build.yaml

# This workflow will build and unit test the project.
# If the workflow is running on the "master" branch, then
# semantic-release is also run to create a new release (if
# warranted by the new commits being built).

name: Build & Release

on:
  push:
    branches:
      - master
  pull_request:
  workflow_dispatch:

# Default permissions: read-only
permissions:
  contents: read

concurrency:
  group: build-${{ github.ref }}
  cancel-in-progress: true

jobs:
  detect-secrets:
    if: "!contains(github.event.head_commit.message, '[skip ci]')"
    name: detect-secrets
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: 3.15

      - name: Install detect-secrets
        run: |
          pip install --upgrade "git+https://github.com/ibm/detect-secrets.git@master#egg=detect-secrets"

      - name: Run detect-secrets
        run: |
          detect-secrets scan --update .secrets.baseline
          detect-secrets -v audit --report --fail-on-unaudited --fail-on-live --fail-on-audited-real .secrets.baseline

  build:
    name: build-test (java ${{matrix.java-version}})
    needs: detect-secrets
    runs-on: ubuntu-latest
    strategy:
      matrix:
        java-version: ['11', '17']

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Setup Java ${{matrix.java-version}}
        uses: actions/setup-java@v4
        with:
          java-version: ${{matrix.java-version}}
          distribution: 'temurin'
          cache: 'maven'

      - name: Build & Test
        run: mvn -B clean verify -fae -DskipITs

      - name: Dry run version bump
        run: |
          CURRENT=$(grep -oE 'IBM Cloud Networking Services Java SDK Version [0-9]+\.[0-9]+\.[0-9]+' README.md | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
          ./scripts/bump-version.sh --dry-run "$CURRENT" 999.999.999

  results:
    if: ${{ always() }}
    runs-on: ubuntu-latest
    name: Final Test Results
    needs: [build]
    steps:
      - run: |
          result="${{ needs.build.result }}"
          if [[ $result == "success" || $result == "skipped" ]]; then
            exit 0
          else
            exit 1
          fi

  create-release:
    name: semantic-release
    if: github.ref == 'refs/heads/master' && github.event_name == 'push' && !contains(github.event.head_commit.message, 'chore')
    needs: build
    runs-on: ubuntu-latest

    concurrency:
      group: release-${{ github.ref }}
      cancel-in-progress: true

    steps:
      - name: Notify Slack - Release Started
        run: |
          jq -n --arg results "Run : ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
            '{sdk: "networking-java-sdk", language: "java", status: "started", actor: "${{ github.actor }}", results: $results}' \
            | curl -X POST "${{ secrets.SLACK_RELEASE_WEBHOOK_URL }}" -H 'Content-Type: application/json' -d @-

      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 24

      - name: Setup Java
        uses: actions/setup-java@v4
        with:
          java-version: 11
          distribution: 'temurin'
          cache: 'maven'

      - name: Install Publishing Tools
        run: npm ci

      - name: Validate version consistency
        id: validate
        run: |
          # Extract versions from all files
          README_VERSION=$(grep -oE 'IBM Cloud Networking Services Java SDK Version [0-9]+\.[0-9]+\.[0-9]+' README.md | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
          POM_VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)

          echo "Version in README.md: $README_VERSION"
          echo "Version in pom.xml: $POM_VERSION (should be 99-SNAPSHOT)"

          # Verify pom.xml uses 99-SNAPSHOT (standard approach)
          if [ "$POM_VERSION" != "99-SNAPSHOT" ]; then
            echo "❌ ERROR: pom.xml version must be 99-SNAPSHOT (found: $POM_VERSION)"
            echo "The version is set dynamically during publish, not in pom.xml"
            exit 1
          fi

          if [ -z "$README_VERSION" ]; then
            echo "❌ ERROR: Could not extract version from README.md"
            exit 1
          fi

          echo "✅ Version consistency check passed"
          echo "  - pom.xml: $POM_VERSION (correct)"
          echo "  - README.md: $README_VERSION"

      - name: Run semantic-release
        id: release
        env:
          GH_TOKEN: ${{ secrets.GH_TOKEN }}
        run: npx semantic-release

      - name: Notify Slack - Release Completed
        if: success()
        run: |
          RESULTS=$(printf 'Release : %s\nRun     : %s' \
            "${{ steps.release.outputs.version || 'No new release published' }}" \
            "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}")
          jq -n --arg results "$RESULTS" \
            '{sdk: "networking-java-sdk", language: "java", status: "completed", actor: "${{ github.actor }}", results: $results}' \
            | curl -X POST "${{ secrets.SLACK_RELEASE_WEBHOOK_URL }}" -H 'Content-Type: application/json' -d @-

      - name: Notify Slack - Release Failed
        if: failure()
        run: |
          RESULTS=$(printf 'Error : %s\nRun   : %s' \
            "${{ steps.validate.outcome == 'failure' && 'Version validation failed, version strings in README.md are inconsistent' || steps.release.outcome == 'failure' && 'semantic-release failed' || 'Failed before semantic-release' }}" \
            "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}")
          jq -n --arg results "$RESULTS" \
            '{sdk: "networking-java-sdk", language: "java", status: "failed", actor: "${{ github.actor }}", results: $results}' \
            | curl -X POST "${{ secrets.SLACK_RELEASE_WEBHOOK_URL }}" -H 'Content-Type: application/json' -d @-