.github/workflows/ci-complete.yml

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: CI Complete

on:
  workflow_run:
    workflows: [CI]
    types:
      - completed

run-name: Build Scans for ${{ github.event.workflow_run.display_title}}

# This workflow runs after the completion of the CI workflow triggered on a "pull_request" event.
# The "pull_request" event type is run in an unprivileged context without access to the repository
# secrets. This means that PRs from public forks cannot publish Gradle Build Scans or modify the
# PR contents.
#
# This "workflow_run" triggered workflow is run in a privileged context and so does have access to
# the repository secrets. Here we can download the build scan files produced by a PR and publish
# them to develocity.apache.org.
#
# The CI workflow itself runs according to the branch of the PR or push event. However, this
# ci-complete workflow always runs using the trunk branch, regardless of the source branch of the
# CI workflow.
#
# If we need to do things like comment on, label, or otherwise modify PRs from public forks. This
# workflow is the place to do it. PR number is ${{ github.event.workflow_run.pull_requests[0].number }}

jobs:
  get-build-scan-names:
    if: (github.event.workflow_run.conclusion == 'success' || github.event.workflow_run.conclusion == 'failure')
    runs-on: ubuntu-latest
    outputs:
      build-scan-names: ${{ steps.build-scan-names.outputs.build-scan-names }}
    steps:
      - name: List buildscan artifacts
        id: build-scan-names
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RUN_ID: ${{ github.event.workflow_run.id }}
        run: |
          names=$(gh api \
            -H "Accept: application/vnd.github+json" \
            /repos/${{ github.repository }}/actions/runs/$RUN_ID/artifacts \
            --jq '[.artifacts[] | select(.name | startswith("build-scan-")) | .name]')
          echo "Found: $names"

          echo "build-scan-names=$names" >> $GITHUB_OUTPUT

  upload-build-scan:
    needs: get-build-scan-names
    # Skip this workflow if the CI run was skipped or cancelled
    if: (github.event.workflow_run.conclusion == 'success' || github.event.workflow_run.conclusion == 'failure')
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        build-scan-name: ${{ fromJson(needs.get-build-scan-names.outputs.build-scan-names) }}
    steps:
      - name: Setup build scan info
        run: |
          BUILD_SCAN_NAME="${{ matrix.build-scan-name }}"
          JAVA=$(echo "$BUILD_SCAN_NAME" | grep -oE '[0-9]+')
          STATUS_CONTEXT="Java $JAVA"
          [[ "$BUILD_SCAN_NAME" == *"-flaky"* ]] && STATUS_CONTEXT="$STATUS_CONTEXT / Flaky"
          [[ "$BUILD_SCAN_NAME" == *"-new"* ]] && STATUS_CONTEXT="$STATUS_CONTEXT / New"

          echo "JAVA=$JAVA" >> $GITHUB_ENV
          echo "STATUS_CONTEXT=$STATUS_CONTEXT" >> $GITHUB_ENV
      - name: Env
        run: printenv
        env:
          GITHUB_CONTEXT: ${{ toJson(github) }}
      - name: Checkout code
        uses: actions/checkout@v5
        with:
          persist-credentials:
            false
      - name: Setup Gradle
        uses: ./.github/actions/setup-gradle
        with:
          java-version: ${{ env.JAVA }}
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
      - name: Download build scan archive
        id: download-build-scan
        uses: actions/download-artifact@v5
        continue-on-error: true  # Don't want this step to fail the overall workflow
        with:
          github-token: ${{ github.token }}
          run-id: ${{ github.event.workflow_run.id }}
          name: ${{ matrix.build-scan-name }}
          path: ~/.gradle/build-scan-data  # This is where Gradle buffers unpublished build scan data when --no-scan is given
      - name: Handle missing scan
        if: ${{ steps.download-build-scan.outcome == 'failure' }}
        uses: ./.github/actions/gh-api-update-status
        with:
          gh-token: ${{ secrets.GITHUB_TOKEN }}
          repository: ${{ github.repository }}
          commit_sha: ${{ github.event.workflow_run.head_sha }}
          url: '${{ github.event.workflow_run.html_url }}'
          description: 'Could not find build scan'
          context: Gradle Build Scan / ${{ env.STATUS_CONTEXT }}
          state: 'error'
      - name: Publish Scan
        id: publish-build-scan
        if: ${{ steps.download-build-scan.outcome == 'success' }}
        run: |
          set +e
          ./gradlew --info buildScanPublishPrevious > gradle.out
          exitcode="$?"
          if [ $exitcode -ne 0 ]; then
            cat gradle.out
            echo "Failed to publish build scan" >> $GITHUB_STEP_SUMMARY
            exit $exitcode
          else
            SCAN_URL=$(grep '^https://.*$' gradle.out)
            cat gradle.out
            echo "Published build scan to $SCAN_URL" >> $GITHUB_STEP_SUMMARY
            echo "build-scan-url=$SCAN_URL" >> $GITHUB_OUTPUT
          fi
      - name: Handle failed publish
        if: ${{ failure() && steps.publish-build-scan.outcome == 'failure' }}
        uses: ./.github/actions/gh-api-update-status
        with:
          gh-token: ${{ secrets.GITHUB_TOKEN }}
          repository: ${{ github.repository }}
          commit_sha: ${{ github.event.workflow_run.head_sha }}
          url: '${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }}'
          description: 'The build scan failed to be published'
          context: Gradle Build Scan / ${{ env.STATUS_CONTEXT }}
          state: 'error'
      - name: Update Status Check
        if: ${{ steps.publish-build-scan.outcome == 'success' }}
        uses: ./.github/actions/gh-api-update-status
        with:
          gh-token: ${{ secrets.GITHUB_TOKEN }}
          repository: ${{ github.repository }}
          commit_sha: ${{ github.event.workflow_run.head_sha }}
          url: ${{ steps.publish-build-scan.outputs.build-scan-url }}
          description: 'The build scan was successfully published'
          context: Gradle Build Scan / ${{ env.STATUS_CONTEXT }}
          state: 'success'