kafka/.github/workflows/ci-complete.yml

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: CI Complete

on:
  workflow_run:
    workflows: [CI]
    types:
      - completed

run-name: Build Scans for ${{ github.event.workflow_run.display_title}}

# This workflow runs after the completion of the CI workflow triggered on a "pull_request" event.
# The "pull_request" event type is run in an unprivileged context without access to the repository
# secrets. This means that PRs from public forks cannot publish Gradle Build Scans or modify the
# PR contents.
#
# This "workflow_run" triggered workflow is run in a privileged context and so does have access to
# the repository secrets. Here we can download the build scan files produced by a PR and publish
# them to develocity.apache.org.
#
# If we need to do things like comment on, label, or otherwise modify PRs from public forks. This
# workflow is the place to do it. PR number is ${{ github.event.workflow_run.pull_requests[0].number }}

jobs:
  upload-build-scan:
    # Skip this workflow if the CI run was skipped or cancelled
    if: (github.event.workflow_run.conclusion == 'success' || github.event.workflow_run.conclusion == 'failure') && github.event.workflow_run.head_branch != '4.0'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        # Make sure these match build.yml and also keep in mind that GitHub Actions build will always use this file from the trunk branch.
        java: [ 25, 17 ]
        run-flaky: [ true, false ]
        run-new: [ true, false ]
        exclude:
          - run-flaky: true
            run-new: true

    env:
      job-variation: ${{ matrix.java }}-${{ matrix.run-flaky == true && 'flaky' || 'noflaky' }}-${{ matrix.run-new == true && 'new' || 'nonew' }}
      status-context: Java ${{ matrix.java }}${{ matrix.run-flaky == true && ' / Flaky' || '' }}${{ matrix.run-new == true && ' / New' || '' }}

    steps:
      - name: Env
        run: printenv
        env:
          GITHUB_CONTEXT: ${{ toJson(github) }}
      - name: Checkout code
        uses: actions/checkout@v5
        with:
          persist-credentials:
            false
      - name: Setup Gradle
        uses: ./.github/actions/setup-gradle
        with:
          java-version: ${{ matrix.java }}
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
      - name: Download build scan archive
        id: download-build-scan
        uses: actions/download-artifact@v5
        continue-on-error: true  # Don't want this step to fail the overall workflow
        with:
          github-token: ${{ github.token }}
          run-id: ${{ github.event.workflow_run.id }}
          name: build-scan-${{ env.job-variation }}
          path: ~/.gradle/build-scan-data  # This is where Gradle buffers unpublished build scan data when --no-scan is given
      - name: Handle missing scan
        if: ${{ steps.download-build-scan.outcome == 'failure' }}
        uses: ./.github/actions/gh-api-update-status
        with:
          gh-token: ${{ secrets.GITHUB_TOKEN }}
          repository: ${{ github.repository }}
          commit_sha: ${{ github.event.workflow_run.head_sha }}
          url: '${{ github.event.workflow_run.html_url }}'
          description: 'Could not find build scan'
          context: Gradle Build Scan / ${{ env.status-context }}
          state: 'error'
      - name: Publish Scan
        id: publish-build-scan
        if: ${{ steps.download-build-scan.outcome == 'success' }}
        run: |
          set +e
          ./gradlew --info buildScanPublishPrevious > gradle.out
          exitcode="$?"
          if [ $exitcode -ne 0 ]; then
            cat gradle.out
            echo "Failed to publish build scan" >> $GITHUB_STEP_SUMMARY
            exit $exitcode
          else
            SCAN_URL=$(grep '^https://.*$' gradle.out)
            cat gradle.out
            echo "Published build scan to $SCAN_URL" >> $GITHUB_STEP_SUMMARY
            echo "build-scan-url=$SCAN_URL" >> $GITHUB_OUTPUT
          fi          
      - name: Handle failed publish
        if: ${{ failure() && steps.publish-build-scan.outcome == 'failure' }}
        uses: ./.github/actions/gh-api-update-status
        with:
          gh-token: ${{ secrets.GITHUB_TOKEN }}
          repository: ${{ github.repository }}
          commit_sha: ${{ github.event.workflow_run.head_sha }}
          url: '${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }}'
          description: 'The build scan failed to be published'
          context: Gradle Build Scan / ${{ env.status-context }}
          state: 'error'
      - name: Update Status Check
        if: ${{ steps.publish-build-scan.outcome == 'success' }}
        uses: ./.github/actions/gh-api-update-status
        with:
          gh-token: ${{ secrets.GITHUB_TOKEN }}
          repository: ${{ github.repository }}
          commit_sha: ${{ github.event.workflow_run.head_sha }}
          url: ${{ steps.publish-build-scan.outputs.build-scan-url }}
          description: 'The build scan was successfully published'
          context: Gradle Build Scan / ${{ env.status-context }}
          state: 'success'