fix(api): update jwks-rsa to v4 and configure jest esm transformation #2105
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Analysis | |
| on: | |
| pull_request: | |
| types: [opened, reopened, synchronize, ready_for_review, converted_to_draft] | |
| push: | |
| branches: [main] | |
| schedule: | |
| - cron: "30 8 1 * *" # 8:30 UDT = 12:30 PDT, runs monthly | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| jobs: | |
| tests-admin: | |
| name: Unit Tests (admin) | |
| if: (! github.event.pull_request.draft) | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: bcgov/action-test-and-analyse@v2.0.0 | |
| with: | |
| commands: | | |
| cd .. && npm ci --ignore-scripts && cd - | |
| npm run test-unit | |
| dir: admin | |
| # Workspaces use a single root package-lock.json; the action's npm cache | |
| # keys on <dir>/package-lock.json (now absent), so disable it to avoid | |
| # "Some specified paths were not resolved, unable to cache dependencies". | |
| cache: "" | |
| node_version: 24 | |
| knip_config: .github/knip.json | |
| tests-api: | |
| name: Unit Tests (api) | |
| if: (! github.event.pull_request.draft) | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: bcgov/action-test-and-analyse@v2.0.0 | |
| with: | |
| commands: | | |
| cd .. && npm ci --ignore-scripts && cd - | |
| npm run test-unit | |
| dir: api | |
| # See note in tests-admin: single root lockfile -> disable per-dir npm cache. | |
| cache: "" | |
| node_version: 24 | |
| knip_config: .github/knip.json | |
| sonar_token: ${{ secrets.SONAR_TOKEN }} | |
| # npm workspaces use a single hoisted root package-lock.json, so the | |
| # per-workspace lockfiles were removed by design. | |
| # The root package.json still has its sibling lock. | |
| sonar_args: > | |
| -Dsonar.exclusions=**/*.spec.ts | |
| -Dsonar.javascript.lcov.reportPaths=coverage/api/lcov.info | |
| -Dsonar.organization=bcgov-sonarcloud | |
| -Dsonar.projectKey=nr-fom | |
| -Dsonar.issue.ignore.multicriteria=e1 | |
| -Dsonar.issue.ignore.multicriteria.e1.ruleKey=text:S8564 | |
| -Dsonar.issue.ignore.multicriteria.e1.resourceKey=**/package.json | |
| tests-public: | |
| name: Unit Tests (public) | |
| if: (! github.event.pull_request.draft) | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: bcgov/action-test-and-analyse@v2.0.0 | |
| with: | |
| commands: | | |
| cd .. && npm ci --ignore-scripts && cd - | |
| npm run test-unit | |
| dir: public | |
| # See note in tests-admin: single root lockfile -> disable per-dir npm cache. | |
| cache: "" | |
| node_version: 24 | |
| knip_config: .github/knip.json | |
| # https://github.com/marketplace/actions/aqua-security-trivy | |
| trivy: | |
| name: Trivy Security Scan | |
| if: (! github.event.pull_request.draft) | |
| permissions: | |
| security-events: write | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Run Trivy vulnerability scanner in repo mode | |
| uses: aquasecurity/trivy-action@v0.36.0 | |
| with: | |
| format: "sarif" | |
| output: "trivy-results.sarif" | |
| ignore-unfixed: true | |
| scan-type: "fs" | |
| scanners: "vuln,secret,config" | |
| severity: "CRITICAL,HIGH" | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: "trivy-results.sarif" | |
| # ========================================================================== | |
| # WARNING: This job acts as the required merge gate for this workflow. | |
| # If you add a new job to this workflow, you MUST add its ID to the 'needs' | |
| # array below, otherwise its failure or cancellation will not block the PR! | |
| # ========================================================================== | |
| results: | |
| name: Analysis Results | |
| needs: [tests-admin, tests-api, tests-public, trivy] | |
| if: always() | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 1 | |
| steps: | |
| - name: Log Job Results Context | |
| run: | | |
| echo "=== Upstream Job Statuses ===" | |
| echo '${{ toJson(needs) }}' | |
| - name: Evaluate Overall Status | |
| if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') | |
| run: | | |
| echo "❌ Critical Check Failure: At least one required job has failed or was cancelled." | |
| exit 1 | |
| - name: Success Message | |
| run: echo "✅ All critical checks passed or were intentionally skipped!" | |