feat: 1379 create opening frontend #4914
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Analysis | |
| on: | |
| pull_request: | |
| types: [opened, reopened, synchronize, ready_for_review, converted_to_draft] | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| jobs: | |
| tests-backend-oracle: | |
| name: Tests Backend Oracle | |
| if: github.event_name != 'pull_request' || !github.event.pull_request.draft | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up Java | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: temurin | |
| java-version: 17 | |
| cache: maven | |
| cache-dependency-path: backend/pom.xml | |
| - name: Run tests | |
| working-directory: backend | |
| run: | | |
| mkdir -p ~/.m2 | |
| if [ -f settings.xml ]; then | |
| cp settings.xml ~/.m2/settings.xml | |
| fi | |
| ./mvnw -s ~/.m2/settings.xml clean install -Dserver.primary-db=oracle --no-transfer-progress checkstyle:checkstyle -P all-tests | |
| - name: Upload Oracle coverage artifact | |
| uses: actions/upload-artifact@v4 | |
| if: success() | |
| with: | |
| name: coverage-oracle | |
| path: backend/target/**/*.exec | |
| retention-days: 1 | |
| tests-backend-postgres: | |
| name: Tests Backend Postgres | |
| if: github.event_name != 'pull_request' || !github.event.pull_request.draft | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up Java | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: temurin | |
| java-version: 17 | |
| cache: maven | |
| cache-dependency-path: backend/pom.xml | |
| - name: Run tests | |
| working-directory: backend | |
| run: | | |
| mkdir -p ~/.m2 | |
| if [ -f settings.xml ]; then | |
| cp settings.xml ~/.m2/settings.xml | |
| fi | |
| ./mvnw -s ~/.m2/settings.xml clean install -Dflyway-environment=dev -Dserver.primary-db=postgres --no-transfer-progress checkstyle:checkstyle -P all-tests | |
| - name: Upload Postgres coverage artifact | |
| uses: actions/upload-artifact@v4 | |
| if: success() | |
| with: | |
| name: coverage-postgres | |
| path: backend/target/**/*.exec | |
| retention-days: 1 | |
| combine-backend-coverage: | |
| name: Combine Backend Coverage | |
| if: github.event_name != 'pull_request' || !github.event.pull_request.draft | |
| needs: [tests-backend-oracle, tests-backend-postgres] | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up Java | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: temurin | |
| java-version: 17 | |
| cache: maven | |
| cache-dependency-path: backend/pom.xml | |
| - name: Download Oracle coverage | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: coverage-oracle | |
| path: backend-target-oracle | |
| - name: Download Postgres coverage | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: coverage-postgres | |
| path: backend-target-postgres | |
| - name: Compile classes | |
| working-directory: backend | |
| run: | | |
| mkdir -p ~/.m2 | |
| if [ -f settings.xml ]; then | |
| cp settings.xml ~/.m2/settings.xml | |
| fi | |
| # Compile to get classes for report generation | |
| ./mvnw -B -s ~/.m2/settings.xml clean compile --no-transfer-progress | |
| - name: Merge coverage reports | |
| working-directory: backend | |
| run: | | |
| set -e | |
| mkdir -p target/coverage-reports | |
| # Gather the already-merged execution data from each database run | |
| ORACLE_EXEC=$(find ../backend-target-oracle -name "jacoco.exec" | head -n 1) | |
| POSTGRES_EXEC=$(find ../backend-target-postgres -name "jacoco.exec" | head -n 1) | |
| if [ -z "$ORACLE_EXEC" ] || [ -z "$POSTGRES_EXEC" ]; then | |
| echo "ERROR: Could not locate jacoco.exec from one of the database runs" | |
| echo "Oracle: $ORACLE_EXEC" | |
| echo "Postgres: $POSTGRES_EXEC" | |
| exit 1 | |
| fi | |
| echo "Found Oracle exec: $ORACLE_EXEC" | |
| echo "Found Postgres exec: $POSTGRES_EXEC" | |
| cp "$ORACLE_EXEC" target/coverage-reports/jacoco-oracle.exec | |
| cp "$POSTGRES_EXEC" target/coverage-reports/jacoco-postgres.exec | |
| echo "Files to merge:" | |
| ls -lh target/coverage-reports/jacoco-*.exec | |
| # Download JaCoCo CLI | |
| echo "Downloading JaCoCo CLI..." | |
| curl -L -f -o /tmp/jacococli.jar \ | |
| https://repo1.maven.org/maven2/org/jacoco/org.jacoco.cli/0.8.14/org.jacoco.cli-0.8.14-nodeps.jar | |
| if [ ! -f /tmp/jacococli.jar ]; then | |
| echo "ERROR: Failed to download JaCoCo CLI" | |
| exit 1 | |
| fi | |
| echo "JaCoCo CLI downloaded successfully" | |
| ls -lh /tmp/jacococli.jar | |
| # Download and verify SHA1 checksum (Maven Central standard) | |
| echo "Downloading SHA1 checksum for verification..." | |
| curl -L -f -o /tmp/jacococli.jar.sha1 \ | |
| https://repo1.maven.org/maven2/org/jacoco/org.jacoco.cli/0.8.14/org.jacoco.cli-0.8.14-nodeps.jar.sha1 | |
| if [ ! -f /tmp/jacococli.jar.sha1 ]; then | |
| echo "ERROR: Failed to download checksum file" | |
| exit 1 | |
| fi | |
| echo "Verifying JAR integrity..." | |
| EXPECTED_SHA=$(cat /tmp/jacococli.jar.sha1) | |
| ACTUAL_SHA=$(sha1sum /tmp/jacococli.jar | awk '{print $1}') | |
| if [ "$EXPECTED_SHA" != "$ACTUAL_SHA" ]; then | |
| echo "ERROR: Checksum verification failed!" | |
| echo "Expected: $EXPECTED_SHA" | |
| echo "Actual: $ACTUAL_SHA" | |
| exit 1 | |
| fi | |
| echo "Checksum verification successful" | |
| # Merge Oracle and Postgres execution data into a single coverage file | |
| echo "Merging coverage data..." | |
| java -jar /tmp/jacococli.jar merge \ | |
| --destfile target/coverage-reports/jacoco-merged.exec \ | |
| target/coverage-reports/jacoco-oracle.exec \ | |
| target/coverage-reports/jacoco-postgres.exec | |
| if [ ! -f target/coverage-reports/jacoco-merged.exec ]; then | |
| echo "ERROR: Merge failed - jacoco-merged.exec not created" | |
| exit 1 | |
| fi | |
| echo "Merge successful:" | |
| ls -lh target/coverage-reports/jacoco-merged.exec | |
| # Generate XML report from merged coverage using pom.xml's merged-reports execution | |
| echo "Generating JaCoCo XML report..." | |
| cp target/coverage-reports/jacoco-merged.exec target/jacoco.exec | |
| ./mvnw org.jacoco:jacoco-maven-plugin:0.8.14:report@merged-reports \ | |
| -Djacoco.skip=false | |
| # Validate XML report was generated successfully | |
| if [ ! -f target/coverage-reports/merged-test-report/jacoco.xml ]; then | |
| echo "ERROR: Report generation failed - jacoco.xml not created" | |
| ls -la target/coverage-reports/merged-test-report/ || echo "Directory does not exist" | |
| exit 1 | |
| fi | |
| echo "Report generation successful:" | |
| ls -lh target/coverage-reports/merged-test-report/jacoco.xml | |
| echo "XML file size:" | |
| wc -c target/coverage-reports/merged-test-report/jacoco.xml | |
| - name: SonarCloud Scan | |
| if: github.event_name == 'pull_request' || github.ref == 'refs/heads/main' | |
| env: | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN_BACKEND }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| working-directory: backend | |
| run: | | |
| set -e | |
| mkdir -p ~/.m2 | |
| if [ -f settings.xml ]; then | |
| cp settings.xml ~/.m2/settings.xml | |
| fi | |
| # Verify the XML report exists before scanning | |
| REPORT_FILE="target/coverage-reports/merged-test-report/jacoco.xml" | |
| if [ ! -f "$REPORT_FILE" ]; then | |
| echo "ERROR: SonarCloud report file not found: $REPORT_FILE" | |
| ls -la target/coverage-reports/ || echo "coverage-reports directory not found" | |
| exit 1 | |
| fi | |
| echo "Found SonarCloud report file:" | |
| ls -lh "$REPORT_FILE" | |
| echo "Report file content preview (first 20 lines):" | |
| head -20 "$REPORT_FILE" | |
| echo "" | |
| echo "Running SonarCloud scan..." | |
| echo "SONAR_TOKEN length: ${#SONAR_TOKEN}" | |
| echo "GITHUB_TOKEN length: ${#GITHUB_TOKEN}" | |
| ./mvnw -B -s ~/.m2/settings.xml \ | |
| org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \ | |
| -Dsonar.host.url=https://sonarcloud.io \ | |
| -Dsonar.exclusions=**/configuration/**,**/dto/**,**/entity/**,**/exception/**,**/enums/**,**/repository/**,**/job/**,**/*$*Builder*,**/ResultsApplication.*,**/*Constants.*,**/security/** \ | |
| -Dsonar.coverage.jacoco.xmlReportPaths=target/coverage-reports/merged-test-report/jacoco.xml \ | |
| -Dsonar.organization=bcgov-sonarcloud \ | |
| -Dsonar.project.monorepo.enabled=true \ | |
| -Dsonar.projectKey=nr-silva-backend | |
| SCAN_EXIT_CODE=$? | |
| if [ $SCAN_EXIT_CODE -ne 0 ]; then | |
| echo "ERROR: SonarCloud scan failed with exit code $SCAN_EXIT_CODE" | |
| exit $SCAN_EXIT_CODE | |
| fi | |
| echo "SonarCloud scan completed successfully" | |
| - name: Upload merged coverage artifact | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: coverage-merged | |
| path: backend/target/coverage-reports | |
| retention-days: 7 | |
| lint-frontend: | |
| name: Lint (Frontend) | |
| if: github.event_name != 'pull_request' || !github.event.pull_request.draft | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: bcgov/action-test-and-analyse@87f88c90526b8b05cea760492ff33db4ba6e271b # v1.6.0 | |
| with: | |
| commands: | | |
| npm ci | |
| npm run lint || true | |
| dir: frontend | |
| node_version: "20" | |
| # Only use triggers for PRs | |
| triggers: ${{ github.event_name == 'pull_request' && '("frontend/")' || '' }} | |
| tests-frontend: | |
| name: Tests (Frontend) | |
| if: github.event_name != 'pull_request' || !github.event.pull_request.draft | |
| runs-on: ubuntu-24.04 | |
| container: | |
| image: mcr.microsoft.com/playwright:v1.59.1-noble | |
| steps: | |
| - name: Fix safe.directory for GitHub Actions | |
| run: git config --global --add safe.directory /__w/nr-silva/nr-silva | |
| - name: Install unzip | |
| run: | | |
| apt-get update | |
| apt-get install -y unzip | |
| - uses: bcgov/action-test-and-analyse@87f88c90526b8b05cea760492ff33db4ba6e271b # v1.6.0 | |
| env: | |
| VITE_ZONE: test | |
| VITE_USER_POOLS_ID: ${{ vars.VITE_USER_POOLS_ID }} | |
| VITE_USER_POOLS_WEB_CLIENT_ID: ${{ vars.VITE_USER_POOLS_WEB_CLIENT_ID }} | |
| VITE_BACKEND_URL: http://localhost:8080 | |
| TEST_BCEID_USERNAME: ${{ secrets.TEST_BCEID_USERNAME }} | |
| TEST_BCEID_PASSWORD: ${{ secrets.TEST_BCEID_PASSWORD }} | |
| with: | |
| commands: | | |
| npm ci | |
| npx playwright install-deps | |
| npx playwright install | |
| npm run coverage | |
| dir: frontend | |
| node_version: "24" | |
| sonar_args: > | |
| -Dsonar.organization=bcgov-sonarcloud | |
| -Dsonar.projectKey=nr-silva-frontend | |
| -Dsonar.javascript.lcov.reportPaths=.nyc_output/coverage/lcov.info | |
| -Dsonar.typescript.tsconfigPaths=tsconfig.json | |
| -Dsonar.sources=src/ | |
| -Dsonar.exclusions=src/__test__/**,src/__e2e__/**,src/amplifyconfiguration.*,src/**/*.scss,src/**/*.css,src/**/*.d.*,src/setupTests.* | |
| -Dsonar.tests=src/__test__/,src/__e2e__/ | |
| -Dsonar.project.monorepo.enabled=true | |
| sonar_token: ${{ secrets.SONAR_TOKEN_FRONTEND }} | |
| # Only use triggers for PRs | |
| triggers: ${{ github.event_name == 'pull_request' && '("frontend/")' || '' }} | |
| # https://github.com/marketplace/actions/aqua-security-trivy | |
| trivy: | |
| name: Trivy Security Scan | |
| if: github.event_name != 'pull_request' || !github.event.pull_request.draft | |
| permissions: | |
| security-events: write | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Run Trivy vulnerability scanner in repo mode | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| format: "sarif" | |
| output: "trivy-results.sarif" | |
| trivyignores: ".trivyignore" | |
| skip-dirs: "common/postgis-playground" | |
| ignore-unfixed: true | |
| scan-type: "fs" | |
| scanners: "vuln,secret,misconfig" | |
| severity: "CRITICAL,HIGH" | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: "trivy-results.sarif" | |
| # ========================================================================== | |
| # WARNING: This job acts as the required merge gate for this workflow. | |
| # If you add a new job to this workflow, you MUST add its ID to the 'needs' | |
| # array below, otherwise its failure or cancellation will not block the PR! | |
| # ========================================================================== | |
| results: | |
| name: Analysis Results | |
| needs: [lint-frontend, tests-frontend, tests-backend-oracle, tests-backend-postgres, combine-backend-coverage] # Include trivy when/if it gets back to being reliable | |
| if: always() | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 1 | |
| steps: | |
| - name: Log Job Results Context | |
| run: | | |
| echo "=== Upstream Job Statuses ===" | |
| echo '${{ toJson(needs) }}' | |
| - name: Evaluate Overall Status | |
| if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') | |
| run: | | |
| echo "❌ Critical Check Failure: At least one required job has failed or was cancelled." | |
| exit 1 | |
| - name: Success Message | |
| run: echo "✅ All critical checks passed or were intentionally skipped!" |