pull_requests.yml

name: Pull Requests

on: 
  pull_request:
    paths-ignore:
      - '**/*.md'
      - '**/*.txt'

jobs:
  test:
    name: Build and Test
    permissions: 
      contents: read
    runs-on: ubuntu-latest 
    steps:
      - uses: actions/checkout@v3
      - name: Check Maven Cache
        id: maven-cache
        uses: actions/cache@v3
        with:
          path: ~/.m2/repository/
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-
      - uses: actions/setup-dotnet@v2
        with:
          dotnet-version: '6.0.x'
      - name: Set up JDK 1.8
        id: jdk-8
        uses: actions/setup-java@v3
        with:
          java-version: 8
          distribution: 'zulu'
      - uses: pnpm/action-setup@v2.2.2
        with:
          version: 6.0.2
      - name: Test with Maven
        id: build
        run: |
            mvn -s settings.xml -pl utils,core,cli,ant,archetype -am compile verify --no-transfer-progress --batch-mode
  maven:
    name: Regression Test Maven Plugin
    permissions: 
      contents: read
    runs-on: ubuntu-latest 
    steps:
      - uses: actions/checkout@v3
      - name: Check Maven Cache
        id: maven-cache
        uses: actions/cache@v3
        with:
          path: ~/.m2/repository/
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-
      - uses: actions/setup-dotnet@v2
        with:
          dotnet-version: '6.0.x'
      - name: Set up JDK 1.8
        id: jdk-8
        uses: actions/setup-java@v3
        with:
          java-version: 8
          distribution: 'zulu'
      - uses: pnpm/action-setup@v2.2.2
        with:
          version: 6.0.2
      - name: Regression Test Maven Plugin
        id: build
        run: |
            mvn -s settings.xml -pl utils,core,maven -am compile verify -DtestMavenPlugin -DreleaseTesting --no-transfer-progress --batch-mode
      - name: Archive IT test logs
        id: archive-logs
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: it-test-logs
          retention-days: 7
          path: maven/target/it/**/build.log
  audit:
    runs-on: ubuntu-latest
    permissions: 
      contents: read
      pull-requests: write
    name: Audit
    steps:
      - uses: actions/checkout@v3
      - name: Check Maven Cache
        id: maven-cache
        uses: actions/cache@v3
        with:
          path: ~/.m2/repository/
          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-
      - name: Semgrep
        id: semgrep
        run: |
            docker run --rm -v "${PWD}:/src" returntocorp/semgrep --config "p/ci" --sarif > semgrep.sarif
      - name: Maven Site
        if: always()
        run: |
            mvn -s settings.xml package site -DskipTests=true --no-transfer-progress --batch-mode
      - name: Publish Comments
        if: always()
        run: |
            mvn se.bjurr.violations:violation-comments-to-github-maven-plugin:violation-comments --no-transfer-progress --batch-mode -DpullRequestId=${{ github.event.pull_request.number }} -DoAuth2Token=${{ secrets.GITHUB_TOKEN }}