-
Notifications
You must be signed in to change notification settings - Fork 1
152 lines (120 loc) · 4.36 KB
/
nodejs.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
name: Build
on: [push]
jobs:
# -- TESTS ------------------------------------------------------------------
tests:
name: Tests
runs-on: ubuntu-latest
strategy:
matrix:
node: ['16']
steps:
- name: Harden GitHub Actions Runner
uses: step-security/harden-runner@0327a39356be0e062df2bb0bd2a3e036b72a8393
with:
egress-policy: audit
- name: Checkout
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
- name: Setup Node.js ${{ matrix.node }}
uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0
with:
node-version: ${{ matrix.node }}
check-latest: true
- name: Install dependencies
run: npm install
- name: Run unit-tests + Code Coverage
run: npm run test:coverage
- name: Save Code Coverage
uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
with:
name: code-coverage
path: coverage
# -- SONARCLOUD -------------------------------------------------------------
code-quality:
name: Code Quality
runs-on: ubuntu-latest
needs: tests
steps:
- name: Harden GitHub Actions Runner
uses: step-security/harden-runner@0327a39356be0e062df2bb0bd2a3e036b72a8393
with:
egress-policy: audit
- name: Checkout
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
- name: Download Code Coverage
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
with:
name: code-coverage
path: coverage
- name: Get App Version
run: ./scripts/version.sh
- name: SonarCloud Scan
uses: sonarsource/sonarcloud-github-action@master
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
# -- SAST SCAN --------------------------------------------------------------
code-security:
name: Code Security
runs-on: ubuntu-latest
needs: tests
# Skip any PR created by dependabot to avoid permission issues
if: (github.actor != 'dependabot[bot]')
steps:
- name: Harden GitHub Actions Runner
uses: step-security/harden-runner@0327a39356be0e062df2bb0bd2a3e036b72a8393
with:
egress-policy: audit
- name: Checkout
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
- name: Perform Scan
uses: ShiftLeftSecurity/scan-action@master
env:
WORKSPACE: https://github.com/${{ github.repository }}/blob/${{ github.sha }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SCAN_ANNOTATE_PR: true
- uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
with:
name: reports
path: reports
# -- RELEASE ----------------------------------------------------------------
pre-release:
name: Prepare Release
runs-on: ubuntu-latest
needs:
- code-quality
- code-security
if: github.ref == 'refs/heads/master'
steps:
- name: Harden GitHub Actions Runner
uses: step-security/harden-runner@0327a39356be0e062df2bb0bd2a3e036b72a8393
with:
egress-policy: audit
- name: Checkout
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
- name: Semantic Release
uses: cycjimmy/semantic-release-action@8e58d20d0f6c8773181f43eb74d6a05e3099571d # v3.4.2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# -- BUILD ------------------------------------------------------------------
build:
name: Build & Release
runs-on: ubuntu-latest
needs: pre-release
strategy:
matrix:
node: ['16']
steps:
- name: Harden GitHub Actions Runner
uses: step-security/harden-runner@0327a39356be0e062df2bb0bd2a3e036b72a8393
with:
egress-policy: audit
- name: Checkout
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
- name: Setup Node.js ${{ matrix.node }}
uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0
with:
node-version: ${{ matrix.node }}
check-latest: true
- name: Install dependencies
run: npm install