workflow-PR.yml

name: workflow-pr

on:
  pull_request:
    branches: ["master", "support/*", "develop"]
    paths-ignore:
      - "**/README.md"
      - "CONTRIBUTING.md"
      - ".github/**"
      - "!.github/workflows/workflow-PR.yml"

permissions:
  checks: write

jobs:
  build:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

      - name: Cache SonarCloud packages
        uses: actions/cache@v4
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
          restore-keys: ${{ runner.os }}-sonar

      - name: Setup Java
        uses: actions/setup-java@v4
        with:
          distribution: "temurin"
          java-version: 17
          cache: "maven"

      - uses: Keeper-Security/ksm-action@v1
        env:
          KSM_CONFIG: ${{ secrets.KSM_CONFIG }}
        if: ${{ env.KSM_CONFIG != '' }}
        with:
          keeper-secret-config: ${{ secrets.KSM_CONFIG }}
          secrets: |
            ${{ vars.KEEPER_SONARCLOUD_RECORD_ID }}/field/password > env:SONAR_TOKEN

      - name: Build with Sonarcloud
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
        if: ${{ env.SONAR_TOKEN != '' }}
        run: ./mvnw -B -ntp clean verify sonar:sonar

      - name: Build
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
        if: ${{ env.SONAR_TOKEN == '' }}
        run: ./mvnw -B -ntp clean verify

      - name: Publish Test Report
        uses: mikepenz/action-junit-report@v5
        if: always() # always run even if the previous step fails
        with:
          report_paths: "**/target/*-reports/TEST-*.xml"