build.yml

name: Build

on:
  workflow_dispatch:
    inputs: {}
  push:
    branches: [ "develop" ]
    tags: [ "v**" ]
  pull_request:
    branches: [ "develop" ]

jobs:
  checksecret:
    runs-on: ubuntu-latest
    outputs:
      HAVE_SECRETS: ${{ steps.checksecret_job.outputs.HAVE_SECRETS }}
    steps:
      - id: checksecret_job
        env:
          OPENSSL_IV: ${{ secrets.OPENSSL_IV }}
          OPENSSL_KEY: ${{ secrets.OPENSSL_KEY }}
        run: |
          echo "HAVE_SECRETS=${{ env.OPENSSL_IV != '' && env.OPENSSL_KEY != '' }}" >> $GITHUB_OUTPUT
  build:
    runs-on: ubuntu-latest
    needs: [ 'checksecret' ]
    strategy:
      matrix:
        java: [ '11', '17' ]
        scala: [ '2.11', '2.12', '2.13', '3' ]
    steps:
      - uses: 7mind/github-env@main
        with:
          java-version: ${{ matrix.java }}
      - name: Build and Test
        run: |
          bash sbtgen.sc --js --native
          sbt "++ ${{ matrix.scala }} -v" clean test mimaReportBinaryIssues
      - uses: dorny/test-reporter@v1
        if: (needs.checksecret.outputs.HAVE_SECRETS == 'true') && (success() || failure())
        with:
          name: Test reports (JDK ${{ matrix.java }}, Scala ${{ matrix.scala }})
          path: '**/target/test-reports/TEST-*.xml'
          reporter: java-junit
      - name: Upload dependency graph
        if: needs.checksecret.outputs.HAVE_SECRETS == 'true'
        uses: scalacenter/sbt-dependency-submission@d3f139371479f7d3ca3db160b9b536cb4f9dcdd5
  publish-artifacts:
    runs-on: ubuntu-latest
    needs: [ 'build', 'checksecret' ]
    if: needs.checksecret.outputs.HAVE_SECRETS == 'true'
    strategy:
      matrix:
        java: [ '17' ]
    steps:
      - uses: 7mind/github-env@main
        with:
          java-version: ${{ matrix.java }}
      - name: Build and Publish to Sonatype
        env:
          OPENSSL_IV: ${{ secrets.OPENSSL_IV }}
          OPENSSL_KEY: ${{ secrets.OPENSSL_KEY }}
          SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
          SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
        run: |
          bash sbtgen.sc --js --native
          
          
          COMMAND="sbt +clean +test +mimaReportBinaryIssues"
          if [[ "$GITHUB_REF" == refs/heads/develop || "$CI_BRANCH_TAG" =~ ^v.*$ ]] ; then
            openssl aes-256-cbc -K ${OPENSSL_KEY} -iv ${OPENSSL_IV} -in secrets.tar.enc -out secrets.tar -d
            tar xvf secrets.tar
            ln -s .secrets/local.sbt local.sbt
            rm ./.secrets/credentials.sonatype-nexus.properties
            printf "%s\n" "realm=Sonatype Nexus Repository Manager" "host=oss.sonatype.org" "user=${SONATYPE_USERNAME}" "password=${SONATYPE_PASSWORD}" > ./.secrets/credentials.sonatype-nexus.properties
  
            COMMAND="$COMMAND +publishSigned"
            if [[ "$CI_BRANCH_TAG" =~ ^v.*$ ]] ; then
              COMMAND="$COMMAND sonatypeBundleRelease"
            fi
          
            echo $COMMAND
            eval $COMMAND
          fi
  release-and-notify-docs:
    name: Release and Notify Docs
    runs-on: ubuntu-latest
    continue-on-error: false
    needs: [ 'build', 'checksecret' ]
    #if: ${{ ((github.event_name == 'release') && (github.event.action == 'published')) || (github.event_name == 'workflow_dispatch') }}
    strategy:
      matrix:
        java: [ '17' ]
    steps:
      - uses: 7mind/github-env@main
        with:
          java-version: ${{ matrix.java }}
      - name: Setup NodeJs
        uses: actions/setup-node@v4
        with:
          node-version: 20.x
          registry-url: https://registry.npmjs.org
      - name: Update Documentation
        run: |
          awk '/<!--- docs:start --->/,/<!--- docs:end --->/' README.md >> docs/index.md
          sed -i '/<!--- docs:start --->/d' docs/index.md
          sed -i '/<!--- docs:end --->/d' docs/index.md
      - name: Publish Docs to NPM Registry
        run: sbt docs/publishToNpm
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
      - name: Notify the main repo about the new release of docs package
        run: |
          PACKAGE_NAME=$(cat docs/package.json | grep '"name"' | awk -F'"' '{print $4}')
          PACKAGE_VERSION=$(npm view $PACKAGE_NAME version)
          curl -L \
            -X POST \
            -H "Accept: application/vnd.github+json" \
            -H "Authorization: token ${{ secrets.PAT_TOKEN }}"\
              https://api.github.com/repos/zio/zio/dispatches \
              -d '{
                    "event_type":"update-docs",
                    "client_payload":{
                      "package_name":"'"${PACKAGE_NAME}"'",
                      "package_version": "'"${PACKAGE_VERSION}"'"
                    }
                  }'
  all-good:
    if: always()
    runs-on: ubuntu-latest
    needs: [ 'build' ]
    steps:
      - name: Decide whether the needed jobs succeeded or failed
        uses: re-actors/alls-green@release/v1
        with:
          jobs: ${{ toJSON(needs) }}