ci.yml

name: CI

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

# When a new revision is pushed to a PR, cancel all in-progress CI runs for that
# PR. See https://docs.github.com/en/actions/using-jobs/using-concurrency
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  checks: write

jobs:

  prepare-testsuite:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout OPA
      uses: actions/checkout@v4
      with:
        repository: open-policy-agent/opa
        ref: main
        # ref: v0.67.1
        path: opa
    - name: Prep OPA cases
      working-directory: opa
      run: WASM_BUILD_ONLY=true make wasm-rego-test
    - uses: actions/upload-artifact@v4
      with:
        name: testcases
        path: opa/.go/cache/testcases.tar.gz

  build:
    needs: prepare-testsuite
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        java-version: [11, 17, 21]
        opa-version:
        - 0.67.1 # latest

    steps:
    - uses: actions/checkout@v4

    - uses: actions/download-artifact@v4
      with:
        name: testcases

    - name: Set up Java
      uses: actions/setup-java@v4
      with:
        distribution: 'temurin'
        java-version: '${{ matrix.java-version }}'
        cache: maven

    - name: Install Open Policy Agent v${{ matrix.opa-version }}
      uses: open-policy-agent/setup-opa@v2
      with:
        version: ${{ matrix.opa-version }}

    - name: Test OPA-Chicory
      run: mvn -B spotless:apply clean install

    - name: Publish Test Report
      uses: mikepenz/action-junit-report@v5
      if: success() || failure() # always run even if the previous step fails
      with:
        report_paths: '**/target/surefire-reports/TEST-*.xml'