backend-checks.yml

on:
  workflow_call:
    secrets:
      SLACK_WEBHOOK_URL:
        required: false
      SONAR_TOKEN:
        required: true
      GH_PACKAGES_REPOSITORY_USER:
        required: true
      GH_PACKAGES_REPOSITORY_TOKEN:
        required: true
jobs:
  scan-backend-changes:
    runs-on: ubuntu-latest
    outputs:
      backend: ${{ steps.filter.outputs.backend }}
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            backend:
              - 'backend/**'

  backend-unit-tests:
    needs: scan-backend-changes
    if: ${{ needs.scan-backend-changes.outputs.backend == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Get Gradle version
        working-directory: ./backend
        run: |
          echo "GRADLE_VERSION=$(sed -n 's/.*gradle-\([0-9]*\(\.[0-9]*\)*\)-.*/\1/p' ./gradle/wrapper/gradle-wrapper.properties)" >> $GITHUB_ENV
      - name: Set up JDK
        uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b
        with:
          java-version: "21.0"
          distribution: "temurin"
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@7ba6b1c82014ba7e124420b8688ca6a4ddb25b7b
        with:
          gradle-version: ${{ env.GRADLE_VERSION}}
      - name: Run backend tests
        working-directory: ./backend
        env:
          GH_PACKAGES_REPOSITORY_USER: ${{ secrets.GH_PACKAGES_REPOSITORY_USER }}
          GH_PACKAGES_REPOSITORY_TOKEN: ${{ secrets.GH_PACKAGES_REPOSITORY_TOKEN }}
        run: ./gradlew test -x integrationTest
      - name: Send status to Slack
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: digitalservicebund/notify-on-failure-gha@814d0c4b2ad6a3443e89c991f8657b10126510bf # v1.5.0
        if: ${{ failure() && github.ref == 'refs/heads/main' }}
        with:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  backend-integration-tests:
    needs: scan-backend-changes
    if: ${{ needs.scan-backend-changes.outputs.backend == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Get Gradle version
        working-directory: ./backend
        run: |
          echo "GRADLE_VERSION=$(sed -n 's/.*gradle-\([0-9]*\(\.[0-9]*\)*\)-.*/\1/p' ./gradle/wrapper/gradle-wrapper.properties)" >> $GITHUB_ENV
      - name: Set up JDK
        uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b
        with:
          java-version: "21.0"
          distribution: "temurin"
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@7ba6b1c82014ba7e124420b8688ca6a4ddb25b7b
        with:
          gradle-version: ${{ env.GRADLE_VERSION }}
      - name: Run backend tests
        working-directory: ./backend
        run: ./gradlew integrationTest -x test
        env:
          GH_PACKAGES_REPOSITORY_USER: ${{ secrets.GH_PACKAGES_REPOSITORY_USER }}
          GH_PACKAGES_REPOSITORY_TOKEN: ${{ secrets.GH_PACKAGES_REPOSITORY_TOKEN }}
      - name: Send status to Slack
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: digitalservicebund/notify-on-failure-gha@814d0c4b2ad6a3443e89c991f8657b10126510bf # v1.5.0
        if: ${{ failure() && github.ref == 'refs/heads/main' }}
        with:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}


  analyze-backend:
    needs: scan-backend-changes
    if: ${{ needs.scan-backend-changes.outputs.backend == 'true' &&  github.ref == 'refs/heads/main'  }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
      - name: Set up JDK
        uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b
        with:
          java-version: "21.0"
          distribution: "temurin"
      - name: Cache SonarQube packages
        uses: actions/cache@v4
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@7ba6b1c82014ba7e124420b8688ca6a4ddb25b7b
        with:
          gradle-version: ${{ env.GRADLE_VERSION }}
      - name: Scan with SonarQube
        run: ./gradlew sonar --info
        working-directory: ./backend
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          GH_PACKAGES_REPOSITORY_USER: ${{ secrets.GH_PACKAGES_REPOSITORY_USER }}
          GH_PACKAGES_REPOSITORY_TOKEN: ${{ secrets.GH_PACKAGES_REPOSITORY_TOKEN }}
      - name: Check SonarQube Quality Gate
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: sonarsource/sonarqube-quality-gate-action@2a53a0f68edfd2b2230e2ad0754bc44785febf12
        with:
          scanMetadataReportFile: backend/build/sonar/report-task.txt
        timeout-minutes: 3 # Force to fail step after specific time
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
      - name: Send status to Slack
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: digitalservicebund/notify-on-failure-gha@814d0c4b2ad6a3443e89c991f8657b10126510bf # v1.5.0
        if: ${{ failure() }}
        with:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}