ci.yml

name: CI

on:
  push:
    branches: [main]
    tags: ['[0-9]*.[0-9]*.[0-9]*']
  pull_request:
    branches: [main]

jobs:
  unit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'temurin'
          cache: 'maven'
      - name: Build + unit tests
        run: mvn -B verify
        env:
          # Skip the gated integration test in this job
          JWT_API_TOKEN: ''

  integration:
    needs: unit
    runs-on: ubuntu-latest
    environment: Preproduction
    # Do not run on tag pushes. The tagged commit already ran integration on its
    # branch push; a second concurrent run submits an identical backtest that the
    # backend deduplicates to the same job, so the two runs race for its result and
    # the loser receives an empty Completed envelope. Branch pushes and PRs still gate.
    if: >-
      github.ref_type != 'tag' &&
      (github.event.pull_request.head.repo.full_name == github.repository || github.event_name == 'push')
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'temurin'
          cache: 'maven'
      - name: Run integration test
        env:
          JWT_API_TOKEN: ${{ secrets.JWT_API_TOKEN }}
          QTSURFER_API_URL: ${{ vars.QTSURFER_API_URL }}
          QTSURFER_TEST_VERBOSE: '1'
        run: |
          if [ -z "$JWT_API_TOKEN" ]; then
            echo "::warning::JWT_API_TOKEN not configured in the Preproduction environment; skipping."
            exit 0
          fi
          mvn -B -Dtest='*IntegrationTest' test

  release:
    needs: [unit, integration]
    runs-on: ubuntu-latest
    # integration is skipped on tag pushes (see above), so gate on it not having
    # failed rather than requiring success.
    if: >-
      always() &&
      startsWith(github.ref, 'refs/tags/') &&
      needs.unit.result == 'success' &&
      needs.integration.result != 'failure'
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          awk "/^## \[${GITHUB_REF_NAME}\]/{found=1; next} found && /^## \[/{exit} found{print}" \
            CHANGELOG.md > /tmp/release-notes.md
          gh release create "$GITHUB_REF_NAME" \
            --title "$GITHUB_REF_NAME" \
            --notes-file /tmp/release-notes.md