qbit-printing/.github/workflows/ci.yml

# Copyright 2026 Kingsrook, LLC
# SPDX-License-Identifier: Apache-2.0

name: Build and prerelease

on:
  pull_request:
  push:
    branches: [main]
    tags: ['v*']
  workflow_dispatch:

permissions:
  contents: read

jobs:
  verify:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    defaults:
      run:
        working-directory: qbit-printing
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          path: qbit-printing
          persist-credentials: false
      - name: Check out reviewed protocol fixtures
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: QRun-IO/qqq-print-protocol
          ref: a26c18c90c7d6102bbe26eb50cbb90fcd1bd46e3
          path: qqq-print-protocol
          persist-credentials: false
      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
        with:
          distribution: temurin
          java-version: '21'
      - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
        with:
          node-version: '24'
          package-manager-cache: false
      - name: Restore locked Pyright
        run: npm ci --ignore-scripts --no-audit --no-fund
      - name: Set up uv
        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
        with:
          version: '0.13.6'
          enable-cache: false
      - name: Restore locked Python tools
        run: uv sync --locked
      - name: Verify script quality gates and rejection paths
        run: |
          uv run --locked --no-sync python .github/scripts/test-script-quality.py
          uv run --locked --no-sync python .github/scripts/check-script-quality.py
      - name: Verify owned source notices and rejection paths
        run: |
          python3 .github/scripts/test-source-headers.py
          python3 .github/scripts/check-source-headers.py
      - name: Checkstyle, unit tests and HTTP contract tests
        run: bash ./mvnw --batch-mode --no-transfer-progress -Pui-demo verify
      - name: Prepare JAR, POM and checksums
        shell: bash
        run: |
          version=$(python3 -c 'import xml.etree.ElementTree as E; print(E.parse("pom.xml").getroot().find("{http://maven.apache.org/POM/4.0.0}version").text)')
          if [[ "$GITHUB_REF_TYPE" == tag && "$GITHUB_REF_NAME" != "v$version" ]]; then
            echo 'Tag does not match pom.xml version.' >&2
            exit 1
          fi
          mkdir -p dist
          cp "target/qbit-printing-$version.jar" dist/
          cp pom.xml "dist/qbit-printing-$version.pom"
          (cd dist && sha256sum ./*.jar ./*.pom > SHA256SUMS)
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: qbit-printing-package
          path: qbit-printing/dist/*
          if-no-files-found: error
      - name: Retain test evidence
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: test-evidence
          path: |
            qbit-printing/target/surefire-reports/
            qbit-printing/target/checkstyle-result.xml
          if-no-files-found: ignore

  release-security:
    if: startsWith(github.ref, 'refs/tags/v')
    uses: ./.github/workflows/security.yml
    permissions:
      contents: read
      security-events: write

  release-codeql:
    if: startsWith(github.ref, 'refs/tags/v')
    uses: ./.github/workflows/codeql.yml
    permissions:
      contents: read
      security-events: write

  release:
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [verify, release-security, release-codeql]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: qbit-printing-package
          path: dist
      - name: Verify packaged checksums
        working-directory: dist
        run: sha256sum --check --strict SHA256SUMS
      - name: Attest verified release artifacts
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: dist/*
      - name: Publish tested GitHub release artifacts
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          prerelease=()
          if [[ "$GITHUB_REF_NAME" == *-* ]]; then prerelease+=(--prerelease); fi
          gh release create "$GITHUB_REF_NAME" dist/*.jar dist/*.pom dist/SHA256SUMS \
            --verify-tag --title "$GITHUB_REF_NAME" --notes-file CHANGELOG.md "${prerelease[@]}"