name: Build

on:
  push:
  pull_request:
  workflow_dispatch:
    inputs:
      module-ref:
        description: Commit to build (default is the dispatched ref)
        required: false
        default: ''
      gradle-args:
        description: Extra Gradle arguments
        required: false
        default: ''
      publish:
        description: Publish the package ('true' or 'false')
        required: false
        default: 'false'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref_name != github.event.repository.default_branch }}

# Organisation-wide Stratum settings (registry, group, runner routes) are organisation variables.
env:
  STRATUM_PUBLISH_URL: ${{ vars.STRATUM_PUBLISH_URL }}
  STRATUM_RESOLVE_URL: ${{ vars.STRATUM_RESOLVE_URL }}
  STRATUM_GROUP_ID: ${{ vars.STRATUM_GROUP_ID }}
  STRATUM_ROUTES: ${{ vars.STRATUM_ROUTES }}

jobs:
  build:
    if: github.event_name != 'push' || github.ref_name == github.event.repository.default_branch
    runs-on: ubuntu-latest
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ inputs.module-ref || github.sha }}
          fetch-depth: 0 # the package version is derived from git history
          filter: blob:none

      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad
        with:
          distribution: zulu
          java-version: '25'
          cache-jdk: true

      - uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c
        with:
          cache-provider: "${{ github.server_url == 'https://github.com' && 'basic' || 'external' }}"

      - name: Build
        env:
          GRADLE_ARGS: ${{ inputs.gradle-args }}
        run: |
          read -r -a extra <<< "$GRADLE_ARGS"
          bash ./gradlew build "${extra[@]}" --no-daemon --console=plain

  publish:
    # Runs only after the build above passed. The Maven credentials exist in this job and nowhere else,
    # so a pull request build can never read them.
    needs: build
    if: ${{ github.event_name == 'push' || inputs.publish == 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      MAVEN_USER: ${{ secrets.MAVEN_USER }}
      MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ inputs.module-ref || github.sha }}
          fetch-depth: 0 # the package version is derived from git history
          filter: blob:none

      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad
        with:
          distribution: zulu
          java-version: '25'
          cache-jdk: true

      - uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c
        with:
          cache-provider: "${{ github.server_url == 'https://github.com' && 'basic' || 'external' }}"

      - name: Check the publish credentials
        run: |
          if [[ -z "$MAVEN_USER" || -z "$MAVEN_PASSWORD" ]]; then
            echo "::error::MAVEN_USER and MAVEN_PASSWORD are not set; cannot publish"
            exit 1
          fi

      - name: Publish
        env:
          GRADLE_ARGS: ${{ inputs.gradle-args }}
        run: |
          read -r -a extra <<< "$GRADLE_ARGS"
          bash ./gradlew publish "${extra[@]}" --no-daemon --console=plain