ci.yml

name: ci

on:
  workflow_dispatch:
  push:
    branches:
      - main
    paths-ignore:
      - ./**.md
      - ./**.txt
      - ./**.json
      - ./.gitignore

env:
  GRADLE_OPTS: -Dorg.gradle.jvmargs="-XX:MaxMetaspaceSize=2g"
  JDK_VERSION: 19
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}
  GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
  CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}

permissions:
  security-events: write
  contents: write
  packages: write

jobs:
  test:
    uses: ./.github/workflows/test.yml
    secrets: inherit

  build:
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up JDK ${{ env.JDK_VERSION }}
        uses: actions/setup-java@v4
        with:
          java-version: ${{ env.JDK_VERSION }}
          distribution: temurin

      - name: Validate Gradle wrapper
        uses: gradle/wrapper-validation-action@v3

      - uses: gradle/gradle-build-action@v2

      - name: Gradle build
        run: ./gradlew build --scan

      - name: Publish snapshots on GPR
        run: ./gradlew publishAllPublicationsToGitHubPackagesRepository

      - name: Publish snapshots on Sonatype
        run: ./gradlew publishToSonatype
        env:
          SONATYPE_USER: ${{ secrets.SONATYPE_USER }}
          SONATYPE_PASS: ${{ secrets.SONATYPE_PASS }}

      - name: Gradle dependency submission
        uses: mikepenz/gradle-dependency-submission@main
        with:
          gradle-build-module: |-
            :build-logic
            :kipher-coverage
            :kipher-core
            :kipher-symmetric
            :kipher-digest
            :kipher-mac
          gradle-build-configuration: |-
            compileClasspath

      - name: Upload SARIF results file
        if: always()
        uses: github/codeql-action/upload-sarif@main
        with:
          sarif_file: build/reports/detekt/merge.sarif

      - name: Trunk Check
        if: always()
        uses: trunk-io/trunk-action@v1
        with:
          check-mode: all
          trunk-token: ${{ secrets.TRUNK_TOKEN }}
          arguments: --replace