build.yml

name: Build

on:
  workflow_dispatch:
    inputs: {}
  push:
    branches: [ "develop" ]
    tags: [ "v**" ]
  pull_request:
    branches: [ "develop" ]

jobs:
  checksecret:
    runs-on: ubuntu-latest
    outputs:
      HAVE_SECRETS: ${{ steps.checksecret_job.outputs.HAVE_SECRETS }}
    steps:
      - id: checksecret_job
        env:
          OPENSSL_IV: ${{ secrets.OPENSSL_IV }}
          OPENSSL_KEY: ${{ secrets.OPENSSL_KEY }}
        run: |
          echo "HAVE_SECRETS=${{ env.OPENSSL_IV != '' && env.OPENSSL_KEY != '' }}" >> $GITHUB_OUTPUT
  build:
    runs-on: ubuntu-latest
    needs: [ 'checksecret' ]
    strategy:
      matrix:
        java: [ '11', '17' ]
        scala: [ '2.11', '2.12', '2.13', '3' ]
    steps:
      - uses: 7mind/github-env@main
        with:
          java-version: ${{ matrix.java }}
      - name: Build and Test
        run: |
          bash sbtgen.sc --js --native
          sbt "++ ${{ matrix.scala }} -v" clean test mimaReportBinaryIssues
      - uses: dorny/test-reporter@v1
        if: (needs.checksecret.outputs.HAVE_SECRETS == 'true') && (success() || failure())
        with:
          name: Test reports (JDK ${{ matrix.java }}, Scala ${{ matrix.scala }})
          path: '**/target/test-reports/TEST-*.xml'
          reporter: java-junit
      - name: Upload dependency graph
        if: needs.checksecret.outputs.HAVE_SECRETS == 'true'
        uses: scalacenter/sbt-dependency-submission@d3f139371479f7d3ca3db160b9b536cb4f9dcdd5
  publish-artifacts:
    runs-on: ubuntu-latest
    needs: [ 'build', 'checksecret' ]
    if: needs.checksecret.outputs.HAVE_SECRETS == 'true'
    strategy:
      matrix:
        java: [ '11' ]
    steps:
      - uses: 7mind/github-env@main
        with:
          java-version: ${{ matrix.java }}
      - name: Build and Publish to Sonatype
        env:
          OPENSSL_IV: ${{ secrets.OPENSSL_IV }}
          OPENSSL_KEY: ${{ secrets.OPENSSL_KEY }}
        run: |
          bash sbtgen.sc --js --native
          
          
          COMMAND="sbt +clean +test +mimaReportBinaryIssues"
          if [[ "$GITHUB_REF" == refs/heads/develop || "$CI_BRANCH_TAG" =~ ^v.*$ ]] ; then
            openssl aes-256-cbc -K ${OPENSSL_KEY} -iv ${OPENSSL_IV} -in secrets.tar.enc -out secrets.tar -d
            tar xvf secrets.tar
            ln -s .secrets/local.sbt local.sbt
            COMMAND="$COMMAND +publishSigned"
            if [[ "$CI_BRANCH_TAG" =~ ^v.*$ ]] ; then
              COMMAND="$COMMAND sonatypeBundleRelease"
            fi
          
            echo $COMMAND
            eval $COMMAND
          fi
  all-good:
    if: always()
    runs-on: ubuntu-latest
    needs: [ 'build', 'publish-artifacts' ]
    steps:
      - name: Decide whether the needed jobs succeeded or failed
        uses: re-actors/alls-green@release/v1
        with:
          jobs: ${{ toJSON(needs) }}