ci.yml

name: CI

on:
  push:
    branches:
      - main
      - next
  pull_request:
    branches:
      - main
      - next
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  lint:
    name: CI / lint
    runs-on: ${{ vars.SDK_GHA_RUNNER || 'ubuntu-24.04' }}
    timeout-minutes: 15

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Set up Java
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          distribution: temurin
          java-version: |
            8
            21

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2

      - name: Run lints
        run: ./scripts/lint

  build:
    name: CI / build + Jackson compatibility
    runs-on: ${{ vars.SDK_GHA_RUNNER || 'ubuntu-24.04' }}
    timeout-minutes: 30

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Set up Java
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          distribution: temurin
          java-version: |
            8
            21

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2

      - name: Build SDK and run compatibility tests
        env:
          GRADLE_OPTS: -Dkotlin.compiler.execution.strategy=in-process
        run: ./scripts/build

      - name: Collect exact-run Gradle build cache
        env:
          CACHE_ARTIFACT_PATH: ${{ runner.temp }}/ci-gradle-build-cache
          GRADLE_OPTS: -Dkotlin.compiler.execution.strategy=in-process
        run: ./scripts/collect-gradle-build-cache "$CACHE_ARTIFACT_PATH"

      # setup-gradle's cross-run cache is read-only on pull requests. Publish this run's local
      # build cache explicitly so downstream jobs can restore the exact compilation that passed.
      - name: Upload exact-run Gradle build cache
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ci-gradle-build-cache-${{ github.run_id }}
          path: ${{ runner.temp }}/ci-gradle-build-cache
          if-no-files-found: error
          retention-days: 1
          compression-level: 0
          overwrite: true

  test:
    name: CI / tests
    runs-on: ${{ vars.SDK_GHA_RUNNER || 'ubuntu-24.04' }}
    timeout-minutes: 30

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Set up Java
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          distribution: temurin
          java-version: |
            8
            21

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2

      - name: Run tests
        run: ./scripts/test

  api_compatibility:
    name: CI / API compatibility
    needs: build
    if: >-
      needs.build.result == 'success' &&
      github.event_name == 'pull_request'
    permissions:
      contents: read
      pull-requests: read
    runs-on: ${{ vars.SDK_GHA_RUNNER || 'ubuntu-24.04' }}
    timeout-minutes: 20

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Set up Java
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          distribution: temurin
          java-version: |
            8
            21

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
        with:
          cache-read-only: true

      - name: Restore exact-run Gradle build cache
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ci-gradle-build-cache-${{ github.run_id }}
          path: ~/.gradle/caches/build-cache-1

      - name: Compile previous tests against the proposed SDK
        env:
          BASE_COMMIT: ${{ github.event.pull_request.base.sha }}
          GRADLE_OPTS: -Dkotlin.compiler.execution.strategy=in-process
        run: |
          set -euo pipefail

          # The proposed detector verifies the current compatibility policy. Running the baseline
          # detector as well prevents a PR from weakening that policy to hide an SDK break.
          ./scripts/detect-breaking-changes "$BASE_COMMIT"

          BASE_DETECTOR="$(mktemp ./scripts/detect-breaking-changes.baseline.XXXXXX)"
          trap 'rm -f "$BASE_DETECTOR"' EXIT
          git show "${BASE_COMMIT}:scripts/detect-breaking-changes" > "$BASE_DETECTOR"
          chmod +x "$BASE_DETECTOR"
          "$BASE_DETECTOR" "$BASE_COMMIT"

  version_support_matrix:
    name: CI / version support matrix
    runs-on: ${{ vars.SDK_GHA_RUNNER || 'ubuntu-24.04' }}
    timeout-minutes: 5

    outputs:
      runtime-matrix: ${{ steps.matrix.outputs.runtime-matrix }}

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Set up Java
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          distribution: temurin
          java-version: 21

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2

      - name: Read version support policy
        id: matrix
        run: |
          ./scripts/gradle generateVersionSupportMatrix -PversionSupportMatrix=pull-request
          echo "runtime-matrix=$(< build/version-support-matrix.json)" >> "$GITHUB_OUTPUT"

  runtime_compatibility:
    name: CI / runtime compatibility / Java ${{ matrix.java }}
    needs:
      - build
      - version_support_matrix
    if: >-
      always() &&
      needs.version_support_matrix.result == 'success' &&
      needs.build.result == 'success'
    runs-on: ${{ vars.SDK_GHA_RUNNER || 'ubuntu-24.04' }}
    timeout-minutes: 20

    strategy:
      fail-fast: false
      matrix:
        java: ${{ fromJSON(needs.version_support_matrix.outputs.runtime-matrix) }}

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Set up consumer Java
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          distribution: temurin
          java-version: ${{ matrix.java }}

      - name: Set up build Java
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          distribution: temurin
          java-version: 21

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
        with:
          cache-read-only: ${{ needs.build.result == 'success' }}

      - name: Restore exact-run Gradle build cache
        if: needs.build.result == 'success'
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ci-gradle-build-cache-${{ github.run_id }}
          path: ~/.gradle/caches/build-cache-1

      - name: Run consumer compatibility smoke test
        env:
          RUNTIME_JAVA_VERSION: ${{ matrix.java }}
        run: >-
          ./scripts/gradle
          :openai-java-runtime-compatibility:runRuntimeCompatibility
          -PruntimeJavaVersion="$RUNTIME_JAVA_VERSION"

  required:
    name: CI / required
    if: always()
    needs:
      - lint
      - build
      - test
      - api_compatibility
      - runtime_compatibility
    runs-on: ${{ vars.SDK_GHA_RUNNER || 'ubuntu-24.04' }}
    timeout-minutes: 5

    steps:
      - name: Verify required jobs succeeded
        env:
          EVENT_NAME: ${{ github.event_name }}
          LINT_RESULT: ${{ needs.lint.result }}
          BUILD_RESULT: ${{ needs.build.result }}
          TEST_RESULT: ${{ needs.test.result }}
          API_COMPATIBILITY_RESULT: ${{ needs.api_compatibility.result }}
          RUNTIME_COMPATIBILITY_RESULT: ${{ needs.runtime_compatibility.result }}
        run: |
          set -euo pipefail

          failed_jobs=()
          [[ "$LINT_RESULT" == "success" ]] || failed_jobs+=("lint: $LINT_RESULT")
          [[ "$BUILD_RESULT" == "success" ]] || failed_jobs+=("build: $BUILD_RESULT")
          [[ "$TEST_RESULT" == "success" ]] || failed_jobs+=("test: $TEST_RESULT")

          if [[ "$EVENT_NAME" == "pull_request" &&
                "$API_COMPATIBILITY_RESULT" != "success" ]]; then
            failed_jobs+=("API compatibility: $API_COMPATIBILITY_RESULT")
          fi
          [[ "$RUNTIME_COMPATIBILITY_RESULT" == "success" ]] ||
            failed_jobs+=("runtime compatibility: $RUNTIME_COMPATIBILITY_RESULT")

          if (( ${#failed_jobs[@]} > 0 )); then
            printf 'Required CI job did not succeed: %s\n' "${failed_jobs[@]}"
            exit 1
          fi

          echo "All required CI jobs succeeded."