alfresco-transform-core/.github/workflows/ci.yml

name: Alfresco Transform Core CI

on:
  push:
    branches:
      - master
      - feature/**
      - fix/**
      - SP/**
      - HF/**
      - ATS-**
      - ACS-**
      - MNT-**
  pull_request:
    branches:
      - master
      - feature/**
      - fix/**
      - SP/**
      - HF/**
  schedule:
    - cron: '0 5 * * 1'
  workflow_dispatch:

# NOTE: Secrets are intentionally NOT declared at the workflow (top) level.
# A workflow-level `env` exposes secrets to every job/step (including third-party
# actions). Secrets are scoped to the individual steps that need them instead.
env:
  GITHUB_ACTIONS_DEPLOY_TIMEOUT: 120
  # Both variables are required to be set before the release process starts.
  # As the release is triggered by a commit message with "[release]" keyword on a release branch,
  # setting these variables to new values can be done in the same commit and will indicate the release and the dev versions in it.
  RELEASE_VERSION: "5.4.5-A.3" # The version of the release (tag).
  DEVELOPMENT_VERSION: "5.4.5-A.4-SNAPSHOT" # The version that will be set in pom files after the release (next dev version)

permissions:
  contents: read

jobs:
  pre_commit:
    runs-on: ubuntu-latest
    steps:
      - uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v18.21.2

  test_run_check:
    name: "Test run check"
    runs-on: ubuntu-latest
    outputs:
      tests: ${{ steps.check.outputs.tests }}
    steps:
      - id: check
        run: |
          echo "tests=true" >> "$GITHUB_OUTPUT"
        if: >
          (
            (github.ref_name == 'master' || startsWith(github.ref_name, 'SP/') || startsWith(github.ref_name, 'HF/') || github.event_name == 'pull_request') &&
            !contains(github.event.head_commit.message, '[skip tests]')
          ) ||
          contains(github.event.head_commit.message, '[run tests]')

  pmd_scan:
    name: "PMD Scan"
    runs-on: ubuntu-latest
    needs:
      - test_run_check
    if: needs.test_run_check.outputs.tests == 'true' && github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.21.2
      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
      - uses: Alfresco/ya-pmd-scan@e817ecd9292844800451c42f07cdebdb14268cfa # v4.1.0
        env:
          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
        with:
          classpath-build-command: "mvn -ntp package -DskipTests"

  build_and_test:
    name: "Core & Base"
    runs-on: ubuntu-latest
    needs:
      - pre_commit
      - test_run_check
    if: needs.test_run_check.outputs.tests == 'true'
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.2
      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
      - name: "Login to Docker Hub"
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: "Login to Quay.io"
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_PASSWORD }}
      - name: "Enable experimental docker features"
        run: |
          echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
          sudo service docker restart
      - name: "Clean-up SNAPSHOT artifacts"
        run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
      - name: "Build"
        timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
        env:
          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
        run: mvn -B -U -q clean install -DadditionalOption=-Xdoclint:none -DskipTests -Dmaven.javadoc.skip=true -Pbase
      - name: "Cache LibreOffice"
        run: bash _ci/cache_artifacts.sh
      - name: "Run tests and deploy snapshots (master only)"
        timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
        env:
          MAVEN_PHASE: ${{ github.event_name == 'push' && github.ref_name == 'master' && 'deploy' || 'verify' }}
          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
        run: mvn -B -U clean "$MAVEN_PHASE" -DadditionalOption=-Xdoclint:none -Dmaven.javadoc.skip=true -Pbase

  all_tests_matrix:
    name: ${{ matrix.testName }}
    runs-on: ubuntu-latest
    needs:
      - pre_commit
      - test_run_check
    if: needs.test_run_check.outputs.tests == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - testName: ImageMagick
            buildProfile: imagemagick
            testProfile: imagemagick
          - testName: LibreOffice
            buildProfile: libreoffice
            testProfile: libreoffice
          - testName: Transform Misc
            buildProfile: misc
            testProfile: misc
          - testName: PDF Renderer
            buildProfile: pdf-renderer
            testProfile: pdf-renderer
          - testName: Tika
            buildProfile: tika
            testProfile: tika
          - testName: All in One Transformer
            buildProfile: full-build
            testProfile: aio-test
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.2
      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
      - name: "Login to Docker Hub"
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: "Login to Quay.io"
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_PASSWORD }}
      - name: "Enable experimental docker features"
        run: |
          echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
          sudo service docker restart
      - name: "Clean-up SNAPSHOT artifacts"
        run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
      - name: "Build local docker image"
        timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
        env:
          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
        run: bash _ci/build.sh ${{ matrix.buildProfile }}
      - name: "Cache LibreOffice"
        run: bash _ci/cache_artifacts.sh
      - name: "Run tests"
        timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
        env:
          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
        run: bash _ci/test.sh ${{ matrix.testProfile }}

  e2e_javaruntime_tests:
    name: "E2E AIO Smoke Tests ( Java: ${{ matrix.java }}"
    runs-on: ubuntu-latest
    needs:
      - pre_commit
      - test_run_check
    if: needs.test_run_check.outputs.tests == 'true'
    strategy:
      fail-fast: false
      matrix:
        java: [ '21', '25' ]
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.2
      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
      - name: "Login to Docker Hub"
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: "Login to Quay.io"
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_PASSWORD }}
      - name: "Enable experimental docker features"
        run: |
          echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
          sudo service docker restart
      - name: "Clean-up SNAPSHOT artifacts"
        run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
      - name: "Build local docker image"
        timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
        env:
          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
        run: bash _ci/build.sh full-build
      - name: "Cache LibreOffice"
        run: bash _ci/cache_artifacts.sh
      - name: "Run tests"
        timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
        env:
          SMOKE_TESTS: true
          SKIP_DEPLOY: true
          JAVA_RUNTIME_VERSION: ${{ matrix.java }}
          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
        run: bash _ci/test.sh aio-test

  release:
    name: "Release"
    runs-on: ubuntu-latest
    needs: [build_and_test, all_tests_matrix, e2e_javaruntime_tests]
    if: >
      !(failure() || cancelled()) &&
      contains(github.event.head_commit.message, '[release]') &&
      github.event_name != 'pull_request' &&
      (github.ref_name == 'master' || startsWith(github.ref_name, 'SP/') || startsWith(github.ref_name, 'HF/'))
    steps:
      - name: Generate app token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }}
          private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }}
          permission-contents: write
      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.21.2
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          token: ${{ steps.app-token.outputs.token }}
      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.2
      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.2
      - name: Set up QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
        with:
          platforms: linux/amd64,linux/arm64
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
      - name: "Login to Docker Hub"
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: "Login to Quay.io"
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_PASSWORD }}
      - name: "Enable experimental docker features"
        run: |
          echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
          sudo service docker restart
      - name: "Clean-up SNAPSHOT artifacts"
        run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
      - uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@v18.21.2
        with:
          username: ${{ secrets.BOT_GITHUB_USERNAME }}
          email: ${{ secrets.BOT_GITHUB_EMAIL }}
          global: true
      - name: "Cache LibreOffice"
        run: bash _ci/cache_artifacts.sh
      - name: "Release"
        timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
        uses: Alfresco/alfresco-build-tools/.github/actions/maven-release-slim@v18.21.2
        env:
          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
        with:
          token: ${{ steps.app-token.outputs.token }}
          release-version: ${{ env.RELEASE_VERSION }}
          development-version: ${{ env.DEVELOPMENT_VERSION }}
          maven-args: "-DskipTests -Dmaven.javadoc.skip=true -DadditionalOption=-Xdoclint:none"