ci.yaml

# Copyright 2023 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# Github action job to test core java library features on
# downstream client libraries before they are released.
on:
  push:
    branches:
    - main
  pull_request:
  pull_request_target:
    types: [ labeled ]
  schedule:
    - cron: '0 2 * * *'
name: ci

# Declare default permissions as read only.
permissions: read-all

jobs:
  units:
    name: unit-tests (linux)
    # run job on proper workflow event triggers (skip job for pull_request event from forks and only run pull_request_target for "tests: run" label)
    if: "${{ (github.event.action != 'labeled' && github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name) || github.event.label.name == 'tests: run' }}"
    runs-on: ubuntu-latest
    permissions:
      contents: "read"
      id-token: "write"
      issues: write
    strategy:
      fail-fast: false
      matrix:
        java: [8, 11, 17]
    steps:
    - name: Checkout code
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      with:
        ref: ${{ github.event.pull_request.head.sha }}
        repository: ${{ github.event.pull_request.head.repo.full_name }}
    - name: Set up JDK
      uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
      with:
        distribution: zulu
        java-version: ${{matrix.java}}
    - name: Authenticate to Google Cloud
      uses: google-github-actions/auth@67e9c72af6e0492df856527b474995862b7b6591 # v2.0.0
      with:
        workload_identity_provider: ${{ secrets.PROVIDER_NAME }}
        service_account: ${{ secrets.SERVICE_ACCOUNT }}
        access_token_lifetime: 600s
    - name: Java Version
      run: java -version
    - name: Run tests
      run: .kokoro/build.sh
      env:
        JOB_TYPE: test
    - name: FlakyBot
      # only run flakybot on periodic (schedule) and continuous (push) events
      if: ${{ (github.event_name == 'schedule' || github.event_name == 'push') && runner.os == 'Linux' && always() }}
      run: |
        curl https://github.com/googleapis/repo-automation-bots/releases/download/flakybot-1.1.0/flakybot -o flakybot -s -L
        chmod +x ./flakybot
        ./flakybot --repo ${{github.repository}} --commit_hash ${{github.sha}} --build_url https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}

  windows:
    name: unit-tests (windows)
    # run job on proper workflow event triggers (skip job for pull_request event from forks and only run pull_request_target for "tests: run" label)
    if: "${{ (github.event.action != 'labeled' && github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name) || github.event.label.name == 'tests: run' }}"
    runs-on: windows-latest
    permissions:
      contents: "read"
      id-token: "write"
      issues: write
    steps:
    - name: Support longpaths
      run: git config --system core.longpaths true
    - name: Checkout code
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      with:
        ref: ${{ github.event.pull_request.head.sha }}
        repository: ${{ github.event.pull_request.head.repo.full_name }}
    - name: Set up JDK
      uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
      with:
        distribution: zulu
        java-version: 8
    - name: Authenticate to Google Cloud
      uses: google-github-actions/auth@67e9c72af6e0492df856527b474995862b7b6591 # v2.0.0
      with:
        workload_identity_provider: ${{ secrets.PROVIDER_NAME }}
        service_account: ${{ secrets.SERVICE_ACCOUNT }}
        access_token_lifetime: 600s
    - name: Java Version
      run: java -version
    - name: Run tests
      run: .kokoro/build.bat
      env:
        JOB_TYPE: test
    - name: FlakyBot
      # only run flakybot on periodic (schedule) and continuous (push) events
      if: ${{ (github.event_name == 'schedule' || github.event_name == 'push') && runner.os == 'Windows' && always() }}
      run: |
        curl https://github.com/googleapis/repo-automation-bots/releases/download/flakybot-1.1.0/flakybot.exe -o flakybot.exe -s -L
        ./flakybot.exe --repo ${{github.repository}} --commit_hash ${{github.sha}} --build_url https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}

  dependencies:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        java: [8, 11, 17]
    steps:
    - name: Checkout code
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      with:
        ref: ${{ github.event.pull_request.head.sha }}
        repository: ${{ github.event.pull_request.head.repo.full_name }}
    - name: Set up JDK
      uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
      with:
        distribution: zulu
        java-version: ${{matrix.java}}
    - name: Java Version
      run: java -version
    - name: Build dependencies
      run: .kokoro/dependencies.sh

  lint:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      with:
        ref: ${{ github.event.pull_request.head.sha }}
        repository: ${{ github.event.pull_request.head.repo.full_name }}
    - name: Set up JDK
      uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
      with:
        distribution: zulu
        java-version: 11
    - name: Java Version
      run: java -version
    - name: Run lint
      run: .kokoro/build.sh
      env:
        JOB_TYPE: lint

  clirr:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      with:
        ref: ${{ github.event.pull_request.head.sha }}
        repository: ${{ github.event.pull_request.head.repo.full_name }}
    - name: Set up JDK
      uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
      with:
        distribution: zulu
        java-version: 8
    - name: Java Version
      run: java -version
    - name: Run CLIRR
      run: .kokoro/build.sh
      env:
        JOB_TYPE: clirr

  graalvm17:
    # run job on periodic (schedule) event
    if: "${{ github.event_name == 'schedule' }}"
    name: graalvm17
    runs-on: [self-hosted, linux, x64]
    permissions:
      contents: "read"
      id-token: "write"
      issues: write
    steps:
    - name: Checkout code
      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      with:
        ref: ${{ github.event.pull_request.head.sha }}
        repository: ${{ github.event.pull_request.head.repo.full_name }}

    - name: Setup Maven Action
      uses: s4u/setup-maven-action@fa2c7e4517ed008b1f73e7e0195a9eecf5582cd4
      with:
        java-version: 17

    - name: Set up GraalVM
      uses: graalvm/setup-graalvm@b8dc5fccfbc65b21dd26e8341e7b21c86547f61b # v1
      with:
        distribution: "graalvm"
        java-version: "17"
        github-token: ${{ secrets.GITHUB_TOKEN }}

    - id: "auth"
      name: Authenticate to Google Cloud
      uses: google-github-actions/auth@67e9c72af6e0492df856527b474995862b7b6591 # v2.0.0
      with:
        workload_identity_provider: ${{ secrets.PROVIDER_NAME }}
        service_account: ${{ secrets.SERVICE_ACCOUNT }}
        access_token_lifetime: 600s

    - id: "secrets"
      name: Get Secrets
      uses: google-github-actions/get-secretmanager-secrets@4d6d3dfd94110800dda8d84109cb6da0f6a5919d # v1.0.1
      with:
        secrets: |-
          ALLOYDB_INSTANCE_NAME:${{ secrets.GOOGLE_CLOUD_PROJECT }}/ALLOYDB_INSTANCE_URI
          ALLOYDB_CLUSTER_PASS:${{ secrets.GOOGLE_CLOUD_PROJECT }}/ALLOYDB_CLUSTER_PASS
          ALLOYDB_IAM_USER:${{ secrets.GOOGLE_CLOUD_PROJECT }}/ALLOYDB_JAVA_IAM_USER
          ALLOYDB_INSTANCE_IP:${{ secrets.GOOGLE_CLOUD_PROJECT }}/ALLOYDB_INSTANCE_IP
          ALLOYDB_IMPERSONATED_USER:${{ secrets.GOOGLE_CLOUD_PROJECT }}/IMPERSONATED_USER

    - name: Run tests
      env:
        ALLOYDB_DB: 'postgres'
        ALLOYDB_USER: 'postgres'
        ALLOYDB_IAM_USER: '${{ steps.secrets.outputs.ALLOYDB_IAM_USER }}'
        ALLOYDB_PASS: '${{ steps.secrets.outputs.ALLOYDB_CLUSTER_PASS }}'
        ALLOYDB_INSTANCE_NAME: '${{ steps.secrets.outputs.ALLOYDB_INSTANCE_NAME }}'
        ALLOYDB_INSTANCE_IP: '${{ steps.secrets.outputs.ALLOYDB_INSTANCE_IP }}'
        ALLOYDB_IMPERSONATED_USER: '${{ steps.secrets.outputs.ALLOYDB_IMPERSONATED_USER }}'
        JOB_TYPE: graalvm17
      run: .kokoro/build.sh
      shell: bash

    - name: FlakyBot
      run: |
        curl https://github.com/googleapis/repo-automation-bots/releases/download/flakybot-1.1.0/flakybot -o flakybot -s -L
        chmod +x ./flakybot
        ./flakybot --repo ${{github.repository}} --commit_hash ${{github.sha}} --build_url https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}

  unitsAndE2e:
    # run job on proper workflow event triggers (skip job for pull_request event from forks and only run pull_request_target for "tests: run" label)
    if: "${{ (github.event.action != 'labeled' && github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name) || github.event.label.name == 'tests: run' }}"
    name: units + e2e
    runs-on: [self-hosted, linux, x64]
    permissions:
      contents: 'read'
      id-token: 'write'
      issues: write
      pull-requests: write
    steps:
      - name: Remove PR label
        if: "${{ github.event.action == 'labeled' && github.event.label.name == 'tests: run' }}"
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            try {
              await github.rest.issues.removeLabel({
                name: 'tests: run',
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.payload.pull_request.number
              });
            } catch (e) {
              console.log('Failed to remove label. Another job may have already removed it!');
            }

      - name: Checkout code
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}

      - name: Set up JDK
        uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
        with:
          distribution: 'zulu'
          java-version: 8

      - name: Setup Maven Action
        uses: s4u/setup-maven-action@fa2c7e4517ed008b1f73e7e0195a9eecf5582cd4
        with:
          java-version: 8

      - id: 'auth'
        name: Authenticate to Google Cloud
        uses: google-github-actions/auth@67e9c72af6e0492df856527b474995862b7b6591 # v2.0.0
        with:
          workload_identity_provider: ${{ secrets.PROVIDER_NAME }}
          service_account: ${{ secrets.SERVICE_ACCOUNT }}
          access_token_lifetime: 600s

      - name: Get Secrets
        id: 'secrets'
        uses: google-github-actions/get-secretmanager-secrets@4d6d3dfd94110800dda8d84109cb6da0f6a5919d # v1.0.1
        with:
          secrets: |-
            ALLOYDB_INSTANCE_NAME:${{ secrets.GOOGLE_CLOUD_PROJECT }}/ALLOYDB_INSTANCE_URI
            ALLOYDB_CLUSTER_PASS:${{ secrets.GOOGLE_CLOUD_PROJECT }}/ALLOYDB_CLUSTER_PASS
            ALLOYDB_IAM_USER:${{ secrets.GOOGLE_CLOUD_PROJECT }}/ALLOYDB_JAVA_IAM_USER
            ALLOYDB_INSTANCE_IP:${{ secrets.GOOGLE_CLOUD_PROJECT }}/ALLOYDB_INSTANCE_IP
            ALLOYDB_IMPERSONATED_USER:${{ secrets.GOOGLE_CLOUD_PROJECT }}/IMPERSONATED_USER

      - name: Run tests
        env:
          ALLOYDB_DB: 'postgres'
          ALLOYDB_USER: 'postgres'
          ALLOYDB_IAM_USER: '${{ steps.secrets.outputs.ALLOYDB_IAM_USER }}'
          ALLOYDB_PASS: '${{ steps.secrets.outputs.ALLOYDB_CLUSTER_PASS }}'
          ALLOYDB_INSTANCE_NAME: '${{ steps.secrets.outputs.ALLOYDB_INSTANCE_NAME }}'
          ALLOYDB_INSTANCE_IP: '${{ steps.secrets.outputs.ALLOYDB_INSTANCE_IP }}'
          ALLOYDB_IMPERSONATED_USER: '${{ steps.secrets.outputs.ALLOYDB_IMPERSONATED_USER }}'
          JOB_TYPE: integration
        run: .kokoro/build.sh
        shell: bash

      - name: Check Coverage
        run: .kokoro/check_coverage.sh


      - name: FlakyBot
        # only run flakybot on periodic (schedule) and continuous (push) events
        if: ${{ (github.event_name == 'schedule' || github.event_name == 'push') && runner.os == 'Linux' && always() }}
        run: |
          curl https://github.com/googleapis/repo-automation-bots/releases/download/flakybot-1.1.0/flakybot -o flakybot -s -L
          chmod +x ./flakybot
          ./flakybot --repo ${{github.repository}} --commit_hash ${{github.sha}} --build_url https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}