PreCommit Spotless

#    Licensed to the Apache Software Foundation (ASF) under one
#    or more contributor license agreements.  See the NOTICE file
#    distributed with this work for additional information
#    regarding copyright ownership.  The ASF licenses this file
#    to you under the Apache License, Version 2.0 (the
#    "License"); you may not use this file except in compliance
#    with the License.  You may obtain a copy of the License at
#      http://www.apache.org/licenses/LICENSE-2.0
#    Unless required by applicable law or agreed to in writing, software
#    distributed under the License is distributed on an "AS IS" BASIS,
#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#    See the License for the specific language governing permissions and
#    limitations under the License.

name: PreCommit Spotless

on:
  push:
    tags: ['v*']
    branches: ['master', 'release-*']
    paths:
      - 'buildSrc/**'
      - 'sdks/java/**'
      - 'runners/**'
      - 'examples/java/**'
      - 'examples/kotlin/**'
      - '.test-infra/jenkins/'
      - '.github/workflows/beam_PreCommit_Spotless.yml'
  pull_request_target:
    branches: ['master', 'release-*']
    paths:
      - 'buildSrc/**'
      - 'sdks/java/**'
      - 'runners/**'
      - 'examples/java/**'
      - 'examples/kotlin/**'
      - '.test-infra/jenkins/'
      - 'release/trigger_all_tests.json'
      - '.github/trigger_files/beam_PreCommit_Spotless.json'
  issue_comment:
    types: [created]
  schedule:
    - cron: '0 3/6 * * *'
  workflow_dispatch:

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.issue.number || github.event.pull_request.head.label || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.comment.id || github.event.sender.login }}'
  cancel-in-progress: true

#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
permissions:
  actions: write
  pull-requests: read
  checks: write
  contents: read
  deployments: read
  id-token: none
  issues: read
  discussions: read
  packages: read
  pages: read
  repository-projects: read
  security-events: read
  statuses: read

env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
  GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
  GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}

jobs:
  beam_PreCommit_Spotless:
    name: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
    timeout-minutes: 120
    runs-on: [self-hosted, ubuntu-20.04, main]
    strategy:
      fail-fast: false
      matrix:
        job_name: [beam_PreCommit_Spotless]
        job_phrase: [Run Spotless PreCommit]
    if: |
      github.event_name == 'push' ||
      github.event_name == 'pull_request_target' ||
      (github.event_name == 'schedule' && github.repository == 'apache/beam') ||
      github.event_name == 'workflow_dispatch' ||
      github.event.comment.body == 'Run Spotless PreCommit'
    steps:
      - uses: actions/checkout@v4
      - name: Setup repository
        uses: ./.github/actions/setup-action
        with:
          comment_phrase: ${{ matrix.job_phrase }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          github_job: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
      - name: Setup environment
        uses: ./.github/actions/setup-environment-action
      - name: run Spotless PreCommit script
        uses: ./.github/actions/gradle-command-self-hosted-action
        with:
          gradle-command: spotlessCheck checkStyleMain checkStyleTest :buildSrc:spotlessCheck
      - name: Upload test report
        uses: actions/upload-artifact@v4
        with:
          name: java-code-coverage-report
          path: "**/build/reports/checkstyle/*.xml"
      - name: Publish checkstyle check
        uses: jwgmeligmeyling/checkstyle-github-action@v1
        if: always()
        with:
          path: '**/build/reports/checkstyle/*.xml'


PreCommit Typescript

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

name: PreCommit Typescript

on:
  push:
    tags: ['v*']
    branches: ['master', 'release-*']
    paths: ['sdks/python/apache_beam/runners/interactive/extensions/**', '.github/workflows/beam_PreCommit_Typescript.yml']
  pull_request_target:
    branches: ['master', 'release-*']
    paths: ['sdks/python/apache_beam/runners/interactive/extensions/**', 'release/trigger_all_tests.json', '.github/trigger_files/beam_PreCommit_Typescript.json']
  issue_comment:
    types: [created]
  schedule:
    - cron: '15 3/6 * * *'
  workflow_dispatch:

  # This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.issue.number || github.event.pull_request.head.label || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.comment.id || github.event.sender.login }}'
  cancel-in-progress: true

env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
  GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
  GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}

#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
permissions:
  actions: write
  pull-requests: read
  checks: read
  contents: read
  deployments: read
  id-token: none
  issues: read
  discussions: read
  packages: read
  pages: read
  repository-projects: read
  security-events: read
  statuses: read
jobs:
  beam_PreCommit_Typescript:
    name: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
    timeout-minutes: 120
    runs-on: [self-hosted, ubuntu-20.04, main]
    strategy:
      matrix:
        job_name: [beam_PreCommit_Typescript]
        job_phrase: [Run Typescript PreCommit]
    if: |
      github.event_name == 'push' ||
      github.event_name == 'pull_request_target' ||
      (github.event_name == 'schedule' && github.repository == 'apache/beam') ||
      github.event_name == 'workflow_dispatch' ||
      github.event.comment.body == 'Run Typescript PreCommit'
    steps:
      - uses: actions/checkout@v4
      - name: Setup repository
        uses: ./.github/actions/setup-action
        with:
          comment_phrase: ${{ matrix.job_phrase }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          github_job: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
      - name: Setup environment
        uses: ./.github/actions/setup-environment-action
        with:
          python-version: default
          java-version: default
      - name: run typescriptPreCommit script
        uses: ./.github/actions/gradle-command-self-hosted-action
        with:
          gradle-command: :typescriptPreCommit


PreCommit Website

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: PreCommit Website

on:
  push:
    tags: ['v*']
    branches: ['master', 'release-*']
    paths: ['website/**','.github/workflows/beam_PreCommit_Website.yml']
  pull_request_target:
    branches: ['master', 'release-*']
    paths: ['website/**', 'release/trigger_all_tests.json', '.github/trigger_files/beam_PreCommit_Website.json']
  issue_comment:
    types: [created]
  schedule:
    - cron: '15 3/6 * * *'
  workflow_dispatch:

#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
permissions:
  actions: write
  pull-requests: read
  checks: read
  contents: read
  deployments: read
  id-token: none
  issues: read
  discussions: read
  packages: read
  pages: read
  repository-projects: read
  security-events: read
  statuses: read

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.issue.number || github.event.pull_request.head.label || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.comment.id || github.event.sender.login }}'
  cancel-in-progress: true

env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
  GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
  GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}

jobs:
  beam_PreCommit_Website:
    name: ${{ matrix.job_name }} (${{ matrix.job_phrase}})
    runs-on: [self-hosted, ubuntu-20.04, small]
    strategy:
      matrix:
        job_name: [beam_PreCommit_Website]
        job_phrase: [Run Website PreCommit]
    timeout-minutes: 120
    if: |
      github.event_name == 'push' ||
      github.event_name == 'pull_request_target' ||
      (github.event_name == 'schedule' && github.repository == 'apache/beam') ||
      github.event_name == 'workflow_dispatch' ||
      github.event.comment.body == 'Run Website PreCommit'
    steps:
      - uses: actions/checkout@v4
      - name: Setup repository
        uses: ./.github/actions/setup-action
        with:
          comment_phrase: ${{ matrix.job_phrase }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          github_job: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
      - name: Setup environment
        uses: ./.github/actions/setup-environment-action
        with:
          java-version: default
      - name: run websitePreCommit script
        uses: ./.github/actions/gradle-command-self-hosted-action
        with:
          gradle-command: :websitePreCommit


PreCommit Website Stage GCS

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: PreCommit Website Stage GCS

on:
  push:
    tags: ['v*']
    branches: ['master', 'release-*']
    paths: ['website/**','.github/workflows/beam_PreCommit_Website_Stage_GCS.yml']
  pull_request_target:
    branches: ['master', 'release-*']
    paths: ['website/**', 'release/trigger_all_tests.json', '.github/trigger_files/beam_PreCommit_Website_Stage_GCS.json']
  issue_comment:
    types: [created]
  schedule:
    - cron: '15 3/6 * * *'
  workflow_dispatch:

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.issue.number || github.event.pull_request.head.label || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.comment.id || github.event.sender.login }}'
  cancel-in-progress: true

env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
  GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
  GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}
  gcsbucket: apache-beam-website-pull-requests
  ghprbPullId:

#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
permissions:
  actions: write
  pull-requests: read
  checks: read
  contents: read
  deployments: read
  id-token: none
  issues: read
  discussions: read
  packages: read
  pages: read
  repository-projects: read
  security-events: read
  statuses: read

jobs:
  beam_PreCommit_Website_Stage_GCS:
    name: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
    runs-on: [self-hosted, ubuntu-20.04, main]
    strategy:
      matrix:
        job_name: [beam_PreCommit_Website_Stage_GCS]
        job_phrase: [Run Website_Stage_GCS PreCommit]
    timeout-minutes: 120
    if: |
      github.event_name == 'push' ||
      github.event_name == 'pull_request_target' ||
      (github.event_name == 'schedule' && github.repository == 'apache/beam') ||
      github.event_name == 'workflow_dispatch' ||
      github.event.comment.body == 'Run Website_Stage_GCS PreCommit'
    steps:
      - uses: actions/checkout@v4
      - name: Setup repository
        uses: ./.github/actions/setup-action
        with:
          comment_phrase: ${{ matrix.job_phrase }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          github_job: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
      - name: Echo PR number
        run: echo "ghprbPullId=${{ github.event.pull_request.number || github.event.issue.number }}" >> $GITHUB_ENV
      - name: Setup environment
        uses: ./.github/actions/setup-environment-action
        with:
          python-version: default
          java-version: default
      - name: Run website_stageWebsite script
        uses: ./.github/actions/gradle-command-self-hosted-action
        with:
          gradle-command: :website:stageWebsite
          arguments: -PwebsiteBucket=$gcsbucket
      - name: Add website link to the summary if pr
        if: env.ghprbPullId != null
        run: echo "Website published to http://$gcsbucket.storage.googleapis.com/$ghprbPullId/index.html" >> $GITHUB_STEP_SUMMARY
      - name: Add website link to the summary
        if: env.ghprbPullId == null
        run: |
          USERNAME="$(whoami)"
          echo "Website published to http://$gcsbucket.storage.googleapis.com/$USERNAME-${GITHUB_REF##*/}/index.html" >> $GITHUB_STEP_SUMMARY


PreCommit Whitespace

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: PreCommit Whitespace

on:
  push:
    tags: ['v*']
    branches: ['master', 'release-*']
    paths: ['**.md', '**.gradle', '**.kts', '.github/workflows/beam_PreCommit_Whitespace.yml']
  pull_request_target:
    branches: ['master', 'release-*']
    paths: ['**.md', '**.gradle', '**.kts', 'release/trigger_all_tests.json', '.github/trigger_files/beam_PreCommit_Whitespace.json']
  issue_comment:
    types: [created]
  schedule:
    - cron: '15 3/6 * * *'
  workflow_dispatch:

permissions:
  actions: write
  pull-requests: read
  checks: read
  contents: read
  deployments: read
  id-token: none
  issues: read
  discussions: read
  packages: read
  pages: read
  repository-projects: read
  security-events: read
  statuses: read

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.issue.number || github.event.pull_request.head.label || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.comment.id || github.event.sender.login }}'
  cancel-in-progress: true

env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
  GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
  GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}

jobs:
  beam_PreCommit_Whitespace:
    name: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
    runs-on: [self-hosted, ubuntu-20.04, main]
    strategy:
      matrix:
        job_name: [beam_PreCommit_Whitespace]
        job_phrase: [Run Whitespace PreCommit]
    timeout-minutes: 120
    if: |
      github.event_name == 'push' ||
      github.event_name == 'pull_request_target' ||
      (github.event_name == 'schedule' && github.repository == 'apache/beam') ||
      github.event_name == 'workflow_dispatch' ||
      github.event.comment.body == 'Run Whitespace PreCommit'
    steps:
      - uses: actions/checkout@v4
      - name: Setup repository
        uses: ./.github/actions/setup-action
        with:
          comment_phrase: ${{ matrix.job_phrase }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          github_job: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
      - name: Setup environment
        uses: ./.github/actions/setup-environment-action
        with:
          java-version: default
          python-version: default
      - name: run whitespacePreCommit script
        uses: ./.github/actions/gradle-command-self-hosted-action
        with:
          gradle-command: :whitespacePreCommit


PreCommit Xlang Generated Transforms

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: PreCommit Xlang Generated Transforms

on:
  push:
    tags: ['v*']
    branches: ['master', 'release-*']
    paths:
      - 'model/**'
      - 'sdks/python/**'
      - 'sdks/java/expansion-service/**'
      - 'sdks/java/core/**'
      - 'sdks/java/io/**'
      - 'sdks/java/extensions/sql/**'
      - 'release/**'
      - '.github/workflows/beam_PreCommit_Xlang_Generated_Transforms.yml'
  pull_request_target:
    branches: ['master', 'release-*']
    paths:
      - 'model/**'
      - 'sdks/python/**'
      - 'sdks/java/expansion-service/**'
      - 'sdks/java/core/**'
      - 'sdks/java/io/**'
      - 'sdks/java/extensions/sql/**'
      - 'release/**'
      - 'release/trigger_all_tests.json'
      - '.github/workflows/beam_PreCommit_Xlang_Generated_Transforms.yml'
  issue_comment:
    types: [created]
  schedule:
    - cron: '30 2/6 * * *'
  workflow_dispatch:

#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
permissions:
  actions: write
  pull-requests: read
  checks: read
  contents: read
  deployments: read
  id-token: none
  issues: read
  discussions: read
  packages: read
  pages: read
  repository-projects: read
  security-events: read
  statuses: read

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.issue.number || github.event.pull_request.head.label || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.comment.id || github.event.sender.login }}'
  cancel-in-progress: true

env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
  GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
  GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}

jobs:
  beam_PreCommit_Xlang_Generated_Transforms:
    name: ${{ matrix.job_name }} (${{ matrix.job_phrase }} ${{ matrix.python_version }})
    timeout-minutes: 120
    runs-on: ['self-hosted', ubuntu-20.04, main]
    strategy:
      fail-fast: false
      matrix:
        job_name: ['beam_PreCommit_Xlang_Generated_Transforms']
        job_phrase: ['Run Xlang_Generated_Transforms PreCommit']
        python_version: ['3.8']
    if: |
      github.event_name == 'push' ||
      github.event_name == 'workflow_dispatch' ||
      github.event_name == 'pull_request_target' ||
      (github.event_name == 'schedule' && github.repository == 'apache/beam') ||
      startsWith(github.event.comment.body, 'Run Xlang_Generated_Transforms PreCommit')
    steps:
      - uses: actions/checkout@v4
      - name: Setup repository
        uses: ./.github/actions/setup-action
        with:
          comment_phrase: ${{ matrix.job_phrase }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          github_job: ${{ matrix.job_name }} (${{ matrix.job_phrase }}
      - name: Setup environment
        uses: ./.github/actions/setup-environment-action
        with:
          java-version: default
          python-version: ${{ matrix.python_version }}
      - name: Set PY_VER_CLEAN
        id: set_py_ver_clean
        run: |
          PY_VER=${{ matrix.python_version }}
          PY_VER_CLEAN=${PY_VER//.}
          echo "py_ver_clean=$PY_VER_CLEAN" >> $GITHUB_OUTPUT
      - name: run Cross-Language Wrapper Validation script
        uses: ./.github/actions/gradle-command-self-hosted-action
        with:
          gradle-command: :sdks:python:test-suites:direct:crossLanguageWrapperValidationPreCommit --info


PreCommit YAML Xlang Direct

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: PreCommit YAML Xlang Direct

on:
  pull_request_target:
    paths: ['release/trigger_all_tests.json', 'model/**', 'sdks/python/**']
  issue_comment:
    types: [created]
  push:
    tags: ['v*']
    branches: ['master', 'release-*']
    paths:
      - "model/**"
      - "release/**"
      - "sdks/python/**"
      - "sdks/java/extensions/schemaio-expansion-service/**"
      - "sdks/java/extensions/sql/**"
      - "sdks/java/io/expansion-service/**"
      - "sdks/java/io/google-cloud-platform/**"
      - ".github/workflows/beam_PreCommit_Yaml_Xlang_Direct.yml"
  schedule:
    - cron: '30 5/6 * * *'
  workflow_dispatch:

#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
permissions:
  actions: write
  pull-requests: write
  checks: write
  contents: read
  deployments: read
  id-token: none
  issues: write
  discussions: read
  packages: read
  pages: read
  repository-projects: read
  security-events: read
  statuses: read

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.issue.number || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.comment.id || github.event.sender.login }}'
  cancel-in-progress: true

env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
  GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
  GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}

jobs:
  beam_PreCommit_Yaml_Xlang_Direct:
    if: |
      github.event_name == 'workflow_dispatch' ||
      github.event_name == 'pull_request_target' ||
      (github.event_name == 'schedule' && github.repository == 'apache/beam') ||
      github.event.comment.body == 'Run Yaml_Xlang_Direct PreCommit'
    runs-on: [self-hosted, ubuntu-20.04, main]
    timeout-minutes: 100
    name: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
    strategy:
      matrix:
        job_name: ["beam_PreCommit_Yaml_Xlang_Direct"]
        job_phrase: ["Run Yaml_Xlang_Direct PreCommit"]
    steps:
      - uses: actions/checkout@v4
      - name: Setup repository
        uses: ./.github/actions/setup-action
        with:
          comment_phrase: ${{ matrix.job_phrase }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          github_job: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
      - name: Setup environment
        uses: ./.github/actions/setup-environment-action
        with:
          python-version: default
      - name: run PreCommit Yaml Xlang Direct script
        uses: ./.github/actions/gradle-command-self-hosted-action
        with:
          gradle-command: :sdks:python:yamlIntegrationTests
      - name: Archive Python Test Results
        uses: actions/upload-artifact@v4
        if: failure()
        with:
          name: Python Test Results
          path: '**/pytest*.xml'
      - name: Publish Python Test Results
        uses: EnricoMi/publish-unit-test-result-action@v2
        if: always()
        with:
          commit: '${{ env.prsha || env.GITHUB_SHA }}'
          comment_mode: ${{ github.event_name == 'issue_comment'  && 'always' || 'off' }}
          files: '**/pytest*.xml'


Community Metrics Prober

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Community Metrics Prober

on:
  issue_comment:
    types: [created]
  schedule:
    - cron: '0 */6 * * *'
  workflow_dispatch:

#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
permissions:
  actions: write
  pull-requests: read
  checks: read
  contents: read
  deployments: read
  id-token: none
  issues: read
  discussions: read
  packages: read
  pages: read
  repository-projects: read
  security-events: read
  statuses: read

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.issue.number || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.comment.id || github.event.sender.login }}'
  cancel-in-progress: true

env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
  GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
  GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}

jobs:
  beam_Prober_CommunityMetrics:
    if: |
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'schedule' && github.repository == 'apache/beam') ||
      github.event.comment.body == 'Run Community Metrics Prober'
    runs-on: [self-hosted, ubuntu-20.04, main]
    timeout-minutes: 100
    name: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
    strategy:
      matrix:
        job_name: ["beam_Prober_CommunityMetrics"]
        job_phrase: ["Run Community Metrics Prober"]
    steps:
      - uses: actions/checkout@v4
      - name: Setup repository
        uses: ./.github/actions/setup-action
        with:
          comment_phrase: ${{ matrix.job_phrase }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          github_job: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
      - name: Setup environment
        uses: ./.github/actions/setup-environment-action
      - name: Health check probes for the Community Metrics infrastructure
        uses: ./.github/actions/gradle-command-self-hosted-action
        with:
          gradle-command: :communityMetricsProber
          arguments: |
            --rerun-tasks


Publish BeamMetrics

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Publish BeamMetrics

on:
  schedule:
    - cron: '24 2 * * *'
  workflow_dispatch:

#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
permissions:
  actions: write
  pull-requests: read
  checks: read
  contents: read
  deployments: read
  id-token: none
  issues: read
  discussions: read
  packages: read
  pages: read
  repository-projects: read
  security-events: read
  statuses: read

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.issue.number || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.comment.id || github.event.sender.login }}'
  cancel-in-progress: true

env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
  GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
  GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}

jobs:
  beam_Publish_BeamMetrics:
    if: |
      github.event_name == 'push' ||
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'schedule' && github.repository == 'apache/beam') ||
      github.event.comment.body == 'Run Beam Metrics Deployment'
    runs-on: [self-hosted, ubuntu-20.04, main]
    timeout-minutes: 100
    name: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
    strategy:
      matrix:
        job_name: ["beam_PostCommit_BeamMetrics_Publish"]
        job_phrase: ["Run Beam Metrics Deployment"]
    steps:
      - uses: actions/checkout@v4
      - name: Setup repository
        uses: ./.github/actions/setup-action
        with:
          comment_phrase: ${{ matrix.job_phrase }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          github_job: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
      - name: Setup environment
        uses: ./.github/actions/setup-environment-action
      - name: Setup credential helper
        run: |
          gcloud auth configure-docker
      - name: run Beam Metrics deployment script
        uses: ./.github/actions/gradle-command-self-hosted-action
        with:
          gradle-command: :beam-test-infra-metrics:getClusterCredentials :beam-test-infra-metrics:deploy
          arguments: |
            -PKUBE_CONFIG_PATH='$HOME/.kube/config'


Publish Beam SDK Snapshots

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Publish Beam SDK Snapshots

on:
  schedule:
    - cron: '0 */4 * * *'
  workflow_dispatch:

#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
permissions:
  actions: write
  pull-requests: read
  checks: read
  contents: read
  deployments: read
  id-token: none
  issues: read
  discussions: read
  packages: read
  pages: read
  repository-projects: read
  security-events: read
  statuses: read

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.issue.number || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.sender.login }}'
  cancel-in-progress: true

env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
  GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
  GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}
  docker_registry: gcr.io

jobs:
  beam_Publish_Beam_SDK_Snapshots:
    if: |
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'schedule' && github.repository == 'apache/beam')
    runs-on: [self-hosted, ubuntu-20.04, main]
    timeout-minutes: 100
    name: ${{ matrix.job_name }} (${{ matrix.container_task }})
    strategy:
      fail-fast: false
      matrix:
        job_name: ["beam_Publish_Beam_SDK_Snapshots"]
        job_phrase: ["N/A"]
        container_task:
          - "go:container"
          - "java:container:java8"
          - "java:container:java11"
          - "java:container:java17"
          - "java:container:java21"
          - "python:container:py38"
          - "python:container:py39"
          - "python:container:py310"
          - "python:container:py311"
          - "python:container:py312"
    steps:
      - uses: actions/checkout@v4
      - name: Setup repository
        uses: ./.github/actions/setup-action
        with:
          comment_phrase: ${{ matrix.job_phrase }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          github_job: ${{ matrix.job_name }} (${{ matrix.container_task }})
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1
      - name: GCloud Docker credential helper
        run: |
          gcloud auth configure-docker ${{ env.docker_registry }}
      - name: Setup Java environment
        if: ${{ startsWith(matrix.container_task, 'java') }}
        uses: ./.github/actions/setup-environment-action
        with:
          java-version: 11
      - name: Setup Python environment
        if: ${{ startsWith(matrix.container_task, 'python') }}
        uses: ./.github/actions/setup-environment-action
        with:
          python-version: default
      - name: run Publish Beam SDK Snapshots script
        uses: ./.github/actions/gradle-command-self-hosted-action
        with:
          gradle-command: :sdks:${{ matrix.container_task }}:docker
          arguments: |
            -Pjava11Home=$JAVA_HOME_11_X64 \
            -Pdocker-repository-root=gcr.io/apache-beam-testing/beam-sdk \
            -Pdocker-tag-list=${{ github.sha }},latest \
            -Pcontainer-architecture-list=arm64,amd64 \
            -Ppush-containers \


Publish Docker Snapshots

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Publish Docker Snapshots

on:
  schedule:
    - cron: '0 13 * * *'
  workflow_dispatch:

#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
permissions:
  actions: write
  pull-requests: read
  checks: read
  contents: read
  deployments: read
  id-token: none
  issues: read
  discussions: read
  packages: read
  pages: read
  repository-projects: read
  security-events: read
  statuses: read

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.issue.number || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.comment.id || github.event.sender.login }}'
  cancel-in-progress: true

env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
  GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
  GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}
  docker_registry: gcr.io

jobs:
  beam_Publish_Docker_Snapshots:
    if: |
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'schedule' && github.repository == 'apache/beam') ||
      github.event.comment.body == 'Publish Docker Snapshots'
    runs-on: [self-hosted, ubuntu-20.04, main]
    timeout-minutes: 100
    name: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
    strategy:
      matrix:
        job_name: ["beam_Publish_Docker_Snapshots"]
        job_phrase: ["Publish Docker Snapshots"]
    steps:
      - uses: actions/checkout@v4
      - name: Setup repository
        uses: ./.github/actions/setup-action
        with:
          comment_phrase: ${{ matrix.job_phrase }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          github_job: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
      - name: Setup environment
        uses: ./.github/actions/setup-environment-action
      - name: GCloud Docker credential helper
        run: |
          gcloud auth configure-docker ${{ env.docker_registry }}
      - name: run Publish Docker Snapshots script for Spark
        uses: ./.github/actions/gradle-command-self-hosted-action
        with:
          gradle-command: :runners:spark:3:job-server:container:dockerPush
          arguments: |
            -Pdocker-repository-root=gcr.io/apache-beam-testing/beam_portability \
            -Pdocker-tag-list=latest \
      - name: run Publish Docker Snapshots script for Flink
        uses: ./.github/actions/gradle-command-self-hosted-action
        with:
          gradle-command: :runners:flink:1.15:job-server-container:dockerPush
          arguments: |
            -Pdocker-repository-root=gcr.io/apache-beam-testing/beam_portability \
            -Pdocker-tag-list=latest


Publish Website

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Publish Website

on:
  schedule:
    - cron: '30 5/6 * * *'
  workflow_dispatch:

#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
permissions:
  actions: write
  pull-requests: read
  checks: read
  contents: write
  deployments: read
  id-token: none
  issues: read
  discussions: read
  packages: read
  pages: read
  repository-projects: read
  security-events: read
  statuses: read

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.issue.number || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.comment.id || github.event.sender.login }}'
  cancel-in-progress: true

env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
  GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
  GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}

jobs:
  beam_Publish_Website:
    if: |
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'schedule' && github.repository == 'apache/beam')
    runs-on: [self-hosted, ubuntu-20.04, main]
    timeout-minutes: 30
    name: beam_Publish_Website
    steps:
      - uses: actions/checkout@v4
      - name: Setup environment
        uses: ./.github/actions/setup-environment-action
        with:
          disable-cache: true
      - name: run PostCommit Website Publish script
        uses: ./.github/actions/gradle-command-self-hosted-action
        with:
          gradle-command: :website:clean :website:publishWebsite
          arguments: -PgitPublishRemote="https://github.com/apache/beam.git"
      - uses: actions/checkout@v4 # Extra checkout to make sure we're on master for post steps.


Python ValidatesContainer Dataflow ARM

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Python ValidatesContainer Dataflow ARM

on:
  schedule:
    - cron: '0 */6 * * *'
  workflow_dispatch:

#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
permissions:
  actions: write
  pull-requests: read
  checks: read
  contents: read
  deployments: read
  id-token: none
  issues: read
  discussions: read
  packages: read
  pages: read
  repository-projects: read
  security-events: read
  statuses: read

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.issue.number || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.comment.id || github.event.sender.login }}'
  cancel-in-progress: true

env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
  GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
  GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}

jobs:
  beam_Python_ValidatesContainer_Dataflow_ARM:
    name: ${{ matrix.job_name }} (${{ matrix.job_phrase }} ${{ matrix.python_version }})
    strategy:
      fail-fast: false
      matrix:
        job_name: [beam_Python_ValidatesContainer_Dataflow_ARM]
        job_phrase: [Run Python ValidatesContainer Dataflow ARM]
        python_version: ['3.8','3.9','3.10','3.11','3.12']
    if: |
      github.event_name == 'push' ||
      (github.event_name == 'schedule' && github.repository == 'apache/beam') ||
      github.event_name == 'workflow_dispatch' ||
      startsWith(github.event.comment.body, 'Run Python ValidatesContainer Dataflow ARM')

    runs-on: [self-hosted, ubuntu-20.04, main]
    steps:
      - uses: actions/checkout@v4
      - name: Setup repository
        uses: ./.github/actions/setup-action
        with:
          comment_phrase: ${{ matrix.job_phrase }} ${{ matrix.python_version }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          github_job: ${{ matrix.job_name }} (${{ matrix.job_phrase }} ${{ matrix.python_version }})
      - name: Setup environment
        uses: ./.github/actions/setup-environment-action
        with:
          python-version: ${{ matrix.python_version }}
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2
      - name: GCloud Docker credential helper
        run: |
          gcloud auth configure-docker us.gcr.io
      - name: Set PY_VER_CLEAN
        id: set_py_ver_clean
        run: |
          PY_VER=${{ matrix.python_version }}
          PY_VER_CLEAN=${PY_VER//.}
          echo "py_ver_clean=$PY_VER_CLEAN" >> $GITHUB_OUTPUT
      - name: Generate TAG unique variable based on timestamp
        id: set_tag
        run: echo "TAG=$(date +'%Y%m%d-%H%M%S%N')" >> $GITHUB_OUTPUT
      - name: run Python validatesContainerARM script
        id: run_script
        uses: ./.github/actions/gradle-command-self-hosted-action
        with:
          gradle-command: :sdks:python:test-suites:dataflow:py${{steps.set_py_ver_clean.outputs.py_ver_clean}}:validatesContainerARM
          arguments: |
            -PpythonVersion=${{ matrix.python_version }} \
            -Pcontainer-architecture-list=arm64,amd64 \
            -Pdocker-repository-root=us.gcr.io/apache-beam-testing/github-actions \
            -Pdocker-tag=${{ steps.set_tag.outputs.TAG }} \
            -Ppush-containers \
        env:
          MULTIARCH_TAG: ${{ steps.set_tag.outputs.TAG }}
          USER: github-actions
      - name: Archive Python Test Results
        uses: actions/upload-artifact@v4
        if: failure()
        with:
          name: Python ${{ matrix.python_version }} Test Results
          path: "**/pytest*.xml"


Release Nightly Snapshot

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Release Nightly Snapshot

on:
  schedule:
    - cron: '15 12 * * *'
  workflow_dispatch:

#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
permissions:
  actions: write
  pull-requests: read
  checks: read
  contents: read
  deployments: read
  id-token: none
  issues: read
  discussions: read
  packages: read
  pages: read
  repository-projects: read
  security-events: read
  statuses: read

env:
    DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
    GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
    GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}

jobs:
  beam_Release_NightlySnapshot:
    name: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
    runs-on: [self-hosted, ubuntu-20.04, main]
    strategy:
      matrix:
        job_name: [beam_Release_NightlySnapshot]
        job_phrase: [Release Nightly Snapshot]
    if: |
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'schedule' && github.repository == 'apache/beam')
    steps:
      - uses: actions/checkout@v4
      - name: Setup repository
        uses: ./.github/actions/setup-action
        with:
          github_job: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
          github_token: ${{ secrets.GITHUB_TOKEN }}
          comment_phrase: ${{ matrix.job_phrase }}
      - name: Setup environment
        uses: ./.github/actions/setup-environment-action
        with:
          java-version: default
      - name: Auth on snapshot repository
        run: |
          mkdir -p ${HOME}/.m2
          echo "<settings>
            <servers>
              <server>
                <id>apache.snapshots.https</id>
                <username>${{ secrets.NEXUS_USER }}</username>
                <password>${{ secrets.NEXUS_PW }}</password>
              </server>
            </servers>
          </settings>" > ${HOME}/.m2/settings.xml
      - name: run Publish script
        run: |
          ./gradlew publish --max-workers=8 -Ppublishing -PskipCheckerFramework \
          --continue -Dorg.gradle.jvmargs=-Xms2g -Dorg.gradle.jvmargs=-Xmx6g \
          -Dorg.gradle.vfs.watch=false -Pdocker-pull-licenses


Release Nightly Snapshot Python

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Release Nightly Snapshot Python

on:
  schedule:
    - cron: '15 12 * * *'
  workflow_dispatch:

#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
permissions:
  actions: write
  pull-requests: read
  checks: read
  contents: read
  deployments: read
  id-token: none
  issues: read
  discussions: read
  packages: read
  pages: read
  repository-projects: read
  security-events: read
  statuses: read

env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
  GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
  GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}

jobs:
  beam_Release_Python_NightlySnapshot:
    name: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
    runs-on: [self-hosted, ubuntu-20.04, main]
    strategy:
      matrix:
        job_name: [beam_Release_Python_NightlySnapshot]
        job_phrase: [Release Nightly Snapshot Python]
    if: |
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'schedule' && github.repository == 'apache/beam')
    steps:
      - uses: actions/checkout@v4
      - name: Setup repository
        uses: ./.github/actions/setup-action
        with:
          github_job: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
          github_token: ${{ secrets.GITHUB_TOKEN }}
          comment_phrase: ${{ matrix.job_phrase }}
      - name: Setup environment
        uses: ./.github/actions/setup-environment-action
        with:
          java-version: default
          python-version: default
      - name: run Cleanup script
        uses: ./.github/actions/gradle-command-self-hosted-action
        with:
          gradle-command: :sdks:python:clean
      - name: run Snapshot script
        uses: ./.github/actions/gradle-command-self-hosted-action
        with:
          gradle-command: :sdks:python:buildSnapshot
      - name: Publish Python Artifacts
        run: |
          bash sdks/python/scripts/run_snapshot_publish.sh
        env:
          WORKSPACE: ${{ github.workspace }}


StressTests Java BigQueryIO

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: StressTests Java BigQueryIO

on:
  schedule:
    - cron: '0 10 * * 6'
  workflow_dispatch:

#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
permissions:
  actions: write
  pull-requests: read
  checks: read
  contents: read
  deployments: read
  id-token: none
  issues: read
  discussions: read
  packages: read
  pages: read
  repository-projects: read
  security-events: read
  statuses: read

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.issue.number || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.comment.id || github.event.sender.login }}'
  cancel-in-progress: true

env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
  GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
  GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}
  INFLUXDB_USER: ${{ secrets.INFLUXDB_USER }}
  INFLUXDB_USER_PASSWORD: ${{ secrets.INFLUXDB_USER_PASSWORD }}

jobs:
  beam_StressTests_Java_BigQueryIO:
    if: |
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'schedule' && github.repository == 'apache/beam') ||
      github.event.comment.body == 'Run Stress Tests Java BigQueryIO'
    runs-on: [self-hosted, ubuntu-20.04, highmem]
    timeout-minutes: 720
    name: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
    strategy:
      matrix:
        job_name: ["beam_StressTests_Java_BigQueryIO"]
        job_phrase: ["Run Stress Tests Java BigQueryIO"]
    steps:
      - uses: actions/checkout@v4
      - name: Setup repository
        uses: ./.github/actions/setup-action
        with:
          comment_phrase: ${{ matrix.job_phrase }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          github_job: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
      - name: Setup environment
        uses: ./.github/actions/setup-environment-action
      - name: run BigQuery StressTest Large
        uses: ./.github/actions/gradle-command-self-hosted-action
        with:
          gradle-command: :it:google-cloud-platform:BigQueryStressTestLarge --info -DinfluxHost="http://10.128.0.96:8086" -DinfluxDatabase="beam_test_metrics" -DinfluxMeasurement="java_stress_test_bigquery"


StressTests Java BigTableIO

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: StressTests Java BigTableIO

on:
  schedule:
    - cron: '0 16 * * 6'
  workflow_dispatch:

#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
permissions:
  actions: write
  pull-requests: read
  checks: read
  contents: read
  deployments: read
  id-token: none
  issues: read
  discussions: read
  packages: read
  pages: read
  repository-projects: read
  security-events: read
  statuses: read

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.issue.number || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.comment.id || github.event.sender.login }}'
  cancel-in-progress: true

env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
  GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
  GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}
  INFLUXDB_USER: ${{ secrets.INFLUXDB_USER }}
  INFLUXDB_USER_PASSWORD: ${{ secrets.INFLUXDB_USER_PASSWORD }}

jobs:
  beam_StressTests_Java_BigTableIO:
    if: |
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'schedule' && github.repository == 'apache/beam') ||
      github.event.comment.body == 'Run Stress Tests Java BigTableIO'
    runs-on: [self-hosted, ubuntu-20.04, highmem]
    timeout-minutes: 720
    name: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
    strategy:
      matrix:
        job_name: ["beam_StressTests_Java_BigTableIO"]
        job_phrase: ["Run Stress Tests Java BigTableIO"]
    steps:
      - uses: actions/checkout@v4
      - name: Setup repository
        uses: ./.github/actions/setup-action
        with:
          comment_phrase: ${{ matrix.job_phrase }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          github_job: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
      - name: Setup environment
        uses: ./.github/actions/setup-environment-action
      - name: run BigTable StressTest Large
        uses: ./.github/actions/gradle-command-self-hosted-action
        with:
          gradle-command: :it:google-cloud-platform:BigTableStressTestLarge --info -DinfluxHost="http://10.128.0.96:8086" -DinfluxDatabase="beam_test_metrics" -DinfluxMeasurement="java_stress_test_bigtable"


StressTests Java KafkaIO

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: StressTests Java KafkaIO

on:
  schedule:
    - cron: '0 10 * * 0'
  workflow_dispatch:

#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
permissions:
  actions: write
  pull-requests: read
  checks: read
  contents: read
  deployments: read
  id-token: none
  issues: read
  discussions: read
  packages: read
  pages: read
  repository-projects: read
  security-events: read
  statuses: read

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.issue.number || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.comment.id || github.event.sender.login }}'
  cancel-in-progress: true

env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
  GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
  GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}
  INFLUXDB_USER: ${{ secrets.INFLUXDB_USER }}
  INFLUXDB_USER_PASSWORD: ${{ secrets.INFLUXDB_USER_PASSWORD }}

jobs:
  beam_StressTests_Java_KafkaIO:
    if: |
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'schedule' && github.repository == 'apache/beam') ||
      github.event.comment.body == 'Run Stress Tests Java KafkaIO'
    runs-on: [self-hosted, ubuntu-20.04, highmem]
    timeout-minutes: 720
    name: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
    strategy:
      matrix:
        job_name: ["beam_StressTests_Java_KafkaIO"]
        job_phrase: ["Run Stress Tests Java KafkaIO"]
    steps:
      - uses: actions/checkout@v4
      - name: Setup repository
        uses: ./.github/actions/setup-action
        with:
          comment_phrase: ${{ matrix.job_phrase }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          github_job: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
      - name: Setup environment
        uses: ./.github/actions/setup-environment-action
      - name: Authenticate on GCP
        id: auth
        uses: google-github-actions/auth@v1
        with:
          credentials_json: ${{ secrets.GCP_SA_KEY }}
          project_id: ${{ secrets.GCP_PROJECT_ID }}
      - name: Set k8s access
        uses: ./.github/actions/setup-k8s-access
        with:
          cluster_name: kafka-workflows
          k8s_namespace: ${{ matrix.job_name }}-${{ github.run_id }}
          cluster_zone: us-central1
      - name: Install Kafka
        id: install_kafka
        run: |
          kubectl apply -k ${{ github.workspace }}/.test-infra/kafka/strimzi/02-kafka-persistent/overlays/gke-internal-load-balanced
          kubectl wait kafka beam-testing-cluster --for=condition=Ready --timeout=1800s
      - name: Set up Kafka brokers
        id: set_brokers
        run: |
          declare -a kafka_service_brokers
          declare -a kafka_service_brokers_ports
          for INDEX in {0..2}; do
            kubectl wait svc/beam-testing-cluster-kafka-${INDEX} --for=jsonpath='{.status.loadBalancer.ingress[0].ip}' --timeout=1200s
            kafka_service_brokers[$INDEX]=$(kubectl get svc beam-testing-cluster-kafka-${INDEX} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
            kafka_service_brokers_ports[$INDEX]=$(kubectl get svc beam-testing-cluster-kafka-${INDEX} -o jsonpath='{.spec.ports[0].port}')
            echo "KAFKA_SERVICE_BROKER_${INDEX}=${kafka_service_brokers[$INDEX]}" >> $GITHUB_OUTPUT
            echo "KAFKA_SERVICE_BROKER_PORTS_${INDEX}=${kafka_service_brokers_ports[$INDEX]}" >> $GITHUB_OUTPUT
          done
      - name: run Kafka StressTest Large
        uses: ./.github/actions/gradle-command-self-hosted-action
        with:
          gradle-command: :it:kafka:KafkaStressTestLarge --info -DbootstrapServers="${{ steps.set_brokers.outputs.KAFKA_SERVICE_BROKER_0 }}:${{ steps.set_brokers.outputs.KAFKA_SERVICE_BROKER_PORTS_0 }},${{ steps.set_brokers.outputs.KAFKA_SERVICE_BROKER_1 }}:${{ steps.set_brokers.outputs.KAFKA_SERVICE_BROKER_PORTS_1 }},${{ steps.set_brokers.outputs.KAFKA_SERVICE_BROKER_2 }}:${{ steps.set_brokers.outputs.KAFKA_SERVICE_BROKER_PORTS_2 }}" -DinfluxHost="http://10.128.0.96:8086" -DinfluxDatabase="beam_test_metrics" -DinfluxMeasurement="java_stress_test_kafka"


StressTests Java PubSubIO

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: StressTests Java PubSubIO

on:
  schedule:
    - cron: '0 22 * * 6'
  workflow_dispatch:

#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
permissions:
  actions: write
  pull-requests: read
  checks: read
  contents: read
  deployments: read
  id-token: none
  issues: read
  discussions: read
  packages: read
  pages: read
  repository-projects: read
  security-events: read
  statuses: read

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.issue.number || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.comment.id || github.event.sender.login }}'
  cancel-in-progress: true

env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
  GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
  GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}
  INFLUXDB_USER: ${{ secrets.INFLUXDB_USER }}
  INFLUXDB_USER_PASSWORD: ${{ secrets.INFLUXDB_USER_PASSWORD }}

jobs:
  beam_StressTests_Java_PubSubIO:
    if: |
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'schedule' && github.repository == 'apache/beam') ||
      github.event.comment.body == 'Run Stress Tests Java PubSubIO'
    runs-on: [self-hosted, ubuntu-20.04, highmem]
    timeout-minutes: 720
    name: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
    strategy:
      matrix:
        job_name: ["beam_StressTests_Java_PubSubIO"]
        job_phrase: ["Run Stress Tests Java PubSubIO"]
    steps:
      - uses: actions/checkout@v4
      - name: Setup repository
        uses: ./.github/actions/setup-action
        with:
          comment_phrase: ${{ matrix.job_phrase }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          github_job: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
      - name: Setup environment
        uses: ./.github/actions/setup-environment-action
      - name: run PubSub StressTest Large
        uses: ./.github/actions/gradle-command-self-hosted-action
        with:
          gradle-command: :it:google-cloud-platform:PubSubStressTestLarge --info -DinfluxHost="http://10.128.0.96:8086" -DinfluxDatabase="beam_test_metrics" -DinfluxMeasurement="java_stress_test_pubsub"


StressTests Java SpannerIO

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: StressTests Java SpannerIO

on:
  schedule:
    - cron: '0 22 * * 6'
  workflow_dispatch:

#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
permissions:
  actions: write
  pull-requests: read
  checks: read
  contents: read
  deployments: read
  id-token: none
  issues: read
  discussions: read
  packages: read
  pages: read
  repository-projects: read
  security-events: read
  statuses: read

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: '${{ github.workflow }} @ ${{ github.event.issue.number || github.sha || github.head_ref || github.ref }}-${{ github.event.schedule || github.event.comment.id || github.event.sender.login }}'
  cancel-in-progress: true

env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
  GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
  GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}
  INFLUXDB_USER: ${{ secrets.INFLUXDB_USER }}
  INFLUXDB_USER_PASSWORD: ${{ secrets.INFLUXDB_USER_PASSWORD }}

jobs:
  beam_StressTests_Java_SpannerIO:
    if: |
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'schedule' && github.repository == 'apache/beam') ||
      github.event.comment.body == 'Run Stress Tests Java SpannerIO'
    runs-on: [self-hosted, ubuntu-20.04, highmem]
    timeout-minutes: 720
    name: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
    strategy:
      matrix:
        job_name: ["beam_StressTests_Java_SpannerIO"]
        job_phrase: ["Run Stress Tests Java SpannerIO"]
    steps:
      - uses: actions/checkout@v4
      - name: Setup repository
        uses: ./.github/actions/setup-action
        with:
          comment_phrase: ${{ matrix.job_phrase }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          github_job: ${{ matrix.job_name }} (${{ matrix.job_phrase }})
      - name: Setup environment
        uses: ./.github/actions/setup-environment-action
      - name: run Spanner StressTest Large
        uses: ./.github/actions/gradle-command-self-hosted-action
        with:
          gradle-command: :it:google-cloud-platform:SpannerStressTestLarge --info -DinfluxHost="http://10.128.0.96:8086" -DinfluxDatabase="beam_test_metrics" -DinfluxMeasurement="java_stress_test_spanner"


name: build_release_candidate

# Workflow added after https://github.com/apache/beam/commit/4183e747becebd18becee5fff547af365910fc9c
# If help is needed debugging issues, you can view the release guide at that commit for guidance on how to do this manually.
# (https://github.com/apache/beam/blob/4183e747becebd18becee5fff547af365910fc9c/website/www/site/content/en/contribute/release-guide.md)
on:
  workflow_dispatch:
    inputs:
      RELEASE:
        description: Beam version of current release (e.g. 2.XX.0)
        required: true
        default: '2.XX.0'
      RC:
        description: Integer RC version for the release (e.g. 3 for RC3)
        required: true
      APACHE_ID:
        description: Your Apache id. Required if you want to stage artifacts into https://dist.apache.org/repos/dist/dev/beam/
        required: false
      APACHE_PASSWORD:
        description: Your Apache password. Required if you want to stage artifacts into https://dist.apache.org/repos/dist/dev/beam/
        required: false
      REPO_TOKEN:
        description: |
          Github Personal Access Token with repo permissions if you want to create the beam-site docs PR,
          create a draft release, or upload prism artifacts to that release.
          See https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens.
        default: ''
      STAGE:
        description: |
          Configure which actions this workflow should perform, by setting the desired fields to "yes".
          --
          java_artifacts: publish java artifacts to https://repository.apache.org/#stagingRepositories
          --
          java_source: java source into https://dist.apache.org/repos/dist/dev/beam/
          --
          docker_artifacts: stage SDK docker images to docker hub Apache organization
          --
          python_artifacts: stage the python artifacts into https://dist.apache.org/repos/dist/dev/beam/
          --
          beam_site_pr: create the documentation update PR against apache/beam-site.
          --
          prism: build and upload the artifacts to the release for this tag
        required: true
        default: |
           {java_artifacts: "no",
            java_source: "no",
            docker_artifacts: "no",
            python_artifacts: "no",
            beam_site_pr: "no",
            prism: "no"}

env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
  GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GE_CACHE_USERNAME }}
  GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GE_CACHE_PASSWORD }}

jobs:
  publish_java_artifacts:
    if:  ${{ fromJson(github.event.inputs.STAGE).java_artifacts == 'yes'}}
    runs-on: [self-hosted, ubuntu-20.04, main]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: "v${{ github.event.inputs.RELEASE }}-RC${{ github.event.inputs.RC }}"
          repository: apache/beam
      - name: Install Java 8
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '8'
      - name: Import GPG key
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@111c56156bcc6918c056dbef52164cfa583dc549
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
      - name: Auth for nexus
        run: |
          mkdir -p ${HOME}/.m2
          echo "<settings>
           <servers>
             <server>
               <id>apache.releases.https</id>
               <username>${{ secrets.NEXUS_STAGE_DEPLOYER_USER }}</username>
               <password>${{ secrets.NEXUS_STAGE_DEPLOYER_PW }}</password>
             </server>
             <server>
               <id>apache.snapshots.https</id>
               <username>${{ secrets.NEXUS_USER }}</username>
               <password>${{ secrets.NEXUS_PW }}</password>
             </server>
           </servers>
          </settings>" > ${HOME}/.m2/settings.xml
      - name: Configure git
        run: git config credential.helper store
      - name: Stage Java Artifacts into Maven
        run: ./gradlew publish -Psigning.gnupg.keyName=${{steps.import_gpg.outputs.fingerprint}} -PisRelease --no-daemon --no-parallel

  stage_java_source:
    if:  ${{ fromJson(github.event.inputs.STAGE).java_source == 'yes'}}
    runs-on: ubuntu-latest
    steps:
      - name: Mask Apache Password
        run: |
          # Workaround for Actions bug - https://github.com/actions/runner/issues/643
          APACHE_PASS=$(jq -r '.inputs.APACHE_PASSWORD' $GITHUB_EVENT_PATH)
          echo "::add-mask::$APACHE_PASS"
      - name: Validate apache id/password
        run: |
          if [ "${{ github.event.inputs.APACHE_ID }}" == "" ]
          then
            echo "Must provide an apache id to stage artifacts to https://dist.apache.org/repos/dist/dev/beam/"
          fi
          if [ "${{ github.event.inputs.APACHE_PASSWORD }}" == "" ]
          then
            echo "Must provide an apache password to stage artifacts to https://dist.apache.org/repos/dist/dev/beam/"
          fi
      - name: Install Java 8
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '8'
      - name: Import GPG key
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@111c56156bcc6918c056dbef52164cfa583dc549
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
      - name: stage source
        run: |
            svn co https://dist.apache.org/repos/dist/dev/beam
            mkdir -p beam/${{ github.event.inputs.RELEASE }}
            cd beam/${{ github.event.inputs.RELEASE }}
            RC_DIR="beam-${{ github.event.inputs.RELEASE }}-RC${{ github.event.inputs.RC }}"
            RC_ZIP="${RC_DIR}.zip"
            RELEASE_DIR="beam-${{ github.event.inputs.RELEASE }}"
            RC_TAG="v${{ github.event.inputs.RELEASE }}-RC${{ github.event.inputs.RC }}"
            SOURCE_RELEASE_ZIP="apache-beam-${{ github.event.inputs.RELEASE }}-source-release.zip"
              # Check whether there is an existing dist dir
            if (svn ls "${SOURCE_RELEASE_ZIP}"); then
              echo "Removing existing ${SOURCE_RELEASE_ZIP}."
              svn delete "${SOURCE_RELEASE_ZIP}"
            fi

            echo "Downloading: https://github.com/apache/beam/archive/${RC_TAG}.zip"
            wget https://github.com/apache/beam/archive/${RC_TAG}.zip  -O "${RC_ZIP}"

            unzip "$RC_ZIP"
            rm "$RC_ZIP"
            mv "$RC_DIR" "$RELEASE_DIR"
            zip -r "${SOURCE_RELEASE_ZIP}" "$RELEASE_DIR"
            rm -r "$RELEASE_DIR"

            echo "----Signing Source Release ${SOURCE_RELEASE_ZIP}-----"
            gpg --local-user "${{steps.import_gpg.outputs.name}}" --armor --batch --yes --detach-sig "${SOURCE_RELEASE_ZIP}"

            echo "----Creating Hash Value for ${SOURCE_RELEASE_ZIP}----"
            sha512sum ${SOURCE_RELEASE_ZIP} > ${SOURCE_RELEASE_ZIP}.sha512

            svn add --force .
            svn status
            svn commit -m "Staging Java artifacts for Apache Beam ${{ github.event.inputs.RELEASE }} RC${{ github.event.inputs.RC }}" --non-interactive --username "${{ github.event.inputs.APACHE_ID }}" --password "${{ github.event.inputs.APACHE_PASSWORD }}"

  stage_python_artifacts:
    if:  ${{ fromJson(github.event.inputs.STAGE).python_artifacts == 'yes'}}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Mask Apache Password
        run: |
          # Workaround for Actions bug - https://github.com/actions/runner/issues/643
          APACHE_PASS=$(jq -r '.inputs.APACHE_PASSWORD' $GITHUB_EVENT_PATH)
          echo "::add-mask::$APACHE_PASS"
      - name: Mask apache id/password
        run: |
          if [ "${{ github.event.inputs.APACHE_ID }}" == "" ]
          then
            echo "Must provide an apache id to stage artifacts to https://dist.apache.org/repos/dist/dev/beam/"
          fi
          if [ "${{ github.event.inputs.APACHE_PASSWORD }}" == "" ]
          then
            echo "Must provide an apache password to stage artifacts to https://dist.apache.org/repos/dist/dev/beam/"
          fi
      - name: Setup environment
        uses: ./.github/actions/setup-environment-action
        with:
          python-version: default
      - name: Import GPG key
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@111c56156bcc6918c056dbef52164cfa583dc549
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
      - name: Install dependencies
        run: |
          pip install python-dateutil
          pip install requests
      - name: stage python artifacts
        env:
          RC_TAG: "v${{ github.event.inputs.RELEASE }}-RC${{ github.event.inputs.RC }}"
          GIT_REPO_BASE_URL: https://github.com/apache/beam
          RELEASE_DIR: "beam/${{ github.event.inputs.RELEASE }}"
          RELEASE: "${{ github.event.inputs.RELEASE }}"
          SCRIPT_DIR: release/src/main/scripts
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SVN_ARTIFACTS_DIR: "beam/${{ github.event.inputs.RELEASE }}/python"
        run: |
          svn co https://dist.apache.org/repos/dist/dev/beam
          mkdir -p "${SVN_ARTIFACTS_DIR}"

          git fetch --all --tags --prune
          RELEASE_COMMIT=$(git rev-list -n 1 "tags/${RC_TAG}")

          python "${SCRIPT_DIR}/download_github_actions_artifacts.py" \
            --github-token-var GITHUB_TOKEN \
            --repo-url "apache/beam" \
            --rc-tag "${RC_TAG}" \
            --release-commit "${RELEASE_COMMIT}" \
            --artifacts_dir "${RELEASE_DIR}/python" \
            --yes True

          cd "${RELEASE_DIR}"/python
          ls

          echo "------Checking Hash Value for apache_beam-${RELEASE}.tar.gz-----"
          sha512sum -c "apache_beam-${RELEASE}.tar.gz.sha512"

          echo "------Signing Source Release apache_beam-${RELEASE}.tar.gz------"
          gpg --local-user "${{steps.import_gpg.outputs.name}}" --armor --detach-sig "apache_beam-${RELEASE}.tar.gz"

          for artifact in *.whl; do
            echo "----------Checking Hash Value for ${artifact} wheel-----------"
            sha512sum -c "${artifact}.sha512"
          done

          for artifact in *.whl; do
            echo "------------------Signing ${artifact} wheel-------------------"
            gpg --local-user "${{steps.import_gpg.outputs.name}}" --armor --batch --yes --detach-sig "${artifact}"
          done

          cd ..
          svn add --force python
          svn status
          svn commit -m "Staging Python artifacts for Apache Beam ${RELEASE} RC${RC_NUM}" --non-interactive --username "${{ github.event.inputs.APACHE_ID }}" --password "${{ github.event.inputs.APACHE_PASSWORD }}"

  stage_docker:
    if:  ${{ fromJson(github.event.inputs.STAGE).docker_artifacts == 'yes'}}
    # Note: if this ever changes to self-hosted, remove the "Remove default github maven configuration" step
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: "v${{ github.event.inputs.RELEASE }}-RC${{ github.event.inputs.RC }}"
          repository: apache/beam
      - name: Free Disk Space (Ubuntu)
        uses: jlumbroso/free-disk-space@v1.3.0
      - name: Install Java 11
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '11'
      - name: Install Python 3.8
        uses: actions/setup-python@v5
        with:
          python-version: '3.8'
      - run: echo $JAVA_HOME
      - run: echo "JAVA11_HOME=${JAVA_HOME}" >> "$GITHUB_OUTPUT"
        id: export-java11
      - name: Install Java 8
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '8'
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2
      - name: Remove default github maven configuration
        # This step is a workaround to avoid a decryption issue of Beam's
        # net.linguica.gradle.maven.settings plugin and github's provided maven
        # settings.xml file
        run: rm ~/.m2/settings.xml || true
      - name: Login to Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USER }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Push docker images
        run: ./gradlew :pushAllDockerImages -PisRelease -Pdocker-pull-licenses -Pprune-images -Pdocker-tag=${{ github.event.inputs.RELEASE }}rc${{ github.event.inputs.RC }} -Pjava11Home=${{steps.export-java11.outputs.JAVA11_HOME}} --no-daemon --no-parallel

  beam_site_pr:
    if:  ${{ fromJson(github.event.inputs.STAGE).beam_site_pr == 'yes'}}
    # Note: if this ever changes to self-hosted, remove the "Remove default github maven configuration" step
    runs-on: ubuntu-latest
    env:
      RC_TAG: "v${{ github.event.inputs.RELEASE }}-RC${{ github.event.inputs.RC }}"
      BRANCH_NAME: updates_release_${{ github.event.inputs.RELEASE }}
      BEAM_ROOT_DIR: ${{ github.workspace }}/beam
      SITE_ROOT_DIR: ${{ github.workspace }}/beam-site
    steps:
      - name: Checkout Beam Repo
        uses: actions/checkout@v4
        with:
          ref: "v${{ github.event.inputs.RELEASE }}-RC${{ github.event.inputs.RC }}"
          repository: apache/beam
          path: beam
      - name: Checkout Beam Site Repo
        uses: actions/checkout@v4
        with:
          repository: apache/beam-site
          path: beam-site
          token: ${{ github.event.inputs.REPO_TOKEN }}
          ref: release-docs
      - name: Install Python 3.8
        uses: actions/setup-python@v5
        with:
          python-version: '3.8'
      - name: Install node
        uses: actions/setup-node@v4
        with:
          node-version: '16'
      - name: Install Java 8
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '8'
      - name: Remove default github maven configuration
        # This step is a workaround to avoid a decryption issue of Beam's
        # net.linguica.gradle.maven.settings plugin and github's provided maven
        # settings.xml file
        run: rm ~/.m2/settings.xml || true
      - name: Create documentation commit for website
        run: |
            echo "OK!"
      - name: Build Python Docs
        working-directory: beam/sdks/python
        run: |
            pip install --upgrade pip setuptools wheel
            pip install -U pip
            pip install tox
            # TODO(https://github.com/apache/beam/issues/20209): Don't hardcode py version in this file.
            tox -e docs
            rm -rf target/docs/_build/.doctrees
      - name: Build Typescript Docs
        working-directory: beam/sdks/typescript
        run: |
            npm ci && npm run docs
      - name: Build Java Docs
        working-directory: beam
        run: |
            ./gradlew :sdks:java:javadoc:aggregateJavadoc -PisRelease --no-daemon --no-parallel
      - name: Build YAML Docs
        working-directory: beam
        run: |
            ./gradlew :sdks:python:generateYamlDocs -PisRelease
      - name: Add canonical link into javadocs
        uses: cicirello/javadoc-cleanup@v1
        with:
          path-to-root: beam/sdks/java/javadoc/build/docs/javadoc
          base-url-path: https://beam.apache.org/releases/javadoc/current/
      - name: Consolidate Release Docs to beam-site branch with symlinks
        working-directory: beam-site
        run: |
            git checkout -b $BRANCH_NAME release-docs

            echo "..........Copying generated javadoc into beam-site.........."
            cp -r ${BEAM_ROOT_DIR}/sdks/java/javadoc/build/docs/javadoc/ javadoc/${{ github.event.inputs.RELEASE }}
            # Update current symlink to point to the latest release
            unlink javadoc/current
            ln -s ${{ github.event.inputs.RELEASE }} javadoc/current

            echo "............Copying generated pydoc into beam-site.........."
            cp -r ${BEAM_ROOT_DIR}/sdks/python/target/docs/_build pydoc/${{  github.event.inputs.RELEASE }}
            # Update current symlink to point to the latest release
            unlink pydoc/current
            ln -s ${{ github.event.inputs.RELEASE }} pydoc/current

            echo "............Copying generated typedoc into beam-site.........."
            mkdir -p typedoc
            cp -r ${BEAM_ROOT_DIR}/sdks/typescript/docs typedoc/${{ github.event.inputs.RELEASE }}
            # Update current symlink to point to the latest release
            unlink typedoc/current | true
            ln -s ${{ github.event.inputs.RELEASE }} typedoc/current

            echo "............Copying generated yamldoc into beam-site.........."
            mkdir -p yamldoc/${{ github.event.inputs.RELEASE }}
            cp -r ${BEAM_ROOT_DIR}/sdks/python/build/yaml-ref.html yamldoc/${{ github.event.inputs.RELEASE }}/index.html
            # Update current symlink to point to the latest release
            unlink yamldoc/current | true
            ln -s ${{ github.event.inputs.RELEASE }} yamldoc/current
      - name: Create commit on beam-site branch
        working-directory: beam
        run: |
            # Get the commit from the beam repo, not the beam-site repo.
            RELEASE_COMMIT=$(git rev-list -n 1 "tags/${RC_TAG}")
            cd ${SITE_ROOT_DIR}
            git config user.name $GITHUB_ACTOR
            git config user.email actions@"$RUNNER_NAME".local
            git add -A
            git commit -m "Update beam-site for release ${{ github.event.inputs.RELEASE }}." -m "Content generated from commit ${RELEASE_COMMIT}."
            git push -f --set-upstream origin $BRANCH_NAME
      - name: Create beam-site PR
        working-directory: beam-site
        env:
          GH_TOKEN: ${{ github.event.inputs.REPO_TOKEN }}
          PR_TITLE: "Publish docs for ${{ github.event.inputs.RELEASE }} release"
          PR_BODY: "Content generated from https://github.com/apache/beam/tree/${{ env.RC_TAG }}."
        run: |
            gh pr create -t "$PR_TITLE" -b "$PR_BODY" --base release-docs

  build_and_stage_prism:
    if: ${{ fromJson(github.event.inputs.STAGE).prism == 'yes'}}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: "v${{ github.event.inputs.RELEASE }}-RC${{ github.event.inputs.RC }}"
          repository: apache/beam
      - name: Mask Apache Password
        run: |
          # Workaround for Actions bug - https://github.com/actions/runner/issues/643
          APACHE_PASS=$(jq -r '.inputs.APACHE_PASSWORD' $GITHUB_EVENT_PATH)
          echo "::add-mask::$APACHE_PASS"
      - name: Mask apache id/password
        run: |
          if [ "${{ github.event.inputs.APACHE_ID }}" == "" ]
          then
            echo "Must provide an apache id to stage artifacts to https://dist.apache.org/repos/dist/dev/beam/"
          fi
          if [ "${{ github.event.inputs.APACHE_PASSWORD }}" == "" ]
          then
            echo "Must provide an apache password to stage artifacts to https://dist.apache.org/repos/dist/dev/beam/"
          fi
      - uses: actions/setup-go@v5
        with:
          go-version: '1.22'
          cache-dependency-path: |
             sdks/go.sum
      - name: Import GPG key
        id: import_gpg
        uses: crazy-max/ghaction-import-gpg@111c56156bcc6918c056dbef52164cfa583dc549
        with:
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
      - name: Build prism artifacts
        env:
          RC_TAG: "v${{ github.event.inputs.RELEASE }}-RC${{ github.event.inputs.RC }}"
          GIT_REPO_BASE_URL: https://github.com/apache/beam
          RELEASE_DIR: "beam/${{ github.event.inputs.RELEASE }}"
          RELEASE: "${{ github.event.inputs.RELEASE }}"
          GH_TOKEN: ${{ github.event.inputs.REPO_TOKEN  }}
          SVN_ARTIFACTS_DIR: "beam/${{ github.event.inputs.RELEASE }}/prism"
        run: |
          # TODO stop the action if a non-prerelease release exists
          # TODO create the draft release automatically if none exist.
          # TODO update the draft release's RC tag to current.

          export GH_RELEASE_ID=`gh api \
           -H "Accept: application/vnd.github+json" \
           -H "X-GitHub-Api-Version: 2022-11-28" \
           /repos/apache/beam/releases | jq '.[] | select(.tag_name | contains(env.RC_TAG)) .id'`

          echo "with gh release id $GH_RELEASE_ID for tag $RC_TAG"

          # Store a reference so we can get back to the start.
          ROOT_DIR=`pwd`
          echo "ROOT_DIR=$ROOT_DIR"
          echo "............Checking out Apache Dev Repo.........."

          svn co https://dist.apache.org/repos/dist/dev/beam
          mkdir -p "${SVN_ARTIFACTS_DIR}"

          OUTPUT_DIR=$ROOT_DIR/$SVN_ARTIFACTS_DIR
          mkdir -p $OUTPUT_DIR
          echo "OUTPUT_DIR=$OUTPUT_DIR"

          # Remove existing prism contents from the svn repo.
          cd $OUTPUT_DIR
          rm -rf *
          cd $ROOT_DIR

          # Navigate to the prism command directory.
          cd sdks/go/cmd/prism

          # Store a reference to where we're building from.
          BUILD_DIR=`pwd`

          echo "............Build and stage prism artifacts in the Github Release $GH_RELEASE_ID for tag $RC_TAG.........."

          # Loop through and build desired set from allowed types.
          for OS in linux windows darwin; do
            for ARCH in amd64 arm64; do
              TARGET_DIR="$OUTPUT_DIR/$OS/$ARCH"
              TARGET_NAME="apache_beam-v$RELEASE-prism-$OS-$ARCH"

              mkdir -p "$TARGET_DIR"
              OUTPUT_FILE="$TARGET_DIR/$TARGET_NAME"
              if GOOS=$OS GOARCH=$ARCH CGO_ENABLED=0 go build -trimpath -buildvcs=false -o "$OUTPUT_FILE" . > /dev/null 2>&1; then
                cd $TARGET_DIR
                # Extract real output name. Windows builds automatically have .exe added.
                ARTIFACT=`ls`
                echo "target built - $ARTIFACT"

                ZIP_NAME="$ARTIFACT.zip"
                zip -r $ZIP_NAME $ARTIFACT

                # Sign and hash
                gpg --local-user "${{steps.import_gpg.outputs.name}}" --armor --batch --yes --detach-sig $ZIP_NAME
                sha512sum $ZIP_NAME > "${ZIP_NAME}.sha512"

                # Upload to the release.
                gh release upload $RC_TAG $ZIP_NAME ${ZIP_NAME}.sha512 ${ZIP_NAME}.asc --clobber

                # Remove the binary from the release directory
                rm $ARTIFACT

                # Return to our root build dir.
                cd $BUILD_DIR
              else
                echo "target failed for $OS - $ARCH"
                rm -f "$OUTPUT_FILE"
                exit 1 # Do not continue action
              fi
            done
          done
          echo "...........Prism builds done!..........."
          cd $ROOT_DIR
          cd $RELEASE_DIR

          echo "...........Adding prism artifacts to the Dev Apache SVN repo..........."

          svn add --force --parents prism
          svn status
          svn commit -m "Staging Prism artifacts for Apache Beam ${RELEASE} RC${RC_NUM}" --non-interactive --username "${{ github.event.inputs.APACHE_ID }}" --password "${{ github.event.inputs.APACHE_PASSWORD }}"


Build and Version Runner Docker Image

#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#
name: Build and Version Runner Docker Image

on:
  push:
    branches: ['master']
    paths: ['.github/gh-actions-self-hosted-runners/arc/images/**','.github/workflows/build_runner_image.yml']
  pull_request:
    branches: ['master']
    paths: ['.github/gh-actions-self-hosted-runners/arc/images/**']
  workflow_dispatch:
env:
  docker_registry: us-central1-docker.pkg.dev
  docker_repo: apache-beam-testing/beam-github-actions/beam-arc-runner
jobs:
  build-and-version-runner:
    if: github.repository == 'apache/beam'
    env:
        working-directory: .github/gh-actions-self-hosted-runners/arc/images/
    runs-on: [self-hosted, ubuntu-20.04]

    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        ref: ${{ github.event.pull_request.head.sha }}
    - name: Authenticate on GCP
      if: github.ref == 'refs/heads/master'
      uses: google-github-actions/setup-gcloud@v0
      with:
        service_account_email: ${{ secrets.GCP_SA_EMAIL }}
        service_account_key: ${{ secrets.GCP_SA_KEY }}
        project_id: ${{ secrets.GCP_PROJECT_ID }}
        export_default_credentials: true
    - name: GCloud Docker credential helper
      run: |
        gcloud auth configure-docker ${{env.docker_registry}}
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v1
    - name: Build and Load to docker
      uses: docker/build-push-action@v4
      with:
        context: ${{ env.working-directory }}
        load: true
        tags: |
          ${{env.docker_registry}}/${{env.docker_repo}}:latest
          ${{env.docker_registry}}/${{env.docker_repo}}:${{ github.sha }}
    - name: Push Docker image
      if: github.ref == 'refs/heads/master'
      id: docker_build
      uses: docker/build-push-action@v4
      with:
        context: ${{ env.working-directory }}
        push: true
        tags: |
          ${{env.docker_registry}}/${{env.docker_repo}}:latest
          ${{env.docker_registry}}/${{env.docker_repo}}:${{ github.sha }}