name: 'SDK Java'

on:
  pull_request:
    branches:
      - 'main'
      - 'release/**'
    paths:
      - 'packages/sdk-java/**'
      - 'packages/cli/src/commands/serve.ts'
      - 'packages/cli/src/serve/**'
      - 'packages/cli/src/acp-integration/**'
      - 'packages/acp-bridge/**'
      - 'integration-tests/fake-openai-server.ts'
      - 'package.json'
      - 'package-lock.json'
      - 'docs/developers/sdk-java.md'
      - 'docs/design/java-daemon-sdk-alpha.md'
      - 'scripts/run-java-daemon-sdk-e2e.ts'
      - '.github/workflows/sdk-java.yml'
      - '.github/workflows/release-sdk-java.yml'
  push:
    branches:
      - 'main'
      - 'release/**'
    paths:
      - 'packages/sdk-java/**'
      - 'packages/cli/src/commands/serve.ts'
      - 'packages/cli/src/serve/**'
      - 'packages/cli/src/acp-integration/**'
      - 'packages/acp-bridge/**'
      - 'integration-tests/fake-openai-server.ts'
      - 'package.json'
      - 'package-lock.json'
      - 'docs/developers/sdk-java.md'
      - 'docs/design/java-daemon-sdk-alpha.md'
      - 'scripts/run-java-daemon-sdk-e2e.ts'
      - '.github/workflows/sdk-java.yml'
      - '.github/workflows/release-sdk-java.yml'

permissions:
  contents: 'read'

env:
  MAVEN_VERSION: '3.9.11'
  MAVEN_SHA512: 'bcfe4fe305c962ace56ac7b5fc7a08b87d5abd8b7e89027ab251069faebee516b0ded8961445d6d91ec1985dfe30f8153268843c89aa392733d1a3ec956c9978'

concurrency:
  group: 'sdk-java-${{ github.event.pull_request.number || github.run_id }}'
  cancel-in-progress: true

jobs:
  test:
    name: '${{ matrix.os }} / Java ${{ matrix.java }}'
    runs-on: '${{ (matrix.os == ''ubuntu-latest'' && github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'' && (github.event_name == ''push'' || github.event.pull_request.head.repo.full_name == github.repository || contains(fromJSON(''["OWNER","MEMBER","COLLABORATOR"]''), github.event.pull_request.author_association))) && fromJSON(''["self-hosted", "linux", "x64", "ecs-qwen"]'') || matrix.os }}'
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: 'ubuntu-latest'
            java: '11'
          - os: 'ubuntu-latest'
            java: '17'
          - os: 'ubuntu-latest'
            java: '21'
          - os: 'macos-latest'
            java: '21'
          - os: 'windows-latest'
            java: '21'
    steps:
      - name: 'Restore workspace ownership'
        if: "${{ runner.environment == 'self-hosted' }}"
        run: |-
          set -uo pipefail
          RUNNER_UID="$(id -u)"
          RUNNER_GID="$(id -g)"
          if [ "$RUNNER_UID" != "0" ]; then
            chown -R "$RUNNER_UID:$RUNNER_GID" "$GITHUB_WORKSPACE" 2>/dev/null || sudo -n chown -R "$RUNNER_UID:$RUNNER_GID" "$GITHUB_WORKSPACE" || echo "::warning::could not restore workspace ownership; checkout may fail on leftover root-owned files"
          fi
          chmod -R u+rwX "$GITHUB_WORKSPACE" 2>/dev/null || sudo -n chmod -R u+rwX "$GITHUB_WORKSPACE" || echo "::warning::could not restore workspace write permissions; checkout may fail on leftover read-only files"

      - name: 'Checkout'
        uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3
        with:
          ref: "${{ (runner.environment == 'self-hosted' && github.event_name == 'pull_request' && format('refs/pull/{0}/head', github.event.pull_request.number)) || github.ref }}"

      - name: 'Verify checkout includes expected head commit'
        if: "${{ runner.environment == 'self-hosted' && github.event_name == 'pull_request' }}"
        env:
          EXPECTED_SHA: '${{ github.event.pull_request.head.sha }}'
        run: |-
          if ! git merge-base --is-ancestor "${EXPECTED_SHA}" HEAD; then
            echo "::error::Checked out ref does not contain expected head ${EXPECTED_SHA}."
            git log --oneline --decorate -5
            exit 1
          fi

      # Runner instances on one self-hosted machine share $HOME and therefore
      # ~/.m2/toolchains.xml. setup-java merges its JDK entry into that file
      # with a non-atomic read-modify-write, so two concurrent jobs can tear
      # it — and once torn, every later job on the machine fails Set up Java
      # with "Cannot insert a text node as a child of a document node". The
      # build never reads toolchains.xml (no maven-toolchains-plugin), so
      # dropping it is free and setup-java rewrites it from scratch.
      - name: 'Drop shared Maven toolchains.xml (self-hosted)'
        if: "${{ runner.environment == 'self-hosted' }}"
        run: 'rm -f "${HOME}/.m2/toolchains.xml"'

      - name: 'Set up Java'
        uses: 'actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654' # v5.2.0
        with:
          distribution: 'temurin'
          java-version: '${{ matrix.java }}'
          cache: 'maven'
          cache-dependency-path: 'packages/sdk-java/qwencode/pom.xml'

      - name: 'Set up Maven (self-hosted)'
        if: "${{ runner.environment == 'self-hosted' }}"
        run: |-
          archive="${RUNNER_TEMP}/apache-maven-${MAVEN_VERSION}-bin.tar.gz"
          curl -fsSL "https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/${MAVEN_VERSION}/apache-maven-${MAVEN_VERSION}-bin.tar.gz" -o "${archive}"
          echo "${MAVEN_SHA512}  ${archive}" | sha512sum --check --status
          tar -xzf "${archive}" -C "${RUNNER_TEMP}"
          echo "${RUNNER_TEMP}/apache-maven-${MAVEN_VERSION}/bin" >> "${GITHUB_PATH}"

      - name: 'Run Java SDK tests'
        working-directory: 'packages/sdk-java/qwencode'
        run: 'mvn --batch-mode --no-transfer-progress clean test'

      - name: 'Run Java SDK Checkstyle'
        if: "${{ matrix.os == 'ubuntu-latest' && matrix.java == '11' }}"
        working-directory: 'packages/sdk-java/qwencode'
        run: 'mvn --batch-mode --no-transfer-progress checkstyle:check'

      - name: 'Build release artifacts'
        if: "${{ matrix.os == 'ubuntu-latest' && matrix.java == '11' }}"
        working-directory: 'packages/sdk-java/qwencode'
        run: 'mvn --batch-mode --no-transfer-progress -DskipTests -Dgpg.skip=true package'

  daemon-e2e:
    name: 'Real daemon E2E / Java 11'
    runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'' && (github.event_name == ''push'' || github.event.pull_request.head.repo.full_name == github.repository || contains(fromJSON(''["OWNER","MEMBER","COLLABORATOR"]''), github.event.pull_request.author_association))) && fromJSON(''["self-hosted", "linux", "x64", "ecs-qwen"]'') || ''ubuntu-latest'' }}'
    timeout-minutes: 30
    steps:
      - name: 'Restore workspace ownership'
        if: "${{ runner.environment == 'self-hosted' }}"
        run: |-
          set -uo pipefail
          RUNNER_UID="$(id -u)"
          RUNNER_GID="$(id -g)"
          if [ "$RUNNER_UID" != "0" ]; then
            chown -R "$RUNNER_UID:$RUNNER_GID" "$GITHUB_WORKSPACE" 2>/dev/null || sudo -n chown -R "$RUNNER_UID:$RUNNER_GID" "$GITHUB_WORKSPACE" || echo "::warning::could not restore workspace ownership; checkout may fail on leftover root-owned files"
          fi
          chmod -R u+rwX "$GITHUB_WORKSPACE" 2>/dev/null || sudo -n chmod -R u+rwX "$GITHUB_WORKSPACE" || echo "::warning::could not restore workspace write permissions; checkout may fail on leftover read-only files"

      - name: 'Checkout'
        uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3
        with:
          ref: "${{ (runner.environment == 'self-hosted' && github.event_name == 'pull_request' && format('refs/pull/{0}/head', github.event.pull_request.number)) || github.ref }}"

      - name: 'Verify checkout includes expected head commit'
        if: "${{ runner.environment == 'self-hosted' && github.event_name == 'pull_request' }}"
        env:
          EXPECTED_SHA: '${{ github.event.pull_request.head.sha }}'
        run: |-
          if ! git merge-base --is-ancestor "${EXPECTED_SHA}" HEAD; then
            echo "::error::Checked out ref does not contain expected head ${EXPECTED_SHA}."
            git log --oneline --decorate -5
            exit 1
          fi

      # Self-hosted can't reach nodejs.org reliably; reuse the machine's Node.
      - name: 'Set up Node.js 22 (hosted)'
        if: "${{ runner.environment == 'github-hosted' }}"
        uses: 'actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e' # v6.4.0
        with:
          node-version: '22'
          cache: 'npm'

      - name: 'Use pre-installed Node.js (self-hosted)'
        if: "${{ runner.environment == 'self-hosted' }}"
        run: |-
          if ! command -v node >/dev/null 2>&1; then
            echo "::error::Node.js is not on PATH for this self-hosted runner. Provision Node 22.x or set MAINTAINER_ECS_RUNNER_DISABLED=true."
            exit 1
          fi
          echo "Using pre-installed Node $(node -v) / npm $(npm -v)"
          if [[ "$(node -p 'process.versions.node.split(".")[0]')" != "22" ]]; then
            echo "::warning::Expected Node 22.x but found $(node -v); daemon E2E will run against the runner's Node."
          fi

      # Same shared-$HOME hazard as the unit job above: drop the torn-prone
      # toolchains.xml so a corrupt leftover cannot fail Set up Java.
      - name: 'Drop shared Maven toolchains.xml (self-hosted)'
        if: "${{ runner.environment == 'self-hosted' }}"
        run: 'rm -f "${HOME}/.m2/toolchains.xml"'

      - name: 'Set up Java'
        uses: 'actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654' # v5.2.0
        with:
          distribution: 'temurin'
          java-version: '11'
          cache: 'maven'
          cache-dependency-path: 'packages/sdk-java/qwencode/pom.xml'

      - name: 'Set up Maven (self-hosted)'
        if: "${{ runner.environment == 'self-hosted' }}"
        run: |-
          archive="${RUNNER_TEMP}/apache-maven-${MAVEN_VERSION}-bin.tar.gz"
          curl -fsSL "https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/${MAVEN_VERSION}/apache-maven-${MAVEN_VERSION}-bin.tar.gz" -o "${archive}"
          echo "${MAVEN_SHA512}  ${archive}" | sha512sum --check --status
          tar -xzf "${archive}" -C "${RUNNER_TEMP}"
          echo "${RUNNER_TEMP}/apache-maven-${MAVEN_VERSION}/bin" >> "${GITHUB_PATH}"

      - name: 'Install Node.js dependencies'
        run: 'npm ci --prefer-offline --no-audit --progress=false'

      - name: 'Build Qwen Code'
        run: 'npm run build'

      - name: 'Bundle Qwen Code'
        run: 'npm run bundle'

      - name: 'Run Java daemon E2E'
        run: 'npx tsx scripts/run-java-daemon-sdk-e2e.ts'