pr-checks.yml

# This workflow will do a clean installation of node dependencies, cache/restore them, build the source code and run tests
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions

name: PR-checks

on:
  push:
    branches: ['develop', 'feature/VTMDEV-1']
  pull_request:
    branches: ['develop', 'feature/VTMDEV-1']

jobs:
  build:
    runs-on: ubuntu-latest

    strategy:
      matrix:
        node-version: [18.18.0]
        # See supported Node.js release schedule at https://nodejs.org/en/about/releases/

    steps:
      - uses: actions/checkout@v4
      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'
      - name: Install dependencies
        run: npm ci --include=optional
      - name: Build
        run: npm run build --ignore-scripts -- --configuration production

  test:
    runs-on: ubuntu-latest

    strategy:
      matrix:
        node-version: [18.18.0]
        # See supported Node.js release schedule at https://nodejs.org/en/about/releases/

    steps:
      - uses: actions/checkout@v4
      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'
      - name: Install dependencies
        run: npm ci --include=optional
      - name: Run tests
        run: npm run test:workflow

  lint:
    runs-on: ubuntu-latest

    strategy:
      matrix:
        node-version: [18.18.0]
        # See supported Node.js release schedule at https://nodejs.org/en/about/releases/

    steps:
      - uses: actions/checkout@v4
      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'
      - name: Install dependencies
        run: npm ci --include=optional
      - name: Run linter
        run: npm run lint

  audit:
    runs-on: ubuntu-latest

    strategy:
      matrix:
        node-version: [18.18.0]
    steps:
      - uses: actions/checkout@v4
      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'
      - name: Run audit
        run: npm audit --audit-level=critical

  scanner:
    permissions:
      id-token: write
    runs-on: X64
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'

      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_MGMT_ROLE }}
          aws-region: ${{ secrets.DVSA_AWS_REGION }}
          role-session-name: 'cvs-app-vtm'

      - uses: aws-actions/aws-secretsmanager-get-secrets@v2
        with: 
          secret-ids: sonarqube-gha
          parse-json-secrets: true

      - name: Install dependencies
        run: npm ci --include=optional

      - name: Run SonarQube scanner
        run: |
          npm run sonar-scanner -- \
          -Dsonar.host.url=${{ env.SONARQUBE_GHA_URL }} \
          -Dsonar.token=${{ env.SONARQUBE_GHA_TOKEN }} \
          -Dsonar.login=${{ env.SONARQUBE_GHA_TOKEN }} \
          -Dsonar.projectName=${{ github.repository }} \
          -Dsonar.projectVersion=1.0.${{ github.run_id }}