ci.yml

name: CI

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  verify:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: '25'
          cache: maven
      - name: Verify
        shell: bash
        run: ./mvnw --batch-mode --no-transfer-progress verify

  external-rag-consumer:
    name: External RAG consumer on ${{ matrix.os }}
    needs: verify
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
    steps:
      - name: Check out ArchUnitJava
        uses: actions/checkout@v7
        with:
          path: ArchUnitJava
      - name: Check out the RAG fixture
        uses: actions/checkout@v7
        with:
          repository: TristanKruse/ArchUnitJava-TestRepo-RAG
          path: ArchUnitJava-TestRepo-RAG
      - name: Set up Java
        uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: '25'
          cache: maven
      - name: Install the library candidate
        id: candidate
        shell: bash
        working-directory: ArchUnitJava
        run: |
          candidate_version="$(./mvnw --batch-mode --no-transfer-progress \
            help:evaluate -Dexpression=project.version -q -DforceStdout)"
          echo "version=$candidate_version" >>"$GITHUB_OUTPUT"
          ./mvnw --batch-mode --no-transfer-progress -Prelease-candidate -DskipTests install
      - name: Verify the external consumer
        shell: bash
        working-directory: ArchUnitJava-TestRepo-RAG
        run: |
          ./mvnw --batch-mode --no-transfer-progress \
            -Darchunitjava.version="${{ steps.candidate.outputs.version }}" verify

  release-dry-run:
    needs: verify
    runs-on: ubuntu-latest
    env:
      CI_CENTRAL_USERNAME: local-dry-run
      CI_CENTRAL_PASSWORD: local-dry-run
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: '25'
          cache: maven
          server-id: central
          server-username: CI_CENTRAL_USERNAME
          server-password: CI_CENTRAL_PASSWORD
      - name: Check release documentation
        shell: bash
        run: |
          for file in README.md LICENSE CHANGELOG.md CONTRIBUTING.md SECURITY.md docs/COMPATIBILITY.md docs/MIGRATION.md docs/RELEASE.md docs/THREAT_MODEL.md; do
            test -s "$file"
          done
          grep -F 'Decision: PUBLISHED PUBLIC BETA.' docs/RELEASE.md
      - name: Build release candidate
        shell: bash
        run: ./mvnw --batch-mode --no-transfer-progress -Prelease-candidate -DskipTests verify
      - name: Reject unexpected SpotBugs findings
        shell: bash
        run: |
          ./mvnw --batch-mode --no-transfer-progress \
            com.github.spotbugs:spotbugs-maven-plugin:4.10.3.0:spotbugs -DskipTests
          python3 - <<'PY'
          import hashlib
          import xml.etree.ElementTree as ET

          report = ET.parse("target/spotbugsXml.xml").getroot()
          errors = report.find("Errors")
          if errors is None or errors.get("errors") != "0" or errors.get("missingClasses") != "0":
              raise SystemExit("SpotBugs analysis errors or missing classes were reported")

          allowed = {"EI_EXPOSE_REP", "EQ_COMPARETO_USE_OBJECT_EQUALS"}
          findings = report.findall("BugInstance")
          finding_keys = []
          for item in findings:
              class_element = item.find("Class")
              field = item.find("Field")
              finding_keys.append("|".join((
                  item.get("type", ""),
                  class_element.get("classname", "") if class_element is not None else "",
                  field.get("name", "") if field is not None else "",
                  field.get("signature", "") if field is not None else "",
              )))
          fingerprint = hashlib.sha256(
              "\n".join(sorted(finding_keys)).encode("utf-8")
          ).hexdigest()
          expected_fingerprint = "fc7970533be9e41f9961b7303fa77d0170a4f441c31ea6e85057effcdfc2f555"
          if len(findings) != 161 or fingerprint != expected_fingerprint:
              raise SystemExit(
                  f"Reviewed SpotBugs baseline changed: {len(findings)} notices, {fingerprint}"
              )

          unexpected = sorted({item.get("type") for item in findings} - allowed)
          if unexpected:
              raise SystemExit("Unexpected SpotBugs categories: " + ", ".join(unexpected))

          collection_signatures = {
              "Ljava/util/List;", "Ljava/util/Map;", "Ljava/util/Set;"
          }
          for item in findings:
              if item.get("type") == "EI_EXPOSE_REP":
                  field = item.find("Field")
                  if field is None or field.get("signature") not in collection_signatures:
                      raise SystemExit("Unexpected exposed-representation field type")

          expected_comparables = {
              "dev.archunitjava.importer.ClassFileResource",
              "dev.archunitjava.model.JavaMember",
              "dev.archunitjava.model.JavaType",
          }
          comparables = {
              item.find("Class").get("classname")
              for item in findings
              if item.get("type") == "EQ_COMPARETO_USE_OBJECT_EQUALS"
          }
          if comparables != expected_comparables:
              raise SystemExit("Natural-order exception set changed: " + repr(comparables))

          print(f"Reviewed SpotBugs baseline accepted: {len(findings)} notices")
          PY
      - name: Verify reproducible primary artifact
        shell: bash
        run: |
          project_version="$(./mvnw --batch-mode --no-transfer-progress \
            help:evaluate -Dexpression=project.version -q -DforceStdout)"
          cp "target/archunitjava-$project_version.jar" "$RUNNER_TEMP/archunitjava-first.jar"
          ./mvnw --batch-mode --no-transfer-progress -Prelease-candidate -DskipTests clean verify
          cmp "$RUNNER_TEMP/archunitjava-first.jar" "target/archunitjava-$project_version.jar"
      - name: Check package contents
        shell: bash
        run: |
          project_version="$(./mvnw --batch-mode --no-transfer-progress \
            help:evaluate -Dexpression=project.version -q -DforceStdout)"
          jar_path="target/archunitjava-$project_version.jar"
          test -s "$jar_path"
          test -s "target/archunitjava-$project_version-sources.jar"
          test -s "target/archunitjava-$project_version-javadoc.jar"
          jar tf "$jar_path" | grep -F 'dev/archunitjava/cli/ArchUnitJavaCli.class'
          jar tf "$jar_path" | grep -F 'META-INF/services/org.junit.platform.engine.TestEngine'
          unzip -p "$jar_path" META-INF/MANIFEST.MF | grep -F 'Automatic-Module-Name: dev.archunitjava'
      - name: Assemble and validate GitHub Pages
        shell: pwsh
        run: ./scripts/build-pages.ps1
      - name: Verify external Maven consumer
        shell: bash
        run: |
          ./mvnw --batch-mode --no-transfer-progress -Prelease-candidate -DskipTests install
          ./mvnw --batch-mode --no-transfer-progress -f examples/basic/pom.xml test
      - name: Exercise signing wiring and local-only deployment
        shell: bash
        run: |
          ./mvnw --batch-mode --no-transfer-progress -Prelease-candidate,release-sign -Dgpg.skip=true -DskipTests \
            "-DaltDeploymentRepository=release-dry-run::file:$RUNNER_TEMP/archunitjava-staging" deploy
          find "$RUNNER_TEMP/archunitjava-staging" -type f -name 'archunitjava-*.jar' | grep .
      - name: Build a signed Central bundle against an unreachable local endpoint
        shell: bash
        env:
          DRY_RUN_VERSION: 0.0.0
        run: |
          gpg --batch --pinentry-mode loopback --passphrase '' \
            --quick-generate-key 'ArchUnitJava CI <ci@archunitjava.invalid>' rsa2048 sign 1d
          export MAVEN_GPG_KEY_FINGERPRINT
          MAVEN_GPG_KEY_FINGERPRINT="$(gpg --batch --with-colons --list-secret-keys \
            | awk -F: '$1 == "fpr" { print $10; exit }')"
          test -n "$MAVEN_GPG_KEY_FINGERPRINT"
          ./mvnw --batch-mode --no-transfer-progress \
            org.codehaus.mojo:versions-maven-plugin:2.19.1:set \
            -DgenerateBackupPoms=false -DnewVersion="$DRY_RUN_VERSION"
          set +e
          ./mvnw --batch-mode --no-transfer-progress \
            -Prelease-candidate,release-sign,central-release \
            -DcentralBaseUrl=http://127.0.0.1:9 \
            -Dgpg.keyname="$MAVEN_GPG_KEY_FINGERPRINT" \
            -DskipTests deploy
          deploy_status=$?
          set -e
          test "$deploy_status" -ne 0
          bundle=target/central-publishing/central-bundle.zip
          test -s "$bundle"
          unzip -l "$bundle" | grep -F "archunitjava-$DRY_RUN_VERSION.jar"
          unzip -l "$bundle" | grep -F "archunitjava-$DRY_RUN_VERSION-sources.jar"
          unzip -l "$bundle" | grep -F "archunitjava-$DRY_RUN_VERSION-javadoc.jar"
          unzip -l "$bundle" | grep -F "archunitjava-$DRY_RUN_VERSION.pom"
          unzip -l "$bundle" | grep -F "archunitjava-$DRY_RUN_VERSION.jar.asc"