BUILD-8581 Add workflow for gradle

.shellspec

@@ -1,5 +1,5 @@
 # kcov (coverage) options
---kcov-options "--include-pattern=build-poetry,get-build-number,pr_cleanup,promote"
+--kcov-options "--include-pattern=build-poetry,get-build-number,pr_cleanup,promote,build-gradle"
 # --kcov-options "--exclude-pattern=.github,.idea,.git"
 
 # define minimum coverage (fail otherwise)

README.md

@@ -91,6 +91,90 @@ jobs:
 - `public-deployer` or `qa-deployer` Artifactory roles for the deployment.
 - `qa-deployer` Artifactory role for the QA deploy.
 
+## `build-gradle`
+
+Build and publish a Gradle project with SonarQube analysis and Artifactory deployment.
+
+### Usage
+
+_All the `with` parameters are optional and have default values which are shown below._
+
+```yaml
+name: Build
+on:
+  push:
+    branches:
+      - master
+      - branch-*
+  pull_request:
+  merge_group:
+  workflow_dispatch:
+
+jobs:
+  build:
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+      cancel-in-progress: ${{ github.ref_name != github.event.repository.default_branch }}
+    runs-on: ubuntu-24.04-large
+    name: Build
+    permissions:
+      id-token: write
+      contents: write
+    steps:
+      - uses: SonarSource/ci-github-actions/get-build-number@v1
+      - uses: SonarSource/ci-github-actions/build-gradle@v1
+        with:
+          artifactory-deploy-repo: ""                               # Artifactory repository name
+          artifactory-deploy-username: ""                           # Artifactory username
+          artifactory-deploy-password: ""                           # Artifactory password
+          deploy-pull-request: false                                # Deploy pull request artifacts
+          skip-tests: false                                         # Skip running tests
+          gradle-args: ""                                           # Additional Gradle arguments
+          gradle-version: ""                                        # Gradle version for setup-gradle
+          # if not provided Gradle Wrapper specified version will be used
+          gradle-wrapper-validation: true                           # Validate Gradle wrapper
+          develocity-url: https://develocity.sonar.build/           # Develocity URL
+          repox-url: https://repox.jfrog.io                         # Repox URL
+```
+
+⚠️ Required GitHub permissions:
+
+- `id-token: write`
+- `contents: write`
+
+⚠️ Required Vault permissions:
+
+- `development/kv/data/next`: SonarQube credentials
+- `development/kv/data/sign`: Artifact signing credentials
+- `development/kv/data/develocity`: Develocity access token
+
+### Inputs
+
+- `artifactory-deploy-repo`: Name of deployment repository (optional)
+- `artifactory-deploy-username`: Username to deploy to Artifactory (optional)
+- `artifactory-deploy-password`: Password to deploy to Artifactory (optional)
+- `deploy-pull-request`: Whether to deploy pull request artifacts (default: `false`)
+- `skip-tests`: Whether to skip running tests (default: `false`)
+- `gradle-args`: Additional arguments to pass to Gradle (optional)
+- `gradle-version`: Gradle version to use for setup-gradle action (optional)
+- `gradle-wrapper-validation`: Whether to validate Gradle wrapper (default: `true`)
+- `develocity-url`: URL for Develocity (default: `https://develocity.sonar.build/`)
+- `repox-url`: URL for Repox (default: `https://repox.jfrog.io`)
+
+### Outputs
+
+- `project-version`: The project version from gradle.properties
+
+### Features
+
+- Automated version management with build numbers
+- SonarQube analysis for code quality (credentials from Vault)
+- Conditional deployment based on branch patterns
+- Automatic artifact signing (credentials from Vault)
+- Pull request support with optional deployment
+- Develocity integration for build optimization
+- Comprehensive build logging and error handling
+
 ## `promote`
 
 This action promotes a build in JFrog Artifactory and updates the GitHub status check accordingly.

build-gradle/action.yml

@@ -0,0 +1,128 @@
+---
+name: Build Gradle
+description: GitHub Action to build, analyze, and deploy a Gradle project with SonarQube integration
+inputs:
+  artifactory-deploy-repo:
+    description: Name of deployment repository
+    required: false
+    default: ''
+  artifactory-deploy-username:
+    description: Username to deploy to Artifactory
+    required: false
+    default: ''
+  artifactory-deploy-password:
+    description: Password to deploy to Artifactory
+    required: false
+    default: ''
+  gradle-args:
+    description: Additional arguments to pass to Gradle
+    required: false
+    default: ''
+  gradle-version:
+    description: Gradle version to use for setup-gradle action
+    required: false
+    default: ''
+  deploy-pull-request:
+    description: Whether to deploy pull request artifacts
+    required: false
+    default: 'false'
+  skip-tests:
+    description: Whether to skip running tests
+    required: false
+    default: 'false'
+  gradle-wrapper-validation:
+    description: Whether to validate Gradle wrapper
+    required: false
+    default: 'true'
+  develocity-url:
+    description: URL for Develocity
+    required: false
+    default: https://develocity.sonar.build/
+  repox-url:
+    description: URL for Repox
+    required: false
+    default: https://repox.jfrog.io
+
+outputs:
+  project-version:
+    description: The project version from gradle.properties
+    value: ${{ steps.build.outputs.project-version }}
+
+runs:
+  using: composite
+  steps:
+    - name: Vault
+      id: secrets
+      uses: SonarSource/vault-action-wrapper@d6d745ffdbc82b040df839b903bc33b5592cd6b0 # 3.0.2
+      with:
+        secrets: |
+          development/kv/data/next url | SONAR_HOST_URL;
+          development/kv/data/next token | SONAR_TOKEN;
+          development/kv/data/sign key | SIGN_KEY;
+          development/kv/data/sign passphrase | PGP_PASSPHRASE;
+          development/kv/data/sign key_id | SIGN_KEY_ID;
+          development/kv/data/develocity token | DEVELOCITY_TOKEN;
+
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1
+      with:
+        gradle-version: ${{ inputs.gradle-version }}
+        develocity-access-key: >-
+          ${{ github.event.repository.visibility != 'public' &&
+          fromJSON(steps.secrets.outputs.vault).DEVELOCITY_TOKEN || '' }}
+        develocity-injection-enabled: ${{ steps.repo-visibility.outputs.repo-visibility != 'public' }}
+
+    - name: Build, analyze and deploy
+      id: build
+      shell: bash
+      env:
+        # GitHub context
+        PULL_REQUEST: ${{ github.event_name == 'pull_request' && github.event.number || 'false' }}
+        PULL_REQUEST_SHA: ${{ github.event.pull_request.base.sha }}
+
+        # Action inputs
+        ARTIFACTORY_URL: ${{ inputs.repox-url }}/artifactory
+        ARTIFACTORY_DEPLOY_REPO: ${{ inputs.artifactory-deploy-repo }}
+        ARTIFACTORY_DEPLOY_USERNAME: ${{ inputs.artifactory-deploy-username }}
+        ARTIFACTORY_DEPLOY_PASSWORD: ${{ inputs.artifactory-deploy-password }}
+        DEPLOY_PULL_REQUEST: ${{ inputs.deploy-pull-request }}
+        SKIP_TESTS: ${{ inputs.skip-tests }}
+        GRADLE_ARGS: ${{ inputs.gradle-args }}
+
+        # Vault secrets
+        SONAR_HOST_URL: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_HOST_URL }}
+        SONAR_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SONAR_TOKEN }}
+        ORG_GRADLE_PROJECT_signingKey: ${{ fromJSON(steps.secrets.outputs.vault).SIGN_KEY }}
+        ORG_GRADLE_PROJECT_signingPassword: ${{ fromJSON(steps.secrets.outputs.vault).PGP_PASSPHRASE }}
+        ORG_GRADLE_PROJECT_signingKeyId: ${{ fromJSON(steps.secrets.outputs.vault).SIGN_KEY_ID }}
+      run: |
+        ${{ github.action_path }}/build.sh
+
+    - name: Generate workflow summary
+      if: always()
+      shell: bash
+      run: |
+        echo "## 🏗️ Gradle Build Summary" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+
+        # Basic build information
+        echo "### 📋 Build Information" >> $GITHUB_STEP_SUMMARY
+        echo "- **Project**: ${GITHUB_REPOSITORY#*/}" >> $GITHUB_STEP_SUMMARY
+        echo "- **Version**: ${{ steps.build.outputs.project-version || 'Unknown' }}" >> $GITHUB_STEP_SUMMARY
+        echo "- **Build Number**: ${{ env.BUILD_NUMBER }}" >> $GITHUB_STEP_SUMMARY
+        echo "- **Commit**: \`${{ github.sha }}\`" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+
+        # Deployment information
+        if [[ -n "${{ inputs.artifactory-deploy-repo }}" ]]; then
+          echo "### 🚀 Deployment" >> $GITHUB_STEP_SUMMARY
+          if [[ "${{ steps.build.conclusion }}" == "success" ]]; then
+            echo "✅ **Artifacts deployed to Artifactory**" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            ARTIFACTORY_BROWSE_URL="${{ inputs.repox-url }}/ui/repos/tree/General/${{ inputs.artifactory-deploy-repo }}"
+            echo "🔗 **[Browse artifacts in Artifactory](${ARTIFACTORY_BROWSE_URL})**" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "❌ **Deployment failed** (build unsuccessful)" >> $GITHUB_STEP_SUMMARY
+          fi
+          echo "" >> $GITHUB_STEP_SUMMARY
+        fi