o2j-convert.yml

name: O2J Convert

# Each pipeline stage is its own step, so a failure names the stage rather than burying it in
# one long log. Exit codes are in SPECIFICATION.md section 8.4.

on:
  workflow_dispatch:
    inputs:
      spec_path:
        description: A spec file, or a folder of *.yaml/*.yml specs (one service each)
        required: true
        default: openapi
      java_version:
        description: Target Java version (17, 21, 25)
        required: false
        default: "21"
  pull_request:
    paths:
      - "openapi/**"
      - "o2j.yaml"
      - "o2j/**"

permissions:
  contents: read
  security-events: write   # SARIF upload

concurrency:
  group: o2j-convert-${{ github.ref }}
  cancel-in-progress: true

jobs:
  convert:
    runs-on: ubuntu-latest
    env:
      # Pinned so formatting and sort order cannot vary by runner locale, which would break
      # the determinism gate for no real reason.
      LC_ALL: C
      TZ: UTC
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: ${{ inputs.java_version || '21' }}
          cache: maven

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip

      - name: Install o2j
        run: pip install -e .

      - name: Preflight
        run: python -I -m o2j doctor

      # On a pull request, the base branch's specs are the released contract: validation
      # reports breaking changes against them (O2J-V-011). A spec new in this PR has no
      # baseline and is not compared.
      - name: Breaking-change baseline from the base branch
        if: github.event_name == 'pull_request'
        env:
          BASE_REF: ${{ github.base_ref }}
        run: |
          git fetch --no-tags --depth=1 origin "$BASE_REF"
          baseline="$RUNNER_TEMP/o2j-baseline"
          mkdir -p "$baseline"
          if [ -n "$(git ls-tree --name-only FETCH_HEAD openapi/)" ]; then
            git archive FETCH_HEAD openapi | tar -x -C "$baseline"
            echo "O2J_BASELINE=$baseline/openapi" >> "$GITHUB_ENV"
          fi

      # Folder mode: every *.yaml / *.yml under openapi/ becomes its own service in
      # generated_Code/<spec-name>/, with stage artifacts in work/<spec-name>/.
      - name: S0-S4 Ingest, validate, normalize, plan, generate
        env:
          SPEC: ${{ inputs.spec_path || 'openapi' }}
        run: |
          args=()
          if [ -n "${O2J_BASELINE:-}" ]; then args=(--baseline "$O2J_BASELINE"); fi
          python -I -m o2j run "$SPEC" --to generate "${args[@]}"

      - name: Upload validation findings
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: work
          category: o2j-openapi

      - name: S6-S7 Build, test and gate every service
        env:
          SPEC: ${{ inputs.spec_path || 'openapi' }}
        run: python -I -m o2j run "$SPEC" --from gate --to gate

      - name: S8 Report
        if: always()
        env:
          SPEC: ${{ inputs.spec_path || 'openapi' }}
        run: python -I -m o2j run "$SPEC" --from report

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: o2j-artifacts-java${{ inputs.java_version || '21' }}
          path: |
            work/**/*.json
            work/**/*.md
            work/**/*.yaml
            generated_Code/**/target/site/jacoco/**
            generated_Code/**/target/pit-reports/**
          if-no-files-found: warn