ci-java.yml

name: CI Java

# Reusable Java SDK workflow: Linux runs the full `gradle build` across every
# JDK (sharing one prebuilt cdylib); a smoke build covers the other published
# platforms. Called by ci.yml when Java-relevant paths change.
on:
  workflow_call:

permissions:
  contents: read

env:
  CARGO_HTTP_MULTIPLEXING: "false"
  CARGO_NET_RETRY: "10"

jobs:
  # Build the JDK-independent cdylib once; test legs reuse it as an artifact.
  native:
    name: Build native library
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v7.0.1

      - name: Set up Rust
        uses: ./.github/actions/setup-rust

      - name: Build the JNI cdylib
        run: cargo build --release --features postgres,redis,workflows,mesh -p flexiq-java

      - name: Upload the cdylib
        uses: actions/upload-artifact@v7
        with:
          name: flexiq-java-native
          path: target/release/libflexiq_java.so
          if-no-files-found: error
          retention-days: 1

  # Build + test on every supported JDK; the SDK targets 17 but runs on 17/21/25
  # over a native .so, so JVM behaviour is runtime-sensitive.
  test:
    name: Java SDK Tests (JDK ${{ matrix.java }})
    needs: native
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        java: ["17", "21", "25"]
    steps:
      - name: Check out repository
        uses: actions/checkout@v7.0.1

      - name: Set up Java + Gradle
        uses: ./.github/actions/setup-java
        with:
          java-version: ${{ matrix.java }}

      - name: Provision Gradle
        uses: ./.github/actions/provision-gradle

      # Stage the prebuilt .so where copyNative expects it, so no Rust is needed.
      - name: Download the cdylib
        uses: actions/download-artifact@v8
        with:
          name: flexiq-java-native
          path: target/release

      # -x cargoBuild skips the Rust compile; copyNative still stages the .so.
      - name: Build and test the Java SDK
        working-directory: sdks/java
        # Spotless/Checkstyle are JDK-independent (and palantir-java-format reaches
        # into javac internals that newer JDKs change), so run the full `build`
        # (which includes `check`) only on the baseline JDK; the other legs run the
        # test suite to verify runtime behaviour on each JDK.
        run: ./gradlew ${{ matrix.java == '17' && 'build' || 'test' }} -x cargoBuild --no-daemon

      # Gradle's console output gives one line per failed test — the assertion
      # or exception type and nothing else. The message, the stack and any
      # suppressed causes live only in the report, which dies with the runner.
      # An intermittent failure therefore costs the same guesswork every time it
      # appears, which is what happened to the Windows @TempDir cleanup.
      - name: Upload the test reports
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: java-test-reports-jdk${{ matrix.java }}
          path: |
            sdks/java/build/reports/tests/
            sdks/java/build/test-results/
            sdks/java/*/build/reports/tests/
            sdks/java/*/build/test-results/
          # A failure before the test task runs leaves nothing to collect, and
          # that must not turn one red step into two.
          if-no-files-found: ignore
          retention-days: 14

  # Smoke the other published platforms on one JDK: their native binary differs,
  # so they rebuild it (cargoBuild) instead of reusing the Linux artifact.
  smoke:
    name: Java SDK Smoke (${{ matrix.classifier }})
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - classifier: osx-aarch64
            runner: macos-15
          - classifier: windows-x86_64
            runner: windows-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v7.0.1

      # Vendored OpenSSL needs Perl; point openssl-sys at Strawberry Perl.
      - name: Point vendored OpenSSL at Strawberry Perl (Windows)
        if: runner.os == 'Windows'
        shell: bash
        run: echo "OPENSSL_SRC_PERL=C:/Strawberry/perl/bin/perl.exe" >> "$GITHUB_ENV"

      - name: Set up Rust
        uses: ./.github/actions/setup-rust

      - name: Set up Java + Gradle
        uses: ./.github/actions/setup-java

      - name: Provision Gradle
        uses: ./.github/actions/provision-gradle

      # bash so `./gradlew` runs uniformly on the Windows runner too.
      - name: Build and test the Java SDK
        working-directory: sdks/java
        shell: bash
        run: ./gradlew build --no-daemon

      # The leg that needs this most: the Windows runner is the only one whose
      # failures have been platform-specific, and it is the one nobody can
      # reproduce locally.
      - name: Upload the test reports
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: java-test-reports-${{ matrix.classifier }}
          path: |
            sdks/java/build/reports/tests/
            sdks/java/build/test-results/
            sdks/java/*/build/reports/tests/
            sdks/java/*/build/test-results/
          if-no-files-found: ignore
          retention-days: 14

  # Prove the SDK works under GraalVM native-image using only the reachability
  # metadata the runtime jar ships (META-INF/native-image/org.byteveda/flexiq/):
  # build the smoke into a native image — no tracing agent — and run the binary.
  # A failure means the shipped metadata went stale; regenerate it with
  # `-Pagent :graalvm-smoke:run` + `:graalvm-smoke:metadataCopy` and commit.
  graalvm:
    name: Java SDK GraalVM native-image
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v7.0.1

      - name: Set up Rust
        uses: ./.github/actions/setup-rust

      - name: Set up GraalVM
        uses: graalvm/setup-graalvm@v1
        with:
          java-version: "21"
          distribution: graalvm
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Provision Gradle
        uses: ./.github/actions/provision-gradle

      - name: Build and run the native image from shipped metadata
        working-directory: sdks/java
        run: |
          ./gradlew :graalvm-smoke:nativeCompile --no-daemon
          ./graalvm-smoke/build/native/nativeCompile/graalvm-smoke