tests-code.yml

name: Source Code Tests

on:
  push:
    branches:
      - main
      - main-release
      - stable
  pull_request:
  merge_group:
  workflow_dispatch:

env:
  AstrophysicsDataSystemAPIKey: ${{ secrets.AstrophysicsDataSystemAPIKey_FOR_TESTS }}
  BiodiversityHeritageApiKey: ${{ secrets.BiodiversityHeritageApiKey_FOR_TESTS}}
  IEEEAPIKey: ${{ secrets.IEEEAPIKey_FOR_TESTS }}
  MedlineAPiKey: ${{ secrets.MedlineApiKey_FOR_TESTS }}
  OpenAlexApiKey: ${{ secrets.OpenAlexApiKey_FOR_TESTS }}
  SpringerNatureAPIKey: ${{ secrets.SPRINGERNATUREAPIKEY_FOR_TESTS }}
  ScholarApiKey: ${{ secrets.SCHOLARAPIKEY_FOR_TESTS }}
  CROSSREF_EMAIL: ${{ secrets.CROSSREF_EMAIL_FOR_TESTS }}
  GRADLE_OPTS: -Xmx4g
  JAVA_OPTS: -Xmx4g

concurrency:
  group: "${{ github.workflow }}-${{ github.head_ref || github.ref }}"
  cancel-in-progress: true

permissions:
  # required for publish.yml
  actions: write
  contents: read
  pull-requests: write

jobs:
  upload-pr-number:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-slim
    steps:
      - name: Create pr_number.txt
        run: echo "${{ github.event.number }}" > pr_number.txt
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: pr_number
          path: pr_number.txt

  changes:
    name: Detect relevant source changes
    runs-on: ubuntu-slim
    outputs:
      run-gradle-ci-requirements: ${{ steps.determine.outputs.run-gradle-ci-requirements }}
      run-gradle-ci-full: ${{ steps.determine.outputs.run-gradle-ci-full }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        if: github.event_name == 'pull_request'
        with:
          fetch-depth: 0
          show-progress: 'false'
      - id: changed-non-workflow-non-markdown-files
        if: github.event_name == 'pull_request'
        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        with:
          files_ignore: |
            .github/workflows/**
            **/*.md
      - id: changed-requirements-docs
        if: github.event_name == 'pull_request'
        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        with:
          files: |
            docs/requirements/**/*.md
      - id: changed-tests-code-workflow
        if: github.event_name == 'pull_request'
        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        with:
          files: |
            .github/workflows/tests-code.yml
      - id: changed-submodules
        if: github.event_name == 'pull_request'
        # `.gitmodules` sets `ignore = all`, which hides submodule pointer bumps from `git diff` and thus from
        # tj-actions/changed-files. Without this step, a submodule bump skips all tests at PR level and fails
        # only in the merge queue.
        shell: bash
        run: |
          submodules=$(git config --file .gitmodules --get-regexp '\.path$' | awk '{print $2}')
          if git diff --quiet --ignore-submodules=none "origin/${{ github.base_ref }}" HEAD -- $submodules; then
            echo "any_changed=false" >> "$GITHUB_OUTPUT"
          else
            echo "any_changed=true" >> "$GITHUB_OUTPUT"
          fi
      - name: Determine whether Gradle jobs should run
        id: determine
        shell: bash
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" || "${{ github.event_name }}" == "push" || "${{ github.event_name }}" == "merge_group" ]]; then
            echo "run-gradle-ci-requirements=true" >> "$GITHUB_OUTPUT"
            echo "run-gradle-ci-full=true" >> "$GITHUB_OUTPUT"
          elif [[ "${{ steps.changed-tests-code-workflow.outputs.any_changed }}" == "true" || "${{ steps.changed-non-workflow-non-markdown-files.outputs.any_changed }}" == "true" || "${{ steps.changed-submodules.outputs.any_changed }}" == "true" ]]; then
            echo "run-gradle-ci-requirements=true" >> "$GITHUB_OUTPUT"
            echo "run-gradle-ci-full=true" >> "$GITHUB_OUTPUT"
          elif [[ "${{ steps.changed-requirements-docs.outputs.any_changed }}" == "true" ]]; then
            echo "run-gradle-ci-requirements=true" >> "$GITHUB_OUTPUT"
            echo "run-gradle-ci-full=false" >> "$GITHUB_OUTPUT"
          else
            echo "run-gradle-ci-requirements=false" >> "$GITHUB_OUTPUT"
            echo "run-gradle-ci-full=false" >> "$GITHUB_OUTPUT"
          fi

  dependencyscopes:
    needs: changes
    if: needs.changes.outputs.run-gradle-ci-full == 'true'
    name: Dependency Scopes
    # too slow on ubuntu-slim
    runs-on: ubuntu-latest
    steps:
      - name: Checkout source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          submodules: 'true'
          show-progress: 'false'
      - uses: ./.github/actions/setup-gradle
      - name: Run checkAllModuleInfo using gradle
        run: gradle checkAllModuleInfo

  format:
    needs: changes
    if: needs.changes.outputs.run-gradle-ci-full == 'true'
    # ubuntu-slim doesn't offer docker
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - uses: ./.github/actions/format-java
      # job should fail in case there are changes
      - uses: ./.github/actions/check-formatting
        with:
          artifact-name: formatting-fix-patch

  format-javadoc:
    needs: changes
    if: needs.changes.outputs.run-gradle-ci-full == 'true'
    # too slow on ubuntu-slim
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          path: 'jabref'
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          repository: 'rmuller/Convert2MarkdownJavadoc'
          path: 'Convert2MarkdownJavadoc'
      - name: Setup JDK
        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6
        with:
          java-version: '24'
          distribution: 'corretto'
          check-latest: true
      - run: |
          cd Convert2MarkdownJavadoc
          java Convert2MarkdownJavadoc.java ../jabref
      - uses: ./jabref/.github/actions/check-formatting
        with:
          working-directory: jabref
          artifact-name: javadoc-fix-patch

  checkstyle:
    name: Checkstyle
    # too slow on ubuntu-slim
    runs-on: ubuntu-latest
    needs: [ changes, format ]
    if: needs.changes.outputs.run-gradle-ci-full == 'true'
    steps:
      - name: Checkout source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          submodules: 'true'
          show-progress: 'false'
      - uses: ./.github/actions/setup-gradle
      - name: Run checkstyle using gradle
        run: gradle checkstyleMain checkstyleTest checkstyleJmh

  openrewrite:
    name: OpenRewrite
    # too slow on ubuntu-slim
    runs-on: ubuntu-latest
    needs: [ changes, checkstyle ]
    if: needs.changes.outputs.run-gradle-ci-full == 'true'
    steps:
      - name: Checkout source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          submodules: 'true'
          show-progress: 'false'
      - uses: ./.github/actions/setup-gradle
      - name: Run OpenRewrite
        run: |
          gradle --no-configuration-cache :rewriteRun

      # Reformat code (because OpenRewrite does different indents)
      - uses: ./.github/actions/format-java

      - name: Fail if working directory is unclean
        uses: ./.github/actions/check-formatting
        with:
          artifact-name: openrewrite-fix-patch
          annotation-title: OpenRewrite
          annotation-message-prefix: "Uncommitted changes after OpenRewrite; run `gradle :rewriteRun`, reformat, and commit the result for"

  modernizer:
    name: Modernizer
    # too slow on ubuntu-slim
    needs: changes
    if: needs.changes.outputs.run-gradle-ci-full == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          submodules: 'true'
          show-progress: 'false'
      - uses: ./.github/actions/setup-gradle
      - name: Run modernizer
        run: |
          # enable failing of this task if modernizer complains
          # sed -i "s/failOnViolations = false/failOnViolations = true/" build.gradle.kts
          gradle modernizer

  markdown:
    name: Markdown
    runs-on: ubuntu-slim
    steps:
      - name: Checkout source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          submodules: 'false'
          show-progress: 'false'
      - name: markdownlint-cli2-action
        uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff # v24
        with:
          globs: |
            *.md
            docs/**/*.md

  yaml:
    name: YAML
    runs-on: ubuntu-slim
    steps:
      - name: Checkout source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          submodules: 'false'
          show-progress: 'false'
      - name: yamllint
        run: pipx run yamllint==1.38.0 --strict .

  spelling:
    name: Spellling
    runs-on: ubuntu-slim
    steps:
      - name: Checkout source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          submodules: 'false'
          show-progress: 'false'
      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 24
          cache: npm
      - name: Install textlint
        run: npm ci
      - name: textlint
        run: npm run textlint
      - name: typos
        run: pipx run typos==1.50.3

  madr:
    name: MADR ADRs
    # JBang needs a JDK
    runs-on: ubuntu-latest
    steps:
      - name: Checkout source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          submodules: 'false'
          show-progress: 'false'
      - name: Generate JBang cache key
        id: cache-key
        shell: bash
        run: |
          echo "cache_key=jbang-madrlint-$(date +%Y-%m)" >> $GITHUB_OUTPUT
      - name: Cache JBang
        # Combined cache action: restores at start and saves ~/.jbang on a
        # cache miss in the post-job step. A madrlint-specific key keeps this
        # cache separate from the other JBang-using jobs.
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: ~/.jbang
          key: ${{ steps.cache-key.outputs.cache_key }}
          restore-keys:
            jbang-madrlint-
      - name: Resolve //DEPS into the cached directory
        # JBang resolves script dependencies into ~/.m2, which is not cached here.
        run: echo "JBANG_REPO=$HOME/.jbang/repository" >> "$GITHUB_ENV"
      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6
        with:
          distribution: 'corretto'
          java-version: '25'
      - name: Setup JBang
        # Pinned to a commit for deterministic CI; comment tracks the tag.
        uses: jbangdev/setup-jbang@2b1b465a7b75f4222b81426f23a01e013aa7b95c # v0.1.1
      - name: Trust madrlint source
        run: jbang trust add https://github.com/adr/
      - name: Lint ADRs
        # madrlint is pinned to a commit (not the moving `madrlint@adr/madrlint` alias) so
        # upstream changes cannot alter lint results without a deliberate bump here.
        # To update: point MADRLINT at a newer https://github.com/adr/madrlint commit.
        env:
          MADRLINT: https://github.com/adr/madrlint/blob/e37d19b6699e45dd1543bccd858f4f49af350e49/madrlint.java
        run: |
          report="$(mktemp)"
          # Each ADR file is checked against the per-file rules; the docs/decisions directory itself
          # is checked against the directory rules (numbering, naming, collisions). Non-ADR files
          # (adr-template.md, index.md) are excluded via .madrlintignore.
          # -n11 disables the external-link check (MADR11); JabRef verifies external links elsewhere.
          for target in docs/decisions/*.md docs/decisions; do
            jbang "$MADRLINT" -n11 --quiet --output-format github-actions "$target"
          done | tee "$report"

          error_count=$(grep -c '^::error' "$report" || true)
          if [ "$error_count" -ne 0 ]; then
            echo "❌ madrlint reported $error_count MADR violation(s). See the annotations above."
            exit 1
          fi
          echo "✅ No MADR violations."

  changelog:
    name: CHANGELOG.md
    # JBang needs a JDK
    runs-on: ubuntu-latest
    steps:
      - name: Checkout source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          submodules: 'false'
          show-progress: 'false'
      - name: Generate JBang cache key
        id: cache-key
        shell: bash
        run: |
          echo "cache_key=jbang-heylogs-$(date +%Y-%m)" >> $GITHUB_OUTPUT
      - name: Cache JBang
        # Combined cache action: the restore-only variant never wrote the key.
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: ~/.jbang
          key: ${{ steps.cache-key.outputs.cache_key }}
          restore-keys:
            jbang-heylogs-
      - name: Resolve //DEPS into the cached directory
        # JBang resolves script dependencies into ~/.m2, which is not cached here.
        run: echo "JBANG_REPO=$HOME/.jbang/repository" >> "$GITHUB_ENV"
      - name: Setup JBang
        uses: jbangdev/setup-jbang@2b1b465a7b75f4222b81426f23a01e013aa7b95c # v0.1.1
      - name: Lint CHANGELOG.md
        run: |
          # the grep is needed to filter out an error about all h2 containing a version, which is not relevant for us, because we have an "Unreleased" section
          jbang com.github.nbbrd.heylogs:heylogs-cli:0.19.1:bin check --rule dot-space-link-style:ERROR --format github-actions CHANGELOG.md | grep -v all-h2-contain-a-version | tee heylogs.txt || true

          error_count=$(grep -c '^::error' heylogs.txt || true)
          if [ "$error_count" -ne 0 ]; then
            {
              echo "heylogs<<EOF"
              cat heylogs.txt
              echo "EOF"
            } >> "$GITHUB_OUTPUT"
            exit 1
          fi

  changelog-unreleased-only:
    if: github.event_name == 'pull_request'
    name: CHANGELOG.md - only unreleased touched
    runs-on: ubuntu-slim
    steps:
      - name: Checkout source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          submodules: 'false'
          show-progress: 'false'
          fetch-depth: 0
      - name: Cache clparse jar
        id: cache-clparse
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: /tmp/clparse
          key: clparse-0.9.1
      - name: unzip
        if: steps.cache-clparse.outputs.cache-hit != 'true'
        run: |
          cd /tmp
          curl -LO https://github.com/marcaddeo/clparse/releases/download/0.9.1/clparse-0.9.1-x86_64-unknown-linux-musl.tar.gz
          tar xzvf clparse-0.9.1-x86_64-unknown-linux-musl.tar.gz
      - name: Install clparse
        run: sudo mv /tmp/clparse /usr/local/bin/clparse
      - uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
        with:
          packages: jq
          version: 1.0
      - name: Check CHANGELOG.md diff
        run: |
          diff \
            <(git show "origin/${{ github.base_ref }}":CHANGELOG.md | clparse --format=json --separator=– - | jq '.releases[] | select(.version != null)') \
            <(git show HEAD:CHANGELOG.md | clparse --format=json --separator=– - | jq '.releases[] | select(.version != null)')

  javadoc:
    needs: changes
    if: needs.changes.outputs.run-gradle-ci-full == 'true'
    name: JavaDoc
    # Sometimes takes longer than 15 minutes, therefore not ubuntu-slim
    runs-on: ubuntu-latest
    steps:
      - name: Checkout source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          submodules: 'true'
          show-progress: 'false'
      - uses: ./.github/actions/setup-gradle
      - run: gradle javadoc

  tests:
    needs: changes
    name: "Unit tests – ${{ matrix.module }}"
    runs-on: ubuntu-latest
    strategy:
      matrix:
        module: [ jablib, jabkit, jabsrv, jabgui ]
    steps:
      - name: Skip tests because no source-relevant files changed
        if: needs.changes.outputs.run-gradle-ci-full != 'true'
        run: echo "Skipping tests because no source-relevant files changed."
      - name: Checkout source
        if: needs.changes.outputs.run-gradle-ci-full == 'true'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          submodules: 'true'
          show-progress: 'false'
      - uses: ./.github/actions/setup-gradle
        if: needs.changes.outputs.run-gradle-ci-full == 'true'
      - name: Run ${{ matrix.module }} tests
        if: needs.changes.outputs.run-gradle-ci-full == 'true'
        run: xvfb-run --auto-servernum gradle :${{ matrix.module }}:check -x checkstyleJmh -x checkstyleMain -x checkstyleTest -x modernizer
        env:
          CI: "true"
      - name: Run JabKit portable smoke test
        if: (needs.changes.outputs.run-gradle-ci-full == 'true') && (matrix.module == 'jabkit')
        run: gradle :jabkit:runJabKitPortableSmokeTest
      - name: Prepare format failed test results
        if: needs.changes.outputs.run-gradle-ci-full == 'true' && failure()
        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
        with:
          packages: xml-twig-tools xsltproc
          version: 1.0
      - name: Format failed test results
        if: needs.changes.outputs.run-gradle-ci-full == 'true' && failure()
        run: scripts/after-failure.sh

  tests-windows:
    needs: changes
    name: "Unit tests (Windows)"
    if: >
      github.repository_owner == 'JabRef' &&
      (
        github.event_name == 'push' ||
        github.event_name == 'workflow_dispatch' ||
        github.event_name == 'pull_request' ||
        github.event_name == 'merge_group'
      )
    runs-on: windows-latest
    strategy:
      matrix:
        module: [ jablib ]
    steps:
      - name: Skip Windows tests because no source-relevant files changed
        if: needs.changes.outputs.run-gradle-ci-full != 'true'
        run: echo "Skipping Windows tests because no source-relevant files changed."
      - name: Checkout source
        if: needs.changes.outputs.run-gradle-ci-full == 'true'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          submodules: 'true'
          show-progress: 'false'
      - uses: ./.github/actions/setup-gradle
        if: needs.changes.outputs.run-gradle-ci-full == 'true'
      - name: Run ${{ matrix.module }} tests
        if: needs.changes.outputs.run-gradle-ci-full == 'true'
        run: gradle :${{ matrix.module }}:check -x checkstyleJmh -x checkstyleMain -x checkstyleTest -x modernizer
        env:
          CI: "true"

  tests-windows-file-based:
    needs: changes
    if: needs.changes.outputs.run-gradle-ci-full == 'true'
    name: "Unit tests (Windows) - file-based"
    runs-on: windows-latest
    steps:
      - name: Checkout source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
          submodules: 'true'
          show-progress: 'false'
      - name: Detect changed windows-related classes
        id: changed-windows-related-files
        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
        with:
          files: |
            jablib/src/main/java/org/jabref/logic/citationstyle/CSLStyleUtils.java
            jablib/src/test/java/org/jabref/logic/citationstyle/CSLStyleUtilsTest.java
            jablib/src/main/java/org/jabref/logic/exporter/AcademicPagesExporter.java
            jablib/src/test/java/org/jabref/logic/exporter/AcademicPagesExporterTest.java
      - uses: ./.github/actions/setup-gradle
        if: steps.changed-windows-related-files.outputs.any_changed == 'true'
      - name: Run jablib tests
        if: steps.changed-windows-related-files.outputs.any_changed == 'true'
        run: gradle :jablib:check -x checkstyleJmh -x checkstyleMain -x checkstyleTest -x modernizer
        env:
          CI: "true"

  databasetests:
    needs: changes
    if: github.repository_owner == 'JabRef' && needs.changes.outputs.run-gradle-ci-full == 'true'
    name: Database tests
    runs-on: ubuntu-latest
    steps:
      - name: Shutdown Ubuntu MySQL
        run: sudo service mysql stop # Shutdown the Default MySQL to save memory, "sudo" is necessary, please do not remove it
      - name: Checkout source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          submodules: 'true'
          show-progress: 'false'
      - uses: ./.github/actions/setup-gradle
      - name: Run tests on PostgreSQL
        run: gradle :jablib:databaseTest --rerun-tasks
        env:
          CI: "true"

  publish:
    needs: changes
    if: github.ref == 'refs/heads/main' && needs.changes.outputs.run-gradle-ci-full == 'true'
    uses: ./.github/workflows/publish.yml
    secrets:
      KOPPOR_SIGNING_SECRETKEYRINGFILE_BASE64: ${{ secrets.KOPPOR_SIGNING_SECRETKEYRINGFILE_BASE64 }}
      KOPPOR_SIGNING_KEYID: ${{ secrets.KOPPOR_SIGNING_KEYID }}
      KOPPOR_SIGNING_PASSWORD: ${{ secrets.KOPPOR_SIGNING_PASSWORD }}
      KOPPOR_MAVENCENTRALUSERNAME: ${{ secrets.KOPPOR_MAVENCENTRALUSERNAME }}
      KOPPOR_MAVENCENTRALPASSWORD: ${{ secrets.KOPPOR_MAVENCENTRALPASSWORD }}

  jbang-main:
    name: JBang (main)
    runs-on: ubuntu-slim
    needs: publish
    if: github.ref == 'refs/heads/main'
    steps:
      - name: Checkout source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          submodules: 'false'
          show-progress: 'false'
      - name: Generate JBang cache key
        id: cache-key
        shell: bash
        run: echo "cache_key=jbang-check-$(date +%Y-%m)" >> $GITHUB_OUTPUT
      - name: Cache JBang
        # Shared by the "JBang (main)" and "JBang (PR)" jobs - both build the same scripts,
        # so they resolve the same dependencies. A PR run restores the entry written on main.
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: ~/.jbang
          key: ${{ steps.cache-key.outputs.cache_key }}
          restore-keys:
            jbang-check-
      - name: Setup JBang
        uses: jbangdev/setup-jbang@2b1b465a7b75f4222b81426f23a01e013aa7b95c # v0.1.1
      - uses: ./.github/actions/setup-gradle
      - name: Build JBang scripts and run launchers
        uses: ./.github/actions/jbang-check

  jbang-pr:
    needs: changes
    name: JBang (PR)
    runs-on: ubuntu-latest
    if: github.ref != 'refs/heads/main' && needs.changes.outputs.run-gradle-ci-full == 'true'
    steps:
      - name: Checkout source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          submodules: 'true'
          show-progress: 'false'
      - name: Generate JBang cache key
        id: cache-key
        shell: bash
        run: echo "cache_key=jbang-check-$(date +%Y-%m)" >> $GITHUB_OUTPUT
      - name: Cache JBang
        # Shared by the "JBang (main)" and "JBang (PR)" jobs - both build the same scripts,
        # so they resolve the same dependencies. A PR run restores the entry written on main.
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: ~/.jbang
          key: ${{ steps.cache-key.outputs.cache_key }}
          restore-keys:
            jbang-check-
      - name: Setup JBang
        uses: jbangdev/setup-jbang@2b1b465a7b75f4222b81426f23a01e013aa7b95c # v0.1.1
      - uses: ./.github/actions/setup-gradle
      # Publish jablib to the local Maven repository so the JBang scripts pick up
      # unreleased changes. -PprojVersion=6.0 makes the artifact 6.0-SNAPSHOT
      # (the default would be 0.1.0-SNAPSHOT, which the scripts do not reference).
      - name: Publish jablib to the local Maven repository
        # -Dmaven.repo.local: the jbang-check action points JBANG_REPO at ~/.jbang/repository,
        # so the snapshot has to be published there instead of into ~/.m2.
        run: gradle -Dmaven.repo.local="$HOME/.jbang/repository" -PprojVersion=6.0 :jablib:publishToMavenLocal
      - name: Build JBang scripts and run launchers
        uses: ./.github/actions/jbang-check

  maven-examples:
    name: Maven examples
    runs-on: ubuntu-latest
    needs: publish
    if: github.ref == 'refs/heads/main'
    strategy:
      fail-fast: false
      matrix:
        project: [ jablib-examples/maven3/doi-to-bibtex ]
    steps:
      - name: Checkout source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          submodules: 'false'
          show-progress: 'false'
      - name: Set up JDK
        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6
        with:
          java-version: 25
          distribution: 'corretto'
          cache: maven
          check-latest: true
      - run: |
          cd ${{ matrix.project }}
          mvn --batch-mode --update-snapshots verify
        shell: bash

  codecoverage:
    if: false
    name: Code coverage
    runs-on: ubuntu-slim
    services:
      postgres:
        image: postgres:10.8
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: postgres
        ports:
          - 5432:5432
        # needed because the postgres container does not provide a healthcheck
        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
    steps:
      - name: Check secrets presence
        id: checksecrets
        shell: bash
        run: |
          if [ "$CODECOV_TOKEN" == "" ]; then
            echo "secretspresent=NO" >> $GITHUB_OUTPUT
            echo "❌ Secret CODECOV_TOKEN not present"
          else
            echo "secretspresent=YES" >> $GITHUB_OUTPUT
            echo "✔️ Secret CODECOV_TOKEN present"
          fi
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
      - name: Checkout source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          submodules: 'true'
          show-progress: 'false'
      - uses: ./.github/actions/setup-gradle
      - name: Update test coverage metrics
        if: (github.ref == 'refs/heads/main') && (steps.checksecrets.outputs.secretspresent == 'YES')
        run: xvfb-run --auto-servernum gradle jacocoTestReport
        env:
          CI: "true"
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
          DBMS: "postgresql"
      - uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7
        if: (github.ref == 'refs/heads/main') && (steps.checksecrets.outputs.secretspresent == 'YES')
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
      - name: Upload Codacy report
        if: (github.ref == 'refs/heads/main') && (steps.checksecrets.outputs.secretspresent == 'YES')
        run: bash <(curl -Ls https://coverage.codacy.com/get.sh)
        env:
          CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}

  requirements_coverage:
    needs: changes
    if: needs.changes.outputs.run-gradle-ci-requirements == 'true'
    name: "Validate requirement coverage"
    runs-on: ubuntu-slim
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          show-progress: 'false'
      - uses: ./.github/actions/setup-gradle
      - run: gradle traceRequirements
      - if: always()
        run: cat build/reports/tracing.txt

  # This is https://github.com/marketplace/actions/gradle-wrapper-validation
  # It ensures that the jar file is from gradle and not by a strange third party.
  gradlevalidation:
    name: "Validate Gradle Wrapper"
    runs-on: ubuntu-slim
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          show-progress: 'false'
      - uses: gradle/actions/wrapper-validation@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0

  # Guards against a committer (e.g. a dependabot wrapper bump) baking CRLF into
  # the committed gradlew.bat blob. .gitattributes stores it as LF and smudges it
  # to CRLF on checkout, so we inspect the committed blob, not the working-tree file.
  line_endings:
    name: "Line endings (gradlew.bat)"
    runs-on: ubuntu-slim
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          show-progress: 'false'
      - name: Ensure gradlew.bat blob has no CRLF
        run: |
          if ! git cat-file -e HEAD:gradlew.bat 2>/dev/null; then
            echo "❌ gradlew.bat not found at HEAD. Cannot validate line endings; failing closed."
            exit 1
          fi
          if git show HEAD:gradlew.bat | grep -q $'\r'; then
            echo "❌ gradlew.bat is committed with CRLF. The repository blob must be LF;"
            echo "   .gitattributes (\"*.bat text eol=crlf\") converts it to CRLF on checkout."
            echo "   Fix: git add --renormalize gradlew.bat && git commit"
            exit 1
          fi
          echo "✅ gradlew.bat blob is LF"