action.yml

---
name: Build NPM
description: GitHub Action to build, analyze, and deploy an NPM project with SonarQube integration
inputs:
  working-directory:
    description: Relative path under github.workspace to execute the build in
    default: .
  artifactory-reader-role:
    description: Suffix for the Artifactory reader role in Vault. Defaults to `private-reader` for private repositories, and `public-reader`
      for public repositories.
    default: ''
  artifactory-deployer-role:
    description: Suffix for the Artifactory deployer role in Vault. Defaults to `qa-deployer` for private repositories, and
      `public-deployer` for public repositories.
    default: ''
  artifactory-deploy-repo:
    description: Deployment repository. Defaults to `sonarsource-npm-public-qa` for private repositories, and `sonarsource-npm-public-qa`
      for public repositories.
    default: ''
  deploy-pull-request:
    description: Whether to deploy pull request artifacts
    default: 'false'
  skip-tests:
    description: Whether to skip running tests
    default: 'false'
  cache-npm:
    description: Whether to cache NPM dependencies
    default: 'true'
  repox-url:
    description: URL for Repox
    default: https://repox.jfrog.io
  repox-artifactory-url:
    description: URL for Repox Artifactory API (overrides repox-url/artifactory if provided)
    default: ''
  sonar-platform:
    description: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans.
    default: next
  run-shadow-scans:
    description: If true, run sonar scanner on all 3 platforms using the provided URL and token.
     If false, run on the platform provided by SONAR_PLATFORM.
    default: 'false'
  build-name:
    description: Name of the build to publish. Defaults to the repository name.
    default: ''
  provenance:
    description: Whether to generate provenance attestation for built artifacts
    default: 'false'
  provenance-artifact-paths:
    description: >-
      Relative paths of the artifacts for which to generate a provenance attestation (glob pattern).
      Default is collected from '.attestation-artifacts/' directory
    default: ''
  generate-summary:
    description: Whether to generate a workflow summary after the build.
    default: 'true'

outputs:
  BUILD_NUMBER:
    description: The current build number. Also set as environment variable BUILD_NUMBER.
    value: ${{ steps.config.outputs.BUILD_NUMBER }}
  current-version:
    description: The project version set in package.json (before replacement). Also set as environment variable CURRENT_VERSION.
    value: ${{ steps.config.outputs.current-version }}
  project-version:
    description: The project version with build number (after replacement). Also set as environment variable PROJECT_VERSION.
    value: ${{ steps.config.outputs.project-version }}
  deployed:
    description: Whether artifacts were deployed
    value: ${{ steps.build.outputs.deployed }}

runs:
  using: composite
  steps:
    - name: Set local action paths
      id: set-path
      shell: bash
      run: |
        echo "::group::Fix for using local actions"
        echo "GITHUB_ACTION_PATH=$GITHUB_ACTION_PATH"
        echo "github.action_path=${{ github.action_path }}"
        ACTION_PATH_BUILD_NPM="${{ github.action_path }}"
        echo "ACTION_PATH_BUILD_NPM=$ACTION_PATH_BUILD_NPM"
        echo "ACTION_PATH_BUILD_NPM=$ACTION_PATH_BUILD_NPM" >> "$GITHUB_ENV"
        host_actions_root="$(dirname "$ACTION_PATH_BUILD_NPM")"
        echo "host_actions_root=$host_actions_root" >> "$GITHUB_OUTPUT"

        mkdir -p ".actions"
        ln -sf "$host_actions_root/get-build-number" .actions/get-build-number
        ln -sf "$host_actions_root/config-npm" .actions/config-npm
        ln -sf "$host_actions_root/shared" .actions/shared
        ls -la .actions/*
        echo "::endgroup::"

    - name: Set build parameters
      shell: bash
      env:
        ARTIFACTORY_READER_ROLE: ${{ inputs.artifactory-reader-role != '' && inputs.artifactory-reader-role ||
          (github.event.repository.visibility == 'public' && 'public-reader' || 'private-reader') }}
        ARTIFACTORY_DEPLOYER_ROLE: ${{ inputs.artifactory-deployer-role != '' && inputs.artifactory-deployer-role ||
          (github.event.repository.visibility == 'public' && 'public-deployer' || 'qa-deployer') }}
      run: |
        echo "ARTIFACTORY_READER_ROLE=${ARTIFACTORY_READER_ROLE}" >> "$GITHUB_ENV"
        echo "ARTIFACTORY_DEPLOYER_ROLE=${ARTIFACTORY_DEPLOYER_ROLE}" >> "$GITHUB_ENV"
        cp "$ACTION_PATH_BUILD_NPM/mise.local.toml" mise.local.toml

    - uses: jdx/mise-action@6d1e696aa24c1aa1bcc1adea0212707c71ab78a8 # v3.6.1
      with:
        version: 2026.1.0

    - uses: ./.actions/config-npm
      id: config
      with:
        host-actions-root: ${{ steps.set-path.outputs.host_actions_root }}
        artifactory-reader-role: ${{ env.ARTIFACTORY_READER_ROLE }}
        repox-url: ${{ inputs.repox-url }}
        repox-artifactory-url: ${{ inputs.repox-artifactory-url }}
        working-directory: ${{ inputs.working-directory }}
        cache-npm: ${{ inputs.cache-npm }}

    - uses: SonarSource/vault-action-wrapper@545e7cfbb5528e7009a1edcc83e073898d292627 # 3.2.0
      id: secrets
      # yamllint disable rule:line-length
      with:
        secrets: |
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/next url | NEXT_URL;' || '' }}
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/next token | NEXT_TOKEN;' || '' }}
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/sonarqube-us url | SQC_US_URL;' || '' }}
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/sonarqube-us token | SQC_US_TOKEN;' || '' }}
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/sonarcloud url | SQC_EU_URL;' || '' }}
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/sonarcloud token | SQC_EU_TOKEN;' || '' }}
          development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_DEPLOYER_ROLE }} access_token | ARTIFACTORY_DEPLOY_ACCESS_TOKEN;
      # yamllint enable rule:line-length
    - name: Build, test, analyze and deploy
      id: build
      shell: bash
      env:
        # GitHub context
        PULL_REQUEST: ${{ github.event.pull_request.number || '' }}
        PULL_REQUEST_SHA: ${{ github.event.pull_request.base.sha || '' }}
        DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        BUILD_NAME: ${{ inputs.build-name || github.event.repository.name }}

        ARTIFACTORY_URL: ${{ inputs.repox-artifactory-url != '' && inputs.repox-artifactory-url ||
          format('{0}/artifactory', inputs.repox-url) }}
        ARTIFACTORY_DEPLOY_REPO: ${{ inputs.artifactory-deploy-repo != '' && inputs.artifactory-deploy-repo ||
          (github.event.repository.visibility == 'public' && 'sonarsource-npm-public-qa' || 'sonarsource-npm-private-qa') }}
        ARTIFACTORY_DEPLOY_ACCESS_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_DEPLOY_ACCESS_TOKEN }}
        DEPLOY_PULL_REQUEST: ${{ inputs.deploy-pull-request }}
        SKIP_TESTS: ${{ inputs.skip-tests }}

        RUN_SHADOW_SCANS: ${{ inputs.run-shadow-scans }}
        SONAR_PLATFORM: ${{ inputs.sonar-platform }}
        NEXT_URL: ${{ fromJSON(steps.secrets.outputs.vault).NEXT_URL }}
        NEXT_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).NEXT_TOKEN }}
        SQC_EU_URL: ${{ fromJSON(steps.secrets.outputs.vault).SQC_EU_URL }}
        SQC_EU_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SQC_EU_TOKEN }}
        SQC_US_URL: ${{ fromJSON(steps.secrets.outputs.vault).SQC_US_URL }}
        SQC_US_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SQC_US_TOKEN }}
      working-directory: ${{ inputs.working-directory }}
      run: $ACTION_PATH_BUILD_NPM/build.sh

    - name: Archive logs
      if: failure()
      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
      with:
        name: npm-logs-${{ github.job }}${{ strategy.job-index }}
        path: ~/.npm/_logs/
        if-no-files-found: ignore

    - name: Generate provenance attestation
      if: >-
        ${{ inputs.provenance == 'true' &&
            github.event_name != 'pull_request' &&
            steps.build.outputs.deployed == 'true' &&
            (inputs.provenance-artifact-paths != '' || steps.build.outputs.artifact-paths != '') }}
      uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
      with:
        subject-path: >-
          ${{ inputs.provenance-artifact-paths != '' && inputs.provenance-artifact-paths || steps.build.outputs.artifact-paths }}
        show-summary: true

    - name: Generate workflow summary
      if: always() && inputs.generate-summary != 'false'
      shell: bash
      env:
        ARTIFACTORY_URL: ${{ inputs.repox-artifactory-url != '' && inputs.repox-artifactory-url ||
          format('{0}/artifactory', inputs.repox-url) }}
      run: |
        build_name="${GITHUB_REPOSITORY#*/}"
        echo "## 📦 NPM Build Summary (\`${GITHUB_JOB}\`)" >> $GITHUB_STEP_SUMMARY
        if [[ "${{ steps.build.conclusion }}" == "success" ]]; then
          echo "✅ **Build SUCCESS**" >> $GITHUB_STEP_SUMMARY
        else
          echo "❌ **Build FAILED**" >> $GITHUB_STEP_SUMMARY
        fi
        echo "### 📋 Build Information" >> $GITHUB_STEP_SUMMARY
        echo "- **Project**: \`$build_name\`" >> $GITHUB_STEP_SUMMARY
        echo "- **Version**: \`${PROJECT_VERSION}\`" >> $GITHUB_STEP_SUMMARY
        echo "- **Build Number**: \`${BUILD_NUMBER}\`" >> $GITHUB_STEP_SUMMARY
        echo "- **Branch**: \`${GITHUB_REF}\`" >> $GITHUB_STEP_SUMMARY
        echo "- **Commit**: \`$GITHUB_SHA\`" >> $GITHUB_STEP_SUMMARY

        if [[ "${{ steps.build.outputs.deployed }}" == true ]]; then
          echo "### 🚀 Deployment" >> $GITHUB_STEP_SUMMARY
          ARTIFACTORY_BROWSE_URL="${ARTIFACTORY_URL%/*}/ui/builds/$build_name/$BUILD_NUMBER"
          echo "🔗 **[Browse artifacts in Artifactory](${ARTIFACTORY_BROWSE_URL})**" >> $GITHUB_STEP_SUMMARY
        fi