security.yml

name: Security

on:
  push:
    branches: ["master"]
    paths-ignore:
      - "*.md"
  pull_request:
    branches: ["master"]
    paths-ignore:
      - "*.md"
  schedule:
    - cron: "0 12 * * 0"
  workflow_dispatch:

jobs:
  eslint:
    name: Run ESLint security rules
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - name: Install dependencies
        run: npm ci --no-fund
      - name: Run ESLint
        run: npm run security:eslint
      - name: Upload analysis results to GitHub
        uses: github/codeql-action/upload-sarif@v2
        if: success() || failure() # Run this step even if previous step failed.
        with:
          sarif_file: eslint-results.sarif
          wait-for-processing: true

  codeql:
    name: Run CodeQL
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          languages: typescript
      - name: Auto-build by CodeQL
        uses: github/codeql-action/autobuild@v2
      - name: Perform CodeQL Analysis and upload to GitHub
        uses: github/codeql-action/analyze@v2

  sonarcloud:
    name: Run SonarCloud
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read # Allows SonarCloud to decorate PRs with analysis results.
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis.
      - name: Install dependencies
        run: npm ci --no-fund
      - name: Test and coverage
        run: npm run test
      - name: SonarCloud Scan
        uses: SonarSource/sonarcloud-github-action@master
        if: success() || failure() # Run this step even if previous step failed.
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        with:
          args: >
            -Dsonar.projectKey=jerone_eslint-plugin-angular-template-consistent-this
            -Dsonar.organization=jerone
            -Dsonar.projectBaseDir=.
            -Dsonar.sources=./src/
            -Dsonar.tests=./tests/rules/
            -Dsonar.javascript.lcov.reportPaths=./coverage/lcov.info

  codecov:
    name: Run Codecov
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis.
      - name: Install dependencies
        run: npm ci --no-fund
      - name: Test and coverage
        run: npm run test
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v3
        if: success() || failure() # Run this step even if previous step failed.