SQL Plugin Tests

name: SQL Plugin Tests

on:
  workflow_dispatch:
    inputs:
      name:
        required: false
        type: string

run-name:
  ${{ inputs.name == '' && format('{0} @ {1}', github.ref_name, github.sha) || inputs.name }}

jobs:
  Get-CI-Image-Tag:
    uses: opensearch-project/opensearch-build/.github/workflows/get-ci-image-tag.yml@main
    with:
      product: opensearch

  build:
    needs: Get-CI-Image-Tag
    strategy:
      matrix:
        java:
          - 11
          - 17
    runs-on: ubuntu-latest
    container:
      # using the same image which is used by opensearch-build team to build the OpenSearch Distribution
      # this image tag is subject to change as more dependencies and updates will arrive over time
      image: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-version-linux }}
      # need to switch to root so that github actions can install runner binary on container without permission issues.
      options: --user root

    steps:
    - uses: actions/checkout@v3

    - name: Set up JDK ${{ matrix.java }}
      uses: actions/setup-java@v3
      with:
        distribution: 'temurin'
        java-version: ${{ matrix.java }}

    - name: Run tests
      id: tests
      run: |
        chown -R 1000:1000 `pwd`
        # Spotless
        su `id -un 1000` -c './gradlew :opensearch:spotlessCheck              || echo "* Spotless failed for opensearch" > report.log'
        su `id -un 1000` -c './gradlew :sql:spotlessCheck                     || echo "* Spotless failed for sql" >> report.log'
        su `id -un 1000` -c './gradlew :ppl:spotlessCheck                     || echo "* Spotless failed for ppl" >> report.log'
        su `id -un 1000` -c './gradlew :core:spotlessCheck                    || echo "* Spotless failed for core" >> report.log'
        su `id -un 1000` -c './gradlew :common:spotlessCheck                  || echo "* Spotless failed for common" >> report.log'
        su `id -un 1000` -c './gradlew :legacy:spotlessCheck                  || echo "* Spotless failed for legacy" >> report.log'
        su `id -un 1000` -c './gradlew :protocol:spotlessCheck                || echo "* Spotless failed for protocol" >> report.log'
        su `id -un 1000` -c './gradlew :opensearch-sql-plugin:spotlessCheck   || echo "* Spotless failed for plugin" >> report.log'
        su `id -un 1000` -c './gradlew :integ-test:spotlessCheck              || echo "* Spotless failed for integ-test" >> report.log'
        # Unit tests
        su `id -un 1000` -c './gradlew :opensearch:test                        || echo "* Unit tests failed for opensearch" >> report.log'
        su `id -un 1000` -c './gradlew :ppl:test                               || echo "* Unit tests failed for sql" >> report.log'
        su `id -un 1000` -c './gradlew :sql:test                               || echo "* Unit tests failed for ppl" >> report.log'
        su `id -un 1000` -c './gradlew :core:test                              || echo "* Unit tests failed for core" >> report.log'
        su `id -un 1000` -c './gradlew :protocol:test                          || echo "* Unit tests failed for protocol" >> report.log'
        su `id -un 1000` -c './gradlew :opensearch-sql-plugin:test             || echo "* Unit tests failed for plugin" >> report.log'
        su `id -un 1000` -c './gradlew :legacy:test                            || echo "* Unit tests failed for legacy" >> report.log'
        # jacoco
        su `id -un 1000` -c './gradlew :opensearch:jacocoTestCoverageVerification             || echo "* Jacoco failed for opensearch" >> report.log'
        su `id -un 1000` -c './gradlew :ppl:jacocoTestCoverageVerification                    || echo "* Jacoco failed for sql" >> report.log'
        su `id -un 1000` -c './gradlew :sql:jacocoTestCoverageVerification                    || echo "* Jacoco failed for ppl" >> report.log'
        su `id -un 1000` -c './gradlew :core:jacocoTestCoverageVerification                   || echo "* Jacoco failed for core" >> report.log'
        su `id -un 1000` -c './gradlew :protocol:jacocoTestCoverageVerification               || echo "* Jacoco failed for protocol" >> report.log'
        su `id -un 1000` -c './gradlew :opensearch-sql-plugin:jacocoTestCoverageVerification  || echo "* Jacoco failed for plugin" >> report.log'
        # Misc tests
        su `id -un 1000` -c './gradlew :integ-test:integTest                   || echo "* Integration test failed" >> report.log'
        su `id -un 1000` -c './gradlew :doctest:doctest                        || echo "* Doctest failed" >> report.log'
        su `id -un 1000` -c './scripts/bwctest.sh                              || echo "* Backward compatibility test failed" >> report.log'

    - name: Verify test results
      run: |
        if [[ -e report.log ]]
        then
          echo "## FAILED TESTS :facepalm::warning::bangbang:" >> $GITHUB_STEP_SUMMARY
          cat report.log >> $GITHUB_STEP_SUMMARY
          exit 1
        fi

    - name: Upload test reports
      if: always()
      uses: actions/upload-artifact@v2
      with:
        name: test-reports-${{ matrix.entry.java }}
        path: |
          sql/build/reports/**
          ppl/build/reports/**
          core/build/reports/**
          common/build/reports/**
          opensearch/build/reports/**
          integ-test/build/reports/**
          protocol/build/reports/**
          legacy/build/reports/**
          plugin/build/reports/**
          doctest/build/testclusters/docTestCluster-0/logs/*
          integ-test/build/testclusters/*/logs/*


SQL Plugin PiTest

name: SQL Plugin PiTest

on:
  workflow_dispatch:
    inputs:
      name:
        required: false
        type: string

run-name:
  ${{ inputs.name == '' && format('{0} @ {1}', github.ref_name, github.sha) || inputs.name }}

jobs:
  Get-CI-Image-Tag:
    uses: opensearch-project/opensearch-build/.github/workflows/get-ci-image-tag.yml@main
    with:
      product: opensearch

  build-linux:
    needs: Get-CI-Image-Tag
    strategy:
      matrix:
        java:
          - 11
          - 17
    runs-on: ubuntu-latest
    container:
      # using the same image which is used by opensearch-build team to build the OpenSearch Distribution
      # this image tag is subject to change as more dependencies and updates will arrive over time
      image: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-version-linux }}
      # need to switch to root so that github actions can install runner binary on container without permission issues.
      options: --user root

    steps:
    - uses: actions/checkout@v3

    - name: Set up JDK ${{ matrix.java }}
      uses: actions/setup-java@v3
      with:
        distribution: 'temurin'
        java-version: ${{ matrix.java }}

    - name: PiTest with Gradle
      run: |
        chown -R 1000:1000 `pwd`
        su `id -un 1000` -c "./gradlew --continue :core:pitest :opensearch:pitest"

    - name: Upload test reports
      if: always()
      uses: actions/upload-artifact@v2
      with:
        name: test-reports-${{ matrix.entry.java }}
        path: |
          core/build/reports/**
          opensearch/build/reports/**


name: Apply 'untriaged' label during issue lifecycle

on:
  issues:
    types: [opened, reopened, transferred]

jobs:
  apply-label:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/github-script@v6
        with:
          script: |
            github.rest.issues.addLabels({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              labels: ['untriaged']
            })


Publish snapshots to maven

name: Publish snapshots to maven

on:
  workflow_dispatch:
  push:
    branches:
      - main
      - 1.*
      - 2.*

jobs:
  build-and-publish-snapshots:
    strategy:
      fail-fast: false
    if: github.repository == 'opensearch-project/sql'
    runs-on: ubuntu-latest

    permissions:
      id-token: write
      contents: write

    steps:
      - uses: actions/setup-java@v3
        with:
          distribution: temurin # Temurin is a distribution of adoptium
          java-version: 11
      - uses: actions/checkout@v3
      - uses: aws-actions/configure-aws-credentials@v1.7.0
        with:
          role-to-assume: ${{ secrets.PUBLISH_SNAPSHOTS_ROLE }}
          aws-region: us-east-1
      - name: publish snapshots to maven
        run: |
          export SONATYPE_USERNAME=$(aws secretsmanager get-secret-value --secret-id maven-snapshots-username --query SecretString --output text)
          export SONATYPE_PASSWORD=$(aws secretsmanager get-secret-value --secret-id maven-snapshots-password --query SecretString --output text)
          echo "::add-mask::$SONATYPE_USERNAME"
          echo "::add-mask::$SONATYPE_PASSWORD"
          ./gradlew publishPluginZipPublicationToSnapshotsRepository


Security Plugin IT

name: Security Plugin IT

on:
  pull_request:
  push:
    branches-ignore:
      - 'dependabot/**'
    paths:
      - 'integ-test/**'
      - '.github/workflows/integ-tests-with-security.yml'

jobs:
  Get-CI-Image-Tag:
    uses: opensearch-project/opensearch-build/.github/workflows/get-ci-image-tag.yml@main
    with:
      product: opensearch

  security-it-linux:
    needs: Get-CI-Image-Tag
    strategy:
      fail-fast: false
      matrix:
        java: [ 11, 17, 21 ]

    runs-on: ubuntu-latest
    container:
      # using the same image which is used by opensearch-build team to build the OpenSearch Distribution
      # this image tag is subject to change as more dependencies and updates will arrive over time
      image: ${{ needs.Get-CI-Image-Tag.outputs.ci-image-version-linux }}
      # need to switch to root so that github actions can install runner binary on container without permission issues.
      options: --user root

    steps:
    - uses: actions/checkout@v3

    - name: Set up JDK ${{ matrix.java }}
      uses: actions/setup-java@v3
      with:
        distribution: 'temurin'
        java-version: ${{ matrix.java }}

    - name: Build with Gradle
      run: |
        chown -R 1000:1000 `pwd`
        su `id -un 1000` -c "./gradlew integTestWithSecurity"

    - name: Upload test reports
      if: ${{ always() }}
      uses: actions/upload-artifact@v2
      continue-on-error: true
      with:
        name: test-reports-${{ matrix.os }}-${{ matrix.java }}
        path: |
          integ-test/build/reports/**
          integ-test/build/testclusters/*/logs/*
          integ-test/build/testclusters/*/config/*

  security-it-windows-macos:
    strategy:
      fail-fast: false
      matrix:
        os: [ windows-latest ]
        java: [ 11, 17, 21 ]

    runs-on: ${{ matrix.os }}

    steps:
    - uses: actions/checkout@v3

    - name: Set up JDK ${{ matrix.java }}
      uses: actions/setup-java@v3
      with:
        distribution: 'temurin'
        java-version: ${{ matrix.java }}

    - name: Build with Gradle
      run: ./gradlew integTestWithSecurity

    - name: Upload test reports
      if: ${{ always() }}
      uses: actions/upload-artifact@v2
      continue-on-error: true
      with:
        name: test-reports-${{ matrix.os }}-${{ matrix.java }}
        path: |
          integ-test/build/reports/**
          integ-test/build/testclusters/*/logs/*
          integ-test/build/testclusters/*/config/*


Build via Maven and run tests

name: Build via Maven and run tests

on: [push, pull_request]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Cache
        uses: actions/cache@v4
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-
      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'adopt'
      - name: Build with Maven
        run: mvn verify -PcheckFormat -B


Deploy artifacts with Maven

# If this workflow is triggered by a push to either main or release branches then it
#        deploys a SNAPSHOT
# If this workflow is triggered by publishing a Release, it
#        deploys a RELEASE with the selected version
#        updates the project version by incrementing the patch version
#        commits the version update change to the repository's branch that triggered the workflow.
name: Deploy artifacts with Maven

on:
  push:
    branches:
      - main
      - release/**
  release:
    types: [ published ]
jobs:
  publish:
    runs-on: ubuntu-22.04
    steps:

      - name: Check out code
        uses: actions/checkout@v4

      - name: Set up Java environment
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'adopt'
          cache: maven
          gpg-private-key: ${{ secrets.MAVEN_CENTRAL_GPG_SIGNING_KEY_SEC }}
          gpg-passphrase: MAVEN_CENTRAL_GPG_PASSPHRASE

      - name: Deploy SNAPSHOT / Release
        uses: camunda-community-hub/community-action-maven-release@v1
        with:
          release-version: ${{ github.event.release.tag_name }}
          maven-url: s01.oss.sonatype.org
          nexus-usr: ${{ secrets.NEXUS_USR }}
          nexus-psw: ${{ secrets.NEXUS_PSW }}
          maven-usr: ${{ secrets.MAVEN_CENTRAL_DEPLOYMENT_USR }}
          maven-psw: ${{ secrets.MAVEN_CENTRAL_DEPLOYMENT_PSW }}
          maven-additional-options: -U
          maven-gpg-passphrase: ${{ secrets.MAVEN_CENTRAL_GPG_SIGNING_KEY_PASSPHRASE }}
          maven-auto-release-after-close: true
          github-token: ${{ secrets.GITHUB_TOKEN }}
          branch: ${{ github.event.release.target_commitish || github.ref_name }}
        id: release

      - if: github.event.release
        name: Attach artifacts to GitHub Release (Release only)
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ github.event.release.upload_url }}
          asset_path: ${{ steps.release.outputs.artifacts_archive_path }}
          asset_name: ${{ steps.release.outputs.artifacts_archive_path }}
          asset_content_type: application/zip


ci

# Copyright 2022 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# Github action job to test core java library features on
# downstream client libraries before they are released.
on:
  push:
    branches:
    - main
  pull_request:
name: ci
jobs:
  units:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        java: [11, 17, 21]
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-java@v4
      with:
        distribution: temurin
        java-version: ${{matrix.java}}
    - run: java -version
    - run: .kokoro/build.sh
      env:
        JOB_TYPE: test
  units-java8:
    # Building using Java 17 and run the tests with Java 8 runtime
    name: "units (8)"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          java-version: 8
          distribution: temurin
      - name: "Set jvm system property environment variable for surefire plugin (unit tests)"
        # Maven surefire plugin (unit tests) allows us to specify JVM to run the tests.
        # https://maven.apache.org/surefire/maven-surefire-plugin/test-mojo.html#jvm
        run: echo "SUREFIRE_JVM_OPT=-Djvm=${JAVA_HOME}/bin/java" >> $GITHUB_ENV
        shell: bash
      - uses: actions/setup-java@v4
        with:
          java-version: 17
          distribution: temurin
      - run: .kokoro/build.sh
        env:
          JOB_TYPE: test
  windows:
    runs-on: windows-latest
    steps:
    - name: Support longpaths
      run: git config --system core.longpaths true
    - uses: actions/checkout@v4
    - uses: actions/setup-java@v4
      with:
        distribution: temurin
        java-version: 8
    - run: java -version
    - run: .kokoro/build.bat
      env:
        JOB_TYPE: test
  dependencies:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        java: [17]
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-java@v4
      with:
        distribution: temurin
        java-version: ${{matrix.java}}
    - run: java -version
    - run: .kokoro/dependencies.sh
  javadoc:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-java@v4
      with:
        distribution: temurin
        java-version: 17
    - run: java -version
    - run: .kokoro/build.sh
      env:
        JOB_TYPE: javadoc
  lint:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-java@v4
      with:
        distribution: temurin
        java-version: 11
    - run: java -version
    - run: .kokoro/build.sh
      env:
        JOB_TYPE: lint
  clirr:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-java@v4
      with:
        distribution: temurin
        java-version: 8
    - run: java -version
    - run: .kokoro/build.sh
      env:
        JOB_TYPE: clirr


auto-merge-readme

# Copyright 2022 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# Github action job to test core java library features on
# downstream client libraries before they are released.
on:
  pull_request:
name: auto-merge-readme
jobs:
  approve:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'googleapis' && github.head_ref == 'autosynth-readme'
    steps:
      - uses: actions/github-script@v7
        with:
          github-token: ${{secrets.YOSHI_APPROVER_TOKEN}}
          script: |
            // only approve PRs from yoshi-automation
            if (context.payload.pull_request.user.login !== "yoshi-automation") {
              return;
            }

            // only approve PRs like "chore: release <release version>"
            if (!context.payload.pull_request.title === "chore: regenerate README") {
              return;
            }

            // only approve PRs with README.md and synth.metadata changes
            const files = new Set(
              (
                await github.paginate(
                  github.pulls.listFiles.endpoint({
                    owner: context.repo.owner,
                    repo: context.repo.repo,
                    pull_number: context.payload.pull_request.number,
                  })
                )
              ).map(file => file.filename)
            );
            if (files.size != 2 || !files.has("README.md") || !files.has(".github/readme/synth.metadata/synth.metadata")) {
              return;
            }

            // approve README regeneration PR
            await github.pulls.createReview({
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: 'Rubber stamped PR!',
              pull_number: context.payload.pull_request.number,
              event: 'APPROVE'
            });

            // attach automerge label
            await github.issues.addLabels({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.payload.pull_request.number,
              labels: ['automerge']
            });


ci

on:
  push:
    branches:
    - main
  pull_request:
name: ci
jobs:
  dashboard:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-java@v4
      with:
        distribution: temurin
        java-version: 8
        cache: maven
    - run: java -version
    - run: .kokoro/dashboard.sh
      env:
        JOB_TYPE: dashboard-units-check
  shared-dependencies-convergence:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'googleapis' && github.head_ref == 'release-please--branches--main'
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-java@v4
      with:
        distribution: temurin
        java-version: 8
        cache: maven
    - run: java -version
    - run: .kokoro/dashboard.sh
      env:
        JOB_TYPE: dependency-convergence-check


release-note-generation-test

on:
  pull_request:
    paths:
      - 'release-note-generation/**'
name: release-note-generation-test
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-java@v4
      with:
        distribution: temurin
        java-version: 11
        cache: maven
    - run: java -version
    - name: Run test in release-note-generation
      shell: bash
      run: |
        mvn -B -ntp verify
      working-directory: release-note-generation
      env:
        GH_TOKEN: ${{ github.token }}

  dry-run:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-java@v4
      with:
        distribution: temurin
        java-version: 11
        cache: maven
    - run: java -version
    - name: Dry-run release-note-generation
      shell: bash
      run: |
        mvn -B -ntp compile
        # This generates release_note.md file
        mvn -B -ntp exec:java \
            -Dlibraries-bom.version="26.2.0" \
            -Dgoogle-cloud-java.version="1.1.0"
      working-directory: release-note-generation
      env:
        GH_TOKEN: ${{ github.token }}
    - name: Show generated release note
      shell: bash
      run: |
        # This fails if the file does not exist
        cat release_note.md
      working-directory: release-note-generation


release-notes

on:
  workflow_dispatch:
    inputs:
      librariesBomVersion:
        description: 'The version of the Libraries BOM we generate release note (e.g., 26.1.5)'
        required: true
        type: string

  release: # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#release
    types: [released]

name: release-notes
jobs:
  release-note-generation:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-java@v4
      with:
        distribution: temurin
        java-version: 11
        cache: maven
    - run: java -version
    - name: Pick Libraries BOM version
      id: pick-version
      shell: bash
      run: |
        set -x
        if [ -n "${WORKFLOW_DISPATCH_INPUT}" ]; then
          echo "WORKFLOW_DISPATCH_INPUT: ${WORKFLOW_DISPATCH_INPUT}"
          echo "libraries-bom-version=${WORKFLOW_DISPATCH_INPUT}" >> $GITHUB_OUTPUT
        elif [[ "${GITHUB_REF}" == *"refs/tags/v"* ]]; then
          # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#release
          # Example value of GITHUB_REF: refs/tags/v26.5.0
          # With the single-component setup of Release Please, the Libraries BOM
          # version is the version of this repository release.
          echo "GITHUB_REF: ${GITHUB_REF}"
          VERSION=${GITHUB_REF#refs/*/v}
          echo "libraries-bom-version=${VERSION}" >> $GITHUB_OUTPUT
        else
          echo "Couldn't find the Libraries BOM version. WORKFLOW_DISPATCH_INPUT \
              was empty and GITHUB_REF was ${GITHUB_REF}."
          exit 1
        fi
      env:
        WORKFLOW_DISPATCH_INPUT: ${{ inputs.librariesBomVersion }}
    - name: Install the BOMs locally
      run: mvn install
      shell: bash
    - name: Generate release_note.md
      shell: bash
      run: |
        set -x
        mvn -B -ntp compile

        GOOGLE_CLOUD_JAVA_VERSION=$(grep -A1 'gapic-libraries-bom' \
            ../google-cloud-bom/pom.xml |perl -nle 'print $1 if m/<version>(.+)</')

        # This generates release_note.md file
        mvn -B -ntp exec:java \
            -Dlibraries-bom.version="${LIBRARIES_BOM_VERSION}" \
            -Dgoogle-cloud-java.version="${GOOGLE_CLOUD_JAVA_VERSION}"
      working-directory: release-note-generation
      env:
        LIBRARIES_BOM_VERSION: ${{ steps.pick-version.outputs.libraries-bom-version }}
        GH_TOKEN: ${{ github.token }}
    - name: Update the release note with release_note.md
      run: |
        TAG="v${LIBRARIES_BOM_VERSION}"
        echo "Updating ${TAG}"
        gh release edit "${TAG}" --notes-file release_note.md
      working-directory: release-note-generation
      env:
        LIBRARIES_BOM_VERSION: ${{ steps.pick-version.outputs.libraries-bom-version }}
        GH_TOKEN: ${{ github.token }}


test for tests/validate-bom logic

# Copyright 2023 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# Github action job to test core java library features on
# downstream client libraries before they are released.
on:
  push:
    branches:
    - main
  pull_request:
name: test for tests/validate-bom logic
jobs:
  test-invalid-bom:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Fetch the bad protobuf-bom version 3.22.1
      shell: bash
      # 3.22.1 had a issue in their pom.xml
      # https://github.com/protocolbuffers/protobuf/issues/12170
      run: |
        mkdir -p bad-protobuf-bom
        curl https://repo1.maven.org/maven2/com/google/protobuf/protobuf-bom/3.22.1/protobuf-bom-3.22.1.pom \
            --output bad-protobuf-bom/pom.xml
    - name: Check the bad BOM
      uses: ./tests/validate-bom
      id: validate-bom
      with:
        bom-path: bad-protobuf-bom/pom.xml
      continue-on-error: true
    - name: Ensure the validate-bom invalidated the bad BOM
      shell: bash
      if: steps.validate-bom.outcome != 'failure'
      run: |
        echo "The validate-bom check should have invalidated the bad BOM"
        exit 1


Update README with libraries-bom table

name: Update README with libraries-bom table
# Run this workflow upon published release

on:
  workflow_dispatch:
  release:
    types:
    - published

jobs:
  update-readme:
    runs-on: ubuntu-latest

    steps:
    - name: Check out repository
      uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.9'

    - name: Delete existing 'update-readme-bot' branch
      run: |
        git push --delete origin update-readme-bot || echo "Branch doesn't exist, continuing..."
        git branch -D update-readme-bot || echo "Branch doesn't exist, continuing..."

    - name: Install dependencies
      run: pip install pyyaml

    - name: Update table of artifacts
      run: |
        echo "Updating README.md with table of artifacts associated with the latest libraries-bom..."
        python libraries-bom-table-generation/updateREADMETable.py

    - name: Commit and push changes
      run: |
        git config --global user.name "Cloud Java Bot"
        git config --global user.email "cloud-java-bot@google.com"
        git add README.md
        git commit -m "chore: update README with release table"
        git checkout -b update-readme-bot
        git push origin update-readme-bot

    - name: Create Pull Request
      run: |
        gh pr create --base main --head update-readme-bot --title "chore: Update README with release table" --body "Updating README with the table of artifacts associated with the latest libraries-bom release"
      env:
        GITHUB_TOKEN: ${{ secrets.CLOUD_JAVA_BOT_GITHUB_TOKEN }}


Renovate Bot Config Validation

name: Renovate Bot Config Validation

on:
  pull_request:
    paths:
      - 'renovate.json'

jobs:
  renovate_bot_config_validation:
    runs-on: ubuntu-22.04

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Node.js
      uses: actions/setup-node@v4
      with:
        node-version: '20'

    - name: Install Renovate and Config Validator
      run: |
        npm install -g npm@latest
        npm install --global renovate
        renovate-config-validator


ci

on:
  push:
    branches:
    - main
  pull_request:
name: ci
jobs:
  bom-content-test:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'googleapis'
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-java@v4
      with:
        distribution: temurin
        java-version: 11
        cache: maven
    - run: java -version
    - name: Install BOMs
      run: |
        mvn -B -V -ntp install
    - name: Ensure the members of the Libraries BOM exist in Maven Central
      uses: ./tests/validate-bom
      with:
        bom-path: libraries-bom/pom.xml
    - name: Ensure the BOM has valid content (at releases)
      if: github.head_ref == 'release-please--branches--main'
      run: |
        mvn -B -V -ntp verify -Dtest="BomContentTest#testLibrariesBom"
      working-directory: tests

  bom-assertion-test:
    name: BomContentAssertionsTest (Test for assertion logic in BomContentTest)
    runs-on: ubuntu-latest
    if: github.repository_owner == 'googleapis'
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-java@v4
      with:
        distribution: zulu
        java-version: 8
    - run: java -version
    - name: Install BOMs
      run: |
        mvn -B -V -ntp install
    - run: |
        mvn -B -V -ntp verify -Dtest="BomContentAssertionsTest"
      working-directory: tests


#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#
name: Pinot Multi-Arch Platform Docker Image Build and Publish

on:
  workflow_dispatch:
    inputs:
      gitUrl:
        description: "The Pinot git repo to check out to build, use https."
        default: "https://github.com/apache/pinot.git"
        required: true
      commit:
        description: "The branch/commit to check out to build Pinot image."
        default: "master"
        required: true
      dockerImageName:
        description: "The docker image name, default to 'apachepinot/pinot'."
        default: "apachepinot/pinot"
        required: true
      tags:
        description: "Tags to push of the image, comma separated, e.g. tag1,tag2,tag3"
        default: ""

jobs:
  generate-build-info:
    name: Generate Build Info
    runs-on: ubuntu-latest
    outputs:
      commit-id: ${{ steps.generate-build-info.outputs.commit-id }}
      tags: ${{ steps.generate-build-info.outputs.tags }}
    steps:
      - uses: actions/checkout@v4
      - name: Generate Build Info
        id: generate-build-info
        env:
          PINOT_GIT_URL: ${{ github.event.inputs.gitUrl }}
          PINOT_BRANCH: ${{ github.event.inputs.commit }}
          TAGS: ${{ github.event.inputs.tags }}
        run: |
          .github/workflows/scripts/docker/.pinot_build_info_gen.sh
  build-pinot-docker-image:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        arch: [ "amd64", "arm64" ]
        base-image-tag: [ "11-amazoncorretto", "11-ms-openjdk" ]
    name: Build Pinot Docker Image on ${{ matrix.arch }} with base image ${{ matrix.base-image-tag }}
    needs: [ generate-build-info ]
    steps:
      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - uses: docker/setup-qemu-action@v3
        name: Set up QEMU
        with:
          platforms: linux/${{ matrix.arch }}
      - uses: docker/setup-buildx-action@v3
        name: Set up Docker Buildx
      - uses: actions/checkout@v4
      - name: Build and push the Docker image
        env:
          DOCKER_FILE_BASE_DIR: "docker/images/pinot"
          DOCKER_IMAGE_NAME: ${{ github.event.inputs.dockerImageName }}
          BUILD_PLATFORM: "linux/${{ matrix.arch }}"
          BASE_IMAGE_TAG: ${{ matrix.base-image-tag }}
          PINOT_GIT_URL: ${{ github.event.inputs.gitUrl }}
          PINOT_BRANCH: "${{needs.generate-build-info.outputs.commit-id}}"
          TAGS: "${{needs.generate-build-info.outputs.tags}}"
        run: .github/workflows/scripts/docker/.pinot_single_platform_docker_image_build.sh
  create-multi-arch-manifest:
    name: Create Multi-Arch Manifest
    runs-on: ubuntu-latest
    needs: [ generate-build-info, build-pinot-docker-image ]
    steps:
      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - uses: docker/setup-qemu-action@v3
        name: Set up QEMU
      - uses: docker/setup-buildx-action@v3
        name: Set up Docker Buildx
      - uses: actions/checkout@v4
      - name: Create Multi-Arch Manifest
        env:
          TAGS: "${{needs.generate-build-info.outputs.tags}}"
          BUILD_PLATFORM: "linux/arm64,linux/amd64"
          BASE_IMAGE_TAGS: "11-amazoncorretto,11-ms-openjdk"
        run: .github/workflows/scripts/docker/.pinot_multi_arch_docker_image_manifest_package.sh


#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#
name: Pinot Base Docker Image Build and Publish

on:
  workflow_dispatch:
    inputs: { }

jobs:
  build-pinot-build-docker-image:
    name: Build Pinot Base Docker Image
    runs-on: ubuntu-latest
    strategy:
      matrix:
        baseImageType: [ "build", "runtime" ]
        openJdkDist: [ "amazoncorretto", "ms-openjdk" ]
    steps:
      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - uses: docker/setup-qemu-action@v3
        name: Set up QEMU
      - uses: docker/setup-buildx-action@v3
        name: Set up Docker Buildx
      - uses: actions/checkout@v4
      - name: Build and push the Docker image
        env:
          OPEN_JDK_DIST: ${{ matrix.openJdkDist }}
          BASE_IMAGE_TYPE: ${{ matrix.baseImageType }}
          BUILD_PLATFORM: "linux/amd64,linux/arm64"
          TAG: "11-${{ matrix.openJdkDist }}"
        run: .github/workflows/scripts/docker/.pinot_base_docker_image_build_and_push.sh


Pinot Docker Image Build and Publish

#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#
name: Pinot Docker Image Build and Publish

on:
  workflow_dispatch:
    inputs:
      gitUrl:
        description: "The Pinot git repo to check out to build, use https."
        default: "https://github.com/apache/pinot.git"
        required: true
      commit:
        description: "The branch/commit to check out to build Pinot image."
        default: "master"
        required: true
      platform:
        description: "The platform of the image to build, e.g. linux/amd64,linux/arm64"
        default: "linux/amd64"
        required: true
      dockerImageName:
        description: "The docker image name, default to 'apachepinot/pinot'."
        default: "apachepinot/pinot"
        required: true
      tags:
        description: "Tags to push of the image, comma separated, e.g. tag1,tag2,tag3"
        default: ""

jobs:
  build-pinot-docker-image:
    name: Build Pinot Docker Image
    runs-on: ubuntu-latest
    steps:
    - name: Login to DockerHub
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}
    - uses: docker/setup-qemu-action@v3
      name: Set up QEMU
    - uses: docker/setup-buildx-action@v3
      name: Set up Docker Buildx
    - uses: actions/checkout@v4
    - name: Build and push the Docker image
      env:
        DOCKER_FILE_BASE_DIR: "docker/images/pinot"
        DOCKER_IMAGE_NAME: ${{ github.event.inputs.dockerImageName }}
        BUILD_PLATFORM: ${{ github.event.inputs.platform }}
        PINOT_GIT_URL: ${{ github.event.inputs.gitUrl }}
        PINOT_BRANCH: ${{ github.event.inputs.commit }}
        TAGS: ${{ github.event.inputs.tags }}
      run: .github/workflows/scripts/docker/.pinot_docker_image_build_and_push.sh


#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#
name: Presto Pinot Docker Image Build and Publish

on:
  workflow_dispatch:
    inputs:
      gitUrl:
        description: "The git url to check out to build Presto, use https not ssh."
        default: "https://github.com/prestodb/presto.git"
        required: true
      commit:
        description: "The branch/commit to check out to build Presto image.."
        default: "master"
        required: true
      platform:
        description: "The platform of the image to build, e.g. linux/amd64"
        default: "linux/amd64"
        required: true
      dockerImageName:
        description: "The docker image name, default is 'apachepinot/pinot-presto'"
        default: "apachepinot/pinot-presto"
        required: true
      tags:
        description: "Tags to push of the image, comma separated, e.g. tag1,tag2,tag3"
        default: ""

jobs:
  build-presto-pinot-docker-image:
    name: Build Presto Pinot Docker Image
    runs-on: ubuntu-latest
    steps:
    - name: Login to DockerHub
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}
    - uses: docker/setup-qemu-action@v3
      name: Set up QEMU
    - uses: docker/setup-buildx-action@v3
      name: Set up Docker Buildx
    - uses: actions/checkout@v4
    - name: Build and push the Docker image
      env:
        DOCKER_FILE_BASE_DIR: "docker/images/pinot-presto"
        DOCKER_IMAGE_NAME: ${{ github.event.inputs.dockerImageName }}
        BUILD_PLATFORM: ${{ github.event.inputs.platform }}
        PRESTO_GIT_URL: ${{ github.event.inputs.gitUrl }}
        PRESTO_BRANCH: ${{ github.event.inputs.commit }}
        TAGS: ${{ github.event.inputs.tags }}
      run: .github/workflows/scripts/docker/.presto_docker_image_build_and_push.sh


#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#
name: Superset Pinot Docker Image Build and Publish

on:
  workflow_dispatch:
    inputs:
      supersetImageTag:
        description: "Base superset docker image tag from https://hub.docker.com/r/apache/superset"
        default: "latest"
        required: true
      platform:
        description: "The platform of the image to build, e.g. linux/amd64"
        default: "linux/amd64"
        required: true
      dockerImageName:
        description: "The docker image name, default is 'apachepinot/pinot-superset'"
        default: "apachepinot/pinot-superset"
        required: true
      tags:
        description: "Tags to push of the image, comma separated, e.g. tag1,tag2,tag3"
        default: ""

jobs:
  build-superset-pinot-docker-image:
    name: Build Superset Pinot Docker Image
    runs-on: ubuntu-latest
    steps:
    - name: Login to DockerHub
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}
    - uses: docker/setup-qemu-action@v3
      name: Set up QEMU
    - uses: docker/setup-buildx-action@v3
      name: Set up Docker Buildx
    - uses: actions/checkout@v4
    - name: Build and push the Docker image
      env:
        DOCKER_FILE_BASE_DIR: "docker/images/pinot-superset"
        DOCKER_IMAGE_NAME: ${{ github.event.inputs.dockerImageName }}
        SUPERSET_IMAGE_TAG: ${{ github.event.inputs.supersetImageTag }}
        BUILD_PLATFORM: ${{ github.event.inputs.platform }}
        TAGS: ${{ github.event.inputs.tags }}
      run: .github/workflows/scripts/docker/.superset_docker_image_build_and_push.sh


Pinot Compatibility Regression Test

#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#
name: Pinot Compatibility Regression Test

on:
  workflow_dispatch:
    inputs:
      oldCommit:
        description: "Git hash (or tag) for old commit. (required)"
        required: true
      newCommit:
        description: "Git hash (or tag) for new commit. (required)"
        required: true

jobs:
  compatibility-verifier:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        test_suite: [ "compatibility-verifier/sample-test-suite" ]
    name: Pinot Compatibility Regression Testing against ${{ github.event.inputs.oldCommit }} and ${{ github.event.inputs.newCommit }} on ${{ matrix.test_suite }}
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 11
        uses: actions/setup-java@v4
        with:
          java-version: 11
          distribution: 'temurin'
          cache: 'maven'
      - name: Setup node
        uses: actions/setup-node@v4
        with:
          node-version: v16.15.0
          cache: 'npm'
          cache-dependency-path: pinot-controller/src/main/resources/package-lock.json
      - name: Install npm
        run: |
          npm install -g npm@8.5.5
          npm --version
      - name: Pinot Compatibility Regression Testing
        if : ${{github.event_name == 'workflow_dispatch'}}
        env:
          OLD_COMMIT: ${{ github.event.inputs.oldCommit }}
          NEW_COMMIT: ${{ github.event.inputs.newCommit }}
          WORKING_DIR: /tmp/compatibility-verifier
          TEST_SUITE: ${{ matrix.test_suite }}
          MAVEN_OPTS: >
            -Xmx2G -DskipShade -DfailIfNoTests=false -Dmaven.wagon.httpconnectionManager.ttlSeconds=25
            -Dmaven.wagon.http.retryHandler.count=30 -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false
            -XX:+IgnoreUnrecognizedVMOptions
            --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED
        run: .github/workflows/scripts/.pinot_compatibility_verifier.sh
      - name: Archive artifacts into zip
        if: always()
        run: |
          zip -1 -r artifacts.zip /tmp/compatibility-verifier/*
      - uses: actions/upload-artifact@v4
        name: Store compatibility verifier work directory
        if: always()
        with:
          ## TODO: currently matrix.test_suite cannot be used as part of name due to invalid path character.
          name: compatibility_verifier_work_dir
          retention-days: 3
          path: artifacts.zip


#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#
name: Pinot Multi-Stage Query Engine Compatibility Regression Test

on:
  workflow_dispatch:
    inputs:
      oldCommit:
        description: "Git hash (or tag) for old commit. (required)"
        required: true
      newCommit:
        description: "Git hash (or tag) for new commit. (required)"
        required: true

jobs:
  compatibility-verifier:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        test_suite: [ "compatibility-verifier/multi-stage-query-engine-test-suite" ]
    name: Pinot Multi-Stage Query Engine Compatibility Regression Testing against ${{ github.event.inputs.oldCommit }} and ${{ github.event.inputs.newCommit }} on ${{ matrix.test_suite }}
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 11
        uses: actions/setup-java@v4
        with:
          java-version: 11
          distribution: 'temurin'
          cache: 'maven'
      - name: Setup node
        uses: actions/setup-node@v4
        with:
          node-version: v16.15.0
          cache: 'npm'
          cache-dependency-path: pinot-controller/src/main/resources/package-lock.json
      - name: Install npm
        run: |
          npm install -g npm@8.5.5
          npm --version
      - name: Pinot Multi-Stage Query Engine Compatibility Regression Testing
        if : ${{github.event_name == 'workflow_dispatch'}}
        env:
          OLD_COMMIT: ${{ github.event.inputs.oldCommit }}
          NEW_COMMIT: ${{ github.event.inputs.newCommit }}
          WORKING_DIR: /tmp/multi-stage-compatibility-verifier
          TEST_SUITE: ${{ matrix.test_suite }}
          MAVEN_OPTS: >
            -Xmx2G -DskipShade -DfailIfNoTests=false -Dmaven.wagon.httpconnectionManager.ttlSeconds=25
            -Dmaven.wagon.http.retryHandler.count=30 -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false
            -XX:+IgnoreUnrecognizedVMOptions
            --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED
        run: .github/workflows/scripts/.pinot_compatibility_verifier.sh
      - name: Archive artifacts into zip
        if: always()
        run: |
          zip -1 -r artifacts.zip /tmp/multi-stage-compatibility-verifier/*
      - uses: actions/upload-artifact@v4
        name: Store multi-stage compatibility verifier work directory
        if: always()
        with:
          ## TODO: currently matrix.test_suite cannot be used as part of name due to invalid path character.
          name: multi_stage_compatibility_verifier_work_dir
          retention-days: 3
          path: artifacts.zip


Cancelling Duplicates

#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#

name: Cancelling Duplicates
on:
  workflow_run:
    workflows:
      - 'Pinot Tests'
    types: ['requested']

jobs:
  cancel-duplicate-workflow-runs:
    name: "Cancel duplicate workflow runs"
    runs-on: ubuntu-latest
    steps:
      - uses: potiuk/cancel-workflow-runs@953e057dc81d3458935a18d1184c386b0f6b5738
        name: "Cancel duplicate workflow runs"
        with:
          cancelMode: allDuplicates
          token: ${{ secrets.GITHUB_TOKEN }}
          sourceRunId: ${{ github.event.workflow_run.id }}


Pinot Tests

#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#

name: Pinot Tests

on:
  push:
    branches:
      - master
    paths-ignore:
      - "contrib/**"
      - "docs/**"
      - "docker/**"
      - "kubernetes/**"
      - "licenses/**"
      - "licenses-binary/**"
      - "**.md"
  pull_request:
    branches:
      - master
    paths-ignore:
      - "contrib/**"
      - "docs/**"
      - "docker/**"
      - "kubernetes/**"
      - "licenses/**"
      - "licenses-binary/**"
      - "**.md"

jobs:
  linter-test:
    if: github.repository == 'apache/pinot'
    runs-on: ubuntu-latest
    name: Pinot Linter Test Set
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 11
        uses: actions/setup-java@v4
        with:
          java-version: 11
          distribution: 'temurin'
          cache: 'maven'
      - name: Linter Test
        env:
          GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
          MAVEN_OPTS: >
            -Xmx2G -DskipShade -DfailIfNoTests=false -Dmaven.wagon.httpconnectionManager.ttlSeconds=25
            -Dmaven.wagon.http.retryHandler.count=30 -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false
            -B -ntp
            -XX:+IgnoreUnrecognizedVMOptions
            --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED
        run: .github/workflows/scripts/.pinot_linter.sh
  unit-test:
    if: github.repository == 'apache/pinot'
    runs-on: ubuntu-latest
    strategy:
      # Changed to false in order to improve coverage using unsafe buffers
      fail-fast: false
      matrix:
        testset: [ 1, 2 ]
        java: [ 11, 21 ]
        distribution: [ "temurin" ]
        skip_bytebuffer: [false]
        include:
          - java: 21
            testset: 1
            distribution: "temurin"
            skip_bytebuffer: true
          - java: 21
            testset: 2
            distribution: "temurin"
            skip_bytebuffer: true
    name: Pinot Unit Test Set ${{ matrix.testset }} (${{matrix.distribution}}-${{matrix.java}}) with skip bytebuffers:${{matrix.skip_bytebuffer}}
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK ${{ matrix.java }}-${{ matrix.distribution }}
        uses: actions/setup-java@v4
        with:
          java-version: ${{ matrix.java }}
          distribution: ${{ matrix.distribution }}
          cache: 'maven'
      # Step that does that actual cache save and restore
      - uses: actions/cache@v4
        env:
          SEGMENT_DOWNLOAD_TIMEOUT_MINS: 10
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-
      - name: Build Project
        env:
          RUN_INTEGRATION_TESTS: false
          RUN_TEST_SET: ${{ matrix.testset }}
          GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
          MAVEN_OPTS: >
            -Xmx2G -DskipShade -DfailIfNoTests=false -Dmaven.wagon.httpconnectionManager.ttlSeconds=25
            -Dmaven.wagon.http.retryHandler.count=30 -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false
            -B -ntp
            -XX:+IgnoreUnrecognizedVMOptions
            --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED
        run: .github/workflows/scripts/pr-tests/.pinot_tests_build.sh
      - name: Unit Test
        env:
          RUN_INTEGRATION_TESTS: false
          RUN_TEST_SET: ${{ matrix.testset }}
          PINOT_OFFHEAP_SKIP_BYTEBUFFER: ${{ matrix.skip_bytebuffer }}
          GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
          MAVEN_OPTS: >
            -Xmx2G -DskipShade -DfailIfNoTests=false -Dmaven.wagon.httpconnectionManager.ttlSeconds=25
            -Dmaven.wagon.http.retryHandler.count=30 -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false
            -B -ntp
            -XX:+IgnoreUnrecognizedVMOptions
            --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED
        run: .github/workflows/scripts/pr-tests/.pinot_tests_unit.sh
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        continue-on-error: true
        timeout-minutes: 5
        with:
          flags: unittests,unittests${{ matrix.testset }},${{matrix.distribution}},java-${{matrix.java}},skip-bytebuffers-${{matrix.skip_bytebuffer}}
          name: codecov-unit-tests
          fail_ci_if_error: false
          verbose: true

  integration-test:
    if: github.repository == 'apache/pinot'
    runs-on: ubuntu-latest
    strategy:
      # Changed to false in order to improve coverage using unsafe buffers
      fail-fast: false
      matrix:
        testset: [ 1, 2 ]
        java: [ 11, 21 ]
        distribution: [ "temurin" ]
        skip_bytebuffer: [false]
        include:
          - java: 21
            testset: 1
            distribution: "temurin"
            skip_bytebuffer: true
          - java: 21
            testset: 2
            distribution: "temurin"
            skip_bytebuffer: true
    name: Pinot Integration Test Set ${{ matrix.testset }} (${{matrix.distribution}}-${{matrix.java}}) with skip bytebuffers:${{matrix.skip_bytebuffer}}
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK ${{ matrix.java }}-${{ matrix.distribution }}
        uses: actions/setup-java@v4
        with:
          java-version: ${{ matrix.java }}
          distribution: ${{ matrix.distribution }}
          cache: 'maven'
      # Step that does that actual cache save and restore
      - uses: actions/cache@v4
        env:
          SEGMENT_DOWNLOAD_TIMEOUT_MINS: 10
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-
      - name: Build Project
        env:
          RUN_INTEGRATION_TESTS: true
          GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
          MAVEN_OPTS: >
            -Xmx2G -DskipShade -DfailIfNoTests=false -Dmaven.wagon.httpconnectionManager.ttlSeconds=25
            -Dmaven.wagon.http.retryHandler.count=30 -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false
            -B -ntp
            -XX:+IgnoreUnrecognizedVMOptions
            --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED
        run: .github/workflows/scripts/pr-tests/.pinot_tests_build.sh
      - name: Integration Test
        env:
          RUN_INTEGRATION_TESTS: true
          RUN_TEST_SET: ${{ matrix.testset }}
          PINOT_OFFHEAP_SKIP_BYTEBUFFER: ${{ matrix.skip_bytebuffer }}
          GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
          MAVEN_OPTS: >
            -Xmx2G -DskipShade -DfailIfNoTests=false -Dmaven.wagon.httpconnectionManager.ttlSeconds=25
            -Dmaven.wagon.http.retryHandler.count=30 -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false
            -B -ntp
            -XX:+IgnoreUnrecognizedVMOptions
            --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED
        run: .github/workflows/scripts/pr-tests/.pinot_tests_integration.sh
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v4
        continue-on-error: true
        timeout-minutes: 5
        with:
          flags: integration,integration${{ matrix.testset }},${{matrix.distribution}},java-${{matrix.java}},skip-bytebuffers-${{matrix.skip_bytebuffer}}
          name: codecov-integration-tests
          fail_ci_if_error: false
          verbose: true
      - name: Custom Integration Test
        if : ${{ matrix.testset == 1 }}
        env:
          RUN_INTEGRATION_TESTS: true
          RUN_TEST_SET: ${{ matrix.testset }}
          GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
          MAVEN_OPTS: >
            -Xmx2G -DskipShade -DfailIfNoTests=false -Dmaven.wagon.httpconnectionManager.ttlSeconds=25
            -Dmaven.wagon.http.retryHandler.count=30 -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false
            -B -ntp
            -XX:+IgnoreUnrecognizedVMOptions
            --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED
        run: .github/workflows/scripts/pr-tests/.pinot_tests_custom_integration.sh
      - name: Upload coverage to Codecov
        if : ${{ matrix.testset == 1 }}
        uses: codecov/codecov-action@v4
        continue-on-error: true
        timeout-minutes: 5
        with:
          flags: integration,custom-integration${{ matrix.testset }},${{matrix.distribution}},java-${{matrix.java}}
          name: codecov-custom-integration-tests
          fail_ci_if_error: false
          verbose: true

  compatibility-verifier:
    if: github.repository == 'apache/pinot'
    runs-on: ubuntu-latest
    strategy:
      # Changed to false in order to improve coverage using unsafe buffers
      fail-fast: false
      matrix:
        test_suite: [ "compatibility-verifier/sample-test-suite" ]
        old_commit: [
          "release-1.0.0", "release-1.1.0", "master"
        ]
    name: Pinot Compatibility Regression Testing against ${{ matrix.old_commit }} on ${{ matrix.test_suite }}
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 11
        uses: actions/setup-java@v4
        with:
          java-version: 11
          distribution: 'temurin'
          cache: 'maven'
      - name: Setup node
        uses: actions/setup-node@v4
        with:
          node-version: v16.15.0
          cache: 'npm'
          cache-dependency-path: pinot-controller/src/main/resources/package-lock.json
      - name: Install npm
        run: |
          npm install -g npm@8.5.5
          npm --version
      # Step that does that actual cache save and restore
      - uses: actions/cache@v4
        env:
          SEGMENT_DOWNLOAD_TIMEOUT_MINS: 10
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-
      - name: Pinot Compatibility Regression Testing
        env:
          OLD_COMMIT: ${{ matrix.old_commit }}
          WORKING_DIR: /tmp/compatibility-verifier
          TEST_SUITE: ${{ matrix.test_suite }}
          MAVEN_OPTS: >
            -Xmx2G -DskipShade -DfailIfNoTests=false -Dmaven.wagon.httpconnectionManager.ttlSeconds=25
            -Dmaven.wagon.http.retryHandler.count=30 -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false
            -B -ntp
            -XX:+IgnoreUnrecognizedVMOptions
            --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED
        run: .github/workflows/scripts/.pinot_compatibility_verifier.sh

  multi-stage-compatibility-verifier:
    if: github.repository == 'apache/pinot'
    runs-on: ubuntu-latest
    strategy:
      # Changed to false in order to improve coverage using unsafe buffers
      fail-fast: false
      matrix:
        test_suite: [ "compatibility-verifier/multi-stage-query-engine-test-suite" ]
        old_commit: [
          "master"
        ]
    name: Pinot Multi-Stage Query Engine Compatibility Regression Testing against ${{ matrix.old_commit }} on ${{ matrix.test_suite }}
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 11
        uses: actions/setup-java@v4
        with:
          java-version: 11
          distribution: 'temurin'
          cache: 'maven'
      - name: Setup node
        uses: actions/setup-node@v4
        with:
          node-version: v16.15.0
          cache: 'npm'
          cache-dependency-path: pinot-controller/src/main/resources/package-lock.json
      - name: Install npm
        run: |
          npm install -g npm@8.5.5
          npm --version
      # Step that does that actual cache save and restore
      - uses: actions/cache@v4
        env:
          SEGMENT_DOWNLOAD_TIMEOUT_MINS: 10
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-
      - name: Pinot Multi-Stage Query Engine Compatibility Regression Testing
        env:
          OLD_COMMIT: ${{ matrix.old_commit }}
          WORKING_DIR: /tmp/multi-stage-compatibility-verifier
          TEST_SUITE: ${{ matrix.test_suite }}
          MAVEN_OPTS: >
            -Xmx2G -DskipShade -DfailIfNoTests=false -Dmaven.wagon.httpconnectionManager.ttlSeconds=25
            -Dmaven.wagon.http.retryHandler.count=30 -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false
            -B -ntp
            -XX:+IgnoreUnrecognizedVMOptions
            --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED
            --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED
        run: .github/workflows/scripts/.pinot_compatibility_verifier.sh

  quickstarts:
    if: github.repository == 'apache/pinot'
    runs-on: ubuntu-latest
    strategy:
      # Changed to false in order to improve coverage using unsafe buffers
      fail-fast: false
      matrix:
        java: [ 11, 21 ]
        distribution: [ "temurin" ]
        skip_bytebuffer: [false]
        include:
          - java: 21
            distribution: "temurin"
            skip_bytebuffer: true
    name: Pinot Quickstart on JDK ${{ matrix.java }}-${{ matrix.distribution }} with skip bytebuffers:${{matrix.skip_bytebuffer}}
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK ${{ matrix.java }}
        uses: actions/setup-java@v4
        with:
          java-version: ${{ matrix.java }}
          distribution: ${{ matrix.distribution }}
          cache: 'maven'
      # Step that does that actual cache save and restore
      - uses: actions/cache@v4
        env:
          SEGMENT_DOWNLOAD_TIMEOUT_MINS: 10
          GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-
      - name: Quickstart on JDK ${{ matrix.java }}
        env:
          PINOT_OFFHEAP_SKIP_BYTEBUFFER: ${{ matrix.skip_bytebuffer }}
        run: .github/workflows/scripts/.pinot_quickstart.sh


Pinot Dependencies

#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#

name: Pinot Dependencies
on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master
    paths:
      - "**/pom.xml"
      - "**/package.json"
      - "**/package-lock.json"
      - "docker/images/pinot/**"
      - ".github/workflows/**"
jobs:
  verify-docker:
    if: github.repository == 'apache/pinot'
    name: Verify Docker Image
    runs-on: ubuntu-latest
    steps:
      - uses: docker/setup-qemu-action@v3
        name: Set up QEMU
      - uses: actions/checkout@v4
      - name: Build the Docker image
        env:
          DOCKER_FILE_BASE_DIR: "docker/images/pinot"
          DOCKER_IMAGE_NAME: "apachepinot/pinot"
          PINOT_GIT_URL: ${{ github.event.inputs.gitUrl }}
          PINOT_BRANCH: ${{ env.GITHUB_REF }}
          PINOT_SHA: ${{ github.sha }}
        run: .github/workflows/scripts/.pinot_vuln_check.sh

      - name: Run Trivy vulnerability scanner (sarif)
        uses: aquasecurity/trivy-action@master
        with:
          trivyignores: '.trivyignore'
          image-ref: 'apachepinot/pinot:${{ github.sha }}'
          format: 'sarif'
          output: 'trivy-results.sarif'
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
          timeout: '10m'
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'


Build & Publish

name: Build & Publish
on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]

jobs:
  build-and-analyse:
    name: Build & Analyse
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
        with:
          fetch-depth: 0 # required by sonarqube
      - name: Use Java 11
        uses: actions/setup-java@v1
        with:
          java-version: "11"
          architecture: x64
      - name: Use Node 16.14.2
        uses: actions/setup-node@v4
        with:
          node-version: 16.14.2
          cache-dependency-path: extension/package-lock.json
          cache: npm
      - name: Cache npm cache directory
        uses: actions/cache@v2
        with:
          path: ~/.npm
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-
      - name: Lint
        uses: gradle/gradle-build-action@v2
        with:
          arguments: lint
      - name: Build & Analyse Gradle Server
        uses: gradle/gradle-build-action@v2
        with:
          arguments: build
        env:
          JAVA_HOME: ""
          NODE_OPTIONS: "--max-old-space-size=4096"
      - name: Upload lib
        uses: actions/upload-artifact@v2
        with:
          name: lib
          path: |
            extension/lib
            extension/dist
            extension/out

  # Although the gradle build can run in all environments, we use the Java
  # lib generated in the previous step for a better real-world test.
  test-extension:
    needs: [build-and-analyse]
    name: "Test Java ${{ matrix.java-version }} - Node ${{ matrix.node-version }} - ${{ matrix.os }}"
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        node-version: [16.14.2]
        java-version: ["8", "11", "17", "21"]
        os: [ubuntu-latest, windows-latest, macos-latest]
    steps:
      - uses: actions/checkout@v2
      - name: Use Node ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache-dependency-path: extension/package-lock.json
          cache: npm
      - name: Use Java ${{ matrix.java-version }}
        uses: actions/setup-java@v1
        with:
          java-version: ${{ matrix.java-version }}
          architecture: x64
      - name: Cache vscode
        uses: actions/cache@v2
        with:
          path: |
            extension/.vscode-test
          key: ${{ runner.os }}-vscode-${{ hashFiles('**/vscode-version.ts') }}
          restore-keys: |
            ${{ runner.os }}-vscode-
      - name: Download lib
        uses: actions/download-artifact@v2
        with:
          name: lib
          path: extension/
      - name: Start Xvfb
        run: |
          Xvfb :99 -screen 0 1024x768x24 > /dev/null 2>&1 &
        if: matrix.os == 'ubuntu-latest'
      - name: Set permissions
        run: |
          chmod +x extension/lib/gradle-server
          unset npm_config_prefix
        if: matrix.os != 'windows-latest'
      - name: Test Gradle Language Server
        uses: gradle/gradle-build-action@v2
        with:
          arguments: gradle-language-server:test
        env:
          JAVA_HOME: ""
      - name: Prepare gradle-groovy-custom-build-file
        uses: gradle/gradle-build-action@v2
        with:
          arguments: build
          build-root-directory: extension/test-fixtures/gradle-groovy-custom-build-file
      - name: Prepare gradle-groovy-default-build-file
        uses: gradle/gradle-build-action@v2
        with:
          arguments: build
          build-root-directory: extension/test-fixtures/gradle-groovy-default-build-file
      - name: Prepare gradle-kotlin-default-build-file
        uses: gradle/gradle-build-action@v2
        with:
          arguments: build
          build-root-directory: extension/test-fixtures/gradle-kotlin-default-build-file
      - name: Install extension dependencies
        working-directory: extension/
        run: npm ci
      - name: Test extension
        uses: gradle/gradle-build-action@v2
        continue-on-error: true
        id: test
        with:
          arguments: testVsCode
        env:
          DISPLAY: ":99.0"
          CI: "true"
      - name: Retry test extension attempt 1
        uses: gradle/gradle-build-action@v2
        continue-on-error: true
        if: steps.test.outcome=='failure'
        id: retry1
        with:
          arguments: testVsCode
        env:
          DISPLAY: ":99.0"
          CI: "true"

      - name: Retry test extension attempt 2
        uses: gradle/gradle-build-action@v2
        continue-on-error: true
        if: steps.retry1.outcome=='failure'
        id: retry2
        with:
          arguments: testVsCode
        env:
          DISPLAY: ":99.0"
          CI: "true"
      - name: Set test extension status
        if: ${{ steps.test.outcome=='failure' && steps.retry1.outcome=='failure' && steps.retry2.outcome=='failure' }}
        run: |
          echo "Tests failed"
          exit 1


Backend

#
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

name: Backend

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

concurrency:
  group: backend-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  check-license:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Check License Header
        uses: apache/skywalking-eyes/header@main
  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Set up JDK 11
        uses: actions/setup-java@v2
        with:
          java-version:  11
          distribution: 'adopt'
      - name: Install Protoc
        run: sudo apt install -y protobuf-compiler
      - uses: actions/cache@v2
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven
      - name: Run Unit tests
        run: ./mvnw clean verify -B -Dmaven.test.skip=false -Dwayang.configuration=file:$(pwd)/tools/test/config/wayang.properties
      - name: Build And Install
        run: ./mvnw clean install -B -Dmaven.test.skip=true


CodeQL

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: "CodeQL"

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        language: ['java']

    steps:
      - name: Checkout repository
        uses: actions/checkout@v2
        with:
          submodules: true
      - name: Set up JDK 11
        uses: actions/setup-java@v2
        with:
          java-version: 11
          distribution: 'adopt'
      - name: Install Protoc
        run: sudo apt install -y protobuf-compiler
      - uses: actions/cache@v2
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          languages: ${{ matrix.language }}
      - name: Autobuild
        uses: github/codeql-action/autobuild@v2
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v2


Generate Documentation workflow

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
name: Generate Documentation workflow

on:
  push:
    branches: [ main ]
    paths:
      - 'wayang-docs/**'
  pull_request:
    branches: [ main ]
    types: [closed]
    paths:
      - 'wayang-docs/**'
permissions:
  issues: write
jobs:
  build:
    name: Create documentation
    runs-on: ubuntu-latest
    env:
      ## Environment variable
      API_KEY: $HOME/gems
    steps:
      - uses: actions/checkout@v2
      - name: Set up JDK 1.8
        uses: actions/setup-java@v2
        with:
          java-version:  8
          distribution: 'adopt'
      - name: Install ruby
        run: |
          sudo apt install -y ruby-full build-essential zlib1g-dev
          export GEM_HOME="$HOME/gems"' >> $GITHUB_ENV
          export PATH="$HOME/gems/bin:$PATH"' >> $GITHUB_ENV
      - name: Install jekyll
        run: |
          sudo gem install jekyll bundler
      - uses: actions/cache@v2
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven
      - name: Generate the documentation
        run: |
          ./mvnw clean gem:exec@bundle-install gem:exec@generate-documentation gem:exec@generate-documentation-as-latest site -pl wayang-docs -Pweb-documentation


to-do to issue workflow

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
name: to-do to issue workflow

on:
  push:
    branches: [ main ]
#   pull_request:
#     branches: [ main ]
#     types: [closed]
permissions:
  issues: write
jobs:
  build:
    runs-on: "ubuntu-latest"
    steps:
      - uses: "actions/checkout@master"
        with:
          persist-credentials: false
          submodules: recursive
      - name: "TODO to Issue"
        uses: ./.github/actions/todo-to-issue-action
        id: "todo"
        with:
          token: ${{ secrets.GITHUB_TOKEN }}


Build and Deploy

name: Build and Deploy

on:
  push:
    branches:
      - '**'
  schedule:
    - cron: '0 10 * * *' # Once per day at 10am UTC
  workflow_dispatch:

jobs:
  build:
    name: Build
    uses: spring-io/spring-security-release-tools/.github/workflows/build.yml@v1
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest]
        jdk: [17]
    with:
      runs-on: ${{ matrix.os }}
      java-version: ${{ matrix.jdk }}
      distribution: temurin
    secrets: inherit
  test:
    name: Test Against Snapshots
    uses: spring-io/spring-security-release-tools/.github/workflows/test.yml@v1
    with:
      test-args: --refresh-dependencies --stacktrace -PforceMavenRepositories=snapshot -PspringFrameworkVersion=6.1.+ -PspringSecurityVersion=6.3.+
    secrets: inherit
  deploy-artifacts:
    name: Deploy Artifacts
    needs: [build, test]
    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml@v1
    with:
      should-deploy-artifacts: ${{ needs.build.outputs.should-deploy-artifacts }}
    secrets: inherit
  deploy-docs:
    name: Deploy Docs
    needs: [build, test]
    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-docs.yml@v1
    with:
      should-deploy-docs: ${{ needs.build.outputs.should-deploy-artifacts }}
    secrets: inherit
  perform-release:
    name: Perform Release
    needs: [deploy-artifacts, deploy-docs]
    uses: spring-io/spring-security-release-tools/.github/workflows/perform-release.yml@v1
    with:
      should-perform-release: ${{ needs.deploy-artifacts.outputs.artifacts-deployed }}
      project-version: ${{ needs.deploy-artifacts.outputs.project-version }}
      milestone-repo-url: https://repo.spring.io/artifactory/milestone
      release-repo-url: https://repo1.maven.org/maven2
      artifact-path: org/springframework/security/spring-security-oauth2-authorization-server
      slack-announcing-id: spring-authorization-server-announcing
    secrets: inherit


Deploy Docs

name: Deploy Docs

on:
  push:
    branches-ignore:
      - "gh-pages"
      - "dependabot/**"
      - "0.4.x"
      - "1.0.x"
      - "1.1.x"
    tags:
      - "**"
  repository_dispatch:
    types: request-build-reference # legacy
  workflow_dispatch:

permissions:
  actions: write

jobs:
  build:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'spring-projects'
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: docs-build
          fetch-depth: 1
      - name: Dispatch (partial build)
        if: github.ref_type == 'branch'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh workflow run deploy-docs.yml -r $(git rev-parse --abbrev-ref HEAD) -f build-refname=${{ github.ref_name }}
      - name: Dispatch (full build)
        if: github.ref_type == 'tag'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh workflow run deploy-docs.yml -r $(git rev-parse --abbrev-ref HEAD)


PR build

name: PR build

on:
  pull_request:
    branches:
      - '**'

jobs:
  build:
    name: Build
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest]
        jdk: [17]
      fail-fast: false
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK ${{ matrix.jdk }}
        uses: spring-io/spring-gradle-build-action@v2
        with:
          java-version: ${{ matrix.jdk }}
          distribution: 'temurin'
      - name: Build with Gradle
        run: ./gradlew clean build


Release Scheduler

name: Release Scheduler

on:
  schedule:
    - cron: '15 15 * * TUE' # Every Tuesday at 3:15pm UTC
  workflow_dispatch:

permissions: read-all

jobs:
  dispatch_scheduled_releases:
    name: Dispatch scheduled releases
    if: ${{ github.repository_owner == 'spring-projects' }}
    strategy:
      matrix:
        # List of active maintenance branches.
        branch: [ main, 1.2.x ]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 1
      - name: Dispatch
        env:
          GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
        run: gh workflow run update-scheduled-release-version.yml -r ${{ matrix.branch }}


Update Scheduled Release Version

name: Update Scheduled Release Version

on:
  workflow_dispatch: # Manual trigger only. Triggered by release-scheduler.yml on main.

jobs:
  update-scheduled-release-version:
    name: Update Scheduled Release Version
    uses: spring-io/spring-security-release-tools/.github/workflows/update-scheduled-release-version.yml@v1
    secrets: inherit


Deploy cdk infra

name: Deploy cdk infra
on:
  workflow_dispatch:
  push:
    branches: ['terraform']
    # List of paths that should be considered when triggering the workflow
    paths: ['cdk_infra/**']

permissions:
  id-token: write
  contents: read

concurrency:
  group: cdk_infra_deploy
  cancel-in-progress: false

jobs:
  run-cdk-deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.TEST_FW_ASSUMABLE_ROLE_ARN }}
          aws-region: us-west-2
          role-duration-seconds: 21600
      - uses: actions/setup-node@v4
        with:
          node-version: 16
      - name: Get npm cache directory
        id: npm-cache-dir
        run: |
          echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT
      - uses: actions/cache@v4
        id: npm-cache
        with:
          path: ${{ steps.npm-cache-dir.outputs.dir }}
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-
      - name: npm install
        working-directory: cdk_infra
        run: |
          npm install
      - name: run cdk deploy
        working-directory: cdk_infra
        run: |
          make deploy-infra


CodeQL

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: "CodeQL"

on:
  push:
    branches: [ terraform ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ terraform ]
  schedule:
    - cron: '18 17 * * 6'

jobs:
  fomrat:
    name: Format
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v4
    - name: Format Terraform
      run: cd terraform && make check-fmt

  analyze:
    name: Analyze
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        language: [ 'go', 'java', 'python' ]
        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
        # Learn more:
        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.
        # queries: ./path/to/local/query, your-org/your-repo/queries@main

    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
      if: matrix.language != 'java'
      uses: github/codeql-action/autobuild@v3

    # ℹ Command-line programs to run using the OS shell.
    # 📚 https://git.io/JvXDl

    # ✏ If the Autobuild fails above, remove it and uncomment the following three lines
    #    and modify them (or add more) to build your code if your project
    #    uses a compiled language

    - run: |
       ./gradlew build
      if: matrix.language == 'java'

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3


Main build

name: Main build

on:
  push:
    branches: [ terraform ]

permissions:
  id-token: write
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-java@v4
      with:
        distribution: 'zulu'
        java-version: 17
    - name: Configure AWS Credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ secrets.INTEG_TEST_TFW_ROLE_ARN }}
        role-duration-seconds: 1200
        aws-region: us-east-1
    - name: Login to ECR
      uses: docker/login-action@v3
      with:
        registry: public.ecr.aws
    - name: Push validator docker image
      uses: burrunan/gradle-cache-action@v1
      with:
        arguments: :validator:jib --stacktrace


PR Build

# This workflow will build a Java project with Gradle
# For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-gradle

name: PR Build
on:
  pull_request:
    branches:
      - terraform
      - release/v*
      - dev*

jobs:
  validator-build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Set up JDK 1.8
      uses: actions/setup-java@v4
      with:
        distribution: 'zulu'
        java-version: 17
    - name: Grant execute permission for gradlew
      run: chmod +x gradlew
    - name: Build with Gradle
      run: ./gradlew :validator:build
  validator-image-build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
    - name: Build validator image
      uses: docker/build-push-action@v5
      with:
        context: ./validator
        push: false
        tags: latest
        cache-from: type=gha
        cache-to: type=gha,mode=max
        platforms : linux/amd64, linux/arm64
  go-test:
    runs-on: ubuntu-latest
    steps:
    - name: Set up Go 1.x
      uses: actions/setup-go@v5
      with:
        go-version: '~1.21.1'
    - name: Checkout repo
      uses: actions/checkout@v4
    - name: Unit test
      run: make go-test
  cdk-test:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout repo
      uses: actions/checkout@v4
    - uses: actions/setup-node@v4
      with:
        node-version: 16
    - name: Get npm cache directory
      id: npm-cache-dir
      run: |
        echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT
    - uses: actions/cache@v4
      id: npm-cache # use this to check for `cache-hit` ==> if: steps.npm-cache.outputs.cache-hit != 'true'
      with:
        path: ${{ steps.npm-cache-dir.outputs.dir }}
        key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
        restore-keys: |
          ${{ runner.os }}-node-
    - name: Test CDK
      working-directory: cdk_infra/
      run: |
        npm install
        npm run test
  adot-testbed:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: '17'
      - name: Setup Gradle
        uses: gradle/gradle-build-action@v3
      - name: adot-testbed build
        working-directory: adot-testbed/
        run: gradle build -x test


Update Load-Generator Image

# This workflow uses GHA to build a Java project with Gradle 'load-generator', and build and push multi-arch docker image of this project to the Amazon ECR.

name: Update Load-Generator Image

# Should execute only one workflow run at a time
concurrency:
  group: build-and-push-load-generator-image
  cancel-in-progress: false

on:
  workflow_dispatch:
  push:
    branches: ['terraform']

    # List of paths that should be considered when triggering the workflow
    paths: ['load-generator/**']

permissions:
  id-token: write
  contents: read

jobs:
  create-and-push-load-generator-image-on-push:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.TEST_FW_ASSUMABLE_ROLE_ARN }}
          aws-region: us-east-1
          role-duration-seconds: 7200
      - name: Login to Amazon ECR Public
        id: login-ecr-public
        uses: aws-actions/amazon-ecr-login@v2
        with:
          registry-type: public
      - name: Set up Java
        uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 17
      - name: Build image with jib
        uses: gradle/gradle-build-action@v3
        with:
          arguments: :load-generator:jib
        env:
          COMMIT_HASH: ${{ github.sha }}


Update Test Images

name: Update Test Images

# We should execute only one workflow run at a time
concurrency:
  group: test_images_concurrency
  cancel-in-progress: false

on:
  workflow_dispatch:
  push:
    branches: ['terraform']

    # List of paths that should be considered when triggering the workflow
    paths: ['mocked_servers/**', 'sample-apps/**']

permissions:
  id-token: write
  contents: read

jobs:
  run-image-build:
    runs-on: ubuntu-latest
    steps:
      - name: Remove cache
        run: rm -rf /opt/hostedtoolcache
      - uses: actions/checkout@v4
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.TEST_FW_ASSUMABLE_ROLE_ARN }}
          aws-region: us-west-2
          role-duration-seconds: 7200
      - uses: actions/setup-java@v4
        with:
          distribution: 'zulu'
          java-version: 17
      - uses: gradle/wrapper-validation-action@v2
      - name: Build locally with gradle
        uses: gradle/gradle-build-action@v3
        with:
          arguments: build
      - name: Set up terraform
        uses: hashicorp/setup-terraform@v3
      - name: run imagebuild
        working-directory: terraform/imagebuild
        run: |
          terraform init && terraform apply --auto-approve


name: Apply 'untriaged' label during issue lifecycle

on:
  issues:
    types: [opened, reopened, transferred]

jobs:
  apply-label:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/github-script@v6
        with:
          script: |
            github.rest.issues.addLabels({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              labels: ['untriaged']
            })