SignalRange/.github/workflows/build-pipeline.yml at 923feb987101041d8ee3680deb1d9a04c6aa3c8f · thkruz/SignalRange · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
---
name: Build Pipeline

on:
  workflow_dispatch:
  pull_request:
    branches:
      - main
      - develop

permissions:
  contents: read
  issues: write
  actions: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint-yml:
    name: Yaml Lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
      - name: YAML Lint
        uses: ibiqlik/action-yamllint@v3.1.1
        with:
          file_or_dir: .github/workflows/build-pipeline.yml
        continue-on-error: true

  compliance:
    needs: lint-yml
    name: NPM Audit Report
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
      - name: NPM Audit Action
        uses: oke-py/npm-audit-action@main
        with:
          working_directory: ./
          issue_assignees: thkruz
          issue_labels: Security
          dedupe_issues: true
          github_token: ${{ secrets.GITHUB_TOKEN }}
        continue-on-error: true

  lint-and-test:
    needs: compliance
    name: Lint and Unit Tests
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./
    strategy:
      fail-fast: false
      matrix:
        task: [eslint, unit-test]
    steps:
      - uses: actions/checkout@v4
      - name: Setup Node.js
        uses: actions/setup-node@v3
        with:
          node-version: '18'
      - name: Cache node modules
        uses: actions/cache@v4.2.3
        with:
          path: ~/.npm
          key: ${{ runner.os }}-build-node-modules-${{
            hashFiles('package-lock.json') }}
          restore-keys: ${{ runner.os }}-build-node-modules-${{ runner.os }}-
      - name: Install Dependencies
        run: npm ci --ignore-scripts

      - name: Update submodules
        run: git submodule update --init --recursive
        working-directory: ./
      - name: Set Timezone (only for tests)
        if: matrix.task == 'unit-test'
        uses: szenius/set-timezone@v1.2
        with:
          timezoneLinux: 'America/New_York'
      - name: Run ESLint
        if: matrix.task == 'eslint'
        run: |
          echo "Running ESLint..."
          npm run lint
          echo '### ESLint Passed' >> $GITHUB_STEP_SUMMARY
      - name: Run Unit Tests
        if: matrix.task == 'unit-test'
        run: |
          echo "Running Unit Tests..."
          npm test
          echo '### Unit Tests Passed' >> $GITHUB_STEP_SUMMARY

  build:
    needs: [lint-and-test]
    name: Build
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
      - name: Setup Node.js
        uses: actions/setup-node@v3
        with:
          node-version: '18'
      - name: Cache node modules
        uses: actions/cache@v4.2.3
        with:
          path: ~/.npm
          key: ${{ runner.os }}-build-node-modules-${{
            hashFiles('package-lock.json') }}
          restore-keys: ${{ runner.os }}-build-node-modules-${{ runner.os }}-
      - name: Update submodules
        run: git submodule update --init --recursive
        working-directory: ./
      - name: Install Dependencies
        run: npm ci --ignore-scripts
      - name: Build
        run: npm run build

  trufflehog:
    needs: build
    name: TruffleHog Secrets Scan
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Run TruffleHog
        uses: trufflesecurity/trufflehog@v3.82.6

  codeql:
    needs: build
    name: CodeQL Security Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: javascript
      - name: Autobuild
        uses: github/codeql-action/autobuild@v3
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3