alfresco-transform-core/.github/workflows/ci.yml

name: Alfresco Transform Core CI

on:
  push:
    branches:
      - master
      - feature/**
      - fix/**
      - SP/**
      - HF/**
      - ATS-**
      - ACS-**
      - MNT-**
  pull_request:
    branches:
      - master
      - feature/**
      - fix/**
      - SP/**
      - HF/**
  schedule:
    - cron: '0 5 * * 1'
  workflow_dispatch:

# NOTE: Secrets are intentionally NOT declared at the workflow (top) level.
# A workflow-level `env` exposes secrets to every job/step (including third-party
# actions). Secrets are scoped to the individual steps that need them instead.
env:
  GITHUB_ACTIONS_DEPLOY_TIMEOUT: 120
  # Both variables are required to be set before the release process starts.
  # As the release is triggered by a commit message with "[release]" keyword on a release branch,
  # setting these variables to new values can be done in the same commit and will indicate the release and the dev versions in it.
  RELEASE_VERSION: "5.4.5-A.1" # The version of the release (tag).
  DEVELOPMENT_VERSION: "5.4.5-A.2-SNAPSHOT" # The version that will be set in pom files after the release (next dev version)

permissions:
  contents: read

jobs:
  pre_commit:
    runs-on: ubuntu-latest
    steps:
      - uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v18.21.0

  test_run_check:
    name: "Test run check"
    runs-on: ubuntu-latest
    outputs:
      tests: ${{ steps.check.outputs.tests }}
    steps:
      - id: check
        run: |
          echo "tests=true" >> "$GITHUB_OUTPUT"
        if: >
          (
            (github.ref_name == 'master' || startsWith(github.ref_name, 'SP/') || startsWith(github.ref_name, 'HF/') || github.event_name == 'pull_request') &&
            !contains(github.event.head_commit.message, '[skip tests]')
          ) ||
          contains(github.event.head_commit.message, '[run tests]')

  pmd_scan:
    name: "PMD Scan"
    runs-on: ubuntu-latest
    needs:
      - test_run_check
    if: needs.test_run_check.outputs.tests == 'true' && github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.21.0
      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.0
      - uses: Alfresco/ya-pmd-scan@1f36f8e45695ce60362010345a99a0c8f7310264 # v4.4.1
        env:
          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
        with:
          classpath-build-command: "mvn -ntp package -DskipTests"

  build_and_test:
    name: "Core & Base"
    runs-on: ubuntu-latest
    needs:
      - pre_commit
      - test_run_check
    if: needs.test_run_check.outputs.tests == 'true'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.0
      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.0
      - name: "Login to Docker Hub"
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: "Login to Quay.io"
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_PASSWORD }}
      - name: "Enable experimental docker features"
        run: |
          echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
          sudo service docker restart
      - name: "Clean-up SNAPSHOT artifacts"
        run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
      - name: "Build"
        timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
        env:
          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
        run: mvn -B -U -q clean install -DadditionalOption=-Xdoclint:none -DskipTests -Dmaven.javadoc.skip=true -Pbase
      - name: "Cache LibreOffice"
        run: bash _ci/cache_artifacts.sh
      - name: "Run tests and deploy snapshots (master only)"
        timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
        env:
          MAVEN_PHASE: ${{ github.event_name == 'push' && github.ref_name == 'master' && 'deploy' || 'verify' }}
          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
        run: mvn -B -U clean "$MAVEN_PHASE" -DadditionalOption=-Xdoclint:none -Dmaven.javadoc.skip=true -Pbase

  all_tests_matrix:
    name: ${{ matrix.testName }}
    runs-on: ubuntu-latest
    needs:
      - pre_commit
      - test_run_check
    if: needs.test_run_check.outputs.tests == 'true'
    strategy:
      fail-fast: false
      matrix:
        include:
          - testName: ImageMagick
            buildProfile: imagemagick
            testProfile: imagemagick
          - testName: LibreOffice
            buildProfile: libreoffice
            testProfile: libreoffice
          - testName: Transform Misc
            buildProfile: misc
            testProfile: misc
          - testName: PDF Renderer
            buildProfile: pdf-renderer
            testProfile: pdf-renderer
          - testName: Tika
            buildProfile: tika
            testProfile: tika
          - testName: All in One Transformer
            buildProfile: full-build
            testProfile: aio-test
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.0
      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.0
      - name: "Login to Docker Hub"
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: "Login to Quay.io"
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_PASSWORD }}
      - name: "Enable experimental docker features"
        run: |
          echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
          sudo service docker restart
      - name: "Clean-up SNAPSHOT artifacts"
        run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
      - name: "Build local docker image"
        timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
        env:
          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
        run: bash _ci/build.sh ${{ matrix.buildProfile }}
      - name: "Cache LibreOffice"
        run: bash _ci/cache_artifacts.sh
      - name: "Run tests"
        timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
        env:
          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
        run: bash _ci/test.sh ${{ matrix.testProfile }}

  e2e_javaruntime_tests:
    name: "E2E AIO Smoke Tests ( Java: ${{ matrix.java }}"
    runs-on: ubuntu-latest
    needs:
      - pre_commit
      - test_run_check
    if: needs.test_run_check.outputs.tests == 'true'
    strategy:
      fail-fast: false
      matrix:
        java: [ '21', '25' ]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.0
      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.0
      - name: "Login to Docker Hub"
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: "Login to Quay.io"
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_PASSWORD }}
      - name: "Enable experimental docker features"
        run: |
          echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
          sudo service docker restart
      - name: "Clean-up SNAPSHOT artifacts"
        run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
      - name: "Build local docker image"
        timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
        env:
          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
        run: bash _ci/build.sh full-build
      - name: "Cache LibreOffice"
        run: bash _ci/cache_artifacts.sh
      - name: "Run tests"
        timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
        env:
          SMOKE_TESTS: true
          SKIP_DEPLOY: true
          JAVA_RUNTIME_VERSION: ${{ matrix.java }}
          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
        run: bash _ci/test.sh aio-test

  release:
    name: "Release"
    runs-on: ubuntu-latest
    needs: [build_and_test, all_tests_matrix, e2e_javaruntime_tests]
    if: >
      !(failure() || cancelled()) &&
      contains(github.event.head_commit.message, '[release]') &&
      github.event_name != 'pull_request' &&
      (github.ref_name == 'master' || startsWith(github.ref_name, 'SP/') || startsWith(github.ref_name, 'HF/'))
    steps:
      - name: Generate app token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          client-id: ${{ vars.GH_APP_ENGINEERING_CONTRIB_CLIENT_ID }}
          private-key: ${{ secrets.GH_APP_ENGINEERING_CONTRIB_PRIVATE_KEY }}
          permission-contents: write
      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.21.0
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          token: ${{ steps.app-token.outputs.token }}
      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.0
      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.0
      - name: "Clean-up SNAPSHOT artifacts"
        run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
      - uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@v18.21.0
        with:
          username: ${{ secrets.BOT_GITHUB_USERNAME }}
          email: ${{ secrets.BOT_GITHUB_EMAIL }}
          global: true
      # Deploys the Maven artifacts, creates the verified release commits and tag.
      # The (slow) multi-arch Docker images are pushed by the separate
      # "push_docker_images" job below (docker.skip=true here).
      - name: "Release"
        timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
        uses: Alfresco/alfresco-build-tools/.github/actions/maven-release-slim@v18.21.0
        env:
          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
        with:
          token: ${{ steps.app-token.outputs.token }}
          release-version: ${{ env.RELEASE_VERSION }}
          development-version: ${{ env.DEVELOPMENT_VERSION }}
          maven-args: "-DskipTests -Dmaven.javadoc.skip=true -DadditionalOption=-Xdoclint:none -Ddocker.skip=true"

  push_docker_images:
    name: "Push Docker Images (${{ matrix.testName }})"
    runs-on: ubuntu-latest
    needs: [release]
    if: >
      !(failure() || cancelled()) &&
      contains(github.event.head_commit.message, '[release]') &&
      github.event_name != 'pull_request' &&
      (github.ref_name == 'master' || startsWith(github.ref_name, 'SP/') || startsWith(github.ref_name, 'HF/'))
    strategy:
      fail-fast: false
      matrix:
        include:
          - testName: ImageMagick
            buildProfile: imagemagick
          - testName: LibreOffice
            buildProfile: libreoffice
          - testName: Transform Misc
            buildProfile: misc
          - testName: PDF Renderer
            buildProfile: pdf-renderer
          - testName: Tika
            buildProfile: tika
          - testName: All in One Transformer
            buildProfile: full-build
            dockerArgs: "-Ddocker.filter=aio"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # The release job tags the release commit (which carries the release
          # version in the POMs) with ${{ env.RELEASE_VERSION }}.
          ref: refs/tags/${{ env.RELEASE_VERSION }}
      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v18.21.0
      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v18.21.0
      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v18.21.0
      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
        with:
          platforms: linux/amd64,linux/arm64
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      - name: "Login to Docker Hub"
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: "Login to Quay.io"
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_PASSWORD }}
      - name: "Enable experimental docker features"
        run: |
          echo '{"experimental":true}' | sudo tee /etc/docker/daemon.json
          sudo service docker restart
      - name: "Clean-up SNAPSHOT artifacts"
        run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" -prune -exec rm -rf {} +
      - name: "Cache LibreOffice"
        run: bash _ci/cache_artifacts.sh
      # Builds the module(s) and pushes the multi-arch Docker image(s). The Maven
      # artifacts were already deployed by the "release" job, so the artifact
      # deploy is skipped here (maven.deploy.skip=true).
      - name: "Build and push docker image"
        timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
        env:
          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
          QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
          DOCKERHUB_USERNAME: ${{ secrets.DOCKER_USERNAME }}
          DOCKERHUB_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
        run: >
          mvn -B -U -ntp clean deploy
          -P release,${{ matrix.buildProfile }}
          -DskipTests -Dmaven.javadoc.skip=true -DadditionalOption=-Xdoclint:none
          -Dmaven.deploy.skip=true -Dparent.core.deploy.skip=true -Dtransformer.base.deploy.skip=true ${{ matrix.dockerArgs }}