spotbugs.yml

#    Copyright (c) 2023 Contributors to the Eclipse Foundation
#
#    See the NOTICE file(s) distributed with this work for additional
#    information regarding copyright ownership.
#
#    This program and the accompanying materials are made available under the
#    terms of the Apache License, Version 2.0 which is available at
#    https://www.apache.org/licenses/LICENSE-2.0.
#
#    Unless required by applicable law or agreed to in writing, software
#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
#    License for the specific language governing permissions and limitations
#    under the License.
#
#  SPDX-License-Identifier: Apache-2.0

name: "[BE][SECURITY] Spotbugs"

on:
  push:
    branches: main
    paths-ignore:
      - '**/*.md'
      - '**/*.txt'
      - 'tx-backend/openapi/**'
      - 'docs/**'
  pull_request:
    branches: main
    paths-ignore:
      - '**/*.md'
      - '**/*.txt'
      - 'tx-backend/openapi/**'
      - 'docs/**'
  schedule:
    - cron: '0 0 * * *' # Once a day

jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read

    name: spotbugs-check
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'temurin'

      - name: Cache maven packages
        uses: actions/cache@v4
        with:
          path: ~/.m2
          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
          restore-keys: ${{ runner.os }}-m2

      - name: run maven spotbugs plugin
        run: mvn clean package -pl tx-models,tx-backend  -DskipTests=true -Pspotbugs-check spotbugs:check