ci.yml

name: Continuous Integration
permissions:
  contents: read
on:
  pull_request:
  push:
    branches:
      - main

jobs:
  unit_test_edge:
    name: Unit test with in-memory test service [Edge]
    runs-on: ubuntu-latest-16-cores
    timeout-minutes: 30
    steps:
      - name: Checkout repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          submodules: recursive
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Set up Java
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          java-version: "23"
          distribution: "temurin"

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@ac396bf1a80af16236baf54bd7330ae21dc6ece5 # v6

      - name: Run unit tests (Java 23)
        env:
          USER: unittest
          USE_EXTERNAL_SERVICE: false
        run: ./gradlew --no-daemon test -x spotlessCheck -x spotlessApply -x spotlessJava -P edgeDepsTest -PtestJavaVersion=23

      - name: Run independent resource tuner test
        env:
          USER: unittest
          USE_EXTERNAL_SERVICE: false
        run: ./gradlew --no-daemon temporal-sdk:testResourceIndependent -x spotlessCheck -x spotlessApply -x spotlessJava -P edgeDepsTest -PtestJavaVersion=23

      - name: Run Spring Boot 3 compatibility tests
        env:
          USER: unittest
          USE_EXTERNAL_SERVICE: false
        run: ./gradlew --no-daemon :temporal-spring-boot-autoconfigure:test -x spotlessCheck -x spotlessApply -x spotlessJava -P edgeDepsTest -P springBoot3Test -PtestJavaVersion=23

      - name: Run Spring Boot 4 compatibility tests
        env:
          USER: unittest
          USE_EXTERNAL_SERVICE: false
        run: ./gradlew --no-daemon :temporal-spring-boot-autoconfigure:test -x spotlessCheck -x spotlessApply -x spotlessJava -P edgeDepsTest -P springBoot4Test -PtestJavaVersion=23

      - name: Publish Test Report
        uses: mikepenz/action-junit-report@bccf2e31636835cf0874589931c4116687171386 # v6
        if: success() || failure() # always run even if the previous step fails
        with:
          report_paths: "**/build/test-results/test/TEST-*.xml"

  unit_test_jdk8:
    name: Unit test with CLI
    runs-on: ubuntu-latest-16-cores
    timeout-minutes: 30
    steps:
      - name: Checkout repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          submodules: recursive
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Set up Java
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          java-version: |
            11
            23
          distribution: "temurin"

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@ac396bf1a80af16236baf54bd7330ae21dc6ece5 # v6

      - name: Prepare dev-server tests
        run: ./gradlew --no-daemon prepareDevServerTests

      # Can't actually run tests against Java 8 because Mockito 5 requires Java 11+.
      # We therefore have to rely on the fact that the code has been compiled with
      # `-release 8` which guarantees that the code is technically (bytecode + API
      # usage) compatible with Java 8.
      - name: Run unit tests (Java 11)
        env:
          USER: unittest
        run: ./gradlew --no-daemon --offline test -PtestJavaVersion=11 -PtestServer=dev-server

      - name: Run Jackson 3 converter tests (Java 17)
        env:
          USER: unittest
          USE_EXTERNAL_SERVICE: false
        run: ./gradlew --no-daemon :temporal-sdk:jackson3Tests -x spotlessCheck -x spotlessApply -x spotlessJava -PtestJavaVersion=17

      - name: Run virtual thread tests (Java 21)
        env:
          USER: unittest
        run: ./gradlew --no-daemon --offline :temporal-sdk:virtualThreadTests -PtestJavaVersion=21 -PtestServer=dev-server

      - name: Publish Test Report
        uses: mikepenz/action-junit-report@bccf2e31636835cf0874589931c4116687171386 # v6
        if: success() || failure() # always run even if the previous step fails
        with:
          report_paths: "**/build/test-results/test/TEST-*.xml"

  unit_test_cloud:
    name: Unit test with cloud
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - name: Checkout repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          submodules: recursive
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Set up Java
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          java-version: "23"
          distribution: "temurin"

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@ac396bf1a80af16236baf54bd7330ae21dc6ece5 # v6

      - name: Check Cloud test eligibility
        id: cloud-test-eligibility
        # Secrets are unavailable to Dependabot and pull requests from forks.
        if: ${{ github.actor != 'dependabot[bot]' && (github.event.pull_request.head.repo.full_name == '' || github.event.pull_request.head.repo.full_name == 'temporalio/sdk-java') }}
        env:
          TEMPORAL_CLIENT_CLOUD_API_KEY: ${{ secrets.TEMPORAL_CLIENT_CLOUD_API_KEY }}
        run: |
          if [[ -n "$TEMPORAL_CLIENT_CLOUD_API_KEY" ]]; then
            echo "enabled=true" >> "$GITHUB_OUTPUT"
          else
            echo "::notice title=Cloud tests skipped::TEMPORAL_CLIENT_CLOUD_API_KEY is unavailable"
          fi

      - name: Generate Cloud test certificates
        if: ${{ steps.cloud-test-eligibility.outputs.enabled == 'true' }}
        run: |
          cert_dir="$RUNNER_TEMP/cloud-test-certs"
          mkdir "$cert_dir"
          openssl req -x509 -newkey rsa:2048 -nodes -days 1 \
            -keyout "$cert_dir/ca.key" -out "$cert_dir/ca.pem" \
            -subj '/CN=Temporal Java SDK Cloud CI CA'
          openssl req -newkey rsa:2048 -nodes \
            -keyout "$cert_dir/client.key" -out "$cert_dir/client.csr" \
            -subj '/CN=Temporal Java SDK Cloud CI'
          openssl x509 -req -days 1 -in "$cert_dir/client.csr" \
            -CA "$cert_dir/ca.pem" -CAkey "$cert_dir/ca.key" -CAcreateserial \
            -out "$cert_dir/client.pem" -extfile <(printf 'extendedKeyUsage=clientAuth')
          {
            echo "TEMPORAL_CLOUD_CLIENT_CA_PATH=$cert_dir/ca.pem"
            echo "TEMPORAL_TLS_CLIENT_CERT_PATH=$cert_dir/client.pem"
            echo "TEMPORAL_TLS_CLIENT_KEY_PATH=$cert_dir/client.key"
          } >> "$GITHUB_ENV"

      - name: Create Cloud namespace
        id: create-cloud-namespace
        if: ${{ steps.cloud-test-eligibility.outputs.enabled == 'true' }}
        env:
          TEMPORAL_CLIENT_CLOUD_API_KEY: ${{ secrets.TEMPORAL_CLIENT_CLOUD_API_KEY }}
          TEMPORAL_CLIENT_CLOUD_API_VERSION: v0.19.1
        run: ./gradlew --no-daemon :temporal-sdk:createCloudTestNamespace

      - name: Run cloud test
        if: ${{ steps.cloud-test-eligibility.outputs.enabled == 'true' }}
        timeout-minutes: 15
        env:
          USER: unittest
          TEMPORAL_TEST_ENV_CONFIG_SERVER: "true"
          TEMPORAL_ADDRESS: ${{ steps.create-cloud-namespace.outputs.namespace }}.tmprl.cloud:7233
          TEMPORAL_NAMESPACE: ${{ steps.create-cloud-namespace.outputs.namespace }}
          TEMPORAL_CLIENT_CLOUD_NAMESPACE: ${{ steps.create-cloud-namespace.outputs.namespace }}
          TEMPORAL_CLIENT_CLOUD_API_KEY: ${{ secrets.TEMPORAL_CLIENT_CLOUD_API_KEY }}
          TEMPORAL_CLIENT_CLOUD_API_VERSION: v0.19.1
        run: |
          ./gradlew --no-daemon :temporal-sdk:test \
            --tests '*CloudOperationsClientTest' \
            --tests 'io.temporal.client.functional.SignalTest.signalCompletedWorkflow'

      - name: Delete Cloud namespace
        if: ${{ always() && steps.create-cloud-namespace.outputs.namespace != '' }}
        env:
          TEMPORAL_CLIENT_CLOUD_API_KEY: ${{ secrets.TEMPORAL_CLIENT_CLOUD_API_KEY }}
          TEMPORAL_CLIENT_CLOUD_API_VERSION: v0.19.1
          TEMPORAL_CLOUD_TEST_NAMESPACE: ${{ steps.create-cloud-namespace.outputs.namespace }}
        run: ./gradlew --no-daemon :temporal-sdk:deleteCloudTestNamespace

      - name: Publish Test Report
        uses: mikepenz/action-junit-report@bccf2e31636835cf0874589931c4116687171386 # v6
        if: success() || failure() # always run even if the previous step fails
        with:
          report_paths: "**/build/test-results/test/TEST-*.xml"

  code_format:
    name: Code format
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          submodules: recursive
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Set up Java
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          java-version: "23"
          distribution: "temurin"

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@ac396bf1a80af16236baf54bd7330ae21dc6ece5 # v6

      - name: Run copyright and code format checks
        run: ./gradlew --no-daemon spotlessCheck

  javadoc:
    name: Javadoc
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          submodules: recursive
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Set up Java
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
        with:
          java-version: "23"
          distribution: "temurin"

      - name: Set up Gradle
        uses: gradle/actions/setup-gradle@ac396bf1a80af16236baf54bd7330ae21dc6ece5 # v6

      - name: Run javadoc
        run: ./gradlew --no-daemon javadoc

  build_native_images:
    name: Build native test server
    uses: ./.github/workflows/build-native-image.yml
    with:
      ref: ${{ github.event.pull_request.head.sha }}