build_publish.yml

name: Build and Publish package
on:
  push:
    branches: [ Bahmni-IPD-master ]
  workflow_dispatch:

jobs:
  Trivy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      - name: Trivy Scan
        run: |
          wget -q https://raw.githubusercontent.com/Bahmni/bahmni-infra-utils/main/trivy_scan.sh && chmod +x trivy_scan.sh
          ./trivy_scan.sh
          rm trivy_scan.sh
  build-publish-package:
    name: Build and Publish package
    runs-on: ubuntu-latest
    needs: Trivy
    steps:
      - uses: actions/checkout@v2
      - name: Set up JDK 1.8
        uses: actions/setup-java@v1
        with:
          java-version: 1.8
          server-id: nexus-sonatype
          server-username: NEXUS_USERNAME
          server-password: NEXUS_PASSWORD
      - name: Cache Maven packages
        uses: actions/cache@v3
        with:
          path: ~/.m2
          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
          restore-keys: ${{ runner.os }}-m2
      - name: Install Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '2.7'
          bundler-cache: true
      - name: Install compass
        run: |
          sudo gem install compass -v 1.0.3
      - name: Build and deploy with Maven
        run: |
          PROJECT_VERSION=$(./mvnw help:evaluate -Dexpression=project.version -q -DforceStdout)
          if [[ "$PROJECT_VERSION" == *"-SNAPSHOT" ]]; then
            ./mvnw --no-transfer-progress clean -U deploy
          else
            echo "❌ The current push is for release. So skipping build."
          fi
        env:
          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}