maven.yml

name: Maven CI

on:
  push:
    branches:
    - master
  pull_request:
    branches:
    - master

permissions: { }

jobs:
  test:
    name: Test
    strategy:
      matrix:
        java-version: [ 8, 11, 17, 21 ]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
    - name: Checkout Repository
      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # tag=v4.1.7
    - name: Set up JDK ${{ matrix.java-version }}
      uses: actions/setup-java@6a0805fcefea3d4657a47ac4c165951e33482018 # tag=v4.2.2
      with:
        distribution: temurin
        java-version: ${{ matrix.java-version }}
        cache: maven
    - name: Test
      run: mvn -B --no-transfer-progress clean verify
    # Publishing coverage to Codacy is only possible for builds of push events.
    # PRs from forks do not get access to repository secrets.
    # https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
    - name: Publish test coverage
      if: ${{ github.event_name != 'pull_request' && github.repository_owner == 'CycloneDX' && matrix.java-version == '21' }}
      uses: codacy/codacy-coverage-reporter-action@89d6c85cfafaec52c72b6c5e8b2878d33104c699 # tag=v1.3.0
      with:
        project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
        language: Java
        coverage-reports: target/site/jacoco/jacoco.xml
    - name: Upload PR test coverage report
      if: ${{ github.event_name == 'pull_request' }}
      uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # tag=v4.4.0
      with:
        name: pr-test-coverage-report-java-${{ matrix.java-version }}
        path: target/site/jacoco/jacoco.xml