maven.yml

name: Maven CI

on:
  push:
    branches:
    - master
  pull_request:
    branches:
    - master

permissions: { }

jobs:
  test:
    name: Test
    strategy:
      matrix:
        java-version: [ 8, 11, 17, 21 ]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
    - name: Checkout Repository
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
    - name: Set up JDK ${{ matrix.java-version }}
      uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # tag=v4.5.0
      with:
        distribution: temurin
        java-version: ${{ matrix.java-version }}
        cache: maven
    - name: Test
      run: mvn -B --no-transfer-progress clean verify
    # Publishing coverage to Codacy is only possible for builds of push events.
    # PRs from forks do not get access to repository secrets.
    # https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
    - name: Publish test coverage
      if: ${{ github.event_name != 'pull_request' && github.repository_owner == 'CycloneDX' && matrix.java-version == '21' }}
      uses: codacy/codacy-coverage-reporter-action@89d6c85cfafaec52c72b6c5e8b2878d33104c699 # tag=v1.3.0
      with:
        project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
        language: Java
        coverage-reports: target/site/jacoco/jacoco.xml
    - name: Upload PR test coverage report
      if: ${{ github.event_name == 'pull_request' }}
      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # tag=v4.4.3
      with:
        name: pr-test-coverage-report-java-${{ matrix.java-version }}
        path: target/site/jacoco/jacoco.xml