pubcode/.github/workflows/analysis.yml at main · bcgov/pubcode · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
name: Analysis

on:
  push:
    branches: [main]
  merge_group:
  pull_request:
    types: [opened, reopened, synchronize, ready_for_review]
  schedule:
    - cron: "0 12 * * 0" # 3 AM PST = 12 PM UDT, runs sundays
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  # https://github.com/marketplace/actions/aqua-security-trivy
  trivy:
    name: Trivy Security Scan
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    runs-on: ubuntu-26.04
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha || '' }}

      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          format: "sarif"
          output: "trivy-results.sarif"
          ignore-unfixed: true
          scan-type: "fs"
          scanners: "vuln,secret,config"
          severity: "CRITICAL,HIGH"

      - name: Upload Trivy scan results to GitHub Security tab (PR)
        if: always() && github.event_name == 'pull_request'
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: "trivy-results.sarif"
          ref: refs/pull/${{ github.event.pull_request.number }}/head
          sha: ${{ github.event.pull_request.head.sha }}

      - name: Upload Trivy scan results to GitHub Security tab
        if: always() && github.event_name != 'pull_request'
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: "trivy-results.sarif"

  api-tests:
    name: API Tests
    runs-on: ubuntu-26.04
    timeout-minutes: 10
    permissions:
      contents: read
    services:
      mongo:
        image: ghcr.io/bcgov/nr-containers/mongo:7.0.43
        options: >-
          --health-cmd "mongosh --quiet --eval 'db.adminCommand({ ping: 1 })'"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 27017:27017
    defaults:
      run:
        working-directory: api
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: "24.x"
      - run: npm ci
      - run: npm test
        env:
          MONGO_URI: mongodb://localhost:27017/pubcode-test

  unit-tests:
    name: Unit Tests (${{ matrix.dir }})
    runs-on: ubuntu-26.04
    timeout-minutes: 10
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        dir: [crawler, schema/script, utilities/remove-deleted-pubcode]
    defaults:
      run:
        working-directory: ${{ matrix.dir }}
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: "24.x"
      - run: npm ci
      - run: npm test

  frontend-lint:
    name: Frontend Lint
    runs-on: ubuntu-26.04
    timeout-minutes: 10
    permissions:
      contents: read
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: "24.x"
      - run: npm ci
      - run: npm run lint

  # Catches broken workflows on the PR, including those that only run after merge or on a schedule
  workflow-lint:
    name: Workflow Lint
    runs-on: ubuntu-26.04
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7
      - uses: docker://rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
        with:
          args: -color

  # This job is the merge gate for this workflow. Every job in this
  # workflow must be listed in 'needs', or its failure won't block the PR.
  results:
    name: Analysis Results
    needs: [trivy, api-tests, unit-tests, frontend-lint, workflow-lint]
    if: always()
    runs-on: ubuntu-26.04
    timeout-minutes: 1
    steps:
      - name: Log Job Results Context
        run: |
          echo "=== Upstream Job Statuses ==="
          echo '${{ toJson(needs) }}'

      - name: Evaluate Overall Status
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
        run: |
          echo "At least one required job failed or was cancelled."
          exit 1

      - name: Success Message
        run: echo "All required jobs passed or were intentionally skipped."