action.yml

---
name: Build Yarn
description: GitHub Action to build, analyze, and deploy a Yarn project with SonarQube integration
inputs:
  working-directory:
    description: Relative path under github.workspace to execute the build in
    default: .
  public:
    description: Deprecated. Use `artifactory-reader-role`, `artifactory-deployer-role`, and `artifactory-deploy-repo` instead.
    default: ${{ github.event.repository.visibility == 'public' && 'true' || 'false' }}
  artifactory-reader-role:
    description: Suffix for the Artifactory reader role in Vault. Defaults to `private-reader` for private repositories, and `public-reader`
      for public repositories.
    default: ''
  artifactory-deployer-role:
    description: Suffix for the Artifactory deployer role in Vault. Defaults to `qa-deployer` for private repositories, and
      `public-deployer` for public repositories.
    default: ''
  artifactory-deploy-repo:
    description: Deployment repository. Defaults to `sonarsource-private-qa` for private repositories, and `sonarsource-public-qa` for
      public repositories.
    default: ''
  deploy-pull-request:
    description: Whether to deploy pull request artifacts
    default: 'false'
  skip-tests:
    description: Whether to skip running tests
    default: 'false'
  cache-yarn:
    description: Whether to cache Yarn dependencies
    default: 'true'
  repox-url:
    description: URL for Repox
    default: https://repox.jfrog.io
  repox-artifactory-url:
    description: URL for Repox Artifactory API (overrides repox-url/artifactory if provided)
    default: ''
  sonar-platform:
    description: SonarQube primary platform (next, sqc-eu, sqc-us, or none). Use 'none' to skip sonar scans.
    default: next
  run-shadow-scans:
    description: If true, run sonar scanner on all 3 platforms using the provided URL and token.
     If false, run on the platform provided by SONAR_PLATFORM.
    default: 'false'
  provenance:
    description: Whether to generate provenance attestation for built artifacts
    default: 'false'
  provenance-artifact-paths:
    description: >-
      Relative paths of the artifacts for which to generate a provenance attestation (glob pattern).
      Default is collected from '.attestation-artifacts/' directory
    default: ''
  generate-summary:
    description: Whether to generate a workflow summary after the build.
    default: 'true'

outputs:
  project-version:
    description: The project version from package.json
    value: ${{ steps.build.outputs.project-version }}
  BUILD_NUMBER:
    description: The build number, incremented or reused if already cached
    value: ${{ steps.get_build_number.outputs.BUILD_NUMBER }}
  deployed:
    description: Whether artifacts were deployed
    value: ${{ steps.build.outputs.deployed }}

runs:
  using: composite
  steps:
    - name: Set local action paths
      id: set-path
      shell: bash
      run: |
        echo "::group::Fix for using local actions"
        echo "GITHUB_ACTION_PATH=$GITHUB_ACTION_PATH"
        echo "github.action_path=${{ github.action_path }}"
        ACTION_PATH_BUILD_YARN="${{ github.action_path }}"
        echo "ACTION_PATH_BUILD_YARN=$ACTION_PATH_BUILD_YARN"
        echo "ACTION_PATH_BUILD_YARN=$ACTION_PATH_BUILD_YARN" >> "$GITHUB_ENV"
        host_actions_root="$(dirname "$ACTION_PATH_BUILD_YARN")"
        echo "host_actions_root=$host_actions_root" >> "$GITHUB_OUTPUT"

        mkdir -p ".actions"
        ln -sf "$host_actions_root/get-build-number" .actions/get-build-number
        ln -sf "$host_actions_root/shared" .actions/shared
        ls -la .actions/*
        echo "::endgroup::"

    - uses: ./.actions/get-build-number
      id: get_build_number
      with:
        host-actions-root: ${{ steps.set-path.outputs.host_actions_root }}

    - name: Set build parameters
      shell: bash
      env:
        ARTIFACTORY_READER_ROLE: ${{ inputs.artifactory-reader-role != '' && inputs.artifactory-reader-role ||
          (github.event.repository.visibility == 'public' && 'public-reader' || 'private-reader') }}
        ARTIFACTORY_DEPLOYER_ROLE: ${{ inputs.artifactory-deployer-role != '' && inputs.artifactory-deployer-role ||
          (github.event.repository.visibility == 'public' && 'public-deployer' || 'qa-deployer') }}
      working-directory: ${{ inputs.working-directory }}
      run: |
        echo "ARTIFACTORY_READER_ROLE=${ARTIFACTORY_READER_ROLE}" >> "$GITHUB_ENV"
        echo "ARTIFACTORY_DEPLOYER_ROLE=${ARTIFACTORY_DEPLOYER_ROLE}" >> "$GITHUB_ENV"
        cp "$ACTION_PATH_BUILD_YARN/mise.local.toml" mise.local.toml

    - uses: jdx/mise-action@6d1e696aa24c1aa1bcc1adea0212707c71ab78a8 # v3.6.1
      with:
        version: 2026.1.0
        working_directory: ${{ inputs.working-directory }}

    - name: Cache Yarn dependencies
      uses: SonarSource/gh-action_cache@v1
      if: ${{ inputs.cache-yarn == 'true' }}
      with:
        path: |
          ~/.yarn
        key: yarn-${{ runner.os }}-${{ hashFiles('**/yarn.lock') }}
        restore-keys: yarn-${{ runner.os }}-

    - uses: SonarSource/vault-action-wrapper@545e7cfbb5528e7009a1edcc83e073898d292627 # 3.2.0
      id: secrets
      # yamllint disable rule:line-length
      with:
        secrets: |
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/next url | NEXT_URL;' || '' }}
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/next token | NEXT_TOKEN;' || '' }}
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/sonarqube-us url | SQC_US_URL;' || '' }}
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/sonarqube-us token | SQC_US_TOKEN;' || '' }}
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/sonarcloud url | SQC_EU_URL;' || '' }}
          ${{ inputs.sonar-platform != 'none' && 'development/kv/data/sonarcloud token | SQC_EU_TOKEN;' || '' }}
          development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME;
          development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN;
          development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_DEPLOYER_ROLE }} access_token | ARTIFACTORY_DEPLOY_ACCESS_TOKEN;
      # yamllint enable rule:line-length

    - name: Build, test, analyze and deploy
      id: build
      shell: bash
      env:
        # GitHub context
        PULL_REQUEST: ${{ github.event.pull_request.number || '' }}
        DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}

        # Action inputs
        ARTIFACTORY_URL: ${{ inputs.repox-artifactory-url != '' && inputs.repox-artifactory-url ||
          format('{0}/artifactory', inputs.repox-url) }}
        ARTIFACTORY_DEPLOY_REPO: ${{ inputs.artifactory-deploy-repo != '' && inputs.artifactory-deploy-repo ||
          github.event.repository.visibility == 'public' && 'sonarsource-public-qa' || 'sonarsource-private-qa' }}
        ARTIFACTORY_USERNAME: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_USERNAME }}
        ARTIFACTORY_ACCESS_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_ACCESS_TOKEN }}
        ARTIFACTORY_DEPLOY_ACCESS_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_DEPLOY_ACCESS_TOKEN }}
        DEPLOY_PULL_REQUEST: ${{ inputs.deploy-pull-request }}
        SKIP_TESTS: ${{ inputs.skip-tests }}

        # Vault secrets
        SQC_EU_URL: ${{ fromJSON(steps.secrets.outputs.vault).SQC_EU_URL }}
        SQC_US_URL: ${{ fromJSON(steps.secrets.outputs.vault).SQC_US_URL }}
        NEXT_URL: ${{ fromJSON(steps.secrets.outputs.vault).NEXT_URL }}
        NEXT_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).NEXT_TOKEN }}
        SQC_EU_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SQC_EU_TOKEN }}
        SQC_US_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).SQC_US_TOKEN }}
        SONAR_PLATFORM: ${{ inputs.sonar-platform }}
        RUN_SHADOW_SCANS: ${{ inputs.run-shadow-scans }}
      working-directory: ${{ inputs.working-directory }}
      run: $ACTION_PATH_BUILD_YARN/build.sh

    - name: Generate provenance attestation
      if: >-
        ${{ inputs.provenance == 'true' &&
            github.event_name != 'pull_request' &&
            steps.build.outputs.deployed == 'true' &&
            (inputs.provenance-artifact-paths != '' || steps.build.outputs.artifact-paths != '') }}
      uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
      with:
        subject-path: >-
          ${{ inputs.provenance-artifact-paths != '' && inputs.provenance-artifact-paths || steps.build.outputs.artifact-paths }}
        show-summary: true

    - name: Generate workflow summary
      if: always() && inputs.generate-summary != 'false'
      shell: bash
      env:
        ARTIFACTORY_URL: ${{ inputs.repox-artifactory-url != '' && inputs.repox-artifactory-url ||
          format('{0}/artifactory', inputs.repox-url) }}
      run: |
        build_name="${GITHUB_REPOSITORY#*/}"
        echo "## 📦 Yarn Build Summary (\`${GITHUB_JOB}\`)" >> $GITHUB_STEP_SUMMARY
        if [[ "${{ steps.build.conclusion }}" == "success" ]]; then
          echo "✅ **Build SUCCESS**" >> $GITHUB_STEP_SUMMARY
        else
          echo "❌ **Build FAILED**" >> $GITHUB_STEP_SUMMARY
        fi
        echo "### 📋 Build Information" >> $GITHUB_STEP_SUMMARY
        echo "- **Project**: \`$build_name\`" >> $GITHUB_STEP_SUMMARY
        echo "- **Version**: \`${PROJECT_VERSION}\`" >> $GITHUB_STEP_SUMMARY
        echo "- **Build Number**: \`${BUILD_NUMBER}\`" >> $GITHUB_STEP_SUMMARY
        echo "- **Branch**: \`${GITHUB_REF}\`" >> $GITHUB_STEP_SUMMARY
        echo "- **Commit**: \`$GITHUB_SHA\`" >> $GITHUB_STEP_SUMMARY

        if [[ "${{ steps.build.outputs.deployed }}" == true ]]; then
          echo "### 🚀 Deployment" >> $GITHUB_STEP_SUMMARY
          ARTIFACTORY_BROWSE_URL="${ARTIFACTORY_URL%/*}/ui/builds/$build_name/$BUILD_NUMBER"
          echo "🔗 **[Browse artifacts in Artifactory](${ARTIFACTORY_BROWSE_URL})**" >> $GITHUB_STEP_SUMMARY
        fi