maven.yml

name: Maven Build (pom.xml)

on:
  workflow_call:
    inputs:
      os:
        required: true
        type: string
      jdk_distro:
        required: true
        type: string
      jdk_version:
        required: true
        type: string
      wolfssl_configure:
        required: true
        type: string

jobs:
  build_wolfcryptjni:
    runs-on: ${{ inputs.os }}
    steps:
      - uses: actions/checkout@v4

      # Cache the installed wolfSSL build. It depends only on the wolfSSL
      # commit, configure flags, and OS/arch, so jobs across workflows
      # can share one build.
      - name: Resolve wolfSSL cache key
        id: wolfssl-key
        env:
          WOLFSSL_CONFIGURE: ${{ inputs.wolfssl_configure }}
        run: |
          SHA=$(git ls-remote https://github.com/wolfSSL/wolfssl.git \
            refs/heads/master | cut -f1)
          if [ -z "$SHA" ]; then
            echo "Failed to resolve wolfSSL master SHA" >&2
            exit 1
          fi
          CFG_HASH=$(printf '%s' "$WOLFSSL_CONFIGURE" | \
            shasum -a 256 | cut -c1-16)
          KEY="wolfssl-${{ runner.os }}-${{ runner.arch }}-$SHA-$CFG_HASH"
          echo "sha=$SHA" >> "$GITHUB_OUTPUT"
          echo "key=$KEY" >> "$GITHUB_OUTPUT"

      - name: Restore cached wolfSSL install
        id: cache-wolfssl
        uses: actions/cache/restore@v4
        with:
          path: build-dir
          key: ${{ steps.wolfssl-key.outputs.key }}

      # Build the exact commit the cache key was computed from so the
      # key and contents cannot drift if master advances mid-run.
      - name: Build native wolfSSL
        if: steps.cache-wolfssl.outputs.cache-hit != 'true'
        uses: wolfSSL/actions-build-autotools-project@v1
        with:
          repository: wolfSSL/wolfssl
          ref: ${{ steps.wolfssl-key.outputs.sha }}
          path: wolfssl
          configure: ${{ inputs.wolfssl_configure }}
          check: false
          install: true

      # Save right after building (not at job end) so a later test
      # failure does not prevent the cache from being populated.
      - name: Save wolfSSL install to cache
        if: steps.cache-wolfssl.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: build-dir
          key: ${{ steps.wolfssl-key.outputs.key }}

      - name: Setup java
        uses: actions/setup-java@v4
        with:
          distribution: ${{ inputs.jdk_distro }}
          java-version: ${{ inputs.jdk_version }}
          cache: 'maven'

      - name: Set LD_LIBRARY_PATH
        run: |
          echo "LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$GITHUB_WORKSPACE/build-dir/lib" >> "$GITHUB_ENV"

      - name: Build JNI library
        run: ./java.sh $GITHUB_WORKSPACE/build-dir

      # Resolve declared dependencies into the local Maven repository so
      # the test dependency bytes can be verified before any test runs.
      - name: Resolve Maven dependencies
        run: mvn -B dependency:resolve

      # Verify the resolved JUnit test dependencies against the same
      # independently trusted SHA-256 digests pinned in the setup-junit
      # composite action, before mvn package compiles and runs the tests.
      - name: Verify test dependency checksums
        shell: bash
        run: |
          M2="$HOME/.m2/repository"
          echo "8e495b634469d64fb8acfa3495a065cbacc8a0fff55ce1e31007be4c16dc57d3  $M2/junit/junit/4.13.2/junit-4.13.2.jar" \
            | shasum -a 256 -c -
          echo "4877670629ab96f34f5f90ab283125fcd9acb7e683e66319a68be6eb2cca60de  $M2/org/hamcrest/hamcrest-all/1.3/hamcrest-all-1.3.jar" \
            | shasum -a 256 -c -

      # Maven build. A single mvn package runs the compile, test, and
      # package phases in one lifecycle pass. Separate compile, test,
      # and package steps would run the whole test suite twice, once
      # for the test step and again inside package.
      - name: mvn package
        run: mvn package

      - name: mvn clean
        run: mvn clean