ci.yml

name: CI

on:
  push:
    branches: [ main ]
  pull_request:

permissions:
  contents: read

env:
  # The conformance suite release this repo is vendored from and must report against.
  BQ_CONFORMANCE_VERSION: "1.5.0"

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        java: [ "17", "21" ]
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: ${{ matrix.java }}
          cache: maven

      # The conformance runner writes results.json (ADR-0032) when BQ_CONFORMANCE_RESULTS is set.
      - name: Test
        run: mvn -B --no-transfer-progress verify
        env:
          BQ_CONFORMANCE_RESULTS: ${{ runner.temp }}/results.json

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      # Schema-valid, no `fail`, bindings derived from the source tree, and every in-scope
      # section and case present (an absent transport or section breaks CI).
      - name: Validate results.json
        run: |
          python -m pip install --quiet jsonschema==4.23.0
          python -I .github/scripts/check-conformance-results.py "$RUNNER_TEMP/results.json" \
            src/test/resources/conformance "$BQ_CONFORMANCE_VERSION"

  conformance:
    name: Conformance suite in sync
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      # fetch.sh downloads the release asset, verifies it against the release's SHA256SUMS and,
      # with --check, fails if the vendored copy differs. It is taken from the same pinned tag.
      - name: Verify vendored conformance matches the pinned release
        run: |
          curl -fsSL -o "$RUNNER_TEMP/fetch.sh" \
            "https://raw.githubusercontent.com/BabelQueue/conformance/v${BQ_CONFORMANCE_VERSION}/fetch.sh"
          bash "$RUNNER_TEMP/fetch.sh" --check "$BQ_CONFORMANCE_VERSION" src/test/resources/conformance

  ci-green:
    name: CI green
    runs-on: ubuntu-latest
    needs: [test, conformance]
    if: ${{ always() }}
    steps:
      - name: Fail if any required job did not pass
        run: |
          if ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}; then
            echo "A required job failed or was cancelled."
            exit 1
          fi