image: maven:3.9-eclipse-temurin-21

stages:
  - build
  - test
  - quality
  - security
  - package
  - release

variables:
  MAVEN_OPTS: "-Dmaven.repo.local=.m2/repository"

cache:
  key: "${CI_COMMIT_REF_SLUG}"
  paths:
    - .m2/repository/

# ============================================
# 构建阶段 — 根据分支自动选择 JDK
# ============================================
build:java21:
  stage: build
  image: maven:3.9-eclipse-temurin-21
  script:
    - ./mvnw -B clean compile
  artifacts:
    paths:
      - target/classes/
    expire_in: 1 hour
  only:
    - master
    - jre21
    - merge_requests

build:java17:
  stage: build
  image: maven:3.9-eclipse-temurin-17
  script:
    - ./mvnw -B clean compile
  artifacts:
    paths:
      - target/classes/
    expire_in: 1 hour
  only:
    - master
    - jre17
    - merge_requests

build:java11:
  stage: build
  image: maven:3.9-eclipse-temurin-11
  script:
    - ./mvnw -B clean compile
  artifacts:
    paths:
      - target/classes/
    expire_in: 1 hour
  only:
    - master
    - jre11
    - merge_requests

build:java8:
  stage: build
  image: maven:3.9-eclipse-temurin-8
  script:
    - ./mvnw -B clean compile
  artifacts:
    paths:
      - target/classes/
    expire_in: 1 hour
  only:
    - master
    - jre8
    - merge_requests

# ============================================
# 测试阶段 — 各 JDK 独立跑测试
# ============================================
test:java21:
  stage: test
  image: maven:3.9-eclipse-temurin-21
  script:
    - ./mvnw -B test
  coverage: '/Total.*?([0-9]{1,3})%/'
  artifacts:
    reports:
      junit: target/surefire-reports/*.xml
      coverage_report:
        coverage_format: jacoco
        path: target/site/jacoco/jacoco.xml
    paths:
      - target/surefire-reports/
      - target/site/jacoco/
    expire_in: 7 days
  only:
    - master
    - jre21
    - merge_requests

test:java17:
  stage: test
  image: maven:3.9-eclipse-temurin-17
  script:
    - ./mvnw -B test
  artifacts:
    reports:
      junit: target/surefire-reports/*.xml
    paths:
      - target/surefire-reports/
    expire_in: 7 days
  only:
    - master
    - jre17
    - merge_requests

test:java11:
  stage: test
  image: maven:3.9-eclipse-temurin-11
  script:
    - ./mvnw -B test
  artifacts:
    reports:
      junit: target/surefire-reports/*.xml
    paths:
      - target/surefire-reports/
    expire_in: 7 days
  only:
    - master
    - jre11
    - merge_requests

test:java8:
  stage: test
  image: maven:3.9-eclipse-temurin-8
  script:
    - ./mvnw -B test
  artifacts:
    reports:
      junit: target/surefire-reports/*.xml
    paths:
      - target/surefire-reports/
    expire_in: 7 days
  only:
    - master
    - jre8
    - merge_requests

# ============================================
# 代码质量检查 (仅 Java 21)
# ============================================
checkstyle:
  stage: quality
  image: maven:3.9-eclipse-temurin-21
  script:
    - ./mvnw -B checkstyle:check
  artifacts:
    reports:
      checkstyle: target/checkstyle-result.xml
    paths:
      - target/checkstyle-result.xml
    expire_in: 7 days
  allow_failure: true

pmd:
  stage: quality
  image: maven:3.9-eclipse-temurin-21
  script:
    - ./mvnw -B pmd:pmd
  artifacts:
    reports:
      pmd: target/pmd-report.xml
    paths:
      - target/pmd-report.xml
    expire_in: 7 days
  allow_failure: true

# ============================================
# 安全扫描 (仅 master/jre21)
# ============================================
owasp-check:
  stage: security
  image: maven:3.9-eclipse-temurin-21
  variables:
    MAVEN_OPTS: "-Xmx2048m -Dmaven.repo.local=.m2/repository"
  script:
    - ./mvnw -B org.owasp:dependency-check-maven:check
  artifacts:
    paths:
      - target/dependency-check-report.html
      - target/dependency-check-report.xml
    expire_in: 14 days
  allow_failure: true
  only:
    - master
    - jre21
    - merge_requests

# ============================================
# 打包
# ============================================
package:
  stage: package
  image: maven:3.9-eclipse-temurin-21
  script:
    - ./mvnw -B package -DskipTests
  artifacts:
    paths:
      - target/*.jar
    expire_in: 1 day

# ============================================
# 发布到 Maven Central (仅 tag, 手动触发)
# ============================================
release:maven-central:
  stage: release
  image: maven:3.9-eclipse-temurin-21
  script:
    - ./mvnw -B deploy -Dgpg.skip=false
  only:
    - tags
  when: manual
  # 需要在 GitLab 项目 Settings > CI/CD > Variables 中配置:
  #   MAVEN_CENTRAL_USERNAME — OSSRH 用户名
  #   MAVEN_CENTRAL_PASSWORD — OSSRH 密码
  #   GPG_PRIVATE_KEY         — GPG 私钥 (ASCII armored)
  #   GPG_PASSPHRASE          — GPG 密钥密码