analysis.yml

name: Analysis

on:
  pull_request:
    types: [opened, reopened, synchronize, ready_for_review, converted_to_draft]
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  tests-backend-oracle:
    name: Tests Backend Oracle
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6

      - name: Set up Java
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17
          cache: maven
          cache-dependency-path: backend/pom.xml

      - name: Run tests
        working-directory: backend
        run: |
          mkdir -p ~/.m2
          if [ -f settings.xml ]; then
            cp settings.xml ~/.m2/settings.xml
          fi
          ./mvnw -s ~/.m2/settings.xml clean install -Dserver.primary-db=oracle --no-transfer-progress checkstyle:checkstyle -P all-tests

      - name: Upload Oracle coverage artifact
        uses: actions/upload-artifact@v4
        if: success()
        with:
          name: coverage-oracle
          path: backend/target/**/*.exec
          retention-days: 1

  tests-backend-postgres:
    name: Tests Backend Postgres
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6

      - name: Set up Java
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17
          cache: maven
          cache-dependency-path: backend/pom.xml

      - name: Run tests
        working-directory: backend
        run: |
          mkdir -p ~/.m2
          if [ -f settings.xml ]; then
            cp settings.xml ~/.m2/settings.xml
          fi
          ./mvnw -s ~/.m2/settings.xml clean install -Dflyway-environment=dev -Dserver.primary-db=postgres --no-transfer-progress checkstyle:checkstyle -P all-tests

      - name: Upload Postgres coverage artifact
        uses: actions/upload-artifact@v4
        if: success()
        with:
          name: coverage-postgres
          path: backend/target/**/*.exec
          retention-days: 1

  combine-backend-coverage:
    name: Combine Backend Coverage
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    needs: [tests-backend-oracle, tests-backend-postgres]
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6

      - name: Set up Java
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17
          cache: maven
          cache-dependency-path: backend/pom.xml

      - name: Download Oracle coverage
        uses: actions/download-artifact@v4
        with:
          name: coverage-oracle
          path: backend-target-oracle

      - name: Download Postgres coverage
        uses: actions/download-artifact@v4
        with:
          name: coverage-postgres
          path: backend-target-postgres

      - name: Compile classes
        working-directory: backend
        run: |
          mkdir -p ~/.m2
          if [ -f settings.xml ]; then
            cp settings.xml ~/.m2/settings.xml
          fi
          # Compile to get classes for report generation
          ./mvnw -B -s ~/.m2/settings.xml clean compile --no-transfer-progress

      - name: Merge coverage reports
        working-directory: backend
        run: |
          set -e

          mkdir -p target/coverage-reports

          # Gather the already-merged execution data from each database run
          ORACLE_EXEC=$(find ../backend-target-oracle -name "jacoco.exec" | head -n 1)
          POSTGRES_EXEC=$(find ../backend-target-postgres -name "jacoco.exec" | head -n 1)

          if [ -z "$ORACLE_EXEC" ] || [ -z "$POSTGRES_EXEC" ]; then
            echo "ERROR: Could not locate jacoco.exec from one of the database runs"
            echo "Oracle: $ORACLE_EXEC"
            echo "Postgres: $POSTGRES_EXEC"
            exit 1
          fi

          echo "Found Oracle exec: $ORACLE_EXEC"
          echo "Found Postgres exec: $POSTGRES_EXEC"

          cp "$ORACLE_EXEC" target/coverage-reports/jacoco-oracle.exec
          cp "$POSTGRES_EXEC" target/coverage-reports/jacoco-postgres.exec

          echo "Files to merge:"
          ls -lh target/coverage-reports/jacoco-*.exec

          # Download JaCoCo CLI
          echo "Downloading JaCoCo CLI..."
          curl -L -f -o /tmp/jacococli.jar \
            https://repo1.maven.org/maven2/org/jacoco/org.jacoco.cli/0.8.14/org.jacoco.cli-0.8.14-nodeps.jar

          if [ ! -f /tmp/jacococli.jar ]; then
            echo "ERROR: Failed to download JaCoCo CLI"
            exit 1
          fi

          echo "JaCoCo CLI downloaded successfully"
          ls -lh /tmp/jacococli.jar

          # Download and verify SHA1 checksum (Maven Central standard)
          echo "Downloading SHA1 checksum for verification..."
          curl -L -f -o /tmp/jacococli.jar.sha1 \
            https://repo1.maven.org/maven2/org/jacoco/org.jacoco.cli/0.8.14/org.jacoco.cli-0.8.14-nodeps.jar.sha1

          if [ ! -f /tmp/jacococli.jar.sha1 ]; then
            echo "ERROR: Failed to download checksum file"
            exit 1
          fi

          echo "Verifying JAR integrity..."
          EXPECTED_SHA=$(cat /tmp/jacococli.jar.sha1)
          ACTUAL_SHA=$(sha1sum /tmp/jacococli.jar | awk '{print $1}')

          if [ "$EXPECTED_SHA" != "$ACTUAL_SHA" ]; then
            echo "ERROR: Checksum verification failed!"
            echo "Expected: $EXPECTED_SHA"
            echo "Actual:   $ACTUAL_SHA"
            exit 1
          fi

          echo "Checksum verification successful"

          # Merge Oracle and Postgres execution data into a single coverage file
          echo "Merging coverage data..."
          java -jar /tmp/jacococli.jar merge \
            --destfile target/coverage-reports/jacoco-merged.exec \
            target/coverage-reports/jacoco-oracle.exec \
            target/coverage-reports/jacoco-postgres.exec

          if [ ! -f target/coverage-reports/jacoco-merged.exec ]; then
            echo "ERROR: Merge failed - jacoco-merged.exec not created"
            exit 1
          fi

          echo "Merge successful:"
          ls -lh target/coverage-reports/jacoco-merged.exec

          # Generate XML report from merged coverage using pom.xml's merged-reports execution
          echo "Generating JaCoCo XML report..."
          cp target/coverage-reports/jacoco-merged.exec target/jacoco.exec
          ./mvnw org.jacoco:jacoco-maven-plugin:0.8.14:report@merged-reports \
            -Djacoco.skip=false

          # Validate XML report was generated successfully
          if [ ! -f target/coverage-reports/merged-test-report/jacoco.xml ]; then
            echo "ERROR: Report generation failed - jacoco.xml not created"
            ls -la target/coverage-reports/merged-test-report/ || echo "Directory does not exist"
            exit 1
          fi

          echo "Report generation successful:"
          ls -lh target/coverage-reports/merged-test-report/jacoco.xml
          echo "XML file size:"
          wc -c target/coverage-reports/merged-test-report/jacoco.xml

      - name: SonarCloud Scan
        if: github.event_name == 'pull_request' || github.ref == 'refs/heads/main'
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN_BACKEND }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        working-directory: backend
        run: |
          set -e

          mkdir -p ~/.m2
          if [ -f settings.xml ]; then
            cp settings.xml ~/.m2/settings.xml
          fi

          # Verify the XML report exists before scanning
          REPORT_FILE="target/coverage-reports/merged-test-report/jacoco.xml"
          if [ ! -f "$REPORT_FILE" ]; then
            echo "ERROR: SonarCloud report file not found: $REPORT_FILE"
            ls -la target/coverage-reports/ || echo "coverage-reports directory not found"
            exit 1
          fi

          echo "Found SonarCloud report file:"
          ls -lh "$REPORT_FILE"
          echo "Report file content preview (first 20 lines):"
          head -20 "$REPORT_FILE"

          echo ""
          echo "Running SonarCloud scan..."
          echo "SONAR_TOKEN length: ${#SONAR_TOKEN}"
          echo "GITHUB_TOKEN length: ${#GITHUB_TOKEN}"

          ./mvnw -B -s ~/.m2/settings.xml \
            org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \
            -Dsonar.host.url=https://sonarcloud.io \
            -Dsonar.exclusions=**/configuration/**,**/dto/**,**/entity/**,**/exception/**,**/enums/**,**/repository/**,**/job/**,**/*$*Builder*,**/ResultsApplication.*,**/*Constants.*,**/security/** \
            -Dsonar.coverage.jacoco.xmlReportPaths=target/coverage-reports/merged-test-report/jacoco.xml \
            -Dsonar.organization=bcgov-sonarcloud \
            -Dsonar.project.monorepo.enabled=true \
            -Dsonar.projectKey=nr-silva-backend

          SCAN_EXIT_CODE=$?
          if [ $SCAN_EXIT_CODE -ne 0 ]; then
            echo "ERROR: SonarCloud scan failed with exit code $SCAN_EXIT_CODE"
            exit $SCAN_EXIT_CODE
          fi

          echo "SonarCloud scan completed successfully"

      - name: Upload merged coverage artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: coverage-merged
          path: backend/target/coverage-reports
          retention-days: 7

  lint-frontend:
    name: Lint (Frontend)
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    runs-on: ubuntu-24.04
    steps:
      - uses: bcgov/action-test-and-analyse@87f88c90526b8b05cea760492ff33db4ba6e271b # v1.6.0
        with:
          commands: |
            npm ci
            npm run lint || true
          dir: frontend
          node_version: "20"
          # Only use triggers for PRs
          triggers: ${{ github.event_name == 'pull_request' && '("frontend/")' || '' }}

  tests-frontend:
    name: Tests (Frontend)
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    runs-on: ubuntu-24.04
    container:
      image: mcr.microsoft.com/playwright:v1.59.1-noble
    steps:
      - name: Fix safe.directory for GitHub Actions
        run: git config --global --add safe.directory /__w/nr-silva/nr-silva
      - name: Install unzip
        run: |
          apt-get update
          apt-get install -y unzip
      - uses: bcgov/action-test-and-analyse@87f88c90526b8b05cea760492ff33db4ba6e271b # v1.6.0
        env:
          VITE_ZONE: test
          VITE_USER_POOLS_ID: ${{ vars.VITE_USER_POOLS_ID }}
          VITE_USER_POOLS_WEB_CLIENT_ID: ${{ vars.VITE_USER_POOLS_WEB_CLIENT_ID }}
          VITE_BACKEND_URL: http://localhost:8080
          TEST_BCEID_USERNAME: ${{ secrets.TEST_BCEID_USERNAME }}
          TEST_BCEID_PASSWORD: ${{ secrets.TEST_BCEID_PASSWORD }}
        with:
          commands: |
            npm ci
            npx playwright install-deps
            npx playwright install
            npm run coverage
          dir: frontend
          node_version: "24"
          sonar_args: >
            -Dsonar.organization=bcgov-sonarcloud
            -Dsonar.projectKey=nr-silva-frontend
            -Dsonar.javascript.lcov.reportPaths=.nyc_output/coverage/lcov.info
            -Dsonar.typescript.tsconfigPaths=tsconfig.json
            -Dsonar.sources=src/
            -Dsonar.exclusions=src/__test__/**,src/__e2e__/**,src/amplifyconfiguration.*,src/**/*.scss,src/**/*.css,src/**/*.d.*,src/setupTests.*
            -Dsonar.tests=src/__test__/,src/__e2e__/
            -Dsonar.project.monorepo.enabled=true
          sonar_token: ${{ secrets.SONAR_TOKEN_FRONTEND }}
          # Only use triggers for PRs
          triggers: ${{ github.event_name == 'pull_request' && '("frontend/")' || '' }}

  # https://github.com/marketplace/actions/aqua-security-trivy
  trivy:
    name: Trivy Security Scan
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    permissions:
      security-events: write
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6

      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          format: "sarif"
          output: "trivy-results.sarif"
          trivyignores: ".trivyignore"
          skip-dirs: "common/postgis-playground"
          ignore-unfixed: true
          scan-type: "fs"
          scanners: "vuln,secret,misconfig"
          severity: "CRITICAL,HIGH"

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: "trivy-results.sarif"

  # ==========================================================================
  # WARNING: This job acts as the required merge gate for this workflow.
  # If you add a new job to this workflow, you MUST add its ID to the 'needs'
  # array below, otherwise its failure or cancellation will not block the PR!
  # ==========================================================================
  results:
    name: Analysis Results
    needs: [lint-frontend, tests-frontend, tests-backend-oracle, tests-backend-postgres, combine-backend-coverage] # Include trivy when/if it gets back to being reliable
    if: always()
    runs-on: ubuntu-24.04
    timeout-minutes: 1
    steps:
      - name: Log Job Results Context
        run: |
          echo "=== Upstream Job Statuses ==="
          echo '${{ toJson(needs) }}'

      - name: Evaluate Overall Status
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
        run: |
          echo "❌ Critical Check Failure: At least one required job has failed or was cancelled."
          exit 1

      - name: Success Message
        run: echo "✅ All critical checks passed or were intentionally skipped!"