build.yml

name: Build
on:
  push:
    branches:
      - master
      - branch-*
      - dogfood-*
  pull_request:
  workflow_dispatch:
  schedule:
    - cron: "30 1 * * 1-5" # Run Mon-Fri at 1:30 AM UTC

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  USE_DEVELOCITY: true
  DEVELOCITY_URL: https://develocity.sonar.build/
  MAVEN_OUTPUT_ARGS: "--errors --show-version"

jobs:
  build:
    runs-on: warp-custom-ubuntu-24-04
    name: Build
    permissions:
      id-token: write  # Required for Vault OIDC authentication
      contents: write  # Required for repository access and tagging
    outputs:
      build-number: ${{ steps.build-maven.outputs.BUILD_NUMBER }}
      deployed: ${{ steps.build-maven.outputs.deployed }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
        with:
          version: 2026.10.0
      - uses: SonarSource/ci-github-actions/build-maven@v2
        id: build-maven
        env:
          MAVEN_OPTS: "-Xmx8g"
        with:
          repox-url: https://repox-internal.dev.sonar.build
          deploy-pull-request: true
          sonar-platform: none # Prevent analysis
          # Override artifactory roles for public repo using private access
          artifactory-reader-role: private-reader
          artifactory-deployer-role: qa-deployer
          use-develocity: ${{ env.USE_DEVELOCITY }}
          develocity-url: ${{ env.DEVELOCITY_URL }}
          maven-args: >
            --define maven.test.skip=true
            --define sonar.skip=true
            --projects !java-checks-test-sources/aws,!java-checks-test-sources/default,!java-checks-test-sources/java-17,!java-checks-test-sources/spring-3.2,!java-checks-test-sources/spring-web-4.0

      # PVF: publish the concrete deployed plugin version so pvf-comment.yml can dispatch a performance-validation run into peachee-java-kotlin.
      - name: Prepare PVF candidate version
        if: ${{ steps.build-maven.outputs.deployed }}
        uses: SonarSource/core-languages-tooling-public/prepare-pvf@master
        with:
          build-version: ${{ steps.build-maven.outputs.project-version }}

  ruling-qa:
    strategy:
      fail-fast: false
      matrix:
        item:
          - { runner: warp-custom-ubuntu-24-04, profile: without-sonarqube-project, sq_version: LATEST_RELEASE }
          - { runner: warp-custom-ubuntu-24-04, profile: only-sonarqube-project, sq_version: LATEST_RELEASE }
          - { runner: warp-custom-windows-2022-l, profile: without-sonarqube-project, sq_version: LATEST_RELEASE }
          - { runner: warp-custom-windows-2022-m, profile: only-sonarqube-project, sq_version: LATEST_RELEASE }
    name: Ruling QA
    needs:
      - build
    if: ${{ needs.build.outputs.deployed }}
    runs-on: ${{ matrix.item.runner }}
    permissions:
      id-token: write
      contents: write
    env:
      BUILD_NUMBER: ${{ needs.build.outputs.build-number }}
    steps:
      - name: Config Git
        if: runner.os == 'Windows'
        run: git config --global core.autocrlf input
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: recursive
      - uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
        with:
          version: 2026.10.0
      - name: Select Java Version
        shell: bash # Set explicitly so Bash is used on Windows runners too.
        run: |
          mise use java@21
          JAVA_21_HOME="$(mise where java@21)"
          echo "JAVA_HOME=${JAVA_21_HOME}" >> "$GITHUB_ENV"
          echo "${JAVA_21_HOME}/bin" >> "$GITHUB_PATH"
      - uses: ./.github/actions/maven-cache
        with:
          namespace: ruling-qa-${{ matrix.item.runner }}-${{ matrix.item.profile }}-${{ matrix.item.sq_version }}
      - name: Configure Maven
        uses: SonarSource/ci-github-actions/config-maven@v2
        with:
          repox-url: https://repox-internal.dev.sonar.build
          artifactory-reader-role: private-reader
          use-develocity: ${{ env.USE_DEVELOCITY }}
          develocity-url: ${{ env.DEVELOCITY_URL }}
          disable-caching: 'true'
      - name: Getting Vault Secrets
        id: secrets
        uses: SonarSource/vault-action-wrapper@v3
        with:
          secrets: |
            development/github/token/licenses-ro token | GITHUB_TOKEN;
            development/artifactory-edge-prod/token/{REPO_OWNER_NAME_DASH}-private-reader access_token | ORCHESTRATOR_ACCESS_TOKEN;
      - name: Configure production Orchestrator
        shell: bash
        env:
          ORCHESTRATOR_ACCESS_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).ORCHESTRATOR_ACCESS_TOKEN }}
        run: |
          umask 077
          config_dir="$RUNNER_TEMP/orchestrator-production-config"
          mkdir -p "$config_dir"
          printf '%s\n' \
            'orchestrator.artifactory.url=https://repox-internal.sonar.build/artifactory' \
            "orchestrator.artifactory.accessToken=$ORCHESTRATOR_ACCESS_TOKEN" > "$config_dir/orchestrator.properties"
          config_path="$config_dir/orchestrator.properties"
          if [[ "$RUNNER_OS" == Windows ]]; then
            config_path="/$(cygpath -m "$config_path")"
          fi
          config_path="${config_path// /%20}"
          echo "ORCHESTRATOR_CONFIG_URL=file://$config_path" >> "$GITHUB_ENV"
      - name: Orchestrator Cache
        uses: ./.github/actions/orchestrator-cache
        with:
          sq-version: ${{ matrix.item.sq_version }}
      - name: Run ruling tests
        shell: bash # Set explicitly so Bash is used on Windows runners too.
        env:
          MAVEN_OPTS: "-Xmx3g -Dfile.encoding=UTF-8"
          JAVA_TOOL_OPTIONS: ""
          GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).GITHUB_TOKEN }}
          ORCHESTRATOR_HOME: ${{ github.event_name == 'pull_request' && format('{0}/orchestrator-production', runner.temp) || env.ORCHESTRATOR_HOME }}
        run: |
          cd its/ruling
          extra_args=()
          # Nested Maven builds share ~/.m2; Windows denies concurrent writes to *.lastUpdated.
          if [[ "${RUNNER_OS}" != "Windows" ]]; then
            extra_args+=(-Dparallel=methods -DuseUnlimitedThreads=true)
          fi
          mvn "-Dorchestrator.configUrl=$ORCHESTRATOR_CONFIG_URL" "-Dorchestrator.home=$ORCHESTRATOR_HOME" package ${MAVEN_OUTPUT_ARGS} "-Pit-ruling,${{ matrix.item.profile }}" -Dsonar.runtimeVersion=${{ matrix.item.sq_version }} -Dmaven.test.redirectTestOutputToFile=false "${extra_args[@]}"
      - name: Upload Actual Results On Failure
        if: failure()
        uses: ./.github/actions/upload-actual
        with:
          name: ${{ matrix.item.runner }}_${{ matrix.item.profile }}
          it-dir: its/ruling
          expected-dir: src/test/resources/expected
          actual-dir: target/actual

  ruling-update-notify:
    name: Ruling Update and Notify
    needs: ruling-qa
    if: always() && github.event_name == 'pull_request'
    runs-on: warp-custom-ubuntu-24-04
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          submodules: recursive

      - name: Install uv
        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
        with:
          enable-cache: true

      - name: Check ruling-qa results
        id: check-ruling
        run: |
          # Check if any ruling-qa job failed
          # For matrix jobs, needs.ruling-qa.result can be 'success' only if ALL jobs succeeded
          RULING_FAILED=false
          if [[ "${{ needs.ruling-qa.result }}" != "success" ]]; then
            RULING_FAILED=true
          fi
          echo "ruling-failed=$RULING_FAILED" >> "$GITHUB_OUTPUT"
          echo "Ruling QA result: ${{ needs.ruling-qa.result }}, failed=$RULING_FAILED"

      - name: Update ruling and notify
        uses: SonarSource/core-languages-tooling-public/ruling-update-and-notify@master
        with:
          ruling-failed: ${{ steps.check-ruling.outputs.ruling-failed }}
        env:
          GH_TOKEN: ${{ github.token }}

  plugin-qa:
    strategy:
      fail-fast: false
      matrix:
        sq_version: ['LATEST_RELEASE', 'DEV']
        is_nightly:
          - ${{ github.event_name == 'schedule' }}
        exclude:
          - sq_version: DEV
            is_nightly: false
    name: Plugin QA
    needs:
      - build
    if: ${{ needs.build.outputs.deployed }}
    runs-on: warp-custom-ubuntu-24-04
    permissions:
      id-token: write
      contents: write
    env:
      BUILD_NUMBER: ${{ needs.build.outputs.build-number }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: recursive
      - uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
        with:
          version: 2026.10.0
      - name: Select Java Version
        shell: bash # Set explicitly so Bash is used on Windows runners too.
        run: |
          mise use java@21
          JAVA_21_HOME="$(mise where java@21)"
          echo "JAVA_HOME=${JAVA_21_HOME}" >> "$GITHUB_ENV"
          echo "${JAVA_21_HOME}/bin" >> "$GITHUB_PATH"
      - uses: ./.github/actions/maven-cache
        with:
          namespace: plugin-qa-${{ matrix.sq_version }}
      - name: Configure Maven
        uses: SonarSource/ci-github-actions/config-maven@v2
        with:
          repox-url: https://repox-internal.dev.sonar.build
          artifactory-reader-role: private-reader
          use-develocity: ${{ env.USE_DEVELOCITY }}
          develocity-url: ${{ env.DEVELOCITY_URL }}
          disable-caching: 'true'
      - name: Getting Vault Secrets
        id: secrets
        uses: SonarSource/vault-action-wrapper@v3
        with:
          secrets: |
            development/github/token/licenses-ro token | GITHUB_TOKEN;
            development/artifactory-edge-prod/token/{REPO_OWNER_NAME_DASH}-private-reader access_token | ORCHESTRATOR_ACCESS_TOKEN;
      - name: Configure production Orchestrator
        shell: bash
        env:
          ORCHESTRATOR_ACCESS_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).ORCHESTRATOR_ACCESS_TOKEN }}
        run: |
          umask 077
          config_dir="$RUNNER_TEMP/orchestrator-production-config"
          mkdir -p "$config_dir"
          printf '%s\n' \
            'orchestrator.artifactory.url=https://repox-internal.sonar.build/artifactory' \
            "orchestrator.artifactory.accessToken=$ORCHESTRATOR_ACCESS_TOKEN" > "$config_dir/orchestrator.properties"
          config_path="$config_dir/orchestrator.properties"
          if [[ "$RUNNER_OS" == Windows ]]; then
            config_path="/$(cygpath -m "$config_path")"
          fi
          config_path="${config_path// /%20}"
          echo "ORCHESTRATOR_CONFIG_URL=file://$config_path" >> "$GITHUB_ENV"
      - name: Orchestrator Cache
        uses: ./.github/actions/orchestrator-cache
        with:
          sq-version: ${{ matrix.sq_version }}
      - name: Plugin QA
        env:
          GITHUB_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).GITHUB_TOKEN }}
          ORCHESTRATOR_HOME: ${{ github.event_name == 'pull_request' && format('{0}/orchestrator-production', runner.temp) || env.ORCHESTRATOR_HOME }}
        run: |
          cd its/plugin
          mvn "-Dorchestrator.configUrl=$ORCHESTRATOR_CONFIG_URL" "-Dorchestrator.home=$ORCHESTRATOR_HOME" package ${MAVEN_OUTPUT_ARGS} -Pit-plugin -Dsonar.runtimeVersion=${{ matrix.sq_version }} -Dmaven.test.redirectTestOutputToFile=false -Dparallel=classes -DuseUnlimitedThreads=true

  sanity:
    name: Sanity Test
    needs:
      - build
    if: ${{ needs.build.outputs.deployed }}
    runs-on: warp-custom-ubuntu-24-04
    permissions:
      id-token: write
      contents: write
    env:
      BUILD_NUMBER: ${{ needs.build.outputs.build-number }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
        with:
          version: 2026.10.0
      - uses: SonarSource/vault-action-wrapper@v3
        id: secrets
        with:
          secrets: |
            development/kv/data/next url | SONAR_HOST_URL;
            development/kv/data/next token | SONAR_TOKEN;
      - uses: ./.github/actions/maven-cache
        with:
          namespace: sanity
      - uses: SonarSource/ci-github-actions/config-maven@v2
        with:
          repox-url: https://repox-internal.dev.sonar.build
          artifactory-reader-role: private-reader
          use-develocity: ${{ env.USE_DEVELOCITY }}
          develocity-url: ${{ env.DEVELOCITY_URL }}
          disable-caching: 'true'
      - name: Compile Test Sources
        env:
          SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }}
          SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }}
        working-directory: java-checks-test-sources
        run: |
          mvn clean compile --batch-mode
      - name: Sanity Test
        env:
          SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }}
          SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }}
          MAVEN_OPTS: "-Xmx8g"
        run: |
          mvn verify ${MAVEN_OUTPUT_ARGS} -f sonar-java-plugin/pom.xml -Psanity -Dtest=SanityTest

  test-analyze:
    name: Test Analyze
    needs:
      - build
    if: ${{ needs.build.outputs.deployed }}
    runs-on: warp-custom-ubuntu-24-04-l
    permissions:
      id-token: write
      contents: write
    env:
      BUILD_NUMBER: ${{ needs.build.outputs.build-number }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
        with:
          version: 2026.10.0
      - uses: SonarSource/vault-action-wrapper@v3
        id: secrets
        with:
          secrets: |
            development/kv/data/next url | SONAR_HOST_URL;
            development/kv/data/next token | SONAR_TOKEN;
      - uses: SonarSource/ci-github-actions/build-maven@v2
        with:
          repox-url: https://repox-internal.dev.sonar.build
          deploy: false
          artifactory-reader-role: private-reader    # Override default public-reader
          artifactory-deployer-role: qa-deployer     # Override default public-deployer
          use-develocity: ${{ env.USE_DEVELOCITY }}
          develocity-url: ${{ env.DEVELOCITY_URL }}
          scanner-java-opts: '-Xmx2g'
        env:
          SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }}
          SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }}
          MAVEN_OPTS: "-Xmx8g"
          JAVA_TOOL_OPTIONS: "" # Set an empty value to avoid issues with runners hanging and significantly slowing down builds

  custom-rules-license-check:
    name: Custom Rules and License Check
    needs:
      - build
    if: ${{ needs.build.outputs.deployed }}
    runs-on: warp-custom-ubuntu-24-04
    permissions:
      id-token: write
      contents: write
    env:
      BUILD_NUMBER: ${{ needs.build.outputs.build-number }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
        with:
          version: 2026.10.0
      - uses: SonarSource/vault-action-wrapper@v3
        id: secrets
        with:
          secrets: |
            development/kv/data/next url | SONAR_HOST_URL;
            development/kv/data/next token | SONAR_TOKEN;
      - uses: ./.github/actions/maven-cache
        with:
          namespace: custom-rules-license-check
      - uses: SonarSource/ci-github-actions/config-maven@v2
        with:
          repox-url: https://repox-internal.dev.sonar.build
          artifactory-reader-role: private-reader
          use-develocity: ${{ env.USE_DEVELOCITY }}
          develocity-url: ${{ env.DEVELOCITY_URL }}
          disable-caching: 'true'
        env:
          SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }}
          SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }}
          JAVA_TOOL_OPTIONS: "" # Set an empty value to avoid issues with runners hanging and significantly slowing down builds
      - name: Build Java Custom Rules Example
        env:
          SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }}
          SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }}
        working-directory: docs/java-custom-rules-example
        run: |
          mvn clean package -f pom_SQ_10_6_LATEST.xml --batch-mode
      - name: Check License Compliance
        run: |
          # See https://xtranet.sonarsource.com/display/DEV/Open+Source+Licenses
          mvn org.codehaus.mojo:license-maven-plugin:aggregate-add-third-party \
            --batch-mode \
            "-Dlicense.missingFile=${PWD}/missing-dep-licenses.properties" \
            -DuseMissingFile

  qa-os-win:
    name: Build and Unit Test on Windows
    # No dependency on build step, because we do not need the build number.
    runs-on: warp-custom-windows-2022-m
    permissions:
      id-token: write  # Required for Vault OIDC authentication
      contents: write  # Required for repository access and tagging
    steps:
      - name: Config Git
        run: git config --global core.autocrlf input
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
        with:
          version: 2026.10.0
      - uses: ./.github/actions/maven-cache
        with:
          namespace: qa-os-win
      - name: Configure Maven
        uses: SonarSource/ci-github-actions/config-maven@v2
        with:
          repox-url: https://repox-internal.dev.sonar.build
          artifactory-reader-role: private-reader
          use-develocity: ${{ env.USE_DEVELOCITY }}
          develocity-url: ${{ env.DEVELOCITY_URL }}
          disable-caching: 'true'
      - name: Run Maven
        env:
          JAVA_TOOL_OPTIONS: ""
          MAVEN_OPTS: "-Xmx8g"
        run: mvn clean verify --batch-mode

  promote:
    needs:
      - build
      - ruling-qa
      - plugin-qa
      - sanity
      - test-analyze
      - custom-rules-license-check
      - qa-os-win
    if: ${{ needs.build.outputs.deployed }}
    runs-on: warp-custom-ubuntu-24-04
    name: Promote
    permissions:
      id-token: write
      contents: write
    env:
      BUILD_NUMBER: ${{ needs.build.outputs.build-number }}
    steps:
      - uses: SonarSource/ci-github-actions/promote@v2
        with:
          promote-pull-request: true

  notify-build-failure:
    name: Notify Build Failure
    needs:
      - build
      - ruling-qa
      - plugin-qa
      - sanity
      - test-analyze
      - custom-rules-license-check
      - qa-os-win
      - promote
    if: >-
      always()
      && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/branch-') || startsWith(github.ref, 'refs/heads/dogfood-'))
      && contains(needs.*.result, 'failure')
    runs-on: sonar-xs-public
    permissions:
      actions: read      # lets the action list this run's own jobs via the GitHub API
      id-token: write    # required for vault-action-wrapper in the shared slack-notify action
    steps:
      - name: Slack Notification
        uses: SonarSource/core-languages-tooling-public/common-actions/slack-notify@v1
        with:
          slack-channel: squad-corelang-notifs
          branch-patterns: ${{ format('{0},branch-*,dogfood-*', github.event.repository.default_branch) }}
          github-token: ${{ github.token }}
          branch: ${{ github.ref_name }}