CI

https://maven.apache.org/guides/mini/guide-deployment-security-settings.html
https://maven.apache.org/settings.html
https://docs.github.com/en/actions
https://www.jenkins.io/doc/

CI rules:
    use ./mvnw
    use -B batch mode
    cache ~/.m2/repository
    inject settings.xml from secret
    publish test reports and coverage reports

./mvnw -B clean verify
./mvnw -B clean deploy

verify:
    compile, test, integration checks, quality gates

deploy:
    publish artifact to remote repository

pipeline {
  agent any

  environment {
    MAVEN_OPTS = '-Dfile.encoding=UTF-8'
  }

  stages {
    stage('Test') {
      steps {
        sh './mvnw -B clean verify'
      }
      post {
        always {
          junit '**/target/surefire-reports/*.xml'
          archiveArtifacts artifacts: '**/target/site/jacoco/**', allowEmptyArchive: true
        }
      }
    }

    stage('Deploy') {
      when { branch 'main' }
      steps {
        withCredentials([file(credentialsId: 'maven-settings', variable: 'MAVEN_SETTINGS')]) {
          sh './mvnw -B -s "$MAVEN_SETTINGS" clean deploy'
        }
      }
    }
  }
}

name: maven

on:
  push:
  pull_request:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'
          cache: maven
      - run: ./mvnw -B clean verify

cat > settings.xml <<'EOF'
<settings>
  <servers>
    <server>
      <id>company-releases</id>
      <username>${env.MAVEN_REPO_USER}</username>
      <password>${env.MAVEN_REPO_PASSWORD}</password>
    </server>
  </servers>
</settings>
EOF

./mvnw -B -s settings.xml clean deploy

settings.xml:
    generate in CI workspace
    do not commit credentials

./mvnw -B clean package -DskipTests
docker build -t registry.example.com/order-api:${GIT_COMMIT} .

docker build \
  --secret id=maven_settings,src="$HOME/.m2/settings.xml" \
  -t registry.example.com/order-api:${GIT_COMMIT} .

check:
    tests cannot be silently skipped
    dependency cache is scoped by OS and pom hash
    deploy credentials are branch-protected
    release job writes artifact and tag once
    test/coverage/security reports are archived