Unit-Test

#
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

name: Unit-Test

on:
  push:
    branches:
      - dev
      - release-*
      - dev-*
    paths-ignore:
      - '**.md'
      - 'deploy/**'
      - 'script/**'
      - 'streampark-console/streampark-console-webapp/**'
  pull_request:

concurrency:
  group: unit-test-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  paths-filter:
    name: Unit-Test-Path-Filter
    runs-on: ubuntu-latest
    outputs:
      not-ignore: ${{ steps.filter.outputs.not-ignore }}
    steps:
      - uses: actions/checkout@v3
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            not-ignore:
              - '!**/*.md'
  license-header:
    name: License header
    runs-on: ubuntu-latest
    if: ${{ (needs.paths-filter.outputs.not-ignore == 'true') || (github.event_name == 'push') }}
    needs: paths-filter
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v3
        with:
          submodules: true
      - name: Check license header
        uses: apache/skywalking-eyes/header@main
  code-style:
    if: github.repository == 'apache/incubator-streampark'
    name: Code style
    runs-on: ubuntu-latest
    needs: license-header
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v3
        with:
          submodules: true
      - name: Check codestyle
        run: ./mvnw -B -q -nsu checkstyle:check spotless:check
  unit-test:
    name: "Unit-Test (java-${{ matrix.java }})"
    runs-on: ubuntu-latest
    needs: code-style
    strategy:
      fail-fast: false
      matrix:
        java: [ 8 , 11 ]
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Set up java ${{ matrix.java }}
        uses: actions/setup-java@v3
        with:
          java-version: ${{ matrix.java }}
          distribution: "adopt"
          cache: "maven"
      - name: Unit-Test with Maven
        run: ./mvnw clean -B test
  result:
    name: Unit-Test - Result
    runs-on: ubuntu-latest
    timeout-minutes: 30
    needs: [ paths-filter, unit-test, license-header, code-style ]
    if: always()
    steps:
      - uses: actions/checkout@v4
      - name: Status
        run: |
          if [[ ${{ needs.paths-filter.outputs.not-ignore }} == 'false' && ${{ github.event_name }} == 'pull_request' ]]; then
            echo "Skip Unit-Test!"
            exit 0
          fi
          if [[ ${{ contains(needs.*.result, 'success') }} != 'true' ]]; then
            echo "Unit-Test Failed!"
            exit -1
          fi


Assign Issue to Project

name: Assign Issue to Project

on:
  issues:
    types: [opened, reopened]
env:
  GITHUB_API_KEY: ${{ secrets.GITHUB_TOKEN }}

jobs:
  Assign-Issue-To-Backlog:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository code
        uses: actions/checkout@v4
      - run: etc/scripts/actions/assign-issue-to-project.sh $GITHUB_REPOSITORY ${{ github.event.issue.number }} Backlog Triage


Create Backport Issues

name: Create Backport Issues

on:
  workflow_dispatch:
    inputs:
      issue:
        description: 'Issue number'
        required: true
      version:
        description: 'Helidon version this issue was reported for'
        required: true
        type: choice
        options:
          - 2.x
          - 3.x
          - 4.x
        default: '2.x'
      target-2:
        type: boolean
        description: 'Port to 2.x?'
        default:  false
      target-3:
        type: boolean
        description: 'Port to 3.x?'
        default: true
      target-4:
        type: boolean
        description: 'Port to 4.x?'
        default: true

env:
  GITHUB_API_KEY: ${{ secrets.GITHUB_TOKEN }}

jobs:
  Issue-Backport:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository code
        uses: actions/checkout@v4
      - run: etc/scripts/actions/create-backport-issues.sh $GITHUB_REPOSITORY ${{ github.event.inputs.issue }} ${{ github.event.inputs.version }} ${{ github.event.inputs.target-2 }} ${{ github.event.inputs.target-3 }} ${{ github.event.inputs.target-4 }}


Release

# Notes
# - cannot run on Windows, as we use shell scripts

name: "Release"

on:
  push:
    branches:
      - 'release-*'
env:
  JAVA_VERSION: '21'
  JAVA_DISTRO: 'oracle'
  MAVEN_HTTP_ARGS: '-Dmaven.wagon.httpconnectionManager.ttlSeconds=60 -Dmaven.wagon.http.retryHandler.count=3'

concurrency:
  group: release-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  copyright:
    timeout-minutes: 10
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set up JDK ${{ env.JAVA_VERSION }}
        uses: actions/setup-java@v4.1.0
        with:
          distribution: ${{ env.JAVA_DISTRO }}
          java-version: ${{ env.JAVA_VERSION }}
          cache: maven
      - name: Copyright
        run: etc/scripts/copyright.sh
  release:
    timeout-minutes: 60
    runs-on: ubuntu-20.04
    environment: release
    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.SERVICE_ACCOUNT_TOKEN }}
          fetch-depth: '0'
      - name: Set up JDK ${{ env.JAVA_VERSION }}
        uses: actions/setup-java@v4.1.0
        with:
          distribution: ${{ env.JAVA_DISTRO }}
          java-version: ${{ env.JAVA_VERSION }}
          cache: maven
      - name: Release
        env:
          GPG_PASSPHRASE: ${{ secrets.HELIDON_GPG_PASSPHRASE }}
          GPG_PRIVATE_KEY: ${{ secrets.HELIDON_GPG_PRIVATE_KEY }}
          GPG_PUBLIC_KEY: ${{ secrets.HELIDON_GPG_PUBLIC_KEY }}
          MAVEN_SETTINGS: ${{ secrets.MAVEN_SETTINGS }}
          RELEASE_WORKFLOW: "true"
        run: |
          git config user.email "helidon-robot_ww@oracle.com"
          git config user.name "Helidon Robot"
          etc/scripts/release.sh release_build
      - name: Upload Staged Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: io-helidon-artifacts-${{ github.ref_name }}
          path: parent/target/nexus-staging/
          retention-days: 90


Snapshot Release

# Perform a snapshot build and deploy to snapshot repository
# Notes
# - cannot run on Windows, as we use shell scripts

name: "Snapshot Release"

on:
  workflow_dispatch:

env:
  JAVA_VERSION: '21'
  JAVA_DISTRO: 'oracle'
  MAVEN_HTTP_ARGS: '-Dmaven.wagon.httpconnectionManager.ttlSeconds=60 -Dmaven.wagon.http.retryHandler.count=3'

concurrency:
  group: release-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  deploy:
    timeout-minutes: 60
    runs-on: ubuntu-20.04
    environment: release
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: '0'
      - name: Set up JDK ${{ env.JAVA_VERSION }}
        uses: actions/setup-java@v4.1.0
        with:
          distribution: ${{ env.JAVA_DISTRO }}
          java-version: ${{ env.JAVA_VERSION }}
          cache: maven
      - name: Build and deploy
        env:
          MAVEN_SETTINGS: ${{ secrets.MAVEN_SETTINGS }}
          RELEASE_WORKFLOW: "true"
        run: |
          etc/scripts/release.sh deploy_snapshot


Validate

# Notes
# - cannot run on Windows, as we use shell scripts
# - removed macos from most jobs to speed up the process

name: "Validate"

on: [pull_request, push]

env:
  JAVA_VERSION: '21'
  JAVA_DISTRO: 'oracle'
  HELIDON_PIPELINES: 'true'
  MAVEN_HTTP_ARGS: '-Dmaven.wagon.httpconnectionManager.ttlSeconds=60 -Dmaven.wagon.http.retryHandler.count=3'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  copyright:
    timeout-minutes: 10
    runs-on: ubuntu-20.04
    steps:
     - uses: actions/checkout@v4
       with:
         fetch-depth: 0
     - name: Set up JDK ${{ env.JAVA_VERSION }}
       uses: actions/setup-java@v4.1.0
       with:
         distribution: ${{ env.JAVA_DISTRO }}
         java-version: ${{ env.JAVA_VERSION }}
         cache: maven
     - name: Copyright
       run: etc/scripts/copyright.sh
  checkstyle:
    timeout-minutes: 10
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK ${{ env.JAVA_VERSION }}
        uses: actions/setup-java@v4.1.0
        with:
          distribution: ${{ env.JAVA_DISTRO }}
          java-version: ${{ env.JAVA_VERSION }}
          cache: maven
      - name: Checkstyle
        run: etc/scripts/checkstyle.sh
  spotbugs:
    timeout-minutes: 45
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK ${{ env.JAVA_VERSION }}
        uses: actions/setup-java@v4.1.0
        with:
          distribution: ${{ env.JAVA_DISTRO }}
          java-version: ${{ env.JAVA_VERSION }}
          cache: maven
      - name: Spotbugs
        run: etc/scripts/spotbugs.sh
  docs:
    timeout-minutes: 30
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK ${{ env.JAVA_VERSION }}
        uses: actions/setup-java@v4.1.0
        with:
          distribution: ${{ env.JAVA_DISTRO }}
          java-version: ${{ env.JAVA_VERSION }}
          cache: maven
      - name: Docs
        run: etc/scripts/docs.sh
  build:
    timeout-minutes: 60
    strategy:
      matrix:
        os: [ ubuntu-20.04 ]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK ${{ env.JAVA_VERSION }}
        uses: actions/setup-java@v4.1.0
        with:
          distribution: ${{ env.JAVA_DISTRO }}
          java-version: ${{ env.JAVA_VERSION }}
          cache: maven
      - name: Maven build
        run: etc/scripts/github-build.sh
  examples:
    timeout-minutes: 40
    strategy:
      matrix:
        os: [ ubuntu-20.04, macos-14 ]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK ${{ env.JAVA_VERSION }}
        uses: actions/setup-java@v4.1.0
        with:
          distribution: ${{ env.JAVA_DISTRO }}
          java-version: ${{ env.JAVA_VERSION }}
          cache: maven
      - uses: graalvm/setup-graalvm@v1
        with:
          java-version: 21
          distribution: graalvm-community
          github-token: ${{ secrets.GITHUB_TOKEN }}
          native-image-job-reports: true
          cache: maven
      - name: Maven build
        run: |
          mvn -B -e "-Dmaven.test.skip=true" $MAVEN_HTTP_ARGS -DskipTests -Ppipeline install
          cd examples
          mvn -B verify
      - name: Test quickstarts native image
        run: etc/scripts/test-quickstarts.sh
  mp-tck:
    timeout-minutes: 60
    name: "MicroProfile TCKs"
    strategy:
      matrix:
        os: [ ubuntu-20.04 ]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK ${{ env.JAVA_VERSION }}
        uses: actions/setup-java@v4.1.0
        with:
          distribution: ${{ env.JAVA_DISTRO }}
          java-version: ${{ env.JAVA_VERSION }}
          cache: maven
      - name: Maven build
        run: etc/scripts/mp-tck.sh
  archetypes:
    timeout-minutes: 45
    strategy:
      matrix:
        os: [ ubuntu-20.04 ]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK ${{ env.JAVA_VERSION }}
        uses: actions/setup-java@v4.1.0
        with:
          distribution: ${{ env.JAVA_DISTRO }}
          java-version: ${{ env.JAVA_VERSION }}
          cache: maven
      - name: Test archetypes
        run: etc/scripts/test-archetypes.sh
  packaging:
    timeout-minutes: 60
    strategy:
      matrix:
        os: [ ubuntu-20.04, macos-14]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - uses: graalvm/setup-graalvm@v1
        with:
          java-version: 21
          distribution: graalvm-community
          github-token: ${{ secrets.GITHUB_TOKEN }}
          native-image-job-reports: true
          cache: maven
      - name: Build Helidon
        run: etc/scripts/github-compile.sh
      - name: JAR packaging
        run: etc/scripts/test-packaging-jar.sh
      - name: JLink packaging
        run: etc/scripts/test-packaging-jlink.sh
      - name: Native-Image packaging
        run: etc/scripts/test-packaging-native.sh


CodeQL

name: "CodeQL"

on:
  push: # Run CodeQL analysis on every push to all branches
  pull_request: # Run CodeQL analysis on every pull request to the repository
  schedule:
    - cron: '0 0 * * *' # Run CodeQL analysis at 00:00 UTC every day

jobs:
  analyze:
    name: Analyze
    runs-on: 'ubuntu-latest'
    timeout-minutes: 360
    permissions:
      security-events: write
      actions: read
      contents: read
    strategy:
      fail-fast: false
      matrix:
        language: [ 'java-kotlin', 'javascript-typescript' ]
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        queries: security-extended,security-and-quality

    - name: Setup JDK 21
      if: ${{ matrix.language == 'java-kotlin' }}
      uses: actions/setup-java@v4
      with:
        distribution: 'oracle'
        java-version: 21

    - name: Build with Maven
      if: ${{ matrix.language == 'java-kotlin' }}
      run: mvn install

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3
      with:
        category: "/language:${{matrix.language}}"


Greetings

name: Greetings

on: [pull_request_target, issues]

jobs:
  welcome:
      runs-on: ubuntu-latest
      steps:
        - uses: actions/checkout@v4
        - uses: EddieHubCommunity/gh-action-community/src/welcome@main
          with:
            github-token: ${{ secrets.GITHUB_TOKEN }}
            issue-message: '
Hello 👋! Thank you very much for raising an issue 🙌! The maintainers will get back to you soon for discussion over the issue! 🚀
'
            pr-message: '
Yeah! You did it 🎉 Now, Relax 😉, Grab a drink ☕, and wait for the maintainers to check your contributions. Meanwhile, you can discuss on other issues and solve them 😀. Thank You 😃!
'
            footer: 'Meanwhile you can also discuss about the project in our Discord Server 😀
'


Deploy Website

# Sample workflow for building and deploying a Next.js site to GitHub Pages
#
# To get started with Next.js see: https://nextjs.org/docs/getting-started
#
name: Deploy Website
defaults:
  run:
    working-directory: "./Website"

on:
  # Runs on pushes targeting the default branch
  push:
    branches: ["master"]
    paths:
      - "Website/**"

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
permissions:
  contents: read
  pages: write
  id-token: write

# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
concurrency:
  group: "pages"
  cancel-in-progress: false

jobs:
  # Build job
  build:
    if: github.repository == 'SaptarshiSarkar12/Drifty'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Detect package manager
        id: detect-package-manager
        run: |
          if [ -f "${{ github.workspace }}/Website/yarn.lock" ]; then
            echo "manager=yarn" >> $GITHUB_OUTPUT
            echo "command=install" >> $GITHUB_OUTPUT
            echo "runner=yarn" >> $GITHUB_OUTPUT
            exit 0
          elif [ -f "${{ github.workspace }}/Website/package.json" ]; then
            echo "manager=npm" >> $GITHUB_OUTPUT
            echo "command=ci" >> $GITHUB_OUTPUT
            echo "runner=npx --no-install" >> $GITHUB_OUTPUT
            exit 0
          else
            echo "Unable to determine package manager"
            exit 1
          fi
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "latest"
          cache: ${{ steps.detect-package-manager.outputs.manager }}
          cache-dependency-path: "./Website/package-lock.json"
      - name: Setup Pages
        uses: actions/configure-pages@v5
      - name: Restore cache
        uses: actions/cache@v4
        with:
          path: |
            .next/cache
          # Generate a new cache whenever packages or source files change.
          key: ${{ runner.os }}-nextjs-${{ hashFiles('**/Website/package-lock.json', '**/Website/yarn.lock') }}-${{ hashFiles('**.[jt]s', '**.[jt]sx') }}
          # If source files changed but packages didn't, rebuild from a prior cache.
          restore-keys: |
            ${{ runner.os }}-nextjs-${{ hashFiles('**/Website/package-lock.json', '**/Website/yarn.lock') }}-
      - name: Install dependencies
        run: ${{ steps.detect-package-manager.outputs.manager }} ${{ steps.detect-package-manager.outputs.command }}
      - name: Build with Next.js
        run: BASE_PATH="/Drifty" ${{ steps.detect-package-manager.outputs.runner }} next build
      - name: Upload artifact
        uses: actions/upload-pages-artifact@v3
        with:
          path: ./Website/out

  # Deployment job
  deploy:
    if: github.repository == 'SaptarshiSarkar12/Drifty'
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    runs-on: ubuntu-latest
    needs: build
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v4


Build and Package Drifty

name: Build and Package Drifty

on:
  push:
    paths-ignore:
      - "Website/**"
      - "*.md"
      - "*.txt"
  pull_request:
    paths-ignore:
      - "Website/**"
      - "*.md"
      - "*.txt"
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  build-Drifty:
    name: Build [${{ matrix.os }}, ${{ matrix.mode }}]
    strategy:
      matrix:
        os: ["windows-latest", "macos-latest", "ubuntu-latest"]
        mode: ["CLI", "GUI"]
      fail-fast: false
    runs-on: ${{ matrix.os }}
    steps:
    - uses: actions/checkout@v4
      with:
        ref: ${{ github.event.pull_request.head.sha }}
      # Setup the Windows build environment
    - name: Add msbuild to PATH
      if: ${{ matrix.os == 'windows-latest' && matrix.mode == 'GUI' }}
      uses: microsoft/setup-msbuild@v2
      with:
        msbuild-architecture: x64
    - name: Visual Studio shell
      if: ${{ matrix.os == 'windows-latest' && matrix.mode == 'GUI' }}
      uses: egor-tensin/vs-shell@v2
    - name: Update system packages
      if: ${{ matrix.os == 'ubuntu-latest' && matrix.mode == 'GUI' }}
      run: sudo apt-get update
    - name: Install required build dependencies for Linux
      if: ${{ matrix.os == 'ubuntu-latest' && matrix.mode == 'GUI' }}
      run: |
        sudo apt-get install libasound2-dev libavcodec-dev libavformat-dev libavutil-dev libfreetype6-dev
        sudo apt-get install libgl-dev libglib2.0-dev libgtk-3-dev libpango1.0-dev libx11-dev libxtst-dev zlib1g-dev
    - name: Set up GraalVM JDK 21
      uses: graalvm/setup-graalvm@v1
      with:
        java-version: '21'
        distribution: 'graalvm'
        github-token: ${{ secrets.GITHUB_TOKEN }}
        set-java-home: true
        cache: 'maven'
    - name: Package Drifty CLI for ${{ matrix.os }} with GraalVM
      if: ${{ matrix.mode == 'CLI' }}
      shell: bash
      run: mvn -P build-drifty-cli-for-${{ matrix.os }} package
    - name: Set Up Maven version 3.8.8 # For GUI build issues, maven version 3.8.8 needs to be used
      if: ${{ matrix.mode == 'GUI' }}
      uses: stCarolas/setup-maven@v5
      with:
        maven-version: 3.8.8
    - name: Build platform-specific C object for missing jdk libraries
      if: ${{ matrix.mode == 'GUI' }}
      shell: bash
      run: gcc -c config/missing_symbols.c -o config/missing_symbols-${{ matrix.os }}.o
    - name: Install dependency modules for GUI
      if: ${{ matrix.mode == 'GUI' }}
      run: mvn -U clean install
    - name: Package Drifty GUI for ${{ matrix.os }} with GluonFX maven plugin
      if: ${{ matrix.mode == 'GUI' }}
      run: mvn -P build-drifty-gui-for-${{ matrix.os }} gluonfx:build gluonfx:package -rf :GUI
    - name: Create Application Type specific folders
      run: |
        mkdir build
        mkdir build/${{ matrix.mode }}
    - name: Categorise build artifacts for linux
      if: ${{ matrix.os == 'ubuntu-latest' }}
      run: |
        if ${{ matrix.mode == 'CLI' }}; then
            mv "CLI/target/CLI/linux/Drifty CLI" "CLI/target/CLI/linux/Drifty-CLI_linux"
            mv "CLI/target/CLI/linux/Drifty-CLI_linux" -t build/CLI
        else
            mv GUI/target/gluonfx/x86_64-linux/GUI "GUI/target/gluonfx/x86_64-linux/Drifty-GUI_linux"
            mv "GUI/target/gluonfx/x86_64-linux/Drifty-GUI_linux" -t build/GUI
        fi
    - name: Categorise build artifacts for windows
      if: ${{ matrix.os == 'windows-latest' }}
      shell: bash
      run: |
        if ${{ matrix.mode == 'CLI' }}; then
            mv "CLI/target/CLI/windows/Drifty CLI.exe" "CLI/target/CLI/windows/Drifty-CLI.exe"
            mv "CLI/target/CLI/windows/Drifty-CLI.exe" build/CLI
        else
            mv GUI/target/gluonfx/x86_64-windows/GUI-1.0.msi "GUI/target/gluonfx/x86_64-windows/Drifty-GUI.msi"
            mv GUI/target/gluonfx/x86_64-windows/GUI.exe "GUI/target/gluonfx/x86_64-windows/Drifty-GUI.exe"
            mv "GUI/target/gluonfx/x86_64-windows/Drifty-GUI.msi" build/GUI
            mv "GUI/target/gluonfx/x86_64-windows/Drifty-GUI.exe" build/GUI
        fi
    - name: Categorise build artifacts for macOS
      if: ${{ matrix.os == 'macos-latest' }}
      run: |
        if ${{ matrix.mode == 'CLI' }}; then
            mv "CLI/target/CLI/macos/Drifty CLI" "CLI/target/CLI/macos/Drifty-CLI_macos"
            mv "CLI/target/CLI/macos/Drifty-CLI_macos" build/CLI
        else
            mv GUI/target/gluonfx/aarch64-darwin/GUI-1.0.0.pkg "GUI/target/gluonfx/aarch64-darwin/Drifty-GUI.pkg"
            mv GUI/target/gluonfx/aarch64-darwin/GUI.app "GUI/target/gluonfx/aarch64-darwin/Drifty-GUI.app"
            mv "GUI/target/gluonfx/aarch64-darwin/Drifty-GUI.pkg" build/GUI
            mv "GUI/target/gluonfx/aarch64-darwin/Drifty-GUI.app" build/GUI
        fi
    - name: Tar build files # To prevent file permission loss
      run: |
        tar -cvf ${{ matrix.os }}-${{ matrix.mode }}.tar build/${{ matrix.mode }}
    - name: Push generated artifacts for ${{ matrix.os }} for ${{ matrix.mode }}
      uses: actions/upload-artifact@v4
      with:
        name: ${{ matrix.os }}-${{ matrix.mode }}-Build-Files
        path: ${{ matrix.os }}-${{ matrix.mode }}.tar

  generate-metadata-and-create-release:
    name: Artifacts Metadata & Release
    runs-on: ubuntu-latest
    needs: build-Drifty
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-tags: true
    - name: Get Drifty version from version.json file
      run: echo "VERSION=$(jq .version version.json | sed -r 's/"//g')" >> $GITHUB_ENV
    - name: Split up Version into semantic parts
      run: |
        echo "VERSION_NUMBER=$(echo $VERSION | cut -d '-' -f1)" >> $GITHUB_ENV
        if [[ $VERSION == *-* ]]; then
            RELEASE_STAGE=$(echo $VERSION | cut -d '-' -f2 | cut -d '.' -f1)
            REVISION_NUMBER=$(echo $VERSION | cut -d '-' -f2 | cut -d '.' -f2)
        else
            RELEASE_STAGE="Stable"
            REVISION_NUMBER=0
        fi
        echo "REVISION_NUMBER=$REVISION_NUMBER" >> $GITHUB_ENV
        if [[ $RELEASE_STAGE == "alpha" ]]; then
            echo "RELEASE_STAGE=Alpha" >> $GITHUB_ENV
        elif [[ $RELEASE_STAGE == "beta" ]]; then
            echo "RELEASE_STAGE=Beta" >> $GITHUB_ENV
        elif [[ $RELEASE_STAGE == "rc" ]]; then
            echo "RELEASE_STAGE=Release Candidate" >> $GITHUB_ENV
        else
            echo "RELEASE_STAGE=Stable" >> $GITHUB_ENV
        fi
    - name: Fetch Previous Release Version
      if: ${{ github.event_name == 'workflow_dispatch' && github.repository == 'SaptarshiSarkar12/Drifty' }}
      run: |
        if ${{ env.RELEASE_STAGE == 'Stable' }}; then
          PREVIOUS_RELEASE_VERSION=$(gh release list --exclude-pre-releases -L 1 --json tagName | grep -o 'v[0-9]*.[0-9]*.[0-9]*')
        else
          if (gh release list -L 1 --json tagName | grep -o 'v[0-9]*.[0-9]*.[0-9]*-[a-z]*[.0-9]*'); then
            PREVIOUS_RELEASE_VERSION=$(gh release list -L 1 --json tagName | grep -o 'v[0-9]*.[0-9]*.[0-9]*-[a-z]*[.0-9]*')
          else
            PREVIOUS_RELEASE_VERSION=$(gh release list -L 1 --json tagName | grep -o 'v[0-9]*.[0-9]*.[0-9]*')
          fi
        fi
        echo "PREVIOUS_RELEASE_VERSION=$PREVIOUS_RELEASE_VERSION" >> $GITHUB_ENV
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Download Build artifacts
      uses: actions/download-artifact@v4
    - name: Make OS specific build directories
      run: |
        mkdir linux
        mkdir macos
        mkdir windows
    - name: Extract build files from tar
      run: |
        tar -xvf ubuntu-latest-CLI-Build-Files/ubuntu-latest-CLI.tar -C linux
        tar -xvf ubuntu-latest-GUI-Build-Files/ubuntu-latest-GUI.tar -C linux
        tar -xvf macos-latest-CLI-Build-Files/macos-latest-CLI.tar -C macos
        tar -xvf macos-latest-GUI-Build-Files/macos-latest-GUI.tar -C macos
        tar -xvf windows-latest-CLI-Build-Files/windows-latest-CLI.tar -C windows
        tar -xvf windows-latest-GUI-Build-Files/windows-latest-GUI.tar -C windows
    - name: Get Size of Build Artifacts
      run: |
        echo "CLI_LINUX_SIZE=$(echo `du -h 'linux/build/CLI/Drifty-CLI_linux'` | sed 's/ .*//')" >> "$GITHUB_ENV"
        echo "GUI_LINUX_SIZE=$(echo `du -h 'linux/build/GUI/Drifty-GUI_linux'` | sed 's/ .*//')" >> "$GITHUB_ENV"
        echo "CLI_MACOS_SIZE=$(echo `du -h 'macos/build/CLI/Drifty-CLI_macos'` | sed 's/ .*//')" >> "$GITHUB_ENV"
        echo "GUI_MACOS_PKG_SIZE=$(echo `du -h 'macos/build/GUI/Drifty-GUI.pkg'` | sed 's/ .*//')" >> "$GITHUB_ENV"
        echo "GUI_MACOS_APP_SIZE=$(echo `du -h 'macos/build/GUI/Drifty-GUI.app'` | sed 's/ .*//')" >> "$GITHUB_ENV"
        echo "CLI_WINDOWS_SIZE=$(echo `du -h 'windows/build/CLI/Drifty-CLI.exe'` | sed 's/ .*//')" >> "$GITHUB_ENV"
        echo "GUI_WINDOWS_MSI_SIZE=$(echo `du -h 'windows/build/GUI/Drifty-GUI.msi'` | sed 's/ .*//')" >> "$GITHUB_ENV"
        echo "GUI_WINDOWS_EXE_SIZE=$(echo `du -h 'windows/build/GUI/Drifty-GUI.exe'` | sed 's/ .*//')" >> "$GITHUB_ENV"
    - name: Generate Artifact metadata summary
      run: |
        if ${{ github.event_name == 'workflow_dispatch' }}; then
            if ${{ env.RELEASE_STAGE == 'Stable' }}; then
                echo "# Drifty v$VERSION Stable Built! :rocket:" >> $GITHUB_STEP_SUMMARY
            else
              echo "# Drifty v${{ env.VERSION_NUMBER }} ${{ env.RELEASE_STAGE }} - Revision ${{ env.REVISION_NUMBER }} Built! :rocket:" >> $GITHUB_STEP_SUMMARY
            fi
        elif ${{ github.event_name == 'pull_request' }}; then
            echo "# Drifty Built! :rocket:" >> $GITHUB_STEP_SUMMARY
        else
            echo "# Drifty v$VERSION Built! :rocket:" >> $GITHUB_STEP_SUMMARY
        fi
        echo "## Build Artifacts :package: Summary :memo:" >> $GITHUB_STEP_SUMMARY

        echo "### Artifacts :package: Generated for Linux :penguin:" >> $GITHUB_STEP_SUMMARY
        echo "| Application Type | Artifact Name | Size |" >> $GITHUB_STEP_SUMMARY
        echo "|------------------|---------------|------|" >> $GITHUB_STEP_SUMMARY
        echo "| CLI | Drifty-CLI_linux | $CLI_LINUX_SIZE |" >> $GITHUB_STEP_SUMMARY
        echo "| GUI | Drifty-GUI_linux | $GUI_LINUX_SIZE |" >> $GITHUB_STEP_SUMMARY

        echo "### Artifacts :package: Generated for macOS :apple:" >> $GITHUB_STEP_SUMMARY
        echo "| Application Type | Artifact Name | Size |" >> $GITHUB_STEP_SUMMARY
        echo "|------------------|---------------|------|" >> $GITHUB_STEP_SUMMARY
        echo "| CLI | Drifty-CLI_macos | $CLI_MACOS_SIZE |" >> $GITHUB_STEP_SUMMARY
        echo "| GUI | Drifty-GUI.pkg | $GUI_MACOS_PKG_SIZE |" >> $GITHUB_STEP_SUMMARY
        echo "| GUI | Drifty-GUI.app | $GUI_MACOS_APP_SIZE |" >> $GITHUB_STEP_SUMMARY

        echo "### Artifacts :package: Generated for Windows :window:" >> $GITHUB_STEP_SUMMARY
        echo "| Application Type | Artifact Name | Size |" >> $GITHUB_STEP_SUMMARY
        echo "|------------------|---------------|------|" >> $GITHUB_STEP_SUMMARY
        echo "| CLI | Drifty-CLI.exe | $CLI_WINDOWS_SIZE |" >> $GITHUB_STEP_SUMMARY
        echo "| GUI | Drifty-GUI.msi | $GUI_WINDOWS_MSI_SIZE |" >> $GITHUB_STEP_SUMMARY
        echo "| GUI | Drifty-GUI.exe | $GUI_WINDOWS_EXE_SIZE |" >> $GITHUB_STEP_SUMMARY
    - name: Create Pre-Release with automated release notes
      if: ${{ github.repository == 'SaptarshiSarkar12/Drifty' && github.ref_name == 'master' && github.event_name == 'workflow_dispatch' && env.RELEASE_STAGE != 'Stable' }}
      run: |
        echo "## Release :bookmark: Drifty v${{ env.VERSION_NUMBER }} ${{ env.RELEASE_STAGE }} - Revision ${{ env.REVISION_NUMBER }}" >> $GITHUB_STEP_SUMMARY
        gh release create v$VERSION --prerelease --generate-notes --notes-start-tag ${{ env.PREVIOUS_RELEASE_VERSION }} 'linux/build/CLI/Drifty-CLI_linux#Drifty-CLI_linux' 'linux/build/GUI/Drifty-GUI_linux#Drifty-GUI_linux' 'macos/build/CLI/Drifty-CLI_macos#Drifty-CLI_macos' 'macos/build/GUI/Drifty-GUI.pkg#Drifty-GUI.pkg' 'windows/build/CLI/Drifty-CLI.exe#Drifty-CLI.exe' 'windows/build/GUI/Drifty-GUI.msi#Drifty-GUI.msi' 'windows/build/GUI/Drifty-GUI.exe#Drifty-GUI.exe' --title "Drifty v${{ env.VERSION_NUMBER }} ${{ env.RELEASE_STAGE }} - Revision ${{ env.REVISION_NUMBER }} Release"
        echo "[Released :white_check_mark: Drifty v${{ env.VERSION_NUMBER }} ${{ env.RELEASE_STAGE }} - Revision ${{ env.REVISION_NUMBER }}](https://github.com/SaptarshiSarkar12/Drifty/releases/tag/v$VERSION) successfully :rocket:!" >> $GITHUB_STEP_SUMMARY
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Create Latest Release with automated release notes
      if: ${{ github.repository == 'SaptarshiSarkar12/Drifty' && github.ref_name == 'master' && github.event_name == 'workflow_dispatch' && env.RELEASE_STAGE == 'Stable' }}
      run: |
        echo "## Release :bookmark: Drifty v$VERSION" >> $GITHUB_STEP_SUMMARY
        gh release create v$VERSION --generate-notes --notes-start-tag ${{ env.PREVIOUS_RELEASE_VERSION }} 'linux/build/CLI/Drifty-CLI_linux#Drifty-CLI_linux' 'linux/build/GUI/Drifty-GUI_linux#Drifty-GUI_linux' 'macos/build/CLI/Drifty-CLI_macos#Drifty-CLI_macos' 'macos/build/GUI/Drifty-GUI.pkg#Drifty-GUI.pkg' 'windows/build/CLI/Drifty-CLI.exe#Drifty-CLI.exe' 'windows/build/GUI/Drifty-GUI.msi#Drifty-GUI.msi' 'windows/build/GUI/Drifty-GUI.exe#Drifty-GUI.exe' --title "Drifty v$VERSION Stable Release"
        echo "[Released :white_check_mark: Drifty v$VERSION Stable](https://github.com/SaptarshiSarkar12/Drifty/releases/tag/v$VERSION) successfully :rocket:!" >> $GITHUB_STEP_SUMMARY
      env:
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}


Labeler

# This workflow will triage pull requests and apply a label based on the
# paths that are modified in the pull request.
#
# To use this workflow, you will need to set up a .github/labeler.yml
# file with configuration.  For more information, see:
# https://github.com/actions/labeler

name: Labeler
on: [pull_request_target]

jobs:
  label:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
    - uses: actions/labeler@v5
      with:
        repo-token: "${{ secrets.GITHUB_TOKEN }}"
        sync-labels: true
        dot: true


Build and publish Docker images

name: Build and publish Docker images

on:
  push:
    branches: [ "**" ]
    paths-ignore:
      - "Website/**"
      - "*.md"
  pull_request_target:
    paths-ignore:
      - "Website/**"
      - "*.md"
  workflow_dispatch:

env:
  REGISTRY: ghcr.io

jobs:
  build:
    runs-on: "ubuntu-latest"
    if: github.repository == 'SaptarshiSarkar12/Drifty'
    strategy:
      matrix:
        docker_context: [CLI, GUI]
        image_name: [ drifty-cli, drifty-gui ]
        exclude:
          - docker_context: CLI
            image_name: drifty-gui
          - docker_context: GUI
            image_name: drifty-cli
      fail-fast: false
    permissions:
      contents: read
      packages: write
      security-events: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Get Drifty version
        run: echo "VERSION=$(jq .version version.json | sed -r 's/"//g')" >> $GITHUB_ENV
      - name: Split up Version into semantic parts
        run: |
          echo "VERSION_NUMBER=$(echo $VERSION | cut -d '-' -f1)" >> $GITHUB_ENV
          if [[ $VERSION == *-* ]]; then
              RELEASE_STAGE_SHORT=$(echo $VERSION | cut -d '-' -f2 | cut -d '.' -f1)
              REVISION_NUMBER=$(echo $VERSION | cut -d '-' -f2 | cut -d '.' -f2)
          else
              RELEASE_STAGE_SHORT="Stable"
              REVISION_NUMBER=0
          fi
          echo "RELEASE_STAGE_SHORT=$RELEASE_STAGE_SHORT" >> $GITHUB_ENV
          echo "REVISION_NUMBER=$REVISION_NUMBER" >> $GITHUB_ENV
          if [[ $RELEASE_STAGE_SHORT == "alpha" ]]; then
              echo "RELEASE_STAGE=Alpha" >> $GITHUB_ENV
          elif [[ $RELEASE_STAGE_SHORT == "beta" ]]; then
              echo "RELEASE_STAGE=Beta" >> $GITHUB_ENV
          elif [[ $RELEASE_STAGE_SHORT == "rc" ]]; then
              echo "RELEASE_STAGE=Release Candidate" >> $GITHUB_ENV
          else
              echo "RELEASE_STAGE=Stable" >> $GITHUB_ENV
          fi
      - name: Update system packages
        if: matrix.docker_context == 'GUI'
        run: sudo apt-get update
      - name: Install build dependencies
        if: matrix.docker_context == 'GUI'
        run: |
          sudo apt-get install libasound2-dev libavcodec-dev libavformat-dev libavutil-dev libfreetype6-dev
          sudo apt-get install libgl-dev libglib2.0-dev libgtk-3-dev libpango1.0-dev libx11-dev libxtst-dev zlib1g-dev
      - name: Set up GraalVM JDK 21
        uses: graalvm/setup-graalvm@v1
        with:
          java-version: '21'
          distribution: 'graalvm'
          github-token: ${{ secrets.GITHUB_TOKEN }}
          set-java-home: true
          cache: 'maven'
      - name: Package Drifty CLI with GraalVM
        if: matrix.docker_context == 'CLI'
        run: mvn -P build-drifty-cli-for-ubuntu-latest package
      - name: Set Up Maven version 3.8.8 # For GUI build issues, maven version 3.8.8 needs to be used
        if: matrix.docker_context == 'GUI'
        uses: stCarolas/setup-maven@v5
        with:
          maven-version: 3.8.8
      - name: Build platform-specific C object for missing jdk libraries
        if: matrix.docker_context == 'GUI'
        run: gcc -c config/missing_symbols.c -o config/missing_symbols-ubuntu-latest.o
      - name: Install dependency modules for GUI
        if: matrix.docker_context == 'GUI'
        run: mvn -U clean install
      - name: Package Drifty GUI with GraalVM
        if: matrix.docker_context == 'GUI'
        run: mvn -P build-drifty-gui-for-ubuntu-latest gluonfx:build gluonfx:package -rf :GUI
      - name: Categorise build artifacts for CLI
        if: matrix.docker_context == 'CLI'
        run: |
          mkdir build
          mkdir build/CLI
          mv "CLI/target/CLI/linux/Drifty CLI" "CLI/target/CLI/linux/Drifty_CLI"
          mv "CLI/target/CLI/linux/Drifty_CLI" -t build/CLI
      - name: Categorise build artifacts for GUI
        if: matrix.docker_context == 'GUI'
        run: |
          mkdir build
          mkdir build/GUI
          mv GUI/target/gluonfx/x86_64-linux/GUI "GUI/target/gluonfx/x86_64-linux/Drifty_GUI"
          mv "GUI/target/gluonfx/x86_64-linux/Drifty_GUI" -t build/GUI

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      # Set up BuildKit Docker container builder to be able to build
      # multi-platform images and export cache
      # https://github.com/docker/setup-buildx-action
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3.3.0

      # Login to GitHub Container Registry
      # https://github.com/docker/login-action
      - name: Log into registry
        uses: docker/login-action@v3.2.0
        if: github.event_name != 'pull_request_target'
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Extract metadata (tags, labels) for Docker
      # https://github.com/docker/metadata-action
      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5.5.1
        with:
          images: |
            ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ matrix.image_name }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=raw,value=alpha,enable=${{ env.RELEASE_STAGE == 'Alpha' && github.event_name == 'workflow_dispatch' && github.repository == 'SaptarshiSarkar12/Drifty' && github.ref_name == 'master' }}
            type=raw,value=beta,enable=${{ env.RELEASE_STAGE == 'Beta' && github.event_name == 'workflow_dispatch' && github.repository == 'SaptarshiSarkar12/Drifty' && github.ref_name == 'master' }}
            type=raw,value=rc,enable=${{ env.RELEASE_STAGE == 'Release Candidate' && github.event_name == 'workflow_dispatch' && github.repository == 'SaptarshiSarkar12/Drifty' && github.ref_name == 'master' }}
            type=raw,value=latest,enable=${{ env.RELEASE_STAGE == 'Stable' && github.event_name == 'workflow_dispatch' && github.repository == 'SaptarshiSarkar12/Drifty' && github.ref_name == 'master' }}
            type=raw,value=${{ env.VERSION }},enable=${{ github.event_name == 'workflow_dispatch' && github.repository == 'SaptarshiSarkar12/Drifty' && github.ref_name == 'master' }}
            type=raw,value=${{ env.VERSION_NUMBER }}-${{ env.RELEASE_STAGE_SHORT }},enable=${{ env.RELEASE_STAGE != 'Stable' && github.event_name == 'workflow_dispatch' && github.repository == 'SaptarshiSarkar12/Drifty' && github.ref_name == 'master' }}
            type=sha
          flavor: |
            latest=false

      - name: Set Image Description prefix
        run: |
          if ${{ github.event_name == 'workflow_dispatch' && github.repository == 'SaptarshiSarkar12/Drifty' && github.ref_name == 'master' }}; then
            echo "IMAGE_DESCRIPTION_PREFIX=The ${{ env.RELEASE_STAGE }}" >> $GITHUB_ENV
          elif ${{ github.event_name == 'push' && github.repository == 'SaptarshiSarkar12/Drifty' }}; then
            echo "IMAGE_DESCRIPTION_PREFIX=The Branch Preview" >> $GITHUB_ENV
          else
            echo "IMAGE_DESCRIPTION_PREFIX=The" >> $GITHUB_ENV
          fi

      # Build and push Docker image with Buildx (don't push on PR and branches created by Dependabot)
      # https://github.com/docker/build-push-action
      - name: Build and push Docker image
        id: build-and-push
        uses: docker/build-push-action@v6.0.2
        with:
          context: build/${{ matrix.docker_context }}
          push: ${{ github.event_name != 'pull_request_target' && github.repository == 'SaptarshiSarkar12/Drifty' && !contains(github.ref_name, 'dependabot') }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          file: Docker/prod/${{ matrix.docker_context }}/Dockerfile
          platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/arm/v6
          outputs: "type=image,name=target,\
            annotation-index.org.opencontainers.image.source=https://github.com/SaptarshiSarkar12/Drifty,\
            annotation-index.org.opencontainers.image.description=${{ env.IMAGE_DESCRIPTION_PREFIX }} docker image for Drifty ${{ matrix.docker_context }},\
            annotation-index.org.opencontainers.image.licenses=Apache-2.0"

      - name: Build same image with different tag # cached build, so, will be faster, and it will be used for security scan
        run: docker build -t ${{ matrix.image_name }} -f Docker/prod/${{ matrix.docker_context }}/Dockerfile build/${{ matrix.docker_context }}

      - name: Run Trivy security scan
        uses: aquasecurity/trivy-action@0.23.0
        continue-on-error: true
        with:
          image-ref: ${{ matrix.image_name }}
          format: 'sarif'
          exit-code: 1
          vuln-type: os,library
          ignore-unfixed: true
          output: 'trivy-report.sarif'
          hide-progress: false
          scanners: vuln,secret,misconfig

      - name: Upload Trivy security scan results
        uses: github/codeql-action/upload-sarif@main
        with:
          sarif_file: trivy-report.sarif


Lint Code Base

name: Lint Code Base

on:
  push:
  pull_request_target:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  build:
    name: Lint Code Base
    if: github.repository == 'SaptarshiSarkar12/Drifty'
    runs-on: ubuntu-latest
    permissions: write-all
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
        with:
          # Full git history is needed to get a proper
          # list of changed files within `super-linter`
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Lint Code Base
        id: lint
        uses: super-linter/super-linter/slim@v6
        continue-on-error: true
        env:
          DEFAULT_BRANCH: master
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CREATE_LOG_FILE: true
          VALIDATE_BASH: false
          VALIDATE_CPP: false
          VALIDATE_CSS: false
          VALIDATE_GITHUB_ACTIONS: false
          VALIDATE_GOOGLE_JAVA_FORMAT: false
          VALIDATE_JAVASCRIPT_STANDARD: false
          VALIDATE_CLANG_FORMAT: false
          VALIDATE_CSHARP: false
          VALIDATE_NATURAL_LANGUAGE: false
          VALIDATE_YAML: false
          VALIDATE_CHECKOV: false
          VALIDATE_SHELL_SHFMT: false
      - name: Set read and write permission in super linter log
        run: sudo chmod 777 super-linter.log
      - name: Upload Lint Result
        uses: actions/upload-artifact@v4
        with:
          name: linter-result
          path: super-linter.log
      - name: Generate Workflow Summary for successful run
        if: ${{ steps.lint.outcome == 'success' }}
        run: |
          echo "## :ballot_box_with_check: Linting passed!" >> $GITHUB_STEP_SUMMARY
      - name: Generate Workflow Summary for failed run
        if: ${{ steps.lint.outcome == 'failure' }}
        run: |
          echo "## :x: Linting errors found!" >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`css" >> $GITHUB_STEP_SUMMARY
          cat super-linter.log | grep "\[ERROR]" | sed 's/[0-9A-Z:.-]\+ [0-9:]\+ //' | sed 's/\[ERROR]//' | sed 's/   //' | sed 's/Error code: [0-9]. Command output://' | sed 's/ //' | sed 's/ERRORSFOUND//' | sed 's/ in [A-Z:]\+//' | sed 's/[[0-9]\+]//' | sed -r "s/\x1B\[(([0-9]+)(;[0-9]+)*)?[m,K,H,f,J]//g" | sed '1,2d' | sed 's/Errorsfound//' | sed 's/\/github\/workspace\///' | awk '!x[$1]++ && ! /^[[:blank:]]*$/' | sed 's/Founderrors when linting [A-Za-z.]\+. Exit code: [0-9].//' | sed 's/Super-linterdetected linting errors//' | tr -s '\n' '\n' >> $GITHUB_STEP_SUMMARY
          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
      - name: Comment on PR for failed run
        if: ${{ steps.lint.outcome == 'failure' && github.event_name == 'pull_request_target' }}
        shell: bash
        run: |
          COMMENT_INITIAL=$(echo -e "## :x: Linting errors found!\n")
          COMMENT_MIDDLE=$(cat super-linter.log | grep "\[ERROR]" | sed 's/[0-9A-Z:.-]\+ [0-9:]\+ //' | sed 's/\[ERROR]//' | sed 's/   //' | sed 's/Error code: [0-9]. Command output://' | sed 's/ //' | sed 's/ERRORSFOUND//' | sed 's/ in [A-Z:]\+//' | sed 's/[[0-9]\+]//' | sed -r "s/\x1B\[(([0-9]+)(;[0-9]+)*)?[m,K,H,f,J]//g" | sed '1,2d' | sed 's/Errorsfound//' | sed 's/\/github\/workspace\///' | awk '!x[$1]++ && ! /^[[:blank:]]*$/' | sed 's/Founderrors when linting [A-Za-z.]\+. Exit code: [0-9].//' | sed 's/Super-linterdetected linting errors//' | tr -s '\n' '\n')
          COMMENT_BODY=$(echo -e "$COMMENT_INITIAL \n @${{ github.event.pull_request.user.login }} Please fix the following errors:\n\n\`\`\`css\n$COMMENT_MIDDLE\n\`\`\`")
          COMMENT=$(echo "$COMMENT_BODY")
          gh pr comment ${{ github.event.pull_request.number }} --body "$COMMENT"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Fail Workflow for failure in linting
        if: ${{ steps.lint.outcome == 'failure' }}
        uses: actions/github-script@v7.0.1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            core.setFailed("Linting errors found! Please check workflow summary for details.")


Format

name: Format

on:
  push:
    paths-ignore:
      - "Website/**"
      - "*.md"
      - "*.txt"
  pull_request:
    paths-ignore:
      - "Website/**"
      - "*.md"
      - "*.txt"
  workflow_dispatch:

jobs:
  formatting:
    name: Format Java files
    runs-on: ubuntu-latest
    permissions: write-all
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Setup JDK 21
        uses: actions/setup-java@v4
        with:
          distribution: 'oracle'
          java-version: 21
      - name: Format Java files
        run: mvn rewrite:run
      - name: Commit changes
        run: |
          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git config --global user.name "github-actions[bot]"
          git add .
          if [[ $(git status --porcelain) ]]; then
             git commit -m "style: Formatted Java files"
          fi
      - name: Push changes
        if: github.event_name != 'pull_request'
        run: git push


Bump Project Version

name: Bump Project Version

on:
  workflow_dispatch:
    inputs:
      new_version:
        description: 'New version to bump to (X.Y.Z)'
        required: true
        type: string
      release_stage:
        description: 'Release stage to bump version for'
        required: true
        type: choice
        options:
          - 'alpha'
          - 'beta'
          - 'rc'
          - 'stable'
      revision_number:
        description: 'Revision number to bump version for'
        required: true
        type: number

jobs:
    bump-version:
      name: Bump Project Version
      runs-on: ubuntu-latest
      steps:
        - name: Checkout Project
          uses: actions/checkout@v4
        - name: Check release stage
          run: |
            if ${{ inputs.release_stage == 'alpha' }}; then
              echo "RELEASE_STAGE=alpha" >> $GITHUB_ENV
            elif ${{ inputs.release_stage == 'beta' }}; then
              echo "RELEASE_STAGE=beta" >> $GITHUB_ENV
            elif ${{ inputs.release_stage == 'rc' }}; then
              echo "RELEASE_STAGE=rc" >> $GITHUB_ENV
            fi
        - name: Generate New Version
          run: |
            if ${{ inputs.release_stage == 'alpha' || inputs.release_stage == 'beta' || inputs.release_stage == 'rc' }}; then
              echo "NEW_VERSION=${{ inputs.new_version }}-${{ env.RELEASE_STAGE }}.${{ inputs.revision_number }}" >> $GITHUB_ENV
            else
              echo "NEW_VERSION=${{ inputs.new_version }}" >> $GITHUB_ENV
            fi
        - name: Bump Project Version
          run: |
            mvn versions:set -D newVersion=${{ env.NEW_VERSION }} -D generateBackupPoms=false
            sed -i 's/\([0-9]\+\.[0-9]\+\.[0-9]\+\(-[a-z]\+\.[0-9]\+\)\?\)/${{ env.NEW_VERSION }}/g' version.json
            sed -i 's/v\([0-9]\+\.[0-9]\+\.[0-9]\+\(-[a-z]\+\.[0-9]\+\)\?\)/v${{ env.NEW_VERSION }}/g' Core/src/main/java/support/Constants.java
            sed -i 's/\([0-9]\+\.[0-9]\+\.[0-9]\+\(-[a-z]\+\.[0-9]\+\)\?\)/${{ env.NEW_VERSION }}/g' GUI/src/darwin/Info.plist
        - name: Commit Version Bump
          run: |
            git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
            git config --global user.name "github-actions[bot]"
            git add .
            if [[ $(git status --porcelain) ]]; then
               if ${{ inputs.release_stage == 'alpha' || inputs.release_stage == 'beta' || inputs.release_stage == 'rc' }}; then
                 git commit -m "chore: Bump Drifty version to ${{ inputs.new_version }} ${{ env.RELEASE_STAGE }} - Revision ${{ inputs.revision_number }}"
               else
                 git commit -m "chore: Bump Drifty version to ${{ inputs.new_version }} Stable"
               fi
            fi
        - name: Push new version
          run: git push


Build Development Docker Images

name: Build Development Docker Images

on:
  push:
    paths-ignore:
      - "Website/**"
      - "*.md"
  pull_request_target:
    paths-ignore:
      - "Website/**"
      - "*.md"
  workflow_dispatch:

jobs:
  build-and-scan:
    name: Build and Scan [drifty-${{ matrix.image_name_suffix }}, ${{ matrix.os }}]
    runs-on: ubuntu-latest
    if: github.repository == 'SaptarshiSarkar12/Drifty'
    strategy:
      matrix:
        os: [ 'ubuntu-latest', 'macos-13', 'macos-latest', 'windows-latest' ] # macos-13 is AMD64 and macos-latest is ARM64
        image_name_suffix: [ 'cli', 'gui' ]
      fail-fast: false
    permissions:
      security-events: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Build Docker image
        run: |
          docker compose build base
          docker compose build runner
          docker compose build ${{ matrix.image_name_suffix }}
      - name: Run Trivy security scan
        uses: aquasecurity/trivy-action@0.23.0
        continue-on-error: true
        with:
          image-ref: drifty-${{ matrix.image_name_suffix }}
          format: 'sarif'
          exit-code: 1
          vuln-type: os,library
          ignore-unfixed: true
          output: 'trivy-report.sarif'
          hide-progress: false
          scanners: vuln,secret,misconfig
      - name: Upload Trivy security scan results
        if: always()
        uses: github/codeql-action/upload-sarif@main
        with:
          sarif_file: trivy-report.sarif


Dependency Review

name: 'Dependency Review'

on:
  pull_request:

permissions:
  contents: read
  pull-requests: write

jobs:
  dependency-review:
    name: Dependency Review
    runs-on: 'ubuntu-latest'
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Dependency Review
        uses: actions/dependency-review-action@v4
        with:
          fail-on-scopes: development, runtime
          comment-summary-in-pr: on-failure
          retry-on-snapshot-warnings: true


SLSA Provenance

# This builds a SLSA provenance statement based on BYOB.
# For now it is under heavy development and is not yet suited for releases.
---
name: SLSA Provenance
on:
  - workflow_dispatch

permissions: read-all

env:
  GH_TOKEN: ${{ github.token }}
  ISSUE_REPOSITORY: ${{ github.repository }}
jobs:
  usetrw:
    permissions:
      contents: write
      id-token: write
      actions: read
      packages: write
    uses: AdamKorcz/java-slsa-generator/.github/workflows/gradle-trw.yml@main
    with:
      rekor-log-public: true
      artifact-list: |
        ./sigstore-java/build/local-maven-repo/dev/sigstore/sigstore-java/GRADLE_VERSION/sigstore-java-GRADLE_VERSION.module,
        ./sigstore-java/build/libs/sigstore-java-GRADLE_VERSION.jar,
        ./sigstore-java/build/local-maven-repo/dev/sigstore/sigstore-java/GRADLE_VERSION/sigstore-java-GRADLE_VERSION.pom,
        ./sigstore-java/build/local-maven-repo/dev/sigstore/sigstore-java/GRADLE_VERSION/sigstore-java-GRADLE_VERSION-sources.jar,
        ./sigstore-java/build/libs/sigstore-java-GRADLE_VERSION-javadoc.jar


Test

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

# This workflow will build a Java project with Gradle and
# cache/restore any dependencies to improve the workflow execution time
# For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-gradle

name: Test

on:
  push:
    branches:
      - '*'
  pull_request:
    branches:
      - main
  workflow_call: # allow this workflow to be called by other workflows

concurrency:
  # On master/release, we don't want any jobs cancelled
  # On PR branches, we cancel the job if new commits are pushed
  # More info: https://stackoverflow.com/a/70972844/1261287
  group: ${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}

jobs:
  build:
    strategy:
      matrix:
        java-version: [11, 17]
      fail-fast: false

    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
    - name: Set up JDK ${{ matrix.java-version }}
      uses: actions/setup-java@v4
      with:
        java-version: ${{ matrix.java-version }}
        distribution: 'temurin'
    - name: Setup Go environment
      uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
      with:
        go-version: '1.21.x'

    # at some point this should just be replaced with something that can bring up a sigstore test env
    - name: Install Fulcio
      run: go install github.com/sigstore/fulcio@main

    - name: Setup Gradle
      uses: gradle/actions/setup-gradle@dbbdc275be76ac10734476cc723d82dfe7ec6eda # v3.4.2

    # tests that hit staging are current disabled due to flakiness (-PskipStaging)
    - name: Test sigstore-java
      run: ./gradlew build -PskipStaging

    - name: Ensure sigstore-java self signing still works
      run: ./gradlew sigstore-java:publishToMavenLocal -Prelease -PskipPgpSigning

    - name: Test sigstore-java/sandbox
      run: |
        cd sandbox
        ./gradlew build


CIFuzz

name: CIFuzz
on: [pull_request]
jobs:
  Fuzzing:
    runs-on: ubuntu-latest
    steps:
    - name: Build Fuzzers
      id: build
      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
      with:
        oss-fuzz-project-name: 'sigstore-java'
        dry-run: false
        language: jvm
    - name: Run Fuzzers
      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
      with:
        oss-fuzz-project-name: 'sigstore-java'
        fuzz-seconds: 1200
        dry-run: false
        language: jvm
    - name: Upload Crash
      uses: actions/upload-artifact@v4
      if: failure() && steps.build.outcome == 'success'
      with:
        name: artifacts
        path: ./out/artifacts


Conformance Tests

name: Conformance Tests

on:
  push:
    branches:
      - '**'
  pull_request:
  # TODO: add cron

jobs:
  conformance:
    strategy:
      max-parallel: 1
      matrix:
        java-version: [11, 17]
        sigstore-env: [production, staging]
      fail-fast: false

    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Set up JDK ${{ matrix.java-version }}
        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
        with:
          java-version: ${{ matrix.java-version }}
          distribution: 'temurin'

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v3

      - name: Build sigstore-java cli
        run: ./gradlew :sigstore-cli:build

      - name: Unpack sigstore-java distribution
        run: tar -xvf ${{ github.workspace }}/sigstore-cli/build/distributions/sigstore-cli-*.tar --strip-components 1

      - uses: sigstore/sigstore-conformance@ee4de0e602873beed74cf9e49d5332529fe69bf6 # v0.0.11
        with:
          entrypoint: ${{ github.workspace }}/bin/sigstore-cli
          environment: ${{ matrix.sigstore-env }}
          xfail: "test_verify_dsse_bundle_with_trust_root"


Dependency Review

#
# Copyright 2022 The Sigstore Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
name: 'Dependency Review'
on: [pull_request]

permissions:
  contents: read

jobs:
  dependency-review:
    name: License and Vulnerability Scan
    uses: sigstore/community/.github/workflows/reusable-dependency-review.yml@f7210b0c38d4220003eba8f6ff321011079a0b4a


Validate Gradle Wrapper

name: "Validate Gradle Wrapper"
on: [push, pull_request]

jobs:
  validation:
    name: "Validation"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      # allstar complains if we don't use tags here (https://github.com/ossf/scorecard/issues/2477)
      - uses: gradle/wrapper-validation-action@v3


name: Release sigstore gradle plugins to Gradle Plugin Portal
on:
  workflow_dispatch:

jobs:
  process-tag:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - name: checkout tag
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      - name: process tag
        id: version
        run: |
          TAG=${{ github.ref_name }}
          echo "version=${TAG#"v"}" >> $GITHUB_OUTPUT
      - name: verify tag matches gradle version
        run: |
          set -Eeo pipefail
          version=$(grep "^version=" gradle.properties | cut -d'=' -f2)
          if [[ ! "$version" == "${{ steps.version.outputs.version }}" ]]; then
            echo "tagged version ${{ github.ref }} (as ${{ steps.version.outputs.version }}) does not match gradle.properties $version"
            exit 1
          fi

  ci:
    needs: [process-tag]
    permissions:
      id-token: write # To run github oidc tests
    uses: ./.github/workflows/ci.yaml

  build:
    permissions:
      id-token: write # To sign the artifacts
    runs-on: ubuntu-latest
    needs: [ci]
    steps:
      - name: Checkout tag
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Set up JDK 11
        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
        with:
          java-version: 11
          distribution: 'temurin'

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@dbbdc275be76ac10734476cc723d82dfe7ec6eda # v3.4.2

      - name: Build, Sign and Release to Gradle Plugin Portal
        run: |
          ./gradlew publishPlugins -Prelease -Pgradle.publish.key=$GRADLE_PUBLISH_KEY -Pgradle.publish.secret=$GRADLE_PUBLISH_SECRET
        env:
          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.PGP_PRIVATE_KEY }}
          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.PGP_PASSPHRASE }}
          GRADLE_PUBLISH_KEY: ${{ secrets.GRADLE_PUBLISH_KEY }}
          GRADLE_PUBLISH_SECRET: ${{ secrets.GRADLE_PUBLISH_SECRET }}


Release sigstore-java to Maven Central

name: Release sigstore-java to Maven Central
on:
  workflow_dispatch:
  # user is expected to use a tag as the branch to run the action on

jobs:
  process-tag:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - name: checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      - name: process tag
        id: version
        run: |
          TAG=${{ github.ref_name }}
          echo "version=${TAG#"v"}" >> $GITHUB_OUTPUT
      - name: verify tag matches gradle version
        run: |
          set -Eeo pipefail
          version=$(grep "^version=" gradle.properties | cut -d'=' -f2)
          if [[ ! "$version" == "${{ steps.version.outputs.version }}" ]]; then
            echo "tagged version ${{ github.ref }} (as ${{ steps.version.outputs.version }}) does not match gradle.properties $version"
            exit 1
          fi

  ci:
    needs: [process-tag]
    permissions:
      id-token: write # To run github oidc tests
    uses: ./.github/workflows/ci.yaml

  build:
    permissions:
      id-token: write # To sign the artifacts
    runs-on: ubuntu-latest
    needs: [ci]
    steps:
      - name: checkout tag
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Set up JDK 11
        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
        with:
          java-version: 11
          distribution: 'temurin'

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@dbbdc275be76ac10734476cc723d82dfe7ec6eda # v3.4.2

      - name: Build, Sign and Release to Maven Central
        run: |
          ./gradlew clean :sigstore-java:publishMavenJavaPublicationToSonatypeRepository -Prelease
        env:
          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.PGP_PRIVATE_KEY }}
          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.PGP_PASSPHRASE }}
          ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.SONATYPE_USERNAME }}
          ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.SONATYPE_PASSWORD }}

  create-release-on-github:
    runs-on: ubuntu-latest
    needs: [build]
    permissions:
      contents: write
    steps:
      - name: Create release
        uses: softprops/action-gh-release@69320dbe05506a9a39fc8ae11030b214ec2d1f87 # v2.0.5
        with:
          tag_name: ${{ github.ref_name }}
          body: "See [CHANGELOG.md](https://github.com/${{ github.repository }}/blob/main/CHANGELOG.md) for more details."


Label when approved workflow run

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#
---
name: Label when approved workflow run
on:
  workflow_run:
    workflows: ["Label when reviewed"]
    types: ['requested']
permissions:
  # All other permissions are set to none
  checks: write
  contents: read
  pull-requests: write

jobs:

  label-when-approved:
    name: "Label when approved"
    runs-on: ubuntu-latest
    outputs:
      isApprovedByCommiters: ${{ steps.label-when-approved-by-commiters.outputs.isApproved }}
      isApprovedByAnyone: ${{ steps.label-when-approved-by-anyone.outputs.isApproved }}
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@v2
        with:
          persist-credentials: false
          submodules: recursive
      - name: "Get information about the original trigger of the run"
        uses: ./.github/actions/get-workflow-origin
        id: source-run-info
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          sourceRunId: ${{ github.event.workflow_run.id }}
      - name: Label when approved by commiters
        uses: ./.github/actions/label-when-approved-action
        id: label-when-approved-by-commiters
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          label: 'approved'
          require_committers_approval: 'true'
          remove_label_when_approval_missing: 'true'
          pullRequestNumber: ${{ steps.source-run-info.outputs.pullRequestNumber }}
          comment: 'PR approved by at least one committer and no changes requested.'
      - name: Label when approved by anyone
        uses: ./.github/actions/label-when-approved-action
        id: label-when-approved-by-anyone
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          label: 'reviewed'
          pullRequestNumber: ${{ steps.source-run-info.outputs.pullRequestNumber }}
          comment: 'PR approved by anyone and no changes requested.'


Label when reviewed

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#
---
name: Label when reviewed
on: pull_request_review
jobs:

  label-when-reviewed:
    name: "Label PRs when reviewed"
    runs-on: ubuntu-latest
    steps:
      - name: "Do nothing. Only trigger corresponding workflow_run event"
        run: echo


License Check

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#
---
name: License Check
on:
  pull_request_target:
  push:
    branches:
      - master
jobs:
  license-check:
    name: "License Check"
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        if: ${{ github.event_name != 'pull_request_target' }}
        uses: actions/checkout@v3

      - name: Checkout ${{ github.ref }} ( ${{ github.event.pull_request.head.sha }} )
        if: ${{ github.event_name == 'pull_request_target' }}
        uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Check License
        uses: apache/skywalking-eyes@v0.2.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


Code Formatter

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#

---
name: Code Formatter

on: [push, pull_request_target]

jobs:
  clang-format:
    name: "Clang Formatter"
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        if: ${{ github.event_name != 'pull_request_target' }}
        uses: actions/checkout@v3
        with:
          persist-credentials: false

      - name: Checkout ${{ github.ref }} ( ${{ github.event.pull_request.head.sha }} )
        if: ${{ github.event_name == 'pull_request_target' }}
        uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Checkout paths-filter
        run: |
          rm -rf ./.github/actions/paths-filter
          git clone https://github.com/dorny/paths-filter .github/actions/paths-filter

          pushd .github/actions/paths-filter &>/dev/null
          git checkout 4512585405083f25c027a35db413c2b3b9006d50
          popd &>/dev/null

      - name: Paths filter
        uses: ./.github/actions/paths-filter
        id: filter
        with:
          filters: |
            changes:
              - 'be/src/**'
              - 'be/test/**'
              - 'cloud/src/**'
              - 'cloud/test/**'

      - name: Checkout clang-format-lint-action
        run: |
          rm -rf ./.github/actions/clang-format-lint-action
          git clone https://github.com/DoozyX/clang-format-lint-action .github/actions/clang-format-lint-action

          pushd .github/actions/clang-format-lint-action &>/dev/null
          git checkout 6adbe14579e5b8e19eb3e31e5ff2479f3bd302c7
          popd &>/dev/null

      - name: "Format it!"
        if: ${{ steps.filter.outputs.changes == 'true' }}
        uses: ./.github/actions/clang-format-lint-action
        id: clang_format
        with:
          source: "be/src be/test cloud/src cloud/test"
          clangFormatVersion: 16
          inplace: False

      - name: Ignore it!
        if: ${{ steps.filter.outputs.changes == 'false' }}
        run: echo 'No need to check.'


Build Extensions

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#
---
name: Build Extensions

on:
  pull_request:

concurrency:
  group: ${{ github.ref }} (Build Extensions)
  cancel-in-progress: true

jobs:
  changes:
    name: Detect Changes
    runs-on: ubuntu-latest
    outputs:
      broker_changes: ${{ steps.filter.outputs.broker_changes }}
      docs_changes: ${{ steps.filter.outputs.docs_changes }}
    steps:
      - name: Checkout ${{ github.ref }}
        uses: actions/checkout@v3
        with:
          persist-credentials: false
          submodules: recursive

      - name: Paths filter
        uses: ./.github/actions/paths-filter
        id: filter
        with:
          filters: |
            broker_changes:
              - 'fs_brokers/**'
            docs_changes:
              - 'docs/**'
  build-broker:
    name: Build Broker
    needs: changes
    if: ${{ needs.changes.outputs.broker_changes == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout ${{ github.ref }}
        uses: actions/checkout@v3

      - name: Setup java
        uses: actions/setup-java@v2
        with:
          distribution: adopt
          java-version: '17'

      - name: Setup thrift
        run: |
          pushd thirdparty
          branch="${{ github.base_ref }}"
          if [[ -z "${branch}" ]] || [[ "${branch}" == 'master' ]]; then
            curl -L https://github.com/apache/doris-thirdparty/releases/download/automation/doris-thirdparty-prebuilt-linux-x86_64.tar.xz \
              -o doris-thirdparty-prebuilt-linux-x86_64.tar.xz
          else
            curl -L "https://github.com/apache/doris-thirdparty/releases/download/automation-${branch/branch-/}/doris-thirdparty-prebuilt-linux-x86_64.tar.xz" \
              -o doris-thirdparty-prebuilt-linux-x86_64.tar.xz
          fi
          tar -xvf doris-thirdparty-prebuilt-linux-x86_64.tar.xz
          popd
          export PATH="${DEFAULT_DIR}/ldb-toolchain/bin/:$(pwd)/thirdparty/installed/bin/:${PATH}"

          thrift --version
          # mkdir -p thirdparty/installed/bin/
          # cd thirdparty/installed/bin/ && ln -s /usr/bin/thrift thrift
      - name: Build broker
        run: |
          cd fs_brokers/apache_hdfs_broker/ && /bin/bash build.sh
  # build-docs:
  #   name: Build Documents
  #   needs: changes
  #   if: ${{ needs.changes.outputs.docs_changes == 'true' }}
  #   runs-on: ubuntu-latest
  #   steps:
  #     - name: Checkout ${{ github.ref }}
  #       uses: actions/checkout@v3

  #     - name: Build docs
  #       run: |
  #         cd docs && /bin/bash build_help_zip.sh
  #     - name: Build
  #       run: |
  #         git clone https://github.com/apache/doris-website.git website
  #         cd website
  #         echo "[\"current\"]" > versions.json
  #         mkdir -p docs
  #         cp -R ../docs/en/docs/* docs/
  #         cp -R ../docs/sidebars.json sidebars.json
  #         mkdir -p i18n/zh-CN/docusaurus-plugin-content-docs/current
  #         cp -R ../docs/zh-CN/docs/* i18n/zh-CN/docusaurus-plugin-content-docs/current/
  #         cp -R ../docs/dev.json i18n/zh-CN/docusaurus-plugin-content-docs/current.json

  #         mkdir -p community
  #         cp -R ../docs/en/community/* community/
  #         mkdir -p i18n/zh-CN/docusaurus-plugin-content-docs-community/current/
  #         cp -R ../docs/zh-CN/community/* i18n/zh-CN/docusaurus-plugin-content-docs-community/current/
  #         cp -R ../docs/sidebarsCommunity.json .

  #         cp -R ../docs/images static/
  #         npm install -g yarn
  #         yarn cache clean
  #         yarn && yarn build
  #         cd ../
  #         rm -rf website


Add Scope Labeler

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#
---
name: Add Scope Labeler

on:
  pull_request_target:
    types:
      - opened
      - synchronize

jobs:
  process:
    name: Process
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Assign GitHub labels
        if: |
          github.event_name == 'pull_request_target' &&
            (github.event.action == 'opened' ||
             github.event.action == 'synchronize')
        uses: actions/labeler@2.2.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          configuration-path: .github/workflows/labeler/scope-label-conf.yml
          sync-labels: true


FE Code Style Checker

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#
---
name: FE Code Style Checker

on:
  pull_request:

jobs:
  java-checkstyle:
    name: "CheckStyle"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          persist-credentials: false
          submodules: recursive

      - name: Paths Filter
        uses: ./.github/actions/paths-filter
        id: filter
        with:
          filters: |
            fe_changes:
              - 'fe/**'
              - 'gensrc/proto/**'
              - 'gensrc/thrift/**'

      - name: Setup Maven Action
        if: steps.filter.outputs.fe_changes == 'true'
        uses: ./.github/actions/setup-maven
        with:
          maven-version: 3.8.4

      - name: Run java checkstyle
        if: steps.filter.outputs.fe_changes == 'true'
        run:
          cd fe && mvn clean checkstyle:check


Close stale PRs

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#
---
name: Close stale PRs

on:
  schedule:
  - cron: "0 0 * * *"

jobs:
  stale:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/stale@c201d45ef4b0ccbd3bb0616f93bae13e73d0a080 # pin@v1.1.0
      with:
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        stale-pr-message: >
          We're closing this PR because it hasn't been updated in a while.

          This isn't a judgement on the merit of the PR in any way. It's just
          a way of keeping the PR queue manageable.

          If you'd like to revive this PR, please reopen it and feel free a
          maintainer to remove the Stale tag!
        days-before-stale: 180
        # Setting this to 0 is the same as setting it to 1.
        # See: https://github.com/actions/stale/issues/28
        days-before-close: 0


Check PR title

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#
---
name: 'Check PR title'

on:
  pull_request:
    types: [ opened, edited ]

jobs:
  PR-title-checker:
    name: "PR title checker"
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@v2
        with:
          persist-credentials: false
          submodules: recursive
      - name: Check Title
        uses: ./.github/actions/action-pr-title
        with:
          regex: '\[([a-zA-Z0-9 \-_])+\]\(([a-zA-Z0-9 \-_])+\)(.*)'
          github_token: ${{ github.token }}


BE UT (macOS)

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

name: BE UT (macOS)

on:
  pull_request:
  schedule:
    - cron: '0 4,10,16,22 * * *'    # schedule it periodically to share the cache

concurrency:
  group: ${{ github.ref }} (BE UT macOS)
  cancel-in-progress: true

jobs:
  run-ut:
    name: BE UT (macOS)
    runs-on: macos-13
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          persist-credentials: false
          submodules: recursive

      - name: Paths Filter
        if: ${{ github.event_name != 'schedule' }}
        uses: ./.github/actions/paths-filter
        id: filter
        with:
          filters: |
            be_changes:
              - 'be/**'
              - 'gensrc/proto/**'
              - 'gensrc/thrift/**'

      - name: Ccache ${{ github.ref }}
        if: ${{ github.event_name == 'schedule' || steps.filter.outputs.be_changes == 'true' }}
        uses: ./.github/actions/ccache-action
        with:
          key: BE-UT-macOS
          max-size: "5G"
          restore-keys: BE-UT-macOS-

      - name: Run UT ${{ github.ref }}
        if: ${{ github.event_name == 'schedule' || steps.filter.outputs.be_changes == 'true' }}
        run: |
          cellars=(
            'm4'
            'automake'
            'autoconf'
            'libtool'
            'pkg-config'
            'texinfo'
            'coreutils'
            'gnu-getopt'
            'python@3'
            'cmake'
            'ninja'
            'ccache'
            'bison'
            'byacc'
            'gettext'
            'wget'
            'pcre'
            'openjdk@11'
            'maven'
            'node'
            'llvm@16'
          )
          brew install "${cellars[@]}" || true

          pushd thirdparty
          branch="${{ github.base_ref }}"
          if [[ -z "${branch}" ]] || [[ "${branch}" == 'master' ]]; then
            curl -L https://github.com/apache/doris-thirdparty/releases/download/automation/doris-thirdparty-prebuilt-darwin-x86_64.tar.xz \
              -o doris-thirdparty-prebuilt-darwin-x86_64.tar.xz
          else
            curl -L "https://github.com/apache/doris-thirdparty/releases/download/automation-${branch/branch-/}/doris-thirdparty-prebuilt-darwin-x86_64.tar.xz" \
              -o doris-thirdparty-prebuilt-darwin-x86_64.tar.xz
          fi
          tar -xvf doris-thirdparty-prebuilt-darwin-x86_64.tar.xz
          popd

          export JAVA_HOME="${JAVA_HOME_17_X64%\/}"
          ./run-be-ut.sh --run -j "$(nproc)" --clean


Build Third Party Libraries

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

name: Build Third Party Libraries

on:
  pull_request:

concurrency:
  group: ${{ github.ref }} (Build Third Party Libraries)
  cancel-in-progress: true

jobs:
  changes:
    name: Detect Changes
    runs-on: ubuntu-latest
    outputs:
      thirdparty_changes: ${{ steps.filter.outputs.thirdparty_changes }}
    steps:
      - name: Checkout ${{ github.ref }}
        uses: actions/checkout@v4
        with:
          persist-credentials: false
          submodules: recursive

      - name: Paths filter
        uses: ./.github/actions/paths-filter
        id: filter
        with:
          filters: |
            thirdparty_changes:
              - 'thirdparty/**'

  build_linux:
    name: Build Third Party Libraries (Linux)
    needs: changes
    if: ${{ needs.changes.outputs.thirdparty_changes == 'true' }}
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout easimon/maximize-build-space
        run: |
          git clone -b v7 https://github.com/easimon/maximize-build-space

      - name: Maximize build space
        uses: ./maximize-build-space
        with:
            root-reserve-mb: 4096
            swap-size-mb: 8192
            remove-dotnet: 'true'
            remove-android: 'true'
            remove-haskell: 'true'
            remove-codeql: 'true'
            remove-docker-images: 'true'

      - name: Checkout ${{ github.ref }}
        uses: actions/checkout@v4

      - name: Download
        run: |
          cd thirdparty
          curl -L https://github.com/apache/doris-thirdparty/releases/download/automation/doris-thirdparty-source.tgz \
            -o doris-thirdparty-source.tgz
          tar -zxvf doris-thirdparty-source.tgz

      - name: Prepare
        run: |
          export DEFAULT_DIR='/opt/doris'
          export PATH="${DEFAULT_DIR}/ldb-toolchain/bin:${PATH}"

          packages=(
            'build-essential'
            'automake'
            'autoconf'
            'libtool-bin'
            'pkg-config'
            'cmake'
            'ninja-build'
            'ccache'
            'python-is-python3'
            'bison'
            'byacc'
            'flex'
            'binutils-dev'
            'libiberty-dev'
            'curl'
            'git'
            'zip'
            'unzip'
            'autopoint'
            'openjdk-8-jdk'
            'openjdk-8-jdk-headless'
            'maven'
          )

          sudo apt update
          sudo DEBIAN_FRONTEND=noninteractive apt install --yes "${packages[@]}"

          mkdir -p "${DEFAULT_DIR}"
          wget https://github.com/amosbird/ldb_toolchain_gen/releases/download/v0.18/ldb_toolchain_gen.sh \
            -q -O /tmp/ldb_toolchain_gen.sh
          bash /tmp/ldb_toolchain_gen.sh "${DEFAULT_DIR}/ldb-toolchain"

      - name: Build
        run: |
          export DEFAULT_DIR='/opt/doris'
          export PATH="${DEFAULT_DIR}/ldb-toolchain/bin:${PATH}"
          export PATH="$(find /usr/lib/jvm/java-8-openjdk* -maxdepth 1 -type d -name 'bin'):${PATH}"
          export JAVA_HOME="$(find /usr/lib/jvm/java-8-openjdk* -maxdepth 0)"
          export DORIS_TOOLCHAIN=gcc

          cd thirdparty
          ./build-thirdparty.sh -j "$(nproc)"

  build_macos:
    name: Build Third Party Libraries (macOS)
    needs: changes
    if: ${{ needs.changes.outputs.thirdparty_changes == 'true' }}
    runs-on: macos-13
    steps:
      - name: Checkout ${{ github.ref }}
        uses: actions/checkout@v4

      - name: Download
        run: |
          cd thirdparty
          curl -L https://github.com/apache/doris-thirdparty/releases/download/automation/doris-thirdparty-source.tgz \
            -o doris-thirdparty-source.tgz
          tar -zxvf doris-thirdparty-source.tgz

      - name: Prepare
        run: |
          packages=(
            'm4'
            'automake'
            'autoconf'
            'libtool'
            'pkg-config'
            'texinfo'
            'coreutils'
            'gnu-getopt'
            'python@3'
            'cmake'
            'ninja'
            'ccache'
            'bison'
            'byacc'
            'gettext'
            'wget'
            'pcre'
            'openjdk@11'
            'maven'
            'node'
            'llvm@16'
          )

          brew install "${packages[@]}" || true

      - name: Build
        run: |
          export MACOSX_DEPLOYMENT_TARGET=12.0

          cd thirdparty
          ./build-thirdparty.sh -j "$(nproc)"

  build_macos_arm64:
    name: Build Third Party Libraries (macOS-arm64)
    needs: changes
    if: ${{ needs.changes.outputs.thirdparty_changes == 'true' }}
    runs-on: macos-14
    steps:
      - name: Checkout ${{ github.ref }}
        uses: actions/checkout@v4

      - name: Download
        run: |
          cd thirdparty
          curl -L https://github.com/apache/doris-thirdparty/releases/download/automation/doris-thirdparty-source.tgz \
            -o doris-thirdparty-source.tgz
          tar -zxvf doris-thirdparty-source.tgz

      - name: Prepare
        run: |
          packages=(
            'm4'
            'automake'
            'autoconf'
            'libtool'
            'pkg-config'
            'texinfo'
            'coreutils'
            'gnu-getopt'
            'python@3'
            'cmake'
            'ninja'
            'ccache'
            'bison'
            'byacc'
            'gettext'
            'wget'
            'pcre'
            'openjdk@11'
            'maven'
            'node'
            'llvm@16'
          )

          brew install "${packages[@]}" || true

      - name: Build
        run: |
          export MACOSX_DEPLOYMENT_TARGET=12.0

          cd thirdparty
          ./build-thirdparty.sh -j "$(nproc)"


Code Checks

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

name: Code Checks

on: [push, pull_request_target]

jobs:
  shellcheck:
    name: ShellCheck
    runs-on: ubuntu-latest
    steps:
      - name: Checkout ${{ github.ref }} ( ${{ github.sha }} )
        if: ${{ github.event_name != 'pull_request_target' }}
        uses: actions/checkout@v3

      - name: Checkout ${{ github.ref }} ( ${{ github.event.pull_request.head.sha }} )
        if: ${{ github.event_name == 'pull_request_target' }}
        uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Checkout action-sh-checker
        run: |
          rm -rf ./.github/actions/action-sh-checker
          git clone https://github.com/luizm/action-sh-checker .github/actions/action-sh-checker

          pushd .github/actions/action-sh-checker &>/dev/null
          git checkout 76ab0b22e1f194e4a582edc7969df6485c4e9246
          sed -i 's/\[ "$GITHUB_EVENT_NAME" == "pull_request" \]/\[\[ "$GITHUB_EVENT_NAME" == "pull_request" || "$GITHUB_EVENT_NAME" == "pull_request_target" \]\]/' entrypoint.sh
          popd &>/dev/null

      - name: Run ShellCheck
        uses: ./.github/actions/action-sh-checker
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          sh_checker_comment: true
          sh_checker_exclude: .git .github ^docker ^thirdparty/src ^thirdparty/installed ^ui ^docs/node_modules ^tools/clickbench-tools ^extension ^output ^fs_brokers/apache_hdfs_broker/output (^|.*/)Dockerfile$ ^be/src/apache-orc ^be/src/clucene ^pytest

  preparation:
    name: "Clang Tidy Preparation"
    if: ${{ github.event_name == 'pull_request_target' }}
    runs-on: ubuntu-22.04
    permissions: read-all
    outputs:
      should_check: ${{ steps.generate.outputs.should_check }}
    steps:
      - name: Checkout ${{ github.ref }} ( ${{ github.event.pull_request.head.sha }} )
        uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Checkout paths-filter
        run: |
          rm -rf ./.github/actions/paths-filter
          git clone https://github.com/dorny/paths-filter .github/actions/paths-filter

          pushd .github/actions/paths-filter &>/dev/null
          git checkout 4512585405083f25c027a35db413c2b3b9006d50
          popd &>/dev/null

      - name: Paths Filter
        uses: ./.github/actions/paths-filter
        id: filter
        with:
          filters: |
            cpp_changes:
              - 'be/**'
              - 'cloud/**'
              - 'gensrc/proto/**'
              - 'gensrc/thrift/**'

      - name: Generate compile_commands.json
        id: generate
        run: |
          if [[ "${{ steps.filter.outputs.cpp_changes }}" == 'true' ]]; then
            export DEFAULT_DIR='/opt/doris'

            mkdir "${DEFAULT_DIR}"
            wget https://github.com/amosbird/ldb_toolchain_gen/releases/download/v0.18/ldb_toolchain_gen.sh \
              -q -O /tmp/ldb_toolchain_gen.sh
            bash /tmp/ldb_toolchain_gen.sh "${DEFAULT_DIR}/ldb-toolchain"

            sudo DEBIAN_FRONTEND=noninteractive apt install --yes tzdata byacc

            pushd thirdparty
            curl -L https://github.com/apache/doris-thirdparty/releases/download/automation/doris-thirdparty-prebuilt-linux-x86_64.tar.xz \
              -o doris-thirdparty-prebuilt-linux-x86_64.tar.xz
            tar -xvf doris-thirdparty-prebuilt-linux-x86_64.tar.xz
            popd

            export PATH="${DEFAULT_DIR}/ldb-toolchain/bin/:$(pwd)/thirdparty/installed/bin/:${PATH}"
            DISABLE_BE_JAVA_EXTENSIONS=ON DO_NOT_CHECK_JAVA_ENV=ON DORIS_TOOLCHAIN=clang ENABLE_PCH=OFF OUTPUT_BE_BINARY=0 ./build.sh --be --cloud
          fi

          echo "should_check=${{ steps.filter.outputs.cpp_changes }}" >>${GITHUB_OUTPUT}

      - name: Upload
        uses: actions/upload-artifact@v3
        if: ${{ steps.filter.outputs.cpp_changes == 'true' }}
        with:
          name: compile_commands
          path: ./be/build_Release/compile_commands.json

  clang-tidy:
    name: "Clang Tidy"
    needs: preparation
    if: ${{ needs.preparation.outputs.should_check == 'true' }}
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout ${{ github.ref }} ( ${{ github.event.pull_request.head.sha }} )
        uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Download
        uses: actions/download-artifact@v3
        with:
          name: compile_commands
          path: ./be/build_Release

      - name: Checkout clang-tidy review
        run: |
          rm -rf ./.github/actions/clang-tidy-review
          git clone https://github.com/ZedThree/clang-tidy-review .github/actions/clang-tidy-review

          pushd .github/actions/clang-tidy-review &>/dev/null
          git checkout 2c55ef8cfc9acb3715d433e58aea086dcec9b206
          popd &>/dev/null

      - name: Run clang-tidy review
        uses: ./.github/actions/clang-tidy-review
        id: review
        with:
          build_dir: ./be/build_Release
          config_file: "./.clang-tidy"

      # clang-tidy review not required now
      # - if: steps.review.outputs.total_comments > 0
      #   run: exit 1


# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
---
name: Need_2_Approval

on:
  pull_request_review:
    types: [ submitted ]

jobs:
  Need_2_Approval:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v3
      - name: Install Python dependencies
        uses: actions/setup-python@v5
        with:
          python-version: '3.10'  # Adjust if needed
      - name: Install match library
        run: |
          pip install --upgrade pip
          pip install match
          pip install requests
      - name: Run Python script
        run: |
          python tools/maintainers/check_review.py  ${{ github.event.pull_request.number }} ${{secrets.GITHUB_TOKEN}}
env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}