build.yml

name: Build and Test

on:
  pull_request_target:
    types:
      - opened
      - reopened
      - synchronize
      - labeled

  push:
    branches:
      - master
      - main
      - github-action-*
    paths-ignore:
      - '**.md'

jobs:
  check_build_safety:
    name: Check if Build should be done
    runs-on: ubuntu-latest
    steps:
      - name: Supress builds for PRs from branch github-action-*
        if: github.event.pull_request && contains(github.head_ref, 'github-action')
        run: |
          echo "not building PRs with source branch github-action-*"
          exit 1
      - name: Emit failure code for unsafe fork PRs
        if: github.event.pull_request && github.event.pull_request.head.repo.full_name != 'liquibase/liquibase' && github.event.label.name != 'SafeToBuild'
        run: |
          echo "PR from Fork is NOT safe to build"
          echo "A member of Liquibase team needs to apply label 'SafeToBuild'! "
          exit 1
      - name: Run needed builds
        if: github.event.action == 'labeled' && github.event.pull_request.head.repo.full_name == 'liquibase/liquibase'
        run: |
          echo "Don't run liquibase/liquibase builds on labels"
          exit 1
  setup:
    name: Setup
    needs: check_build_safety
    runs-on: ubuntu-latest
    outputs:
      proBranchName: ${{ steps.find-branches.outputs.proBranchName }}
      proBranchSha: ${{ steps.find-branches.outputs.proBranchSha }}
      thisSha: ${{ steps.find-branches.outputs.thisSha }}
      thisBranchName: ${{ steps.find-branches.outputs.thisBranchName }}
      thisBranchFileName: ${{ steps.find-branches.outputs.thisBranchFileName }}
      thisRepositoryName: ${{ steps.find-branches.outputs.thisRepositoryName }}
      thisRepositoryOwner: ${{ steps.find-branches.outputs.thisRepositoryName }}
      standAlonePR: ${{ steps.find-branches.outputs.standAlonePR }}
      stablePro: ${{ steps.find-branches.outputs.stablePro }}
      setupSuccessful: "true"
    steps:
      - name: Failsafe
        uses: actions/github-script@v6
        with:
          script: |
            if (${{ github.run_attempt }} % 5 == 0) {
              core.setFailed("Fail every 5 run attempts to catch accidental infinite loops");
            }


      - uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.sha || github.event.after}}

      - name: Find corresponding branches
        id: find-branches
        uses: actions/github-script@v6
        with:
          github-token: ${{ secrets.BOT_TOKEN }}
          script: |
            const helper = require('./.github/util/workflow-helper.js')({github, context});

            core.setOutput("thisSha", helper.getCurrentSha());
            core.setOutput("thisBranchName", helper.getCurrentBranch());
            core.setOutput("thisBranchFileName", helper.getCurrentBranch().replace(/[^a-zA-Z0-9\-_]/g, "_"));
            core.setOutput("thisRepoName", helper.getRepositoryName());
            core.setOutput("thisRepoOwner", helper.getRepositoryOwner());

            let proStatusMessage = "success";
            let proFailed = false;

            let branch = await helper.findMatchingBranch("liquibase", "liquibase-pro");
            //count as not a stand-alone PR for branch builds on master/main, even though there are no PRs
            if (helper.getCurrentBranch() == 'master' || helper.getCurrentBranch() == 'main' && branch.pullRequestId) {
              core.setOutput("standAlonePR", helper.getCurrentBranch() !== branch.name);
            } else {
              core.setOutput("standAlonePR", true);
            }

            if (!branch.lastSuccessfulRunNumber) {
              proFailed = true;
              proStatusMessage = "Matching pro branch has never passed. Falling back to master"
              branch = await helper.findMatchingBranch("liquibase", "liquibase-pro", ["main", "master"])
            }
            core.setOutput("proBranchName", branch.name);
            core.setOutput("proBranchSha", branch.sha);

            if (!proFailed) {
              if (!branch.workflowId) {
                proStatusMessage = "does not have a ran workflow";
                proFailed = true
              } else if ( branch.runStatus != "completed") {
                proStatusMessage = "build is "+ branch.runStatus;
                proFailed = true
              } else if ( branch.runConclusion != "success") {
                proStatusMessage = "build conclusion was "+branch.runConclusion;
                proFailed = true
              }
            }

            statusMessage = "liquibase/liquibase-pro:"+branch.name+"@" + branch.sha.substring(0, 7) + " " + proStatusMessage;
            console.log("Pro failed?" + proFailed + ": "+statusMessage);

            github.rest.repos.createCommitStatus({
              "owner": "liquibase",
              "repo": "liquibase",
              "sha": helper.getCurrentSha(),
              "state": (proFailed ? "failure" : "success"),
              "target_url": branch.runHtmlUrl,
              "context": "Stable Liquibase Pro",
              "description": statusMessage
            });

            core.setOutput("stablePro", !proFailed);

      - name: Upload Event File
        uses: actions/upload-artifact@v2
        with:
          name: Event File
          path: ${{ github.event_path }}

  build:
    name: Build & Test (Java ${{ matrix.java }} ${{ matrix.os }})
    needs: setup
    strategy:
      fail-fast: false
      matrix:
        os: [ ubuntu-latest, macos-latest, windows-2019 ]
        java: [ 8, 11, 17 ]
        exclude:
          # exclude java 11 and 17 on macos and windows builds
          - os: macos-latest
            java: 11
          - os: windows-2019
            java: 11
          - os: macos-latest
            java: 17
          - os: windows-2019
            java: 17
    runs-on: ${{ matrix.os }}
    env:
      OS_TYPE: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.sha || github.event.after}}
      - name: Built Code Cache
        if: ${{ matrix.java == 8}}
        uses: actions/cache@v2
        with:
          key: built-code-${{ github.run_number }}-${{ github.run_attempt }}
          path: ./**/target
      - name: Set up JDK ${{ matrix.java }}
        uses: actions/setup-java@v2
        with:
          java-version: ${{ matrix.java }}
          distribution: 'temurin'
          cache: 'maven'
      - name: Build & Test
        run: |
          mvn -B "-Dbuild.repository.owner=${{ needs.setup.outputs.thisRepositoryOwner }}" "-Dbuild.repository.name=${{ needs.setup.outputs.thisRepositoryName }}" "-Dbuild.branch=${{ needs.setup.outputs.thisBranchName }}" "-Dbuild.number=${{ github.run_number }}" "-Dbuild.commit=${{ needs.setup.outputs.thisSha }}" "-DtrimStackTrace=false" -pl '!liquibase-dist' clean test package surefire-report:report
      - name: Remove Original Jars for *nix
        if: env.OS_TYPE != 'windows-2019'
        run: |
          find . -name original-*.jar -exec rm {} \;


      - name: Archive Test Results
        if: ${{ always() }}
        uses: actions/upload-artifact@v2
        with:
          name: liquibase-test-results-jdk${{ matrix.java }}
          path: |
            ./**/target/surefire-reports
            ./**/target/site

      - name: Archive Modules
        if: ${{ matrix.java == 8 && matrix.os == 'ubuntu-latest'}}
        uses: actions/upload-artifact@v2
        with:
          name: liquibase-modules
          path: |
            */target/*-0-SNAPSHOT.jar

  sonar:
    name: Sonar Scan
    runs-on: ubuntu-latest
    needs: build
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
          ref: ${{ github.event.pull_request.head.sha || github.event.after}}
      - name: Set up JDK
        uses: actions/setup-java@v2
        with:
          java-version: 11
          distribution: 'adopt'
          cache: 'maven'
      - name: Cache SonarCloud packages
        uses: actions/cache@v2
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
          restore-keys: ${{ runner.os }}-sonar
      - name: Build and analyze
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: mvn clean verify sonar:sonar -P sonar -Dsonar.login=$SONAR_TOKEN -Dsonar.pullrequest.key=${{ github.event.pull_request.number }} -Dsonar.pullrequest.branch=${{ github.event.pull_request.head.ref }} -Dsonar.pullrequest.base=${{ github.event.pull_request.base.ref }}

  integration-test:
    name: Integration Test
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        testSystem:
          - h2
          #          - h2:1.4
          - hsqldb
          - mariadb
          - mssql
          - mysql
          - oracle
          - postgresql
          - sqlite
    needs: build
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.sha || github.event.after}}

      - name: Prepare
        id: prepare
        uses: actions/github-script@v6
        with:
          script: |
            core.setOutput("testResultsArtifact", "liquibase-test-results-integration-${{ matrix.testSystem }}".replace(/[^a-zA-Z0-9\-_]/g, "_"));

      - name: Set up JDK 8
        uses: actions/setup-java@v2
        with:
          java-version: '8'
          distribution: 'temurin'
          cache: 'maven'
      - name: Restore Built Code Cache
        uses: actions/cache@v2
        with:
          key: built-code-${{ github.run_number }}-${{ github.run_attempt }}
          path: ./**/target

      - name: Login to Artifactory
        uses: docker/login-action@v1
        with:
          registry: docker-dev.artifactory.datical.net
          username: ${{ secrets.ARTIFACTORY_USER }}
          password: ${{ secrets.ARTIFACTORY_TOKEN }}

      - name: Run Tests
        run: mvn -B jar:jar jar:test-jar surefire:test -DtrimStackTrace=false -Dliquibase.sdk.testSystem.test=${{ matrix.testSystem }} -Dliquibase.sdk.testSystem.acceptLicenses=${{ matrix.testSystem }} -Dtest=*IntegrationTest,*ExecutorTest -DfailIfNoTests=false

      - name: Archive Test Results
        if: ${{ always() }}
        uses: actions/upload-artifact@v2
        with:
          name: ${{ steps.prepare.outputs.testResultsArtifact }}
          path: |
            ./**/target/surefire-reports

  package:
    name: Package Artifacts
    runs-on: macos-latest
    needs: [ setup, build ]
    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.sha || github.event.after}}

      - name: Built Code Cache
        uses: actions/cache@v2
        with:
          key: built-code-${{ github.run_number }}-${{ github.run_attempt }}
          path: ./**/target

      ##Cache based on install4j file, since changes to JVM is seen in there. If install4j version changes without changing the file, change the prefix letter before hashFiles to force a new cache
      - name: Install4j Cache
        uses: actions/cache@v2
        with:
          key: install4j-A${{ hashFiles('liquibase-dist/src/main/install4j/liquibase.install4j') }}
          path: ~/.install4j8/**

      - name: Set up JDK 8
        uses: actions/setup-java@v2
        with:
          java-version: '8'
          distribution: 'temurin'
          gpg-private-key: ${{ secrets.GPG_SECRET }}
          gpg-passphrase: GPG_PASSPHRASE
          cache: 'maven'
        env:
          GPG_PASSWORD: ${{ secrets.GPG_PASSPHRASE }}

      - name: Download liquibase-pro
        uses: dawidd6/action-download-artifact@v2
        with:
          github_token: ${{ secrets.BOT_TOKEN }}
          workflow: build.yml
          workflow_conclusion: success
          branch: "${{ needs.setup.outputs.proBranchName }}"
          name: liquibase-pro-modules
          path: download/liquibase-pro
          repo: liquibase/liquibase-pro

      - name: Install Built Modules
        run: |
          (find . -name *-SNAPSHOT.jar -exec mvn -B org.apache.maven.plugins:maven-install-plugin:3.0.0-M1:install-file -Dfile={} \;)
          (find . -name *-SNAPSHOT-sources.jar -exec mvn -B org.apache.maven.plugins:maven-install-plugin:3.0.0-M1:install-file -Dclassifier=sources -Dfile={} \;)
          mvn -B org.apache.maven.plugins:maven-install-plugin:3.0.0-M1:install-file -Dfile=download/liquibase-pro/liquibase-pro-0-SNAPSHOT.jar

      - name: Build & Sign Artifacts
        env:
          INSTALL4J_LICENSE: ${{ secrets.INSTALL4J_LICENSE }}
          INSTALL4J_APPLE_KEY: ${{ secrets.INSTALL4J_APPLE_KEY }}
          INSTALL4J_APPLE_KEY_PASSWORD: ${{ secrets.INSTALL4J_APPLE_KEY_PASSWORD }}
          INSTALL4J_APPLE_ID: ${{ secrets.INSTALL4J_APPLE_ID }}
          INSTALL4J_APPLE_ID_PASSWORD: ${{ secrets.INSTALL4J_APPLE_ID_PASSWORD }}
          INSTALL4J_WINDOWS_KEY: ${{ secrets.INSTALL4J_WINDOWS_KEY }}
          INSTALL4J_WINDOWS_KEY_PASSWORD: ${{ secrets.INSTALL4J_WINDOWS_KEY_PASSWORD }}
          GPG_PASSWORD: ${{ secrets.GPG_PASSPHRASE }}
        run: |
          ## save install4j code signing keys
          mkdir -p liquibase-dist/target/keys
          echo "Saving apple key"
          echo "$INSTALL4J_APPLE_KEY" | base64 -d > liquibase-dist/target/keys/datical_apple.p12

          echo "Saving windows key"
          echo "$INSTALL4J_WINDOWS_KEY" | base64 -d > liquibase-dist/target/keys/datical_windows.pfx
          mvn -B -pl liquibase-dist -P liquibase-pro source:jar package

          ## extract tar content for other artifacts
          mkdir -p liquibase-dist/target/liquibase-0-SNAPSHOT
          (cd liquibase-dist/target/liquibase-0-SNAPSHOT && tar xfz ../liquibase-0-SNAPSHOT.tar.gz)

          ##create zip file from tar content
          (cd liquibase-dist/target/liquibase-0-SNAPSHOT && zip -r ../liquibase-0-SNAPSHOT.zip *)

          ##create installers
          (cd liquibase-dist && ${{ github.workspace }}/.github/util/package-install4j.sh 0-SNAPSHOT)

          find . -name original-*.jar -exec rm {} \;

          mkdir -p artifacts
          cp liquibase-dist/target/liquibase-0-SNAPSHOT.tar.gz artifacts
          cp liquibase-dist/target/liquibase-0-SNAPSHOT.zip artifacts
          cp liquibase-dist/target/liquibase-0-SNAPSHOT.jar artifacts
          cp liquibase-dist/target/liquibase-0-SNAPSHOT-sources.jar artifacts
          cp liquibase-dist/target/liquibase-*-installer-* artifacts

          cp liquibase-maven-plugin/target/liquibase-maven-plugin-0-SNAPSHOT.jar artifacts
          cp liquibase-maven-plugin/target/liquibase-maven-plugin-0-SNAPSHOT-sources.jar artifacts
          cp liquibase-maven-plugin/target/liquibase-maven-plugin-0-SNAPSHOT-javadoc.jar artifacts

          cp liquibase-cdi/target/liquibase-cdi-0-SNAPSHOT.jar artifacts
          cp liquibase-cdi/target/liquibase-cdi-0-SNAPSHOT-sources.jar artifacts
          cp liquibase-cdi/target/liquibase-cdi-0-SNAPSHOT-javadoc.jar artifacts

          cp target/liquibase-0-SNAPSHOT-javadoc.jar artifacts

          .github/util/sign-artifacts.sh artifacts

          ##prepare branch-named convenience artifacts directories
          mkdir artifacts-named
          cp liquibase-dist/target/liquibase-0-SNAPSHOT.tar.gz artifacts-named/liquibase-${{ needs.setup.outputs.thisBranchFileName }}.tar.gz
          cp liquibase-dist/target/liquibase-0-SNAPSHOT.jar artifacts-named/liquibase-${{ needs.setup.outputs.thisBranchFileName }}.jar
          cp liquibase-maven-plugin/target/liquibase-maven-plugin-0-SNAPSHOT.jar artifacts-named/liquibase-maven-plugin-${{ needs.setup.outputs.thisBranchFileName }}.jar
          cp liquibase-cdi/target/liquibase-cdi-0-SNAPSHOT.jar artifacts-named/liquibase-cdi-${{ needs.setup.outputs.thisBranchFileName }}.jar
          cp liquibase-extension-testing/target/liquibase-extension-testing-0-SNAPSHOT.jar artifacts-named/liquibase-extension-testing-${{ needs.setup.outputs.thisBranchFileName }}.jar
          cp liquibase-extension-testing/target/liquibase-extension-testing-0-SNAPSHOT-deps.jar artifacts-named/liquibase-extension-testing-${{ needs.setup.outputs.thisBranchFileName }}-deps.jar

      - name: Archive Packages
        uses: actions/upload-artifact@v2
        with:
          name: liquibase-artifacts
          path: artifacts/*

      - name: Archive Convenience Zip
        uses: actions/upload-artifact@v2
        with:
          name: liquibase-zip-${{ needs.setup.outputs.thisBranchFileName }}
          path: liquibase-dist/target/liquibase-0-SNAPSHOT/*

      - name: Archive Convenience Artifacts
        uses: actions/upload-artifact@v2
        with:
          name: liquibase-artifacts-${{ needs.setup.outputs.thisBranchFileName }}
          path: artifacts-named/*


  finish:
    name: Finish Build
    runs-on: ubuntu-latest
    needs: [ setup, build, integration-test, package, sonar ]
    if: ${{ needs.setup.outputs.setupSuccessful }}
    steps:
      - uses: actions/checkout@v3
        with:
          ref: ${{ github.event.pull_request.head.sha || github.event.after}}

      - name: Coordinate Liquibase-Pro
        uses: actions/github-script@v6
        with:
          github-token: ${{ secrets.BOT_TOKEN }}
          script: |
            const helper = require('./.github/util/workflow-helper.js')({github, context});
            let currentBranchInfo = await helper.findMatchingBranch("liquibase", "liquibase-pro");

            let thisStatus = "${{ needs.package.result }}" == "success" ? "success" : "failure";
            let stablePro = ("${{ needs.setup.outputs.stablePro }}" == "true");
            let standalonePR = "${{ needs.setup.outputs.standAlonePR }}" == "true";

            console.log("Stand alone PR: "+standalonePR);

            let runFunctionalTests = false;
            let markFunctionalTestsStatus = "failure";
            let markFunctionalTestsDescription = "Unexpected setup";

            if (stablePro) {
              console.log("Pro is stable");

              runFunctionalTests = true;
              markFunctionalTestsStatus = "pending";
              markFunctionalTestsDescription = "Trigger internal functional tests";
            } else {
              console.log("Last pro was unstable");

              runFunctionalTests = false;
              markFunctionalTestsStatus = "failure";
              markFunctionalTestsDescription = "Liquibase Pro is unstable";

              let checks = await github.rest.repos.listCommitStatusesForRef({
                "owner": "liquibase",
                "repo": "liquibase-pro",
                "ref": currentBranchInfo.sha
              });

              let failedCheckingUs = false;
              if (standalonePR) {
                for (let status of checks.data) {
                  if (status.context == "Stable Liquibase Core") {
                    console.log("Stable Liquibase Core is "+ status.state);
                    failedCheckingUs = (status.state == "failure");
                  }
                }
              }

              if (failedCheckingUs) {
                console.log("Rerun liquibase-pro that was waiting on us");

                //octokit removed the retryWorkflow function
                github.request("POST "+currentBranchInfo.runRerunUrl);

                //await github.rest.actions.retryWorkflow({
                //    "owner": "liquibase",
                //    "repo": "liquibase-pro",
                //    "run_id": currentBranchInfo.workflowId
                //});
              }
            }

            if (standalonePR) {
              console.log("Do not mark base pro branch as included in this");
            } else {
              console.log("Mark 'Included in Liquibase Core' status as "+thisStatus);
              github.rest.repos.createCommitStatus({
                "owner": "liquibase",
                "repo": "liquibase-pro",
                "sha": currentBranchInfo.sha,
                "state": thisStatus,
                "context": "Stable Liquibase Core",
                "target_url": currentBranchInfo.runHtmlUrl,
                "description": "Latest Liquibase Core build"
              });
            }

            if (runFunctionalTests) {
              let testsBranch = await helper.findMatchingBranch("liquibase", "liquibase-pro-tests");

              let notices = [];
              if (context.payload.pull_request) {
                console.log("Sending pull request information");
                notices = ["Triggered by PR " + context.payload.pull_request.html_url];
              }
              console.log("Trigger functional tests");
              let workflowDispatch = await github.rest.actions.createWorkflowDispatch({
                "owner": "liquibase",
                "repo": "liquibase-pro-tests",
                "workflow_id": "test.yml",
                "ref": testsBranch.name,
                "inputs": {
                  "liquibaseCommit": helper.getCurrentSha(),
                  "runDescription": "Triggered by https://github.com/liquibase/liquibase/actions/runs/"+context.runId,
                  "runDetails": JSON.stringify({
                    "liquibaseBranch": helper.getCurrentBranch(),
                    "notices": notices
                  })
                }
              });
            }

            await github.rest.repos.createCommitStatus({
              "owner": "liquibase",
              "repo": "liquibase",
              "sha": helper.getCurrentSha(),
              "state": markFunctionalTestsStatus,
              "context": "Run Functional Tests",
              "description": markFunctionalTestsDescription
            });