name: GH Actions CI on: push: branches: - 'main' pull_request: branches: - 'main' permissions: {} # none # See https://github.com/hibernate/hibernate-orm/pull/4615 for a description of the behavior we're getting. concurrency: # Consider that two builds are in the same concurrency group (cannot run concurrently) # if they use the same workflow and are about the same branch ("ref") or pull request. group: "workflow = ${{ github.workflow }}, ref = ${{ github.event.ref }}, pr = ${{ github.event.pull_request.id }}" # Cancel previous builds in the same concurrency group even if they are in progress # for pull requests or pushes to forks (not the upstream repository). cancel-in-progress: ${{ github.event_name == 'pull_request' || github.repository != 'hibernate/hibernate-orm' }} jobs: # Main job for h2/docker DBs. build: permissions: contents: read name: OpenJDK 17 - ${{matrix.rdbms}} runs-on: ubuntu-latest strategy: fail-fast: false matrix: include: - rdbms: h2 - rdbms: hsqldb - rdbms: mysql - rdbms: mariadb - rdbms: postgresql - rdbms: edb - rdbms: oracle - rdbms: db2 - rdbms: mssql - rdbms: sybase # Running with CockroachDB requires at least 2-4 vCPUs, which we don't have on GH Actions runners # - rdbms: cockroachdb # Running with HANA requires at least 8GB memory just for the database, which we don't have on GH Actions runners # - rdbms: hana steps: - uses: actions/checkout@v4 with: persist-credentials: false - name: Reclaim Disk Space run: .github/ci-prerequisites.sh - name: Start database env: RDBMS: ${{ matrix.rdbms }} run: ci/database-start.sh - name: Set up Java 17 uses: actions/setup-java@v4 with: distribution: 'temurin' java-version: '17' - name: Generate cache key id: cache-key run: | CURRENT_BRANCH="${{ github.repository != 'hibernate/hibernate-orm' && 'fork' || github.base_ref || github.ref_name }}" CURRENT_MONTH=$(/bin/date -u "+%Y-%m") CURRENT_DAY=$(/bin/date -u "+%d") ROOT_CACHE_KEY="buildtool-cache" echo "buildtool-monthly-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}" >> $GITHUB_OUTPUT echo "buildtool-monthly-branch-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}" >> $GITHUB_OUTPUT echo "buildtool-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}-${CURRENT_DAY}" >> $GITHUB_OUTPUT - name: Cache Maven/Gradle Local Caches id: cache-maven uses: actions/cache@v4 # if it's not a pull request, we restore and save the cache if: github.event_name != 'pull_request' with: path: | ~/.m2/repository/ ~/.m2/wrapper/ ~/.gradle/caches/ ~/.gradle/wrapper/ # A new cache will be stored daily. After that first store of the day, cache save actions will fail because the cache is immutable but it's not a problem. # The whole cache is dropped monthly to prevent unlimited growth. # The cache is per branch but in case we don't find a branch for a given branch, we will get a cache from another branch. key: ${{ steps.cache-key.outputs.buildtool-cache-key }} restore-keys: | ${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}- ${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}- - name: Restore Maven/Gradle Local Caches uses: actions/cache/restore@v4 # if it a pull request, we restore the cache but we don't save it if: github.event_name == 'pull_request' with: path: | ~/.m2/repository/ ~/.m2/wrapper/ ~/.gradle/caches/ ~/.gradle/wrapper/ key: ${{ steps.cache-key.outputs.buildtool-cache-key }} restore-keys: | ${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}- ${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}- - name: Run build script run: ./ci/build-github.sh shell: bash env: RDBMS: ${{ matrix.rdbms }} # For jobs running on 'push', publish build scan and cache immediately. # This won't work for pull requests, since they don't have access to secrets. POPULATE_REMOTE_GRADLE_CACHE: ${{ github.event_name == 'push' && github.repository == 'hibernate/hibernate-orm' && 'true' || 'false' }} DEVELOCITY_ACCESS_KEY: "${{ secrets.DEVELOCITY_ACCESS_KEY }}" # For jobs running on 'pull_request', tar and upload build scan data. # The actual publishing must be done in a separate job (see ci-report.yml). # We don't write to the remote cache as that would be unsafe. - name: Tar build scan content pushed to subsequent jobs if: "${{ github.event_name == 'pull_request' && !cancelled() }}" run: tar -czf build-scan-data.tgz -C ~/.gradle/build-scan-data . - name: Upload GitHub Actions artifact for the Develocity build scan uses: actions/upload-artifact@v4 if: "${{ github.event_name == 'pull_request' && !cancelled() }}" with: name: build-scan-data-${{ matrix.rdbms }} path: ~/.gradle/build-scan-data - name: Upload test reports (if Gradle failed) uses: actions/upload-artifact@v4 if: failure() with: name: test-reports-java11-${{ matrix.rdbms }} path: | ./**/target/reports/tests/ - name: Omit produced artifacts from build cache run: ./ci/before-cache.sh # Job for builds on Atlas (Oracle) infrastructure. # This is untrusted, even for pushes, see below. atlas: permissions: contents: read name: GraalVM 21 - ${{matrix.rdbms}} # runs-on: ubuntu-latest runs-on: [self-hosted, Linux, X64, OCI] strategy: fail-fast: false matrix: include: - rdbms: oracle_atps - rdbms: oracle_db19c - rdbms: oracle_db21c - rdbms: oracle_db23c steps: - uses: actions/checkout@v4 with: persist-credentials: false - name: Reclaim disk space and sanitize user home run: .github/ci-prerequisites-atlas.sh - name: Start database env: RDBMS: ${{ matrix.rdbms }} RUNID: ${{ github.run_number }} run: ci/database-start.sh - name: Set up Java 21 uses: graalvm/setup-graalvm@v1 with: distribution: 'graalvm' java-version: '21' - name: Generate cache key id: cache-key run: | CURRENT_BRANCH="${{ github.repository != 'hibernate/hibernate-orm' && 'fork' || github.base_ref || github.ref_name }}" CURRENT_MONTH=$(/bin/date -u "+%Y-%m") CURRENT_DAY=$(/bin/date -u "+%d") ROOT_CACHE_KEY="buildtool-cache-atlas" echo "buildtool-monthly-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}" >> $GITHUB_OUTPUT echo "buildtool-monthly-branch-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}" >> $GITHUB_OUTPUT echo "buildtool-cache-key=${ROOT_CACHE_KEY}-${CURRENT_MONTH}-${CURRENT_BRANCH}-${CURRENT_DAY}" >> $GITHUB_OUTPUT - name: Cache Maven/Gradle Local Caches id: cache-maven uses: actions/cache@v4 # if it's not a pull request, we restore and save the cache if: github.event_name != 'pull_request' with: path: | ~/.m2/repository/ ~/.m2/wrapper/ ~/.gradle/caches/ ~/.gradle/wrapper/ # A new cache will be stored daily. After that first store of the day, cache save actions will fail because the cache is immutable but it's not a problem. # The whole cache is dropped monthly to prevent unlimited growth. # The cache is per branch but in case we don't find a branch for a given branch, we will get a cache from another branch. key: ${{ steps.cache-key.outputs.buildtool-cache-key }} restore-keys: | ${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}- ${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}- - name: Restore Maven/Gradle Local Caches uses: actions/cache/restore@v4 # if it a pull request, we restore the cache but we don't save it if: github.event_name == 'pull_request' with: path: | ~/.m2/repository/ ~/.m2/wrapper/ ~/.gradle/caches/ ~/.gradle/wrapper/ key: ${{ steps.cache-key.outputs.buildtool-cache-key }} restore-keys: | ${{ steps.cache-key.outputs.buildtool-monthly-branch-cache-key }}- ${{ steps.cache-key.outputs.buildtool-monthly-cache-key }}- - name: Run build script env: RDBMS: ${{ matrix.rdbms }} RUNID: ${{ github.run_number }} run: ./ci/build-github.sh shell: bash # Tar and upload build scan data. # The actual publishing must be done in a separate job (see ci-report.yml). # We don't write to the remote cache as that would be unsafe. # That's even on push, because we do not trust Atlas runners to hold secrets: they are shared infrastructure. - name: Tar build scan content pushed to subsequent jobs if: "${{ !cancelled() }}" run: tar -czf build-scan-data.tgz -C ~/.gradle/build-scan-data . - name: Upload GitHub Actions artifact for the Develocity build scan uses: actions/upload-artifact@v4 if: "${{ !cancelled() }}" with: name: build-scan-data-${{ matrix.rdbms }} path: build-scan-data.tgz - name: Upload test reports (if Gradle failed) uses: actions/upload-artifact@v4 if: failure() with: name: test-reports-java11-${{ matrix.rdbms }} path: | ./**/target/reports/tests/ - name: Omit produced artifacts from build cache run: ./ci/before-cache.sh