name: Unit and Integration Tests

# Security: Use minimal workflow-level permissions (principle of least privilege)

# Job-specific permissions are granted at the job level where needed

# Reference: https://docs.github.com/en/actions/security-guides/automatic-token-authentication

permissions:

contents: read

on:

workflow_call:

workflow_dispatch:

inputs:

archive_test_results:

description: 'If set to true, the unit and integration test results will be archived to the build artifacts page.'

required: false

default: 'false'

push:

branches:

- main

- '*.*.*'

pull_request_target:

types:

- opened

- reopened

- synchronize

paths-ignore:

- '**.md'

jobs:

authorize:

#concurrent runs for pull requests from forked repositories will be canceled, while runs for pull requests from the main repository won't be affected.

#for a pull_request against main: the concurrency check will cancel commit A so that commit B check can run.

concurrency:

group: ${{ github.workflow }}-${{ github.head_ref == 'main' && (github.event_name == 'push' && 'push-to-main' || github.event_name == 'pull_request' && 'merge-to-main') || github.event_name == 'pull_request_target' && github.event.pull_request.number || github.run_id }}

cancel-in-progress: ${{ github.event_name == 'pull_request' && github.base_ref == 'main' }}

environment: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}

runs-on: ubuntu-latest

steps:

- run: true

setup:

name: setup

needs: [authorize]

runs-on: ubuntu-24.04

outputs:

timestamp: ${{ steps.get-date.outputs.date }}

latestMergeSha: ${{ steps.get-sha.outputs.latestMergeSha }}

thisBranchName: ${{ steps.get-branch-name.outputs.thisBranchName }}

thisSha: ${{ steps.get-sha.outputs.latestMergeSha }}

setupSuccessful: "true"

steps:

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

with:

ref: ${{ github.event.pull_request.head.sha || github.ref }}

- name: Get current date

id: get-date

run: |

echo "date=$(date +'%Y-%m-%d %H:%M:%S %Z')" >> $GITHUB_OUTPUT

- name: Get Latest Merge Commit SHA

id: get-sha

run: |

latest_merge_sha=`(git rev-parse HEAD)`

echo "latestMergeSha=${latest_merge_sha}" >> $GITHUB_OUTPUT

- name: Get Current BranchName

id: get-branch-name

run: |

# this logic checks if the branch is from a forked repository PR or not. Where -n is the inverse of -z (not empty)

if [ -n "${GITHUB_HEAD_REF}" ];

then

branch_name=${GITHUB_HEAD_REF}

else

branch_name=${{ github.ref_name }}

fi

modified_branch_name=`(echo $branch_name | tr '/_' '-')`

echo "thisBranchName=$modified_branch_name" >> $GITHUB_OUTPUT

echo $modified_branch_name

build_tests:

name: Run Test for (Java ${{ matrix.java }} ${{ matrix.os }})

needs: setup

strategy:

fail-fast: false

matrix:

os: [ ubuntu-24.04, macos-15-intel, windows-latest ]

java: [ 17, 21, 25 ]

exclude:

- os: windows-latest

java: 17

- os: macos-15-intel

java: 17

runs-on: ${{ matrix.os }}

env:

OS_TYPE: ${{ matrix.os }}

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

steps:

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

with:

ref: ${{ github.event.pull_request.head.sha || github.event.after}}

- name: Built Code Cache

if: ${{ matrix.java == 17}}

uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5

with:

key: built-code-${{ github.run_number }}-${{ github.run_attempt }}

path: ./**/target

- name: Set up JDK ${{ matrix.java }}

uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0

with:

java-version: ${{ matrix.java }}

distribution: 'temurin'

cache: 'maven'

# look for dependencies in maven

- name: Configure Maven settings

shell: bash

run: |

mkdir -p ~/.m2

cp .github/maven/settings-snapshots.xml ~/.m2/settings.xml

echo "MAVEN_GPM_PASSWORD=${{ secrets.GITHUB_TOKEN }}" >> $GITHUB_ENV

# getting from build results page. If we remove 0-SNAPSHOT then we will need settings.xml

- name: Build & Test Java 17+

run: |

./mvnw -B "-Dbuild.repository.owner=liquibase" "-Dbuild.repository.name=liquibase" "-Dbuild.branch=${{ needs.setup.outputs.thisBranchName }}" "-Dbuild.number=${{ github.run_number }}" "-Dbuild.commit=${{ needs.setup.outputs.latestMergeSha }}" "-DtrimStackTrace=false" -P 'skip-integration-tests' clean test package surefire-report:report

- name: Remove Original Jars for *nix

if: env.OS_TYPE != 'windows-latest'

run: |

find . -name original-*.jar -exec rm {} \;

- name: Upload Artifacts for build.yml

if: ${{ matrix.java == 17 && matrix.os == 'ubuntu-24.04'}}

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

with:

name: temp-artifact

path: |

./**/target/*.jar

- name: Archive Test Results

if: ${{ inputs.archive_test_results == 'true' }}

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

with:

name: liquibase-test-results-jdk${{ matrix.java }}

path: |

./**/target/surefire-reports

./**/target/site

- name: Save Jacoco Report for Sonar

if: ${{ matrix.java == 17 && matrix.os == 'ubuntu-24.04'}}

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

with:

name: liquibase-jacoco-test-results

path: |

./liquibase-standard/target/jacoco.exec

- name: Archive Modules

if: ${{ matrix.java == 17 && matrix.os == 'ubuntu-24.04'}}

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

with:

name: liquibase-modules

path: |

*/target/*-0-SNAPSHOT.jar

fossa:

needs: build_tests

uses: liquibase/build-logic/.github/workflows/fossa_ai.yml@main

if: github.event_name != 'workflow_dispatch'

secrets: inherit

permissions:

actions: write

pull-requests: write

id-token: write

contents: read

with:

check_snippets: true

check_ai_generated_code: true

generate_fossa_3p_license_report: true

integration-test:

name: Integration Test

runs-on: ubuntu-24.04

strategy:

fail-fast: false

matrix:

testSystem:

- db2

- h2

#- h2:1.4

- hsqldb

- mariadb

- mssql

- mysql

- oracle

- postgresql

- sqlite

- firebird

needs: build_tests

timeout-minutes: 30

steps:

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

with:

ref: ${{ github.event.pull_request.head.sha || github.event.after}}

- name: Prepare

id: prepare

uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

with:

script: |

core.setOutput("testResultsArtifact", "liquibase-test-results-integration-${{ matrix.testSystem }}".replace(/[^a-zA-Z0-9\-_]/g, "_"));

- name: Set up JDK 17

if: ${{ matrix.testSystem != 'snowflake' }}

uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0

with:

java-version: '17'

distribution: 'temurin'

cache: 'maven'

- name: Set up JDK 17 # get rid of this after https://github.com/snowflakedb/snowflake-jdbc/issues/589 is fixed

if: ${{ matrix.testSystem == 'snowflake' }}

uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0

with:

java-version: '17'

distribution: 'temurin'

cache: 'maven'

# getting from build results page. If we remove 0-SNAPSHOT then we will need settings.xml

- name: Restore Built Code Cache

uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5

with:

key: built-code-${{ github.run_number }}-${{ github.run_attempt }}

path: ./**/target

- name: Run Tests

run: ./mvnw -B clean verify -DtrimStackTrace=false -Dliquibase.sdk.testSystem.test=${{ matrix.testSystem }} -Dliquibase.sdk.testSystem.acceptLicenses=${{ matrix.testSystem }} -Dliquibase.sdk.testSystem.snowflake.url=${{ env.TH_SNOW_URL }} -Dliquibase.sdk.testSystem.snowflake.username=${{ env.TH_DB_ADMIN }} -Dliquibase.sdk.testSystem.snowflake.password=${{ env.TH_DB_PASSWD }} -Dtest=*IntegrationTest,*ExecutorTest -DfailIfNoTests=false -Dsurefire.failIfNoSpecifiedTests=false -Dsurefire.failIfNoTests=false

- name: Archive Test Results

if: ${{ inputs.archive_test_results == 'true' }}

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

with:

name: ${{ steps.prepare.outputs.testResultsArtifact }}

path: |

./**/target/surefire-reports

- name: Save Jacoco Report for Sonar

uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

with:

name: liquibase-integration-jacoco-test-results-${{ matrix.testSystem }}

path: |

./liquibase-integration-tests/target/jacoco.exec

sonar:

needs: [ setup, build_tests, integration-test ]

uses: liquibase/build-logic/.github/workflows/sonar-coverage-merge.yml@main

permissions:

pull-requests: write

id-token: write

contents: read

with:

testedClassesModuleName: liquibase-standard

secrets: inherit

run-build-publish-file:

needs: [ build_tests,integration-test ]

uses: ./.github/workflows/build.yml

permissions:

contents: read

packages: write

actions: read

id-token: write

secrets: inherit