main.yml

name: Main

on:
  push:
    branches:
      - master
    tags:
      - v*

  pull_request:
    branches:
      - master

jobs:
  check:
    name: Check & Publish
    runs-on: ubuntu-latest
    env:
      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
    steps:
      - uses: actions/checkout@v4

      # JDK
      - name: Set up JDK
        uses: actions/setup-java@v3
        with:
          distribution: 'temurin'
          java-version: 17

      - name: Validate Gradle wrapper
        uses: gradle/wrapper-validation-action@v1

      # Caches
      - name: Gradle cache
        uses: actions/cache@v3
        with:
          path: |
            ~/.gradle/caches
            ~/.gradle/wrapper
          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle*.properties') }}
          restore-keys: |
            ${{ runner.os }}-gradle-

      # Services
      - name: Build the docker-compose stack
        run: |
          mkdir certs
          openssl req -new -x509 -days 365 -nodes -out certs/ca.crt -keyout certs/ca.key -subj "/CN=root-ca"

          mkdir certs/server
          openssl genrsa -des3 -out certs/server/server.key -passout pass:p4ssphrase 2048
          openssl rsa -in certs/server/server.key -passin pass:p4ssphrase -out certs/server/server.key
          openssl req -new -nodes -key certs/server/server.key -out certs/server/server.csr -subj "/CN=postgresql"
          openssl x509 -req -in certs/server/server.csr -days 365 -CA certs/ca.crt -CAkey certs/ca.key -CAcreateserial -out certs/server/server.crt
          sudo chmod -R 600 certs/server/
          sudo chown -R 1001 certs/server/

          mkdir certs/client
          openssl genrsa -des3 -out certs/client/client.key -passout pass:p4ssphrase 2048
          openssl rsa -in certs/client/client.key -passin pass:p4ssphrase -out certs/client/client-no-pass.key
          openssl req -new -nodes -key certs/client/client.key -passin pass:p4ssphrase -out certs/client/client.csr -subj "/CN=postgres"
          openssl x509 -req -in certs/client/client.csr -days 365 -CA certs/ca.crt -CAkey certs/ca.key -CAcreateserial -out certs/client/client.crt

          mkdir plugin-jdbc-postgres/src/test/resources/ssl/
          cp certs/client/* plugin-jdbc-postgres/src/test/resources/ssl/
          cp certs/ca.crt plugin-jdbc-postgres/src/test/resources/ssl/

          docker-compose -f docker-compose-ci.yml up -d sqlserver
          docker-compose -f docker-compose-ci.yml up -d
          sleep 3

      # Gradle check
      - name: Build with Gradle
        env:
          ROCKSET_APIKEY: ${{ secrets.ROCKSET_APIKEY }}
        run: ./gradlew check

      # Publish
      - name: Publish package to Sonatype
        if: github.ref == 'refs/heads/master'
        env:
          ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.SONATYPE_USER }}
          ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.SONATYPE_PASSWORD }}
          SONATYPE_GPG_KEYID: ${{ secrets.SONATYPE_GPG_KEYID }}
          SONATYPE_GPG_PASSWORD: ${{ secrets.SONATYPE_GPG_PASSWORD }}
          SONATYPE_GPG_FILE: ${{ secrets.SONATYPE_GPG_FILE }}
        run: |
          echo "signing.keyId=${SONATYPE_GPG_KEYID}" > ~/.gradle/gradle.properties
          echo "signing.password=${SONATYPE_GPG_PASSWORD}" >> ~/.gradle/gradle.properties
          echo "signing.secretKeyRingFile=${HOME}/.gradle/secring.gpg" >> ~/.gradle/gradle.properties
          echo ${SONATYPE_GPG_FILE} | base64 -d > ~/.gradle/secring.gpg
          ./gradlew publishToSonatype

      # Release
      - name: Release package to Maven Central
        if: startsWith(github.ref, 'refs/tags/v')
        env:
          ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.SONATYPE_USER }}
          ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.SONATYPE_PASSWORD }}
          SONATYPE_GPG_KEYID: ${{ secrets.SONATYPE_GPG_KEYID }}
          SONATYPE_GPG_PASSWORD: ${{ secrets.SONATYPE_GPG_PASSWORD }}
          SONATYPE_GPG_FILE: ${{ secrets.SONATYPE_GPG_FILE }}
        run: |
          echo "signing.keyId=${SONATYPE_GPG_KEYID}" > ~/.gradle/gradle.properties
          echo "signing.password=${SONATYPE_GPG_PASSWORD}" >> ~/.gradle/gradle.properties
          echo "signing.secretKeyRingFile=${HOME}/.gradle/secring.gpg" >> ~/.gradle/gradle.properties
          echo ${SONATYPE_GPG_FILE} | base64 -d > ~/.gradle/secring.gpg
          ./gradlew publishToSonatype closeAndReleaseSonatypeStagingRepository

      # GitHub Release
      - name: Create GitHub release
        uses: "marvinpinto/action-automatic-releases@latest"
        if: startsWith(github.ref, 'refs/tags/v')
        with:
          repo_token: "${{ secrets.GITHUB_TOKEN }}"
          prerelease: false
          files: |
            plugin-jdbc-*/build/libs/*.jar

      # Cleanup services
      - name: Cleanup services
        if: ${{ always() }}
        run: sudo rm -rf certs

      # Slack
      - name: Slack notification
        uses: 8398a7/action-slack@v3
        if: ${{ always() && env.SLACK_WEBHOOK_URL != 0 }}
        with:
          status: ${{ job.status }}
          job_name: Check & Publish
          fields: repo,message,commit,author,action,eventName,ref,workflow,job,took
          username: GitHub Actions
          icon_emoji: ':github-actions:'
          channel: 'C02DQ1A7JLR'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}