nr-wrf/.github/workflows/analysis.yml at main · bcgov/nr-wrf · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
name: Analysis

on:
  push:
    branches: [main]
  pull_request:
    types: [opened, reopened, synchronize, ready_for_review, converted_to_draft]
  schedule:
    - cron: "0 11 * * 0" # 3 AM PST = 12 PM UDT, runs sundays
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  # backend-tests:
  #   name: Backend Tests
  #   if: (! github.event.pull_request.draft)
  #   runs-on: ubuntu-24.04
  #   timeout-minutes: 5
  #   services:
  #     postgres:
  #       image: postgres
  #       env:
  #         POSTGRES_PASSWORD: default
  #       options: >-
  #         --health-cmd pg_isready
  #         --health-interval 10s
  #         --health-timeout 5s
  #         --health-retries 5
  #       ports:
  #         - 5432:5432
  #   steps:
  #     - uses: bcgov/action-test-and-analyse@8f699e3fd3fadd9a6adf6f4b1f2638ef7ecfefb9 # v2.0.0
  #       env:
  #         sonar_token: ${{ secrets.sonar_token_backend }}
  #       with:
  #         commands: |
  #           npm ci
  #           npm run lint
  #           npm run format:check
  #           npm run test:cov
  #         dir: backend
  #         node_version: "22"
  #         sonar_args: >
  #           -Dsonar.exclusions=**/coverage/**,**/node_modules/**,**/*spec.ts
  #           -Dsonar.organization=bcgov-sonarcloud
  #           -Dsonar.projectKey=quickstart-openshift_backend
  #           -Dsonar.sources=src
  #           -Dsonar.test.inclusions=**/*spec.ts
  #           -Dsonar.javascript.lcov.reportPaths=./coverage/lcov.info
  #         sonar_token: ${{ env.sonar_token }}
  #         dep_scan: warn
  #         supply_scan: true
  #         triggers: ('backend/')

  # frontend-tests:
  #   name: Frontend Tests
  #   if: (! github.event.pull_request.draft)
  #   runs-on: ubuntu-24.04
  #   timeout-minutes: 5
  #   steps:
  #     - uses: bcgov/action-test-and-analyse@8f699e3fd3fadd9a6adf6f4b1f2638ef7ecfefb9 # v2.0.0
  #       env:
  #         sonar_token: ${{ secrets.sonar_token_frontend }}
  #       with:
  #         commands: |
  #           npm ci
  #           npm run lint
  #           npm run format:check
  #           npm run test:cov
  #         dir: frontend
  #         node_version: "22"
  #         sonar_args: >
  #           -Dsonar.exclusions=**/coverage/**,**/node_modules/**,**/*spec.ts,**/*test.tsx,**/routeTree.gen.ts
  #           -Dsonar.organization=bcgov-sonarcloud
  #           -Dsonar.projectKey=quickstart-openshift_frontend
  #           -Dsonar.sources=src
  #           -Dsonar.test.inclusions=**/*spec.ts,**/*test.tsx
  #           -Dsonar.javascript.lcov.reportPaths=./coverage/lcov.info
  #         sonar_token: ${{ env.sonar_token }}
  #         dep_scan: warn
  #         supply_scan: true
  #         triggers: ('frontend/')

  # https://github.com/marketplace/actions/aqua-security-trivy
  trivy:
    name: Trivy Security Scan
    if: (! github.event.pull_request.draft)
    continue-on-error: true
    permissions:
      security-events: write
    runs-on: ubuntu-slim
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7

      - name: Cache Trivy DB
        uses: actions/cache@v6
        with:
          path: .trivycache
          key: ${{ runner.os }}-trivy-v0.36.0-cache-v1
          restore-keys: |
            ${{ runner.os }}-trivy-

      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          format: "sarif"
          output: "trivy-results.sarif"
          ignore-unfixed: true
          scan-type: "fs"
          scanners: "vuln,secret,misconfig"
          severity: "CRITICAL,HIGH"
          trivyignores: ".github/.trivyignore"
          cache-dir: .trivycache
          skip-dirs: "**/node_modules,**/coverage,**/dist,.git"

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v4
        with:
          category: "trivy"
          sarif_file: "trivy-results.sarif"

  # ==========================================================================
  # WARNING: This job acts as the required merge gate for this workflow.
  # If you add a new job to this workflow, you MUST add its ID to the 'needs'
  # array below, otherwise its failure or cancellation will not block the PR!
  # ==========================================================================
  results:
    name: Analysis Results
    needs: [trivy]
    if: always() && (! github.event.pull_request.draft)
    runs-on: ubuntu-slim
    timeout-minutes: 1
    steps:
      - name: Log Job Results Context
        run: |
          echo "=== Upstream Job Statuses ==="
          echo '${{ toJson(needs) }}'

      - name: Evaluate Overall Status
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
        run: |
          echo "❌ Critical Check Failure: At least one required job has failed or was cancelled."
          exit 1

      - name: Success Message
        run: echo "✅ All critical checks passed or were intentionally skipped!"