ci.yml

---
name: CI

on:
  push:
    branches:
      - main
      - stable/*
      - release-*
  pull_request: {}
  merge_group: {}
  workflow_dispatch: {}

# Limit workflow to 1 concurrent run per ref (branch): new commit -> old runs are canceled to save costs
# Exception for main branch: complete builds for every commit needed for confidenence
# Exception for deploy jobs that have to wait for each other to avoid overwriting
concurrency:
  cancel-in-progress: true
  group: ${{ format('{0}-{1}', github.workflow, github.ref == 'refs/heads/main' && github.sha || github.ref) }}

defaults:
  run:
    # use bash shell by default to ensure pipefail behavior is the default
    # see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
    shell: bash

env:
  DOCKER_PLATFORMS: "linux/amd64,linux/arm64"

jobs:
  detect-changes:
    outputs:
      actionlint: ${{ steps.filter.outputs.actionlint }}
      maven-spotless-linter: ${{ steps.filter.outputs.maven-spotless-linter }}
      java-code-changes: ${{ steps.filter.outputs.java-code-changes }}
      camunda-docker-tests: ${{ steps.filter.outputs.camunda-docker-tests}}
      identity-frontend-tests: ${{ steps.filter.outputs.identity-frontend-tests }}
      frontend-changes: ${{ steps.filter.outputs.frontend-changes }}
      zeebe-changes: ${{ steps.filter.outputs.zeebe-changes }}
      operate-backend-changes: ${{ steps.filter.outputs.operate-backend-changes }}
      tasklist-backend-changes: ${{ steps.filter.outputs.tasklist-backend-changes }}
      optimize-frontend-changes: ${{ steps.filter.outputs.optimize-frontend-changes }}
      optimize-backend-changes: ${{ steps.filter.outputs.optimize-backend-changes }}
      protobuf-changes: ${{ steps.filter.outputs.protobuf-changes }}
      openapi-changes: ${{ steps.filter.outputs.openapi-changes }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      # Detect changes against the base branch
      - name: Detect changes
        uses: ./.github/actions/paths-filter
        id: filter

  actionlint:
    if: needs.detect-changes.outputs.actionlint == 'true'
    needs: [detect-changes]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    env:
      # renovate: datasource=github-releases depName=rhysd/actionlint
      ACTIONLINT_VERSION: '1.7.4'
    steps:
      - uses: actions/checkout@v4
      - run: echo "::add-matcher::.github/actionlint-matcher.json"
      - run: |
          bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) $ACTIONLINT_VERSION
          ./actionlint -shellcheck '' -ignore 'property "vault_.+" is not defined in object type' -ignore 'object type "{}" cannot be filtered by object filtering `.*` since it has no object element'
      - name: Observe build status
        if: always()
        continue-on-error: true
        uses: ./.github/actions/observe-build-status
        with:
          build_status: ${{ job.status }}
          secret_vault_address: ${{ secrets.VAULT_ADDR }}
          secret_vault_roleId: ${{ secrets.VAULT_ROLE_ID }}
          secret_vault_secretId: ${{ secrets.VAULT_SECRET_ID }}

  maven-spotless-linter:
    if: needs.detect-changes.outputs.maven-spotless-linter == 'true'
    needs: [detect-changes]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-build
        with:
          maven-cache-key-modifier: maven-spotless-linter
          vault-address: ${{ secrets.VAULT_ADDR }}
          vault-role-id: ${{ secrets.VAULT_ROLE_ID }}
          vault-secret-id: ${{ secrets.VAULT_SECRET_ID }}
      - run: ./mvnw spotless:check
      - name: Observe build status
        if: always()
        continue-on-error: true
        uses: ./.github/actions/observe-build-status
        with:
          build_status: ${{ job.status }}
          secret_vault_address: ${{ secrets.VAULT_ADDR }}
          secret_vault_roleId: ${{ secrets.VAULT_ROLE_ID }}
          secret_vault_secretId: ${{ secrets.VAULT_SECRET_ID }}

  java-checks:
    if: needs.detect-changes.outputs.java-code-changes == 'true'
    needs: [detect-changes]
    name: Java checks
    timeout-minutes: 15
    runs-on: gcp-perf-core-8-default
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-build
        with:
          maven-cache-key-modifier: java-checks
          vault-address: ${{ secrets.VAULT_ADDR }}
          vault-role-id: ${{ secrets.VAULT_ROLE_ID }}
          vault-secret-id: ${{ secrets.VAULT_SECRET_ID }}
      # Not running Maven Spotless here since it is checked in a dedicated job
      - run: ./mvnw -T1C -B -D skipTests -Dspotless.check.skip=true -D skipOptimize -P !autoFormat,checkFormat,spotbugs,skipFrontendBuild verify
      - name: Observe build status
        if: always()
        continue-on-error: true
        uses: ./.github/actions/observe-build-status
        with:
          build_status: ${{ job.status }}
          secret_vault_secretId: ${{ secrets.VAULT_SECRET_ID }}
          secret_vault_address: ${{ secrets.VAULT_ADDR }}
          secret_vault_roleId: ${{ secrets.VAULT_ROLE_ID }}

  build-platform-frontend:
    if: needs.detect-changes.outputs.frontend-changes == 'true'
    needs: [detect-changes]
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/build-frontend
        id: build-operate-fe
        with:
          directory: ./operate/client
      - uses: ./.github/actions/build-frontend
        id: build-tasklist-fe
        with:
          directory: ./tasklist/client
      - uses: ./.github/actions/build-frontend
        id: build-identity-fe
        with:
          directory: ./identity/client
      - uses: ./.github/actions/build-frontend
        id: build-optimize-fe
        with:
          directory: ./optimize/client
      - name: Observe build status
        if: always()
        continue-on-error: true
        uses: ./.github/actions/observe-build-status
        with:
          build_status: ${{ job.status }}
          secret_vault_secretId: ${{ secrets.VAULT_SECRET_ID }}
          secret_vault_address: ${{ secrets.VAULT_ADDR }}
          secret_vault_roleId: ${{ secrets.VAULT_ROLE_ID }}

  java-unit-tests:
    if: needs.detect-changes.outputs.java-code-changes == 'true'
    needs: [detect-changes]
    runs-on: gcp-perf-core-16-default
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-build
        with:
          vault-address: ${{ secrets.VAULT_ADDR }}
          vault-role-id: ${{ secrets.VAULT_ROLE_ID }}
          vault-secret-id: ${{ secrets.VAULT_SECRET_ID }}
      - uses: ./.github/actions/build-zeebe
        with:
          maven-extra-args: -T1C -PskipFrontendBuild -D skipOptimize
      - name: Create build output log file
        run: echo "BUILD_OUTPUT_FILE_PATH=$(mktemp)" >> $GITHUB_ENV
      - name: Maven Test Build
        # we use the verify goal here as flaky test extraction is bound to the post-integration-test
        # phase of Maven https://maven.apache.org/guides/introduction/introduction-to-the-lifecycle.html#default-lifecycle
        run: >
          ./mvnw -T2 -B --no-snapshot-updates
          -D skipITs -D skipQaBuild=true -D skipChecks -D surefire.rerunFailingTestsCount=3
          -D junitThreadCount=16
          -D skipOptimize
          -P skip-random-tests,parallel-tests,extract-flaky-tests,skipFrontendBuild
          verify
          | tee "${BUILD_OUTPUT_FILE_PATH}"
      - name: Analyze Test Runs
        id: analyze-test-run
        if: always()
        uses: ./.github/actions/analyze-test-runs
        with:
          buildOutputFilePath: ${{ env.BUILD_OUTPUT_FILE_PATH }}
      - name: Upload test artifacts
        uses: ./.github/actions/collect-test-artifacts
        if: ${{ failure() || cancelled() || steps.analyze-test-run.outputs.flakyTests != '' }}
        with:
          name: "unit tests"
      - name: Observe build status
        if: always()
        continue-on-error: true
        uses: ./.github/actions/observe-build-status
        with:
          build_status: ${{ job.status }}
          user_reason: ${{ (steps.analyze-test-run.outputs.flakyTests != '') && 'flaky-tests' || '' }}
          user_description: ${{ steps.analyze-test-run.outputs.flakyTests }}
          secret_vault_secretId: ${{ secrets.VAULT_SECRET_ID }}
          secret_vault_address: ${{ secrets.VAULT_ADDR }}
          secret_vault_roleId: ${{ secrets.VAULT_ROLE_ID }}

  integration-tests:
    if: needs.detect-changes.outputs.java-code-changes == 'true'
    name: "[IT] ${{ matrix.name }}"
    needs: [ detect-changes ]
    timeout-minutes: 25
    runs-on: ${{ matrix.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        group: [ root, modules, qa-integration, qa-update ]
        include:
          - group: root
            name: "Root Integration Tests"
            maven-modules: "'qa/integration-tests'"
            maven-build-threads: 2
            maven-test-fork-count: 7
            runs-on: gcp-perf-core-8-default
          - group: modules
            name: "Zeebe Module Integration Tests"
            maven-modules: "'!qa/integration-tests,!qa/update-tests' -f zeebe"
            maven-build-threads: 2
            maven-test-fork-count: 7
            runs-on: gcp-perf-core-8-longrunning
          - group: qa-integration
            name: "Zeebe QA - Integration Tests"
            maven-modules: "zeebe/qa/integration-tests"
            maven-build-threads: 1
            maven-test-fork-count: 10
            runs-on: gcp-perf-core-16-default
          - group: qa-migration-integration
            name: "Migration QA - Integration Tests"
            maven-modules: "migration/process-migration"
            maven-build-threads: 1
            maven-test-fork-count: 10
            runs-on: gcp-perf-core-8-default
          - group: qa-update
            name: "Zeebe QA - Update Tests"
            maven-modules: "zeebe/qa/update-tests"
            maven-build-threads: 1
            maven-test-fork-count: 10
            runs-on: gcp-perf-core-8-default
    env:
      ZEEBE_TEST_DOCKER_IMAGE: localhost:5000/camunda/zeebe:current-test
    services:
      registry:
        image: registry:2
        ports:
          - 5000:5000
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-build
        with:
          maven-cache-key-modifier: it-${{ matrix.group }}
          vault-address: ${{ secrets.VAULT_ADDR }}
          vault-role-id: ${{ secrets.VAULT_ROLE_ID }}
          vault-secret-id: ${{ secrets.VAULT_SECRET_ID }}
      - uses: ./.github/actions/build-zeebe
        id: build-zeebe
        with:
          maven-extra-args: -T1C -PskipFrontendBuild -D skipOptimize
      - uses: ./.github/actions/build-platform-docker
        with:
          repository: localhost:5000/camunda/zeebe
          version: current-test
          push: true
          distball: ${{ steps.build-zeebe.outputs.distball }}
      - name: Create build output log file
        run: echo "BUILD_OUTPUT_FILE_PATH=$(mktemp)" >> $GITHUB_ENV
      - name: Maven Test Build
        run: >
          ./mvnw -B -T ${{ matrix.maven-build-threads }} --no-snapshot-updates
          -D forkCount=${{ matrix.maven-test-fork-count }}
          -D maven.javadoc.skip=true
          -D skipUTs -D skipChecks -D skipOptimize
          -D failsafe.rerunFailingTestsCount=3 -D flaky.test.reportDir=failsafe-reports
          -P parallel-tests,extract-flaky-tests,skipFrontendBuild
          -pl ${{ matrix.maven-modules }}
          verify
          | tee "${BUILD_OUTPUT_FILE_PATH}"
      - name: Analyze Test Runs
        id: analyze-test-run
        if: always()
        uses: ./.github/actions/analyze-test-runs
        with:
          buildOutputFilePath: ${{ env.BUILD_OUTPUT_FILE_PATH }}
      - name: Upload test artifacts
        uses: ./.github/actions/collect-test-artifacts
        if: ${{ failure() || cancelled() || steps.analyze-test-run.outputs.flakyTests != '' }}
        with:
          name: "[IT] ${{ matrix.name }}"
      - name: Observe build status
        if: always()
        continue-on-error: true
        uses: ./.github/actions/observe-build-status
        with:
          job_name: "integration-tests/${{ matrix.group }}"
          build_status: ${{ job.status }}
          user_reason: ${{ (steps.analyze-test-run.outputs.flakyTests != '') && 'flaky-tests' || '' }}
          user_description: ${{ steps.analyze-test-run.outputs.flakyTests }}
          secret_vault_secretId: ${{ secrets.VAULT_SECRET_ID }}
          secret_vault_address: ${{ secrets.VAULT_ADDR }}
          secret_vault_roleId: ${{ secrets.VAULT_ROLE_ID }}

  docker-checks:
    if: needs.detect-changes.outputs.camunda-docker-tests == 'true'
    name: Camunda docker tests
    needs: [ detect-changes ]
    runs-on: ubuntu-latest
    timeout-minutes: 20
    services:
      # local registry is used as this job needs to push as it builds multi-platform images
      registry:
        image: registry:2
        ports:
          - 5000:5000
    env:
      LOCAL_DOCKER_IMAGE: localhost:5000/camunda/camunda
      TEST_ELASTICSEARCH_IMAGE: docker.elastic.co/elasticsearch/elasticsearch:8.14.1
    steps:
      - uses: actions/checkout@v4
      - uses: hadolint/hadolint-action@v3.1.0
        with:
          config: ./.hadolint.yaml
          dockerfile: ./camunda.Dockerfile
          format: sarif
          output-file: ./hadolint.sarif
          no-color: true
          verbose: true
      - name: Upload Hadolint Results
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ./hadolint.sarif
      - uses: ./.github/actions/setup-build
        with:
          dockerhub-readonly: true
          vault-address: ${{ secrets.VAULT_ADDR }}
          vault-role-id: ${{ secrets.VAULT_ROLE_ID }}
          vault-secret-id: ${{ secrets.VAULT_SECRET_ID }}
      - uses: ./.github/actions/build-zeebe
        id: build-camunda
        with:
          maven-extra-args: -PskipFrontendBuild -D skipOptimize
      - uses: ./.github/actions/build-platform-docker
        id: build-camunda-docker
        with:
          # we use a local registry for pushing
          repository: ${{ env.LOCAL_DOCKER_IMAGE }}
          distball: ${{ steps.build-camunda.outputs.distball }}
          platforms: ${{ env.DOCKER_PLATFORMS }}
          dockerfile: camunda.Dockerfile
          # push is needed for multi-arch images as buildkit does not support loading them locally
          push: true

      # We need to free up some space to let the step after this block succeed.
      # With this cleanup, at the time of measuring, we go from a 100% disk usage (73/74 GB) to a
      # 94% (68/73 GB), on the runner ubuntu-latest. This allows the workflow to go through.
      - name: Cleanup docker images
        run: docker system prune -af

      - name: Verify Docker image
        uses: ./.github/actions/verify-platform-docker
        with:
          imageName: ${{ env.LOCAL_DOCKER_IMAGE }}
          date: ${{ steps.build-camunda-docker.outputs.date }}
          revision: ${{ github.sha }}
          version: ${{ steps.build-camunda-docker.outputs.version }}
          platforms: ${{ env.DOCKER_PLATFORMS }}
          goldenfile: camunda-docker-labels.golden.json
      - name: Run Docker tests
        run: |
          ./mvnw -f dist --no-snapshot-updates -DskipChecks -DskipOptimize -Dtest=CamundaDockerIT -Dsurefire.rerunFailingTestsCount=3 \
          -Dcamunda.docker.test.enabled=true \
          -Dcamunda.docker.test.image="${{ env.LOCAL_DOCKER_IMAGE }}:${{ steps.build-camunda-docker.outputs.version }}" \
          -Dcamunda.docker.test.elasticsearch.image="${{ env.TEST_ELASTICSEARCH_IMAGE }}" \
          test
      - name: Observe build status
        if: always()
        continue-on-error: true
        uses: ./.github/actions/observe-build-status
        with:
          build_status: ${{ job.status }}
          secret_vault_secretId: ${{ secrets.VAULT_SECRET_ID }}
          secret_vault_address: ${{ secrets.VAULT_ADDR }}
          secret_vault_roleId: ${{ secrets.VAULT_ROLE_ID }}

  identity-frontend-tests:
    if: needs.detect-changes.outputs.identity-frontend-tests == 'true'
    needs: [detect-changes]
    runs-on: ubuntu-latest
    timeout-minutes: 5
    defaults:
      run:
        working-directory: identity/client
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'yarn'
          cache-dependency-path: identity/client/yarn.lock
      - name: Install dependencies
        run: yarn install --frozen-lockfile
      - name: Check formatting
        run: yarn test:format
      - name: Lint code
        run: yarn test:lint
      - name: Unit & Integration tests
        run: yarn test:unit
      - name: Check licenses
        run: yarn test:licenses
      - name: Build frontend
        run: yarn build
      - name: Observe build status
        if: always()
        continue-on-error: true
        uses: ./.github/actions/observe-build-status
        with:
          build_status: ${{ job.status }}
          secret_vault_address: ${{ secrets.VAULT_ADDR }}
          secret_vault_roleId: ${{ secrets.VAULT_ROLE_ID }}
          secret_vault_secretId: ${{ secrets.VAULT_SECRET_ID }}

  zeebe-ci:
    if: needs.detect-changes.outputs.zeebe-changes == 'true'
    needs: [detect-changes]
    uses: ./.github/workflows/zeebe-ci.yml
    secrets: inherit

  build-operate-backend:
    if: needs.detect-changes.outputs.operate-backend-changes == 'true'
    needs: [detect-changes]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - uses: ./.github/actions/setup-build
        name: Build setup
        with:
          java-distribution: adopt
          maven-cache-key-modifier: operate
          maven-version: 3.8.6
          vault-address: ${{ secrets.VAULT_ADDR }}
          vault-role-id: ${{ secrets.VAULT_ROLE_ID }}
          vault-secret-id: ${{ secrets.VAULT_SECRET_ID }}
      - name: Build Maven
        run: |
          ./mvnw clean deploy -B -T1C -P -docker,skipFrontendBuild -DskipTests -D skipOptimize -DskipChecks -DaltStagingDirectory=${{ github.workspace }}/staging-${{ env.BRANCH_NAME }} -DskipRemoteStaging=true -Dmaven.deploy.skip=true
      # Build the docker image to verify the built artifacts and the Dockerfile
      # It does NOT push the image to the registry
      - name: Build Docker image
        uses: ./.github/actions/build-platform-docker
        with:
          dockerfile: operate.Dockerfile
          repository: 'registry.camunda.cloud/team-operate/camunda-operate'
      - name: Observe build status
        if: always()
        continue-on-error: true
        uses: ./.github/actions/observe-build-status
        with:
          build_status: ${{ job.status }}
          secret_vault_secretId: ${{ secrets.VAULT_SECRET_ID }}
          secret_vault_address: ${{ secrets.VAULT_ADDR }}
          secret_vault_roleId: ${{ secrets.VAULT_ROLE_ID }}

  build-tasklist-backend:
    if: needs.detect-changes.outputs.tasklist-backend-changes == 'true'
    needs: [detect-changes]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - uses: ./.github/actions/setup-build
        name: Build setup
        with:
          java-distribution: adopt
          maven-cache-key-modifier: tasklist
          maven-version: 3.8.6
          vault-address: ${{ secrets.VAULT_ADDR }}
          vault-role-id: ${{ secrets.VAULT_ROLE_ID }}
          vault-secret-id: ${{ secrets.VAULT_SECRET_ID }}
      - name: Build Maven
        run: |
          ./mvnw clean deploy -B -T1C -PskipFrontendBuild -DskipTests -DskipOptimize -DskipChecks -DaltStagingDirectory=${{ github.workspace }}/staging-${{ env.BRANCH_NAME }} -DskipRemoteStaging=true -Dmaven.deploy.skip=true
      # Build the docker image to verify the built artifacts and the Dockerfile
      # It does NOT push the image to the registry
      - name: Build Docker image
        uses: ./.github/actions/build-platform-docker
        with:
          dockerfile: tasklist.Dockerfile
          repository: 'registry.camunda.cloud/team-hto/tasklist'
      - name: Observe build status
        if: always()
        continue-on-error: true
        uses: ./.github/actions/observe-build-status
        with:
          build_status: ${{ job.status }}
          secret_vault_secretId: ${{ secrets.VAULT_SECRET_ID }}
          secret_vault_address: ${{ secrets.VAULT_ADDR }}
          secret_vault_roleId: ${{ secrets.VAULT_ROLE_ID }}

  optimize-frontend-unit-tests:
    if: needs.detect-changes.outputs.optimize-frontend-changes == 'true'
    needs: [detect-changes]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    defaults:
      run:
        working-directory: optimize/client
    env:
      LIMITS_CPU: 4
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - name: "Parse pom.xml for versions"
        id: "pom_info"
        uses: YunaBraska/java-info-action@main
        with:
          work-dir: ./optimize
      - name: Set Node.js
        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
        with:
          node-version: ${{ steps.pom_info.outputs.x_version_node }}
          cache: yarn
          cache-dependency-path: optimize/client/yarn.lock
      - name: Install dependencies
        run: yarn install --frozen-lockfile
      - name: Unit tests
        run: yarn test:ci
      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
        with:
          name: optimize-unit-tests-frontend-junit
          path: |
            **/jest-test-results.xml
          retention-days: 7
          if-no-files-found: ignore
      - name: Observe build status
        if: always()
        continue-on-error: true
        uses: ./.github/actions/observe-build-status
        with:
          build_status: ${{ job.status }}
          secret_vault_secretId: ${{ secrets.VAULT_SECRET_ID }}
          secret_vault_address: ${{ secrets.VAULT_ADDR }}
          secret_vault_roleId: ${{ secrets.VAULT_ROLE_ID }}

  optimize-backend-unit-tests:
    if: needs.detect-changes.outputs.optimize-backend-changes == 'true'
    needs: [detect-changes]
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      LIMITS_CPU: 4
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - name: Setup Maven
        uses: ./.github/actions/setup-build
        with:
          maven-cache-key-modifier: optimize-tests
          maven-version: 3.8.6
          time-zone: Europe/Berlin
          vault-address: ${{ secrets.VAULT_ADDR }}
          vault-role-id: ${{ secrets.VAULT_ROLE_ID }}
          vault-secret-id: ${{ secrets.VAULT_SECRET_ID }}
      - name: Test
        uses: ./.github/actions/run-maven
        with:
          parameters: -f optimize/pom.xml test -Dskip.fe.build -Dskip.docker
          threads: .5C
      - name: Upload Test Results
        if: always()
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
        with:
          name: optimize-unit-tests-backend-junit
          path: |
            **/surefire-reports/**/*.xml
          retention-days: 7
          if-no-files-found: ignore
      - name: Observe build status
        if: always()
        continue-on-error: true
        uses: ./.github/actions/observe-build-status
        with:
          build_status: ${{ job.status }}
          secret_vault_secretId: ${{ secrets.VAULT_SECRET_ID }}
          secret_vault_address: ${{ secrets.VAULT_ADDR }}
          secret_vault_roleId: ${{ secrets.VAULT_ROLE_ID }}

  protobuf-checks:
    name: "Protobuf Backwards Compatibility"
    timeout-minutes: 10
    needs: [detect-changes]
    runs-on: ubuntu-latest
    env:
      # set the comparison based on the type of workflow trigger:
      #   - for PRs, we use the last commit of the base
      #   - for merge queues, we use the last commit of the target merge queue
      #   - for a push, we use the last commit before the push
      BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || github.event.before }}
    if: |
      needs.detect-changes.outputs.protobuf-changes == 'true'
    steps:
      - uses: actions/checkout@v4
      - id: pr-body
        name: Fetch latest PR body
        if: github.event_name == 'pull_request'
        run: |
          {
            echo 'result<<EOF'
            gh pr view ${{ github.event.pull_request.number }} --json body | jq '.body'
            echo EOF
          } >> "$GITHUB_OUTPUT"
        env:
          GH_TOKEN: ${{ github.token }}
        # by the default the action will compare against the base branch, or if on push, against the
        # previous commit
      - uses: bufbuild/buf-action@v1
        if: |
          !(contains(steps.pr-body.outputs.result, 'BREAKING CHANGE:') ||
            contains(github.event.merge_group.head_commit.message, 'BREAKING CHANGE:') ||
            contains(github.event.push.commits.*.message, 'BREAKING CHANGE:'))
        with:
          format: false
          lint: false
          push: false
          archive: false
          breaking: true
          breaking_against: '${{ github.event.repository.clone_url }}#format=git,commit=${{ env.BASE_SHA }}'
      - name: Observe build status
        if: always()
        continue-on-error: true
        uses: ./.github/actions/observe-build-status
        with:
          build_status: ${{ job.status }}
          secret_vault_secretId: ${{ secrets.VAULT_SECRET_ID }}
          secret_vault_address: ${{ secrets.VAULT_ADDR }}
          secret_vault_roleId: ${{ secrets.VAULT_ROLE_ID }}

  openapi-lint:
    name: C8 REST OpenAPI linting
    timeout-minutes: 2
    needs: [detect-changes]
    runs-on: ubuntu-latest
    if: |
      needs.detect-changes.outputs.openapi-changes == 'true'
    steps:
      - uses: actions/checkout@v4
      - name: Install Vacuum
        run: curl -fsSL https://quobix.com/scripts/install_vacuum.sh | sh > /dev/null
        shell: bash
      - name: Run OpenAPI Linter
        run: vacuum lint zeebe/gateway-protocol/src/main/proto/rest-api.yaml -r .github/vacuum-ruleset.yaml -d -e
        shell: bash
      - name: Observe build status
        if: always()
        continue-on-error: true
        uses: ./.github/actions/observe-build-status
        with:
          build_status: ${{ job.status }}
          secret_vault_secretId: ${{ secrets.VAULT_SECRET_ID }}
          secret_vault_address: ${{ secrets.VAULT_ADDR }}
          secret_vault_roleId: ${{ secrets.VAULT_ROLE_ID }}

  check-results:
    # Used by the merge queue to check all tests, including the unit test matrix.
    # New test jobs must be added to the `needs` lists!
    # This name is hard-coded in the branch rules; remember to update that if this name changes
    if: always()
    runs-on: ubuntu-latest
    needs:
      - actionlint
      - build-operate-backend
      - build-platform-frontend
      - build-tasklist-backend
      - docker-checks
      - identity-frontend-tests
      - integration-tests
      - java-checks
      - java-unit-tests
      - maven-spotless-linter
      - openapi-lint
      - optimize-backend-unit-tests
      - optimize-frontend-unit-tests
      - protobuf-checks
      - zeebe-ci
    steps:
      - uses: actions/checkout@v4
      - name: Check for aborted jobs
        continue-on-error: true
        uses: ./.github/actions/observe-aborted-jobs
        with:
          secret_vault_secretId: ${{ secrets.VAULT_SECRET_ID }}
          secret_vault_address: ${{ secrets.VAULT_ADDR }}
          secret_vault_roleId: ${{ secrets.VAULT_ROLE_ID }}
      - run: exit ${{ ((contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'failure')) && 1) || 0 }}

  deploy-snapshots:
    name: Deploy snapshot artifacts
    needs: [ check-results ]
    runs-on: ubuntu-latest
    if: github.repository == 'camunda/camunda' && github.ref == 'refs/heads/main'
    concurrency:
      group: deploy-maven-snapshot
      cancel-in-progress: false
    steps:
      - uses: actions/checkout@v4
      - name: Import Secrets
        id: secrets
        uses: hashicorp/vault-action@v3.0.0
        with:
          url: ${{ secrets.VAULT_ADDR }}
          method: approle
          roleId: ${{ secrets.VAULT_ROLE_ID }}
          secretId: ${{ secrets.VAULT_SECRET_ID }}
          secrets: |
            secret/data/products/zeebe/ci/zeebe ARTIFACTS_USR;
            secret/data/products/zeebe/ci/zeebe ARTIFACTS_PSW;
      - uses: actions/setup-java@v4.5.0
        with:
          distribution: 'temurin'
          java-version: '21'
      # Use CI Nexus as co-located pull-through cache for Maven artifacts via ~/.m2/settings.xml
      - name: 'Create settings.xml'
        uses: s4u/maven-settings-action@v3.1.0
        with:
          githubServer: false
          servers: |
            [{
              "id": "camunda-nexus",
              "username": "${{ steps.secrets.outputs.ARTIFACTS_USR }}",
              "password": "${{ steps.secrets.outputs.ARTIFACTS_PSW }}"
            }]
          mirrors: '[{"url": "https://repository.nexus.camunda.cloud/content/groups/internal/", "id": "camunda-nexus", "mirrorOf": "zeebe,zeebe-snapshots", "name": "camunda Nexus"}]'
      - name: Configure Maven
        uses: ./.github/actions/setup-maven-cache
        with:
          maven-cache-key-modifier: snapshots
      - uses: ./.github/actions/build-frontend
        id: build-operate-fe
        with:
          directory: ./operate/client
      - uses: ./.github/actions/build-frontend
        id: build-tasklist-fe
        with:
          directory: ./tasklist/client
      - uses: ./.github/actions/build-frontend
        id: build-identity-fe
        with:
          directory: ./identity/client
      # compile and generate-sources to ensure that the Javadoc can be properly generated; compile is
      # necessary when using annotation preprocessors for code generation, as otherwise the symbols are
      # not resolve-able by the Javadoc generator
      - run: ./mvnw -B -D skipTests -D skipChecks -PskipFrontendBuild compile generate-sources source:jar javadoc:jar deploy
        env:
          MAVEN_USERNAME: ${{ steps.secrets.outputs.ARTIFACTS_USR }}
          MAVEN_PASSWORD: ${{ steps.secrets.outputs.ARTIFACTS_PSW }}
      - name: Observe build status
        if: always()
        continue-on-error: true
        uses: ./.github/actions/observe-build-status
        with:
          build_status: ${{ job.status }}
          secret_vault_secretId: ${{ secrets.VAULT_SECRET_ID }}
          secret_vault_address: ${{ secrets.VAULT_ADDR }}
          secret_vault_roleId: ${{ secrets.VAULT_ROLE_ID }}

  deploy-camunda-docker-snapshot:
    name: Deploy snapshot Camunda Docker image
    needs: [ docker-checks, check-results ]
    runs-on: ubuntu-latest
    if: github.repository == 'camunda/camunda' && github.ref == 'refs/heads/main'
    concurrency:
      group: deploy-camunda-docker-snapshot
      cancel-in-progress: false
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-build
        with:
          dockerhub: true
          vault-address: ${{ secrets.VAULT_ADDR }}
          vault-role-id: ${{ secrets.VAULT_ROLE_ID }}
          vault-secret-id: ${{ secrets.VAULT_SECRET_ID }}
      - uses: ./.github/actions/build-frontend
        id: build-operate-fe
        with:
          directory: ./operate/client
      - uses: ./.github/actions/build-frontend
        id: build-tasklist-fe
        with:
          directory: ./tasklist/client
      - uses: ./.github/actions/build-frontend
        id: build-identity-fe
        with:
          directory: ./identity/client
      - uses: ./.github/actions/build-zeebe
        id: build-camunda
        with:
          maven-extra-args: -PskipFrontendBuild
      - uses: ./.github/actions/build-platform-docker
        id: build-camunda-docker
        with:
          repository: camunda/camunda
          version: SNAPSHOT
          distball: ${{ steps.build-camunda.outputs.distball }}
          platforms: ${{ env.DOCKER_PLATFORMS }}
          dockerfile: camunda.Dockerfile
          push: true
      - name: Observe build status
        if: always()
        continue-on-error: true
        uses: ./.github/actions/observe-build-status
        with:
          build_status: ${{ job.status }}
          secret_vault_secretId: ${{ secrets.VAULT_SECRET_ID }}
          secret_vault_address: ${{ secrets.VAULT_ADDR }}
          secret_vault_roleId: ${{ secrets.VAULT_ROLE_ID }}