runs-on: ${{ matrix.platform }}

    steps:
    - name: Set up Go 1.x
      uses: actions/setup-go@v5
      with:
        go-version: ${{ matrix.go }}

    - name: Check out code into the Go module directory
      uses: actions/checkout@v4

    - name: go mod package cache
      uses: actions/cache@v4
      with:
        path: ~/go/pkg/mod

        env:
          GITHUB_CONTEXT: ${{ toJson(github) }}
        run: echo "$GITHUB_CONTEXT"
      - uses: actions/checkout@v6
      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}
      - name: Setup uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: |

    steps:
      - name: git clone
        uses: actions/checkout@v6
      - id: setup-matrix
        run: echo "matrix=$(jq -c -f .github/workflows/extract-unit-test-split.jq .teamcity/subprojects.json)" >> $GITHUB_OUTPUT
      - name: setup java
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: 17
      - id: determine-sys-prop-args
        uses: actions/github-script@v8
        with:

jobs:
  initial-build:
    runs-on: ubuntu-latest
    steps:
      - name: Set up JDK
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: 17
          distribution: 'temurin'

      - name: Checkout maven
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

permissions: {}

jobs:
  generate-and-submit:
    permissions:
      contents: write
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6
    - uses: actions/setup-java@v5
      with:
        distribution: temurin
        java-version: 17
    - name: Setup Gradle
      uses: gradle/actions/dependency-submission@v6
      env:

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::992382829881:role/GHASecrets_gradle_all
          aws-region: "eu-central-1"
      - name: get secrets
        uses: aws-actions/aws-secretsmanager-get-secrets@v3
        with:

      # - 11 (sometimes) to *download* to support anyone who runs JDiff or our Gradle integration tests (including our doc snapshots and our Java 11 CI test run) but not to use directly
      # - 25 for running Javadoc and javac (to help people who build Guava locally and might not use a recent JDK to run Maven)
      - name: 'Set up JDKs'
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::992382829881:role/GHASecrets_gradle_all
          aws-region: "eu-central-1"
      - name: get secrets
        uses: aws-actions/aws-secretsmanager-get-secrets@v3
        with:

jobs:
  #build-and-test-linux-x86-cpu:
  #  uses: ./.github/workflows/build-reusable.yml
  #  with:
  #    runner: 'linux-x86-n2-16'
  #    tfci: 'py313,linux_x86,rbe'

  #build-and-test-linux-x86-cuda:
  #  uses: ./.github/workflows/build-reusable.yml
  #  with:
  #    runner: 'linux-x86-n4-32'
  #    tfci: 'py313,linux_x86_cuda'

  #build-and-test-arm64:
  #  uses: ./.github/workflows/build-reusable.yml
  #  with:

      # contents: read
      # actions: read

    steps:
      - name: "Checkout code"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: "Run analysis"
        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
        with:
          results_file: results.sarif