checks.yml

name: Check
on:
  pull_request: ~
  push:
    branches:
      - main
      - main-v1

permissions: read-all

jobs:
  benchmark:
    name: Benchmark
    runs-on: ubuntu-22.04
    needs:
      - test-unit
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            actions-results-receiver-production.githubapp.com:443
            api.github.com:443
            artifactcache.actions.githubusercontent.com:443
            github.com:443
            gitlab.com:443
            nodejs.org:443
            objects.githubusercontent.com:443
            registry.npmjs.org:443
      - name: Checkout repository
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - name: Install Node.js
        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          cache: npm
          node-version-file: .nvmrc
      - name: Install dependencies
        run: npm clean-install
      - name: Cache benchmark data
        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
        with:
          path: ./cache
          key: ${{ runner.os }}-benchmark
      - name: Run benchmark
        run: npm run benchmark | tee output.txt
      - name: Store benchmark result
        uses: benchmark-action/github-action-benchmark@70405016b032d44f409e4b1b451c40215cbe2393 # v1.18.0
        with:
          comment-on-alert: false
          external-data-json-path: ./cache/benchmark-data.json
          fail-on-alert: true
          github-token: ${{ secrets.GITHUB_TOKEN }}
          output-file-path: output.txt
          tool: benchmarkjs
  codeql:
    name: CodeQL
    runs-on: ubuntu-22.04
    permissions:
      security-events: write # To upload CodeQL results
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            actions-results-receiver-production.githubapp.com:443
            api.github.com:443
            ghcr.io:443
            github.com:443
            objects.githubusercontent.com:443
            pkg-containers.githubusercontent.com:443
            uploads.github.com:443
      - name: Checkout repository
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - name: Initialize CodeQL
        uses: github/codeql-action/init@00e563ead9f72a8461b24876bee2d0c2e8bd2ee8 # v2.21.5
        with:
          config-file: ./.github/codeql.yml
          languages: javascript
      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@00e563ead9f72a8461b24876bee2d0c2e8bd2ee8 # v2.21.5
  format:
    name: Formatting
    runs-on: ubuntu-22.04
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            actions-results-receiver-production.githubapp.com:443
            api.github.com:443
            artifactcache.actions.githubusercontent.com:443
            github.com:443
            gitlab.com:443
            nodejs.org:443
            objects.githubusercontent.com:443
            registry.npmjs.org:443
      - name: Checkout repository
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - name: Install Node.js
        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          cache: npm
          node-version-file: .nvmrc
      - name: Install dependencies
        run: npm clean-install
      - name: Check formatting
        run: npm run format:check
  licenses:
    name: Licenses
    runs-on: ubuntu-22.04
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            actions-results-receiver-production.githubapp.com:443
            api.github.com:443
            artifactcache.actions.githubusercontent.com:443
            github.com:443
            gitlab.com:443
            nodejs.org:443
            objects.githubusercontent.com:443
            registry.npmjs.org:443
      - name: Checkout repository
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - name: Install Node.js
        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          cache: npm
          node-version-file: .nvmrc
      - name: Install dependencies
        run: npm clean-install
      - name: Check licenses
        run: npm run license-check
  lint:
    name: Lint
    runs-on: ubuntu-22.04
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            actions-results-receiver-production.githubapp.com:443
            api.github.com:443
            artifactcache.actions.githubusercontent.com:443
            github.com:443
            gitlab.com:443
            nodejs.org:443
            objects.githubusercontent.com:443
            registry.npmjs.org:443
      - name: Checkout repository
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - name: Install tooling
        uses: asdf-vm/actions/install@6a442392015fbbdd8b48696d41e0051b2698b2e4 # v2.2.0
      - name: Install Node.js
        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          cache: npm
          node-version-file: .nvmrc
      - name: Install dependencies
        run: npm clean-install
      - name: Lint CI
        if: ${{ failure() || success() }}
        run: npm run lint:ci
      - name: Lint JavaScript
        if: ${{ failure() || success() }}
        run: npm run lint:js
      - name: Lint JSON
        if: ${{ failure() || success() }}
        run: npm run lint:json
      - name: Lint MarkDown
        if: ${{ failure() || success() }}
        run: npm run lint:md
      - name: Lint shell scripts
        if: ${{ failure() || success() }}
        run: npm run lint:sh
      - name: Lint YAML
        if: ${{ failure() || success() }}
        run: npm run lint:yml
  njsscan:
    name: njsscan
    runs-on: ubuntu-22.04
    permissions:
      security-events: write # To upload SARIF results
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            actions-results-receiver-production.githubapp.com:443
            api.github.com:443
            ghcr.io:443
            github.com:443
            objects.githubusercontent.com:443
            pkg-containers.githubusercontent.com:443
            uploads.github.com:443
      - name: Checkout repository
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - name: Perform njsscan analysis
        id: njsscan
        uses: ajinabraham/njsscan-action@d58d8b2f26322cd35a9efb8003baac517f226d81 # v7
        with:
          args: . --sarif --output njsscan-results.sarif || true
      - name: Upload njsscan report to GitHub
        uses: github/codeql-action/upload-sarif@00e563ead9f72a8461b24876bee2d0c2e8bd2ee8 # v2.21.5
        if: ${{ failure() || success() }}
        with:
          sarif_file: njsscan-results.sarif
  test-compatibility:
    name: Compatibility
    runs-on: ubuntu-22.04
    needs:
      - test-integration
      - transpile
    strategy:
      fail-fast: false
      matrix:
        node-version:
          - 14.18.0
          - 16.13.0
          - 18.0.0
          - 19.0.0
          - 20.0.0
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            actions-results-receiver-production.githubapp.com:443
            api.github.com:443
            artifactcache.actions.githubusercontent.com:443
            github.com:443
            gitlab.com:443
            nodejs.org:443
            objects.githubusercontent.com:443
            registry.npmjs.org:443
      - name: Checkout repository
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - name: Install Node.js
        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          cache: npm
          node-version: ${{ matrix.node-version }}
      - name: Install compatible npm version
        run: npm install --global npm@8.1.2
      - name: Install dependencies
        run: npm clean-install --ignore-scripts
      - name: Download index.cjs
        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
        with:
          name: index-common-js
      - name: Run compatibility tests
        run: npm run coverage:compat --ignore-scripts
  test-e2e:
    name: End-to-end (${{ matrix.name }})
    runs-on: ${{ matrix.os }}
    needs:
      - test-integration
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: MacOS
            os: macos-12
          - name: Ubuntu
            os: ubuntu-22.04
          - name: Windows
            os: windows-2022
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          disable-sudo: false
          egress-policy: block
          allowed-endpoints: >
            actions-results-receiver-production.githubapp.com:443
            api.github.com:443
            artifactcache.actions.githubusercontent.com:443
            azure.archive.ubuntu.com:80
            codecov.io:443
            github.com:443
            gitlab.com:443
            nodejs.org:443
            objects.githubusercontent.com:443
            registry.npmjs.org:443
            storage.googleapis.com:443
            uploader.codecov.io:443
      - name: Checkout repository
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - name: Install Node.js
        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          cache: npm
          node-version-file: .nvmrc
      - name: Install dependencies
        run: npm clean-install
      - name: Install csh
        if: ${{ matrix.name == 'Ubuntu' }}
        run: sudo apt-get --assume-yes install csh
      - name: Install Zsh
        if: ${{ matrix.name == 'Ubuntu' }}
        run: sudo apt-get --assume-yes install zsh
      - name: Run end-to-end tests
        run: npm run coverage:e2e
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
        if: ${{ always() }}
        with:
          file: ./_reports/coverage/e2e/lcov.info
          flags: e2e-${{ matrix.name }}
  test-integration:
    name: Integration (${{ matrix.name }})
    runs-on: ${{ matrix.os }}
    needs:
      - test-unit
      - transpile
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: MacOS
            os: macos-12
          - name: Ubuntu
            os: ubuntu-22.04
          - name: Windows
            os: windows-2022
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          disable-sudo: false
          egress-policy: block
          allowed-endpoints: >
            actions-results-receiver-production.githubapp.com:443
            api.github.com:443
            artifactcache.actions.githubusercontent.com:443
            azure.archive.ubuntu.com:80
            codecov.io:443
            github.com:443
            gitlab.com:443
            nodejs.org:443
            objects.githubusercontent.com:443
            registry.npmjs.org:443
            storage.googleapis.com:443
            uploader.codecov.io:443
      - name: Checkout repository
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - name: Install Node.js
        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          cache: npm
          node-version-file: .nvmrc
      - name: Install dependencies
        run: npm clean-install
      - name: Install Zsh
        if: ${{ matrix.name == 'Ubuntu' }}
        run: sudo apt-get --assume-yes install zsh
      - name: Install csh
        if: ${{ matrix.name == 'Ubuntu' }}
        run: sudo apt-get --assume-yes install csh
      - name: Run integration tests
        run: npm run coverage:integration
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
        if: ${{ always() }}
        with:
          file: ./_reports/coverage/integration/lcov.info
          flags: integration-${{ matrix.name }}
  test-mutation-unit:
    name: Mutation (Unit)
    runs-on: ubuntu-22.04
    needs:
      - test-unit
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            actions-results-receiver-production.githubapp.com:443
            api.github.com:443
            artifactcache.actions.githubusercontent.com:443
            github.com:443
            gitlab.com:443
            nodejs.org:443
            objects.githubusercontent.com:443
            registry.npmjs.org:443
      - name: Checkout repository
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - name: Install Node.js
        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          cache: npm
          node-version-file: .nvmrc
      - name: Cache Stryker incremental report
        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
        with:
          path: .cache/stryker-incremental-unit.json
          key: mutation-unit-${{ github.run_number }}
          restore-keys: |
            mutation-unit-
      - name: Install dependencies
        run: npm clean-install
      - name: Run mutation tests
        run: npm run mutation:unit
      - name: Upload mutation report
        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
        if: ${{ failure() || success() }}
        with:
          name: mutation-unit-report
          path: |
            _reports/mutation/unit.html
            .cache/stryker-incremental-unit.json
  test-mutation-integration:
    name: Mutation (integration)
    runs-on: ubuntu-22.04
    needs:
      - test-integration
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          disable-sudo: false
          egress-policy: block
          allowed-endpoints: >
            actions-results-receiver-production.githubapp.com:443
            api.github.com:443
            artifactcache.actions.githubusercontent.com:443
            azure.archive.ubuntu.com:80
            github.com:443
            gitlab.com:443
            nodejs.org:443
            objects.githubusercontent.com:443
            registry.npmjs.org:443
      - name: Checkout repository
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - name: Install Node.js
        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          cache: npm
          node-version-file: .nvmrc
      - name: Cache Stryker incremental report
        uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
        with:
          path: .cache/stryker-incremental-integration.json
          key: mutation-integration-${{ github.run_number }}
          restore-keys: |
            mutation-integration-
      - name: Install dependencies
        run: npm clean-install
      - name: Install Zsh
        run: sudo apt-get --assume-yes install zsh
      - name: Install csh
        run: sudo apt-get --assume-yes install csh
      - name: Run mutation tests
        run: npm run mutation:integration
      - name: Upload mutation report
        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
        if: ${{ failure() || success() }}
        with:
          name: mutation-integration-report
          path: |
            _reports/mutation/integration.html
            .cache/stryker-incremental-integration.json
  test-unit:
    name: Unit
    runs-on: ubuntu-22.04
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            actions-results-receiver-production.githubapp.com:443
            api.github.com:443
            artifactcache.actions.githubusercontent.com:443
            codecov.io:443
            github.com:443
            gitlab.com:443
            nodejs.org:443
            objects.githubusercontent.com:443
            registry.npmjs.org:443
            storage.googleapis.com:443
            uploader.codecov.io:443
      - name: Checkout repository
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - name: Install Node.js
        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          cache: npm
          node-version-file: .nvmrc
      - name: Install dependencies
        run: npm clean-install
      - name: Run unit tests
        run: npm run coverage:unit
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
        if: ${{ always() }}
        with:
          file: ./_reports/coverage/unit/lcov.info
          flags: unit
  transpile:
    name: Transpile
    runs-on: ubuntu-22.04
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            actions-results-receiver-production.githubapp.com:443
            api.github.com:443
            artifactcache.actions.githubusercontent.com:443
            github.com:443
            gitlab.com:443
            nodejs.org:443
            objects.githubusercontent.com:443
            registry.npmjs.org:443
      - name: Checkout repository
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - name: Install Node.js
        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          cache: npm
          node-version-file: .nvmrc
      - name: Install dependencies
        run: npm clean-install
      - name: Transpile to CommonJS
        run: npm run transpile
      - name: Upload transpiled file for re-use
        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
        with:
          name: index-common-js
          path: index.cjs
          retention-days: 1
  trivy:
    name: Trivy
    runs-on: ubuntu-22.04
    permissions:
      security-events: write # To upload SARIF results
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            actions-results-receiver-production.githubapp.com:443
            api.github.com:443
            ghcr.io:443
            github.com:443
            objects.githubusercontent.com:443
            pkg-containers.githubusercontent.com:443
            uploads.github.com:443
      - name: Checkout repository
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - name: Perform Trivy analysis
        uses: aquasecurity/trivy-action@fbd16365eb88e12433951383f5e99bd901fc618f # 0.12.0
        with:
          exit-code: 1
          format: sarif
          output: trivy-results.sarif
          scanners: vuln,secret
          scan-type: fs
          scan-ref: .
          template: "@/contrib/sarif.tpl"
      - name: Upload Trivy report to GitHub
        uses: github/codeql-action/upload-sarif@00e563ead9f72a8461b24876bee2d0c2e8bd2ee8 # v2.21.5
        if: ${{ failure() || success() }}
        with:
          sarif_file: trivy-results.sarif
  vet:
    name: Vet
    runs-on: ubuntu-22.04
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            actions-results-receiver-production.githubapp.com:443
            api.github.com:443
            artifactcache.actions.githubusercontent.com:443
            github.com:443
            gitlab.com:443
            nodejs.org:443
            objects.githubusercontent.com:443
            registry.npmjs.org:443
      - name: Checkout repository
        uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - name: Install Node.js
        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          cache: npm
          node-version-file: .nvmrc
      - name: Install dependencies
        run: npm clean-install
      - name: Vet dependencies
        if: ${{ failure() || success() }}
        run: npm run vet:deps
      - name: Check runtime dependency versions
        if: ${{ failure() || success() }}
        run: node script/check-runtime-deps.js