yexuejc-base/.github/workflows/ci.yaml

name: CI - Build and Quality Check

on:
  push:
    branches:
      - master
      - jre8
      - jre11
      - jre17
      - jre21
  pull_request:
    branches:
      - master
      - jre8
      - jre11
      - jre17
      - jre21

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        java: ['21', '17', '11', '8']

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Java ${{ matrix.java }}
        uses: actions/setup-java@v4
        with:
          java-version: ${{ matrix.java }}
          distribution: 'temurin'
          cache: 'maven'

      - name: Build with Maven
        run: ./mvnw -B clean compile -q
        env:
          JAVA_HOME: ${{ runner.temp }}/jdk-${{ matrix.java }}

      - name: Checkstyle
        run: ./mvnw -B checkstyle:check -q
        continue-on-error: true

      - name: PMD
        run: ./mvnw -B pmd:pmd -q
        continue-on-error: true

      - name: Test
        run: ./mvnw -B test -q

      - name: JaCoCo Report
        run: ./mvnw -B test jacoco:report -q
        continue-on-error: true

      - name: Package
        run: ./mvnw -B package -DskipTests -q

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: artifacts-java-${{ matrix.java }}
          path: target/*.jar
          retention-days: 7

  security-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'
          cache: 'maven'

      - name: OWASP Dependency Check
        run: ./mvnw -B org.owasp:dependency-check-maven:check -q
        continue-on-error: true

      - name: Upload report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: dependency-check-report
          path: target/dependency-check-report.html
          retention-days: 14

  release:
    needs: build
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/jre21')
    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'
          cache: 'maven'

      - name: Get version
        id: version
        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT

      - name: Build & Publish
        run: ./mvnw -B deploy -q
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Create GitHub Release
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v1
        with:
          files: target/*.jar
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}