ci.yml

name: CI

on:
  workflow_dispatch:
  push:
    branches: [main, 'release/v*', next, next-major, beta, alpha]
  pull_request:
    branches: [main, 'release/v*', next, next-major, beta, alpha]
  schedule:
    - cron: '5 4 * * *' # Every day at 04:05

permissions: {}

jobs:
  build-and-test:
    name: Build & Test
    runs-on: ubuntu-22.04
    timeout-minutes: 15

    permissions:
      contents: read
      security-events: write # Required by SonarCloud for reporting found security vulnerabilities

    steps:
      - name: Harden runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            api.github.com:443
            objects.githubusercontent.com:443
            repo.maven.apache.org:443
            jitpack.io:443
            repo.papermc.io:443
            api.nuget.org:443
            registry.npmjs.org:443
            auth.docker.io:443
            registry-1.docker.io:443
            production.cloudflare.docker.com:443
            sonarcloud.io:443
            scanner.sonarcloud.io:443
            ea6ne4j2sb.execute-api.eu-central-1.amazonaws.com:443
            sc-cleancode-sensorcache-eu-central-1-prod.s3.amazonaws.com:443

      - name: Checkout repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          persist-credentials: false
          fetch-depth: 0 # Required by SonarCloud

      - name: Setup Java
        uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
        with:
          java-version: 17
          distribution: temurin
          cache: maven

      - name: Testcontainers - Enable reusable containers
        run: echo 'testcontainers.reuse.enable=true' >> ~/.testcontainers.properties

      - name: Cache SonarCloud packages
        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
        with:
          path: ~/.sonar/cache
          key: sonar
          restore-keys: sonar

      - name: Maven build & SonarCloud quality scan
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: https://sonarcloud.io
        run: |
          SONAR_ORGANIZATION="$(echo '${{ github.repository_owner }}' | awk '{print tolower($0)}')"
          SONAR_PROJECT_KEY="$(echo '${{ github.repository }}' | sed 's/\//_/')"

          mvn verify sonar:sonar --activate-profiles ci -Dstyle.color=always \
            --batch-mode --errors --strict-checksums --update-snapshots \
            -Dsonar.host.url="${SONAR_HOST_URL}" \
            -Dsonar.organization="${SONAR_ORGANIZATION}" \
            -Dsonar.projectKey="${SONAR_PROJECT_KEY}"

  codeql-sast:
    name: CodeQL - Static Application Security Testing (SAST)
    runs-on: ubuntu-22.04
    timeout-minutes: 15

    permissions:
      actions: read
      contents: read
      security-events: write # Required for reporting found security vulnerabilities

    steps:
      - name: Harden runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            api.github.com:443
            uploads.github.com:443
            objects.githubusercontent.com
            repo.maven.apache.org:443
            jitpack.io:443
            repo.papermc.io:443
            api.nuget.org:443

      - name: Checkout repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          persist-credentials: false

      - name: Setup Java
        uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
        with:
          java-version: 17
          distribution: temurin
          cache: maven

      - name: Initialize CodeQL
        uses: github/codeql-action/init@e8893c57a1f3a2b659b6b55564fdfdbbd2982911 # v3.24.0
        with:
          languages: java

      - name: Build
        run: |
          mvn package --activate-profiles fast -Dstyle.color=always \
            --batch-mode --errors --strict-checksums --update-snapshots --fail-fast

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@e8893c57a1f3a2b659b6b55564fdfdbbd2982911 # v3.24.0
        with:
          category: /language:java