name: Build Java Sources

on:
  workflow_call:
  workflow_dispatch:

env:
  # MinIO credentials and endpoint — feldera-minio-cache reads these to talk
  # to the in-cluster gha-cache bucket. AWS_* are also unused by upload-jar
  # (configure-aws-credentials overrides them via $GITHUB_ENV).
  AWS_ACCESS_KEY_ID: "${{ secrets.CI_K8S_MINIO_ACCESS_KEY_ID }}"
  AWS_SECRET_ACCESS_KEY: "${{ secrets.CI_K8S_MINIO_SECRET_ACCESS_KEY }}"
  SCCACHE_REGION: ${{ vars.SCCACHE_REGION }}
  SCCACHE_ENDPOINT: ${{ vars.SCCACHE_ENDPOINT }}
  # Pin Maven's local repo so it matches the cache path regardless of
  # whatever HOME the GHA container runner sets — JVM's user.home reads
  # /etc/passwd, not $HOME, and we don't want to rely on that match.
  MAVEN_OPTS: -Dmaven.repo.local=/home/ubuntu/.m2/repository

jobs:
  build-jar:
    name: Build Compiler
    runs-on: [k8s-runners-amd64]
    permissions:
      contents: read
    container:
      image: ghcr.io/feldera/feldera-dev:sha-a5ab793b8d261068867b9fdfad3f04157b2536fc
    steps:
      - name: Show Kubernetes node
        if: always()
        run: |
          echo "K8S node: ${K8S_NODE_NAME}"

      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Cache JVM build dependencies
        uses: ./.github/actions/feldera-minio-cache
        with:
          path: |
            /home/ubuntu/.gradle
            /home/ubuntu/.m2/repository
            ./sql-to-dbsp-compiler/calcite
          key: build-java-jvm-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('sql-to-dbsp-compiler/calcite_version.env', 'sql-to-dbsp-compiler/**/pom.xml') }}
          restore-keys: |
            build-java-jvm-${{ runner.os }}-${{ runner.arch }}-

      - name: gradle version
        run: |
          gradle --version

      - name: Build sql2dbsp JARs
        run: bash build.sh -pl SQL-compiler
        working-directory: ./sql-to-dbsp-compiler
        env:
          CALCITE_BUILD_DIR: ./calcite
          GRADLE_HOME: /home/ubuntu/.gradle

      - name: Stop gradle daemon
        run: gradle --stop

      - name: Copy JAR to artifacts directory
        run: |
          mkdir -p build-artifacts
          cp ./sql-to-dbsp-compiler/SQL-compiler/target/sql2dbsp.jar build-artifacts/
          cp ./sql-to-dbsp-compiler/SQL-compiler/target/sql2dbsp-jar-with-dependencies.jar build-artifacts/

      - name: Upload build artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: feldera-sql-compiler
          path: build-artifacts
          retention-days: 7

  # S3 upload runs in a separate job so the OIDC session token never enters
  # the build-jar environment, where it would poison the cache save phase
  # of runs-on/cache (MinIO rejects requests carrying a stray AWS_SESSION_TOKEN).
  upload-jar:
    name: Upload JAR to S3
    needs: build-jar
    runs-on: [k8s-runners-amd64]
    permissions:
      id-token: write
      contents: read
    container:
      image: ghcr.io/feldera/feldera-dev:sha-a5ab793b8d261068867b9fdfad3f04157b2536fc
    steps:
      - name: Download build artifact
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
        with:
          name: feldera-sql-compiler
          path: build-artifacts

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8 # v5.1.0
        with:
          role-to-assume: ${{ vars.SQL2DBSP_UPLOAD_ROLE }}
          role-session-name: gha-${{ github.run_id }}
          aws-region: ${{ vars.SQL2DBSP_S3_REGION }}

      - name: Upload JAR to S3 with SHA in filename
        run: |
          JAR_FILE=build-artifacts/sql2dbsp-jar-with-dependencies.jar
          DEST_NAME=sql2dbsp-jar-with-dependencies-${{ github.sha }}.jar
          aws s3 cp "$JAR_FILE" "s3://${{ vars.SQL2DBSP_S3_BUCKET }}/$DEST_NAME" \
            --content-type application/java-archive