maven-build-pr.yml

name: Maven Pull Request Build

on:
  pull_request:
    branches:
      - "*"
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout Source
      uses: actions/checkout@v4
      with:
        # Disabling shallow clone is recommended for improving relevancy of reporting
        fetch-depth: 0

    - name: Cache maven repository
      uses: actions/cache@v3
      with:
        path: |
          ~/.m2/repository
          ~/.sonar/cache
        key: pr-${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
        restore-keys: |
          pr-${{ runner.os }}-maven
          ${{ runner.os }}-maven

    - name: Set up JDK 11
      uses: actions/setup-java@v3
      with:
        distribution: 'adopt'
        java-version: 11

    - name: Build with Maven
      env:
        ARTIFACTORY_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }}
        ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
      run: |
        mvn test-compile -P build-ci --settings maven-ci-settings.xml -B

    - name: Test with Coverage
      if: ${{ github.event.pull_request.head.repo.fork == false }}
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        ARTIFACTORY_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }}
        ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
      run: |
        mvn install sonar:sonar -P coverage -Dsonar.projectKey=FraunhoferIOSB_FAAAST-Service --settings maven-ci-settings.xml -B

    - name: Dependency Vulnerability Check with OWASP
      env:
        OWASP_OSS_INDEX_USERNAME: ${{ secrets.OWASP_OSS_INDEX_USERNAME }}
        OWASP_OSS_INDEX_APIKEY: ${{ secrets.OWASP_OSS_INDEX_APIKEY }}
      run: |
        mvn org.owasp:dependency-check-maven:aggregate -P owasp --settings maven-ci-settings.xml -B