROID_SDK_ROOT}
          cd ${ANDROID_HOME}
          wget -q https://dl.google.com/android/repository/android-ndk-r25b-linux.zip
          unzip -q android-ndk-r25b-linux.zip
          echo "y" | sdkmanager --install 'cmake;3.22.1' --channel=0 --sdk_root=${ANDROID_SDK_ROOT}

      - name: Installing pre-requisites
        run: |
          set -x
          # Install some dependencies & premake5
          sudo apt update && sudo apt-get -y install clang libgl1-mesa-dev libvorbis-dev libvpx-dev ninja-build python3-pip
          wget -q https://github.com/premake/premake-core/releases/download/v5.0.0-alpha15/premake-5.0.0-alpha15-linux.tar.gz
          tar -xf premake-5.0.0-alpha15-linux.tar.gz
          sudo mv premake5 /usr/local/bin
          pip3 install ply

      # Base64 decodes and pipes the GPG key content into the secret file
      - name: Prepare environment
        env:
          GPG_KEY_CONTENTS: ${{ secrets.GPG_KEY_CONTENTS }}
          SIGNING_SECRET_KEY_RING_FILE: ${{ secrets.SIGNING_SECRET_KEY_RING_FILE }}
        run: |
          git fetch --unshallow
          sudo bash -c "echo '$GPG_KEY_CONTENTS' | base64 -d > '$SIGNING_SECRET_KEY_RING_FILE'"

      # Run release it
      - name: Install dependencies
        run: npm ci
        working-directory: ./.github/scripts/release
      - name: Git config
        run: |
          git config --local user.email 'hello@rive.app'
          git config --local user.name ${{ github.actor }}

      - if: ${{ inputs.major == true }}
        name: Major Release - Bump version number, update changelog, push and tag
        run: npm run release -- major --ci
        working-directory: ./.github/scripts/release
        env:
          GITHUB_TOKEN: ${{ secrets.RIVE_REPO_PAT }}
      - if: ${{inputs.major == false && inputs.minor == true}}
        name: Minor release - Bump version number, update changelog, push and tag
        run: npm run release -- minor --ci
        working-directory: ./.github/scripts/release
        env:
          GITHUB_TOKEN: ${{ secrets.RIVE_REPO_PAT }}
      - if: ${{inputs.major == false && inputs.minor == false}}
        name: Build release - Bump version number, update changelog, push and tag
        run: npm run release -- --ci
        working-directory: ./.github/scripts/release
        env:
          GITHUB_TOKEN: ${{ secrets.RIVE_REPO_PAT }}

      # Builds the release artifacts of the library, this depends on the TAGs set in release-it
      - name: Build Android
        env:
          # ANDROID_SDK_ROOT has been in the env by 'setup-android' above
          #   and is => /usr/local/lib/android/sdk
          NDK_PATH: ${{ env.ANDROID_SDK_ROOT }}/android-ndk-r25b
        run: ./gradlew kotlin:assembleRelease

      # Runs upload, and then closes & releases the repository
      - name: Publish to MavenCentral
        run: ./gradlew publishAllPublicationsToSonatypeRepository --max-workers 1 closeAndReleaseSonatypeStagingRepository
        env:
          UAT_OSSRH_USERNAME: ${{ secrets.UAT_OSSRH_USERNAME }}
          UAT_OSSRH_PASSWORD: ${{ secrets.UAT_OSSRH_PASSWORD }}
          # TODO: remove these after UAT is confirmed working
          OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
          OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
          # ====
          SIGNING_KEY_ID: ${{ secrets.SIGNING_KEY_ID }}
          SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
          SIGNING_SECRET_KEY_RING_FILE: ${{ secrets.SIGNING_SECRET_KEY_RING_FILE }}
          SONATYPE_STAGING_PROFILE_ID: ${{ secrets.SONATYPE_STAGING_PROFILE_ID }}


Check Rive-Android sub modules

name: Check Rive-Android sub modules

on:
  # lets check it when we push to master (we've just done something in android, its a good time to see about this)
  push:
    branches:
      - master

  schedule:
    # 8am UTC every day
    - cron: '0 8 * * *'

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v2

      - name: Run cpp version check
        uses: rive-app/github-actions-submodule-check@v8
        with:
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
          SUBMODULE_GIT_URL: https://github.com/rive-app/rive-cpp.git


On PR - test recorder

name: On PR - test recorder

on:
  workflow_dispatch:
  pull_request:

jobs:
  build-android-so:
    strategy:
      matrix:
        arch: [ "x86", "x86_64", "arm64-v8a", "armeabi-v7a" ]
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout Code
        uses: actions/checkout@v3
        with:
          submodules: true
          token: ${{ secrets.PAT_GITHUB }}
      - name: Rive Renderer Repo
        uses: actions/checkout@v3
        with:
          submodules: true
          repository: ${{ secrets.RIVE_RENDERER_REPO }}
          token: ${{ secrets.PAT_GITHUB }}
          path: ./submodules/pls

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-region: us-west-2
          role-to-assume: ${{ secrets.ACTIONS_ROLE }}

      - name: Update Java
        uses: actions/setup-java@v2
        with:
          distribution: 'zulu'
          java-version: '17'

      - name: Installing pre-requisites
        run: |
          set -x
          # Install some dependencies & premake5
          sudo apt update && sudo apt-get -y install build-essential cmake wget clang g++ libgl1-mesa-dev libvorbis-dev libvpx-dev ninja-build
          wget https://github.com/premake/premake-core/releases/download/v5.0.0-alpha15/premake-5.0.0-alpha15-linux.tar.gz
          tar -xf premake-5.0.0-alpha15-linux.tar.gz
          mkdir bin
          cp premake5 bin/premake5
          sudo chmod a+x premake5
          sudo mv premake5 /usr/local/bin

      - name: Cache NDK
        id: cache-ndk
        uses: actions/cache@v3
        with:
          path: |
            ${{github.workspace}}/android-ndk-r25b
          # we are JUST going to cache for this workflow.
          # really we could cache flutter way more (based on the flutter version)
          key: android-ndk-r25b-linux
      - name: Get and Unzip NDK
        if: ${{steps.cache-ndk.outputs.cache-hit != 'true'}}
        run: |
          wget -q https://dl.google.com/android/repository/android-ndk-r25b-linux.zip
          unzip android-ndk-r25b-linux
          ls
      - name: Build rive for ${{ matrix.arch }}
        run: |
          cd cpp && ./build.rive.for.sh -c -a ${{ matrix.arch }}
        env:
          NDK_PATH: ${{github.workspace}}/android-ndk-r25b
      # NOTE: this is sneaky, we are adding multiple files from the matrix jobs into the same artifact
      - uses: actions/upload-artifact@v3
        with:
          name: android-so
          path: kotlin/src/main/jniLibs/*

  run-tests:
    needs: build-android-so
    runs-on: macos-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v2

      - name: Update Java
        uses: actions/setup-java@v2
        with:
          distribution: 'zulu'
          java-version: '17'

      - uses: actions/download-artifact@v3
        with:
          name: android-so
          path: kotlin/src/main/jniLibs/
      - name: Display structure of downloaded files
        run: ls -R
        working-directory: kotlin/src/main/jniLibs/

      - name: Test Android v30
        uses: reactivecircus/android-emulator-runner@v2
        with:
          api-level: 30
          target: google_apis
          script: ./gradlew kotlin:connectedAndroidTest app:connectedAndroidTest


Build

name: Build

on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

env:
  CARGO_TERM_COLOR: always

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Install rustfmt and clippy
        run: rustup component add rustfmt clippy

      # Cache dependencies - must be run after rustup
      - uses: Swatinem/rust-cache@v2

      - name: Lint
        run: |
          cargo fmt --all -- --check
          cargo clippy --all-features --all-targets --no-deps -- -Dwarnings

      - name: Build
        run: cargo check

      - name: Run tests
        run: cargo test


arcs-live

# An Action to build and deploy Web Arcs to https://live.arcs.dev
name: arcs-live

on:
  push:
    branches: [ master ]

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v2

      - name: Setup Node
        uses: actions/setup-node@v2-beta
        with:
          node-version: 10.x

      - name: Install dependencies
        run: npm install

      - name: Run Typescript Tests
        run: tools/sigh test --all

      - name: Run deployment preparation script
        run: tools/deploy

      - name: Deploy to Github Pages
        uses: peaceiris/actions-gh-pages@v3.7.3
        with:
          deploy_key: ${{ secrets.ACTIONS_DEPLOY_KEY }}
          external_repository: PolymerLabs/arcs-live
          publish_dir: ./
          publish_branch: master
          user_name: 'arcs-c3po'
          user_email: arcs-c3po@users.noreply.github.com
          cname: live.arcs.dev


Publish to GitHub Packages

name: Publish to GitHub Packages

on:
  release:
    types: [prereleased, released]

jobs:
  publish-release:
    runs-on: ubuntu-latest
    steps:
      - name: Setup Java
        uses: actions/setup-java@v3
        with:
          distribution: 'temurin'
          java-version: '17'

      - name: Checkout code
        uses: actions/checkout@v2

      - name: Publish artifact to GitHub Packages
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: ./gradlew -Pversion=${{ github.event.release.tag_name }} clean build -x test publish --stacktrace


Publish to Sonatype

name: Publish to Sonatype

on:
  release:
    types: [released]

jobs:
  publish-release:
    runs-on: ubuntu-latest
    steps:
      - name: Setup Java
        uses: actions/setup-java@v3
        with:
          distribution: 'temurin'
          java-version: '17'

      - name: Checkout code
        uses: actions/checkout@v2

      - name: Publish artifact to Sonatype
        env:
          SONATYPE_USER: ${{ secrets.SONATYPE_USER }}
          SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
          GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
          GPG_SECRET_KEY: ${{ secrets.GPG_SECRET_KEY }}
          GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}
        run: ./gradlew -Psonatype -Pversion=${{ github.event.release.tag_name }} clean build -x test publish


CI

name: CI

on: [push]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - name: Setup Java
        uses: actions/setup-java@v3
        with:
          distribution: 'temurin'
          java-version: '17'

      - name: Checkout code
        uses: actions/checkout@v2

      - name: Run lint
        run: ./gradlew turbo:lint

      - name: Run tests
        run: ./gradlew testRelease

      - name: Archive test results
        uses: actions/upload-artifact@v2
        if: failure()
        with:
          name: test-results-report
          path: turbo/build/reports/tests/testReleaseUnitTest


Build master

name: Build master

on:
  push:
    branches:
      - master
permissions:
  actions: read
  contents: write
  security-events: write
  packages: write
  id-token: write

jobs:
  build:
    runs-on: ubuntu-latest-4-cores
    steps:
      - name: Checkout latest code
        uses: actions/checkout@v4

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: 21
          distribution: temurin
      - name: Setup build cache
        uses: actions/cache@v4
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-

      -   name: Submit Dependency Snapshot
          uses: advanced-security/maven-dependency-submission-action@v4
          with:
            settings-file: .github/settings.xml

      - name: Build with Maven
        env:
          GITHUB_USERNAME: x-access-token
          GITHUB_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: ./mvnw  package --settings .github/settings.xml -Pgithub

  release-notes:
    runs-on: ubuntu-latest
    steps:
      - name: Release Drafter
        uses: release-drafter/release-drafter@v6
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


CodeQL

name: "CodeQL"

on:
    push:
        branches: [ "master" ]
    pull_request:
        # The branches below must be a subset of the branches above
        branches: [ "main" ]
    schedule:
        -   cron: '17 3 * * 0'

jobs:
    analyze:
        name: Analyze
        runs-on: ubuntu-latest
        permissions:
            actions: read
            contents: read
            security-events: write

        strategy:
            fail-fast: false
            matrix:
                language: [ 'java' ]

        steps:
            -   name: Checkout repository
                uses: actions/checkout@v4

            -   name: Setter opp Java 21
                uses: actions/setup-java@v4
                with:
                    java-version: 21
                    distribution: temurin
                    cache: maven

            # Initializes the CodeQL tools for scanning.
            -   name: Initialize CodeQL
                uses: github/codeql-action/init@v3
                with:
                    languages: ${{ matrix.language }}
                    queries: security-extended,security-and-quality

            -   name: Kompilerer
                id: kompiler
                env:
                    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                run: ./mvnw --settings .github/settings.xml  -Drevision=${TAG} package

            -   name: Perform CodeQL Analysis
                uses: github/codeql-action/analyze@v3
                with:
                    category: "/language:${{matrix.language}}"


Dependabot auto-merge

name: Dependabot auto-merge
on: pull_request

permissions:
  contents: write
  pull-requests: write

jobs:
  dependabot:
    runs-on: ubuntu-latest
    if: ${{ github.actor == 'dependabot[bot]' }}
    steps:
      - name: Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@v2
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
      - name: Enable auto-merge for Dependabot PRs
        if: steps.metadata.outputs.update-type != 'version-update:semver-major'
        run: gh pr merge --auto --squash "$PR_URL"
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


Publish release

name: Publish release

on:
  release:
    types: [published]

jobs:
  publish-release:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout latest code
        uses: actions/checkout@v4

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: 21
          distribution: temurin
          cache: maven

      - name: Setup build cache
        uses: actions/cache@v4
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-

      - name: Set new version and publish artifact to central
        env:
          NEW_VERSION: ${{ github.event.release.tag_name }}
          SONATYPE_USER: ${{ secrets.SONATYPE_USER }}
          SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
          GPG_KEYNAME: ${{ secrets.GPG_KEYNAME }}
          GPG_KEYS: ${{ secrets.GPG_KEYS }}
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
        run: |
          export GPG_TTY=$(tty) && echo "$GPG_KEYS" | gpg --fast-import --batch
          echo "-- Setting new release version ${NEW_VERSION} --"
          ./mvnw -B versions:set -DnewVersion="${NEW_VERSION}" -DgenerateBackupPoms=false
          echo "-- Build, test and deploy release to Sonatype --"
          ./mvnw -B --settings .github/settings.xml clean deploy -Prelease,deploy-to-sonatype -Dmaven.wagon.http.pool=false

      - name: Publish artifact to GPR
        env:
          GITHUB_USERNAME: ${{ github.actor }}
          GITHUB_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_TOKEN:  ${{ secrets.GITHUB_TOKEN }}
        run: |
          ./mvnw -Pgithub --settings .github/settings.xml --batch-mode -DskipTests -Dmaven.main.skip=true -Dmaven.test.skip=true  deploy


Sonar

name: Sonar

on:
    push:
        branches:
            - master
env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

jobs:
    bygg:
        runs-on: ubuntu-latest
        steps:

            - name: Sjekk ut kode
              uses: actions/checkout@v4

            - name: Sett opp Java 21
              uses: actions/setup-java@v4
              with:
                  java-version: 21
                  distribution: temurin
                  cache: maven
            - name: Analyser
              run: |
                  ./mvnw versions:set -DnewVersion=${TAG}
                  ./mvnw --settings .github/settings.xml verify jacoco:prepare-agent jacoco:report  org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.login=${SONAR_TOKEN} -Dsonar.projectKey=navikt_token-support


Test pull requests

name: Test pull requests

on: [pull_request]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout latest code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: 21
          distribution: temurin

      - name: Setup build cache
        uses: actions/cache@v4
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-
      - name: Build with Maven
        env:
          GITHUB_USERNAME: x-access-token
          GITHUB_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          GITHUB_TOKEN:  ${{ secrets.GITHUB_TOKEN }}
        run: mvn  -B test


CI

#
# CI build that assembles artifacts and runs tests.
# If validation is successful this workflow releases from the main dev branch.
#
# - skipping CI: add [skip ci] to the commit message
# - skipping release: add [skip release] to the commit message
#
name: CI

on:
  push:
    branches: ["main"]
    tags-ignore: [v*] # release tags are autogenerated after a successful CI, no need to run CI against them
    paths-ignore:
      - "docs/**"
  pull_request:
    branches: ["**"]

jobs:
  gradle_wrapper_validation:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4 # docs: https://github.com/actions/checkout
        with:
          fetch-depth: "0" # https://github.com/shipkit/shipkit-auto-version#fetch-depth-on-ci
      - name: Gradle wrapper validation
        uses: gradle/wrapper-validation-action@216d1ad2b3710bf005dc39237337b9673fd8fcd5 # v3
  build:
    runs-on: ubuntu-latest
    needs: [gradle_wrapper_validation]
    steps:
      - name: Checkout code
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4 # https://github.com/actions/checkout
        with:
          fetch-depth: "0" # https://github.com/shipkit/shipkit-changelog#fetch-depth-on-ci

      - name: Setup Java
        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4
        with:
          distribution: adopt
          java-version: 17

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@db19848a5fa7950289d3668fb053140cf3028d43 # v3

      - name: Perform Build via Gradle
        run: ./gradlew build publishToMavenLocal

      - name: Upload Distribution to GitHub Actions
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4
        # Development job, only for PRs or pushes not to the main development branch
        if: github.event_name == 'pull_request'
          && github.repository == 'MythicDrops/MythicDrops'
        with:
          path: build/distributions/*.zip

      - name: Upload CodeCov Report
        uses: codecov/codecov-action@125fc84a9a348dbcf27191600683ec096ec9021c # v4
        with:
          files: "**/build/reports/jacoco/**/*.xml"
          token: ${{ secrets.CODECOV_TOKEN }}

      - name: Publish to Maven Central via Gradle
        uses: gradle/gradle-build-action@a8f75513eafdebd8141bd1cd4e30fcd194af8dfa # v2
        # Release job, only for pushes to the main development branch
        if: github.event_name == 'push'
          && github.ref == 'refs/heads/main'
          && github.repository == 'MythicDrops/MythicDrops'
          && !contains(toJSON(github.event.commits.*.message), '[skip release]')
        with:
          arguments: githubRelease publishToSonatype closeAndReleaseStagingRepositories --scan
        env:
          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
          SONATYPE_USER: ${{secrets.OSSRH_USERNAME}}
          SONATYPE_PWD: ${{secrets.OSSRH_TOKEN}}
          PGP_KEY: ${{secrets.GPG_PRIVATE_KEY}}
          PGP_PWD: ${{secrets.GPG_PASSWORD}}


MegaLinter

# MegaLinter GitHub Action configuration file
# More info at https://oxsecurity.github.io/megalinter
name: MegaLinter

permissions: read-all

on:
  # Trigger mega-linter at every push. Action will also be visible from Pull Requests to master
  push: # Comment this line to trigger action only on pull-requests (not recommended if you don't pay for GH Actions)
  pull_request:
    branches: [main]

env: # Comment env block if you do not want to apply fixes
  # Apply linter fixes configuration
  APPLY_FIXES: all # When active, APPLY_FIXES must also be defined as environment variable (in github/workflows/mega-linter.yml or other CI tool)
  APPLY_FIXES_EVENT: pull_request # Decide which event triggers application of fixes in a commit or a PR (pull_request, push, all)
  APPLY_FIXES_MODE: pull_request # If APPLY_FIXES is used, defines if the fixes are directly committed (commit) or posted in a PR (pull_request)

concurrency:
  group: "${{ github.ref }}-${{ github.workflow }}"
  cancel-in-progress: true

jobs:
  gradle_wrapper_validation:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4   # docs: https://github.com/actions/checkout
        with:
          fetch-depth: '0'  # https://github.com/shipkit/shipkit-auto-version#fetch-depth-on-ci
      - name: Gradle wrapper validation
        uses: gradle/wrapper-validation-action@8a2cbc9ccf0390177c07106bbfb02746e8f0413b # v2.1.0
  build:
    name: MegaLinter
    runs-on: ubuntu-latest
    needs: [ gradle_wrapper_validation ]
    permissions:
      issues: write
      pull-requests: write
    steps:
      # Git Checkout
      - name: Checkout Code
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
        with:
          token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
          fetch-depth: 0

      # MegaLinter
      - name: MegaLinter
        id: ml
        # You can override MegaLinter flavor used to have faster performances
        # More info at https://oxsecurity.github.io/megalinter/flavors/
        uses: oxsecurity/megalinter@688bc7466d7ab4faa83d614c2e6f9acf42b674dc # v7
        env:
          # All available variables are described in documentation
          # https://oxsecurity.github.io/megalinter/configuration/
          VALIDATE_ALL_CODEBASE: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} # Validates all source when push on main, else just the git diff with main. Set 'true' if you always want to lint all sources
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # ADD YOUR CUSTOM ENV VARIABLES HERE TO OVERRIDE VALUES OF .mega-linter.yml AT THE ROOT OF YOUR REPOSITORY

      # Upload MegaLinter artifacts
      - name: Archive production artifacts
        if: success() || failure()
        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4
        with:
          name: MegaLinter reports
          path: |
            megalinter-reports
            mega-linter.log


Anchore security scan

name: Anchore security scan
on:
  push:
    branches:
      - develop
  pull_request:
    types: [opened, synchronize, reopened]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout project
        uses: actions/checkout@v4
      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '21'
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v3
      - name: Assemble project
        run: ./gradlew assemble
      - name: Upload jars artifacts
        uses: actions/upload-artifact@v4
        with:
          name: jars
          path: |
            api-gateway/build/libs
            search-service/build/libs
            subscription-service/build/libs
  anchore:
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Checkout project
        uses: actions/checkout@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Download jars artifacts
        uses: actions/download-artifact@v4
        with:
          name: jars
          path: build
      - name: Build API Gateway local container
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./api-gateway/Dockerfile
          tags: localbuild/api-gateway:latest-scan
          push: false
          load: true
          build-args: |
            JAR_FILE=./build/api-gateway/build/libs/api-gateway-latest-dev.jar
      - name: Build Search Service local container
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./search-service/Dockerfile
          tags: localbuild/search-service:latest-scan
          push: false
          load: true
          build-args: |
            JAR_FILE=./build/search-service/build/libs/search-service-latest-dev.jar
      - name: Build Subscription Service local container
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./subscription-service/Dockerfile
          tags: localbuild/subscription-service:latest-scan
          push: false
          load: true
          build-args: |
            JAR_FILE=./build/subscription-service/build/libs/subscription-service-latest-dev.jar
      - name: Security Scan for API Gateway image
        id: scan-api-gateway
        uses: anchore/scan-action@v3
        with:
          image: "localbuild/api-gateway:latest-scan"
          severity-cutoff: critical
      - name: Security Scan for Search Service image
        id: scan-search-service
        uses: anchore/scan-action@v3
        with:
          image: "localbuild/search-service:latest-scan"
          severity-cutoff: critical
      - name: Security Scan for Subscription Service image
        id: scan-subscription-service
        uses: anchore/scan-action@v3
        with:
          image: "localbuild/subscription-service:latest-scan"
          severity-cutoff: critical
      - name: Upload Anchore scan SARIF report for API Gateway
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: ${{ steps.scan-api-gateway.outputs.sarif }}
          category: anchore-api-gateway
      - name: Upload Anchore scan SARIF report for Search Service
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: ${{ steps.scan-search-service.outputs.sarif }}
          category: anchore-search-service
      - name: Upload Anchore scan SARIF report for Subscription Service
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: ${{ steps.scan-subscription-service.outputs.sarif }}
          category: anchore-subscription-service


Build

name: Build
on:
  push:
    branches:
      - master
      - develop
  pull_request:
    types: [opened, synchronize, reopened]
jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    permissions:
      checks: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '21'
          cache: 'gradle'
      - name: Cache SonarCloud packages
        uses: actions/cache@v4
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
          restore-keys: ${{ runner.os }}-sonar
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v3
      - name: Build
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: ./gradlew build
      - name: Publish unit test results
        uses: EnricoMi/publish-unit-test-result-action@v2
        if: always()
        with:
          junit_files: '**/test-results/**/TEST-*.xml'
      - name: Perform SonarQube analysis
        if: github.actor != 'dependabot[bot]'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: ./gradlew sonarqube --info


CLA Assistant

name: "CLA Assistant"
on:
  issue_comment:
    types: [created]
  pull_request_target:
    types: [opened,closed,synchronize]

jobs:
  CLAssistant:
    runs-on: ubuntu-latest
    steps:
      - name: "CLA Assistant"
        if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
        # Beta Release
        uses: cla-assistant/github-action@v2.4.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # the below token should have repo scope and must be manually added by you in the repository's secret
          PERSONAL_ACCESS_TOKEN : ${{ secrets.PERSONAL_ACCESS_TOKEN }}
        with:
          path-to-signatures: 'docs/cla/cla.json'
          path-to-document: 'https://fiware.github.io/contribution-requirements/individual-cla.pdf' # e.g. a CLA or a DCO document
          # branch should not be protected
          branch: 'master'
          allowlist: bobeal,franckLG,HoucemKacem,dependabot,bot*
          signed-commit-message: '$contributorName has signed the CLA in #$pullRequestNo'


CodeQL

name: "CodeQL"

on:
  push:
    branches: [ "develop" ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ "develop" ]
  schedule:
    - cron: '34 6 * * 3'

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: [ 'java' ]
        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
        # Use only 'java' to analyze code written in Java, Kotlin or both
        # Use only 'javascript' to analyze code written in JavaScript, TypeScript or both
        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Set up JDK 21
      uses: actions/setup-java@v4
      with:
        distribution: 'temurin'
        java-version: '21'

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.

        # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
        # queries: security-extended,security-and-quality

    # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
      uses: github/codeql-action/autobuild@v3

    # ℹ Command-line programs to run using the OS shell.
    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun

    #   If the Autobuild fails above, remove it and uncomment the following three lines.
    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.

    # - run: |
    #     echo "Run, Build Application using script"
    #     ./location_of_script_within_repo/buildscript.sh

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3
      with:
        category: "/language:${{matrix.language}}"


Dependency Submission

name: Dependency Submission

on:
  push:
    branches:
      - develop

permissions:
  contents: write

jobs:
  dependency-submission:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
        uses: actions/checkout@v4

      - name: Set up the JDK used to run Gradle
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '21'

      - name: Generate and submit dependency graph
        uses: gradle/actions/dependency-submission@v3


PR Labeler

name: PR Labeler
on:
  pull_request:
    types: [opened]

permissions:
  contents: read

jobs:
  pr-labeler:
    permissions:
      contents: read # for TimonVS/pr-labeler-action to read config file
      pull-requests: write # for TimonVS/pr-labeler-action to add labels in PR
    runs-on: ubuntu-latest
    steps:
      - uses: TimonVS/pr-labeler-action@v5.0.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}


Release Drafter

name: Release Drafter

on:
  push:
    # branches to consider in the event; optional, defaults to all
    branches:
      - master
      - develop

jobs:
  update_release_draft:
    runs-on: ubuntu-latest
    steps:
      # Drafts your next Release notes as Pull Requests are merged into "master"
      - uses: release-drafter/release-drafter@v6
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


Android CI

name: Android CI

on:
  release:
    types: [ published ]
  workflow_dispatch:

jobs:
  deploy-to-maven-central:

    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v3
    - name: set up JDK 11
      uses: actions/setup-java@v3
      with:
        java-version: '11'
        distribution: 'temurin'
        cache: gradle

    - name: Which version
      run: echo "${{github.ref_name}}"

    - name: Decrypt the artefact signing key
      run: gpg --quiet --batch --yes --decrypt --passphrase="${{ secrets.ANDROID_ROOM_KIT_SONATYPE_PRIVATE_KEY_DECRYPT_PASSWORD }}" --output secrets/private.pgp secrets/private.pgp.gpg

    - name: Grant execute permission for gradlew
      run: chmod +x gradlew

    - name: Deploy to Maven Central live.100ms (Sonatype)
      run: ./gradlew clean publishToSonatype closeAndReleaseSonatypeStagingRepository -PhmsRoomKitGroup="live.100ms" -PHMS_ROOM_KIT_VERSION="${{github.ref_name}}" -PossrhUsername="${{ secrets.ANDROID_SONATYPE_USERNAME}}" -PossrhPassword="${{ secrets.ANDROID_SONATYPE_PASSWORD}}" -Psigning.keyId="62C0C2F9" -Psigning.password="${{ secrets.ANDROID_ROOM_KIT_SIGNING_PASSWORD }}" -Psigning.secretKeyRingFile="../secrets/private.pgp" -PTOKEN_ENDPOINT="\"\""


CodeQL

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: "CodeQL"

on:
  push:
    branches: [ "main", "dev" ]
  pull_request:
    branches: [ "main", "dev" ]
  schedule:
    - cron: '24 21 * * 0'

jobs:
  analyze:
    name: Analyze
    # Runner size impacts CodeQL analysis time. To learn more, please see:
    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
    #   - https://gh.io/supported-runners-and-hardware-resources
    #   - https://gh.io/using-larger-runners
    # Consider using larger runners for possible analysis time improvements.
    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
    timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
    permissions:
      # required for all workflows
      security-events: write

      # only required for workflows in private repositories
      actions: read
      contents: read

    strategy:
      fail-fast: false
      matrix:
        language: [ 'java-kotlin' ]
        # CodeQL supports [ 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' ]
        # Use only 'java-kotlin' to analyze code written in Java, Kotlin or both
        # Use only 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - uses: actions/setup-java@v4
      with:
        distribution: 'temurin' # See 'Supported distributions' for available options
        java-version: '17'

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.

        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
        # queries: security-extended,security-and-quality

    # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
      uses: github/codeql-action/autobuild@v3

    # ℹ Command-line programs to run using the OS shell.
    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun

    #   If the Autobuild fails above, remove it and uncomment the following three lines.
    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.

    # - run: |
    #     echo "Run, Build Application using script"
    #     ./location_of_script_within_repo/buildscript.sh

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3
      with:
        category: "/language:${{matrix.language}}"