permissions:
      contents: read
    runs-on: ubuntu-latest
    needs: build
    strategy:
      matrix:
        bucket: ${{ fromJson(needs.build.outputs.matrix) }}
      fail-fast: false
    steps:
      - name: git clone
        uses: actions/checkout@v4
      - name: setup java
        uses: actions/setup-java@v4
        with:
          distribution: temurin

      contents: read  # for actions/checkout to fetch code
      security-events: write  # for github/codeql-action/analyze to upload SARIF results
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        # Override automatic language detection by changing the below list
        # Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
        language: ['java', 'javascript']

      with:
        distribution: temurin
        java-version: 11
    - name: Setup Gradle
      uses: gradle/actions/dependency-submission@v3
      with:
        # Action runs a custom dependencies task that fails with config-cache on Gradle 8.7 (works with 8.6)
        additional-arguments: --no-configuration-cache
      env:
        # Exclude some projects and configurations that should not contribute to the dependency graph