fix(schedules): automatic recalculation of derived figures during data entry (#291) #667
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Analysis | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| types: [opened, reopened, synchronize, ready_for_review, converted_to_draft] | |
| schedule: | |
| - cron: "0 11 * * 0" # 3 AM PST = 12 PM UDT, runs sundays | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| jobs: | |
| backend-tests: | |
| name: Backend Tests | |
| if: (! github.event.pull_request.draft) | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| runs-on: ubuntu-24.04 | |
| # Raised from 15 to cover the Testcontainers Oracle pull + start the ITs now add. | |
| timeout-minutes: 25 | |
| steps: | |
| - uses: bcgov/action-test-and-analyse-java@7c7309721cae054b3e837c723afa4efb4b1a256d # v1.1.0 | |
| name: Backend Coverage | |
| with: | |
| # skip.integration.tests: the pom defaults it to true, so `verify` ran surefire only and | |
| # every *IT.java suite — authorization, persistence and validation against a real Oracle — | |
| # was skipped in CI (AR17). The failsafe suites need only Docker, which the GitHub runner | |
| # provides: AbstractOracleIT starts one gvenzl/oracle-free container per JVM and applies | |
| # the test snapshot with Flyway's Java API. | |
| commands: | | |
| mvn -B -ntp -Dskip.integration.tests=false verify | |
| dir: backend | |
| java-cache: maven | |
| java-distribution: temurin | |
| java-version: "21" | |
| # cpd.exclusions: both RoadGroup lookups are verbatim ports of the legacy RMG tables, | |
| # where ~18 of the TSA cases are token-identical apart from their literals. CPD reads | |
| # that as ~174 duplicated lines each; the tables ARE the business rule and must not be | |
| # de-duplicated. schedule6 ports setRmgByTfaTsbNumberCode/setRmgByTflNumberCode; | |
| # schedule10 ports setRG10ByTsaTsbNumberCode/setRG10ByTflNumberCode. | |
| # They are NOT interchangeable: the same inputs map to DIFFERENT road groups (TSA 01 -> | |
| # 15 vs 11, TSA 08 -> 10 vs 7, TFL 08 -> 7 vs 10), so "resolving" the duplication by | |
| # merging them would silently corrupt one schedule's derived, user-visible Road Group. | |
| # xmlReportPaths: with the ITs running, the pom's jacoco `merge`/`report-merged` executions | |
| # produce the union of surefire and failsafe coverage. Sonar would otherwise keep reading | |
| # the unit-only report and still count IT-covered lines as uncovered. | |
| sonar_args: > | |
| -Dsonar.organization=bcgov-sonarcloud | |
| -Dsonar.projectKey=bcgov-sonarcloud_nr-ilcr_backend | |
| -Dsonar.host.url=https://sonarcloud.io | |
| -Dsonar.coverage.jacoco.xmlReportPaths=target/site/jacoco-merged/jacoco.xml | |
| -Dsonar.cpd.exclusions=**/schedule6/RoadGroupLookup.java,**/schedule10/RoadGroup10Lookup.java | |
| sonar_token: ${{ secrets.sonar_token_backend }} | |
| triggers: ('backend/') | |
| frontend-tests: | |
| name: Frontend Tests | |
| if: (! github.event.pull_request.draft) | |
| permissions: | |
| contents: read | |
| checks: write | |
| security-events: write | |
| runs-on: ubuntu-24.04 | |
| # Covers all four commands below — npm ci, lint, format:check AND a coverage run — not the tests | |
| # alone. Raised from 5 after PR #317 was cancelled at 4m58s with zero test failures: the same job | |
| # had passed at 3m22s one commit earlier, so the 5-minute budget was already two thirds spent and | |
| # a growing component suite left no room for runner variance. 10 restores headroom without | |
| # hiding a genuine hang. | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: bcgov/action-test-and-analyse@8f699e3fd3fadd9a6adf6f4b1f2638ef7ecfefb9 # v2.0.0 | |
| env: | |
| sonar_token: ${{ secrets.sonar_token_frontend }} | |
| with: | |
| commands: | | |
| npm ci | |
| npm run lint | |
| npm run format:check | |
| npm run test:cov | |
| dir: frontend | |
| node_version: "24" | |
| sonar_args: > | |
| -Dsonar.exclusions=**/coverage/**,**/node_modules/**,**/*spec.ts,**/*test.tsx,**/routeTree.gen.ts | |
| -Dsonar.organization=bcgov-sonarcloud | |
| -Dsonar.projectKey=bcgov-sonarcloud_nr-ilcr_frontend | |
| -Dsonar.sources=src | |
| -Dsonar.test.inclusions=**/*spec.ts,**/*test.tsx | |
| -Dsonar.javascript.lcov.reportPaths=./coverage/lcov.info | |
| sonar_token: ${{ env.sonar_token }} | |
| dep_scan: warn | |
| supply_scan: true | |
| triggers: ('frontend/') | |
| # https://github.com/marketplace/actions/aqua-security-trivy | |
| trivy: | |
| name: Trivy Security Scan | |
| if: (! github.event.pull_request.draft) | |
| permissions: | |
| contents: read | |
| security-events: write | |
| runs-on: ubuntu-slim | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Cache Trivy DB | |
| uses: actions/cache@v6 | |
| with: | |
| path: .trivycache | |
| key: ${{ runner.os }}-trivy-v0.36.0-cache-v1 | |
| restore-keys: | | |
| ${{ runner.os }}-trivy- | |
| - name: Run Trivy vulnerability scanner in repo mode | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| format: "sarif" | |
| output: "trivy-results.sarif" | |
| ignore-unfixed: true | |
| scan-type: "fs" | |
| scanners: "vuln,secret,misconfig" | |
| severity: "CRITICAL,HIGH" | |
| trivyignores: ".github/.trivyignore" | |
| cache-dir: .trivycache | |
| skip-dirs: "**/node_modules,**/coverage,**/dist,**/target,.git" | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| category: "trivy" | |
| sarif_file: "trivy-results.sarif" | |
| # ========================================================================== | |
| # WARNING: This job acts as the required merge gate for this workflow. | |
| # If you add a new job to this workflow, you MUST add its ID to the 'needs' | |
| # array below, otherwise its failure or cancellation will not block the PR! | |
| # ========================================================================== | |
| results: | |
| name: Analysis Results | |
| needs: [backend-tests, frontend-tests, trivy] | |
| if: always() | |
| runs-on: ubuntu-slim | |
| timeout-minutes: 1 | |
| steps: | |
| - name: Log Job Results Context | |
| run: | | |
| echo "=== Upstream Job Statuses ===" | |
| echo '${{ toJson(needs) }}' | |
| - name: Evaluate Overall Status | |
| if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') | |
| run: | | |
| echo "❌ Critical Check Failure: At least one required job has failed or was cancelled." | |
| exit 1 | |
| - name: Success Message | |
| run: echo "✅ All critical checks passed or were intentionally skipped!" |