tech-log-backend/.github/workflows/fileserver-pr.yml

name: fileserver-pr

# Every claim in docs/fileserver/support-matrix.md that says "Stable" is backed by a job here.
# A support level with no job behind it is a marketing claim, not an engineering one, and
# DocumentationCoverageTest fails the build when the two drift apart.

on:
  workflow_dispatch:
  pull_request:
    paths:
      - 'src/application-core/src/**/fileserver/**'
      - 'src/adapter/inbound/web/src/**/fileserver/**'
      - 'src/adapter/outbound/fileserver/**'
      - 'src/adapter/outbound/persistence-jpa/src/**/fileserver/**'
      - 'src/app-bootstrap/src/**/fileserver/**'
      - 'docs/fileserver/**'
      # The capability is not only its Java files. A change to the bound settings, the shipped
      # environment, the registry that documents it, or the container that has to give it a
      # writable volume changes how it behaves at runtime just as surely — and those were the
      # exact files that could previously ship unverified.
      - 'src/app-bootstrap/src/main/resources/application.yml'
      - 'src/.env'
      - 'docs/registries/env-keys.yaml'
      - 'src/Dockerfile'
      - 'docker-compose.yml'
      - 'infra/nginx/**'
      - 'infra/k8s/**'
      - '.github/workflows/fileserver-pr.yml'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  fileserver-unit-and-architecture:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - name: Validate Gradle wrapper
        id: gradle-wrapper-validation
        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
        with:
          distribution: temurin
          java-version: "21.0.11+10"
          cache: gradle
          cache-dependency-path: |
            src/**/*.gradle
            src/**/gradle-wrapper.properties
            src/**/gradle.lockfile
      - name: Run the fileserver application and architecture suites
        working-directory: src
        run: >-
          ./gradlew
          :application-core:test
          :app-bootstrap:test --tests '*CleanArchitectureTest' --tests '*Fileserver*'
          --no-daemon
          --stacktrace

  fileserver-local-ext4-contract:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - name: Validate Gradle wrapper
        id: gradle-wrapper-validation
        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
        with:
          distribution: temurin
          java-version: "21.0.11+10"
          cache: gradle
          cache-dependency-path: |
            src/**/*.gradle
            src/**/gradle-wrapper.properties
            src/**/gradle.lockfile
      - name: Certify the local content store against the shared contract
        working-directory: src
        run: >-
          ./gradlew
          :adapter:outbound:fileserver:test
          --no-daemon
          --stacktrace

  fileserver-http-contract:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - name: Validate Gradle wrapper
        id: gradle-wrapper-validation
        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
        with:
          distribution: temurin
          java-version: "21.0.11+10"
          cache: gradle
          cache-dependency-path: |
            src/**/*.gradle
            src/**/gradle-wrapper.properties
            src/**/gradle.lockfile
      - name: Run the servlet and reactive transport contracts
        working-directory: src
        run: >-
          ./gradlew
          :adapter:inbound:web:test
          --no-daemon
          --stacktrace

  fileserver-security-suite:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - name: Validate Gradle wrapper
        id: gradle-wrapper-validation
        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
        with:
          distribution: temurin
          java-version: "21.0.11+10"
          cache: gradle
          cache-dependency-path: |
            src/**/*.gradle
            src/**/gradle-wrapper.properties
            src/**/gradle.lockfile
      - name: Run the path, filename, range, and problem-detail hardening suite
        working-directory: src
        run: >-
          ./gradlew
          :adapter:inbound:web:test --tests '*FileserverHardeningContractTest'
          :adapter:outbound:fileserver:test --tests '*PhysicalPathResolverTest'
          --no-daemon
          --stacktrace

  fileserver-bounded-memory:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
      - name: Validate Gradle wrapper
        id: gradle-wrapper-validation
        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
        with:
          distribution: temurin
          java-version: "21.0.11+10"
          cache: gradle
          cache-dependency-path: |
            src/**/*.gradle
            src/**/gradle-wrapper.properties
            src/**/gradle.lockfile
      - name: Prove transfer cost does not scale with file size
        working-directory: src
        run: >-
          ./gradlew
          :adapter:outbound:fileserver:test --tests '*LargeFileBoundedMemoryTest'
          :adapter:inbound:web:test --tests '*DataBufferReleaseTest'
          --no-daemon
          --stacktrace