ci: CCP-3438 draft pr testing

.github/workflows/.pr-close.yml

@@ -5,63 +5,63 @@ on:
     inputs:
       ### Typical / recommended
       cleanup:
-        description: "Type of cleanup; e.g. helm or label"
+        description: 'Type of cleanup; e.g. helm or label'
         required: false
         type: string
       environment:
         description: Environment name; omit for PRs
         required: false
         type: string
       packages:
-        description: "Space-separated list of packages to promote"
+        description: 'Space-separated list of packages to promote'
         required: false
         type: string
       remove_pvc:
         required: false
         default: data-${{ github.event.repository.name }}-${{ github.event.number }}-bitnami-pg-0
         type: string
-        description: "Comma separated list of PVCs to remove"
+        description: 'Comma separated list of PVCs to remove'
 
       ### Usually a bad idea / not recommended
       merge_branch:
-        description: "Merge target branch"
+        description: 'Merge target branch'
         required: false
         type: string
         default: ${{ github.event.repository.default_branch }}
       cleanup_name:
-        description: "Use if template/cleanup name differs from repo"
+        description: 'Use if template/cleanup name differs from repo'
         type: string
         default: ${{ github.event.repository.name }}
       organization:
-        description: "GitHub organization; e.g. bcgov"
+        description: 'GitHub organization; e.g. bcgov'
         default: ${{ github.repository_owner }}
         required: false
         type: string
       repository:
-        description: "GitHub repository, e.g. quickstart-openshift"
+        description: 'GitHub repository, e.g. quickstart-openshift'
         default: ${{ github.event.repository.name }}
         required: false
         type: string
       tag_promote:
-        description: "Tag to promote to; e.g. latest, test, demo or prod"
+        description: 'Tag to promote to; e.g. latest, test, demo or prod'
         default: latest
         required: false
         type: string
       target:
-        description: "Target; e.g. PR number, test or prod"
+        description: 'Target; e.g. PR number, test or prod'
         default: ${{ github.event.number }}
         required: false
         type: string
 
     secrets:
       oc_namespace:
-        description: "OpenShift namespace"
+        description: 'OpenShift namespace'
         required: false
       oc_token:
-        description: "OpenShift token"
+        description: 'OpenShift token'
         required: false
       oc_server:
-        description: "OpenShift server, defaults to https://api.silver.devops.gov.bc.ca:6443"
+        description: 'OpenShift server, defaults to https://api.silver.devops.gov.bc.ca:6443'
         required: false
 
 permissions: {}

.github/workflows/analysis.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [main]
   pull_request:
-    types: [opened, reopened, synchronize, ready_for_review, converted_to_draft]
+    types: [opened, reopened, synchronize]
   schedule:
     - cron: '0 11 * * 0' # 3 AM PST = 12 PM UDT, runs sundays
   workflow_dispatch:
@@ -18,7 +18,6 @@ permissions: {}
 jobs:
   backend-tests:
     name: Backend Tests
-    if: (! github.event.pull_request.draft)
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     services:
@@ -57,7 +56,6 @@ jobs:
 
   frontend-tests:
     name: Frontend Tests
-    if: (! github.event.pull_request.draft)
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
@@ -86,7 +84,6 @@ jobs:
   # https://github.com/marketplace/actions/aqua-security-trivy
   trivy:
     name: Trivy Security Scan
-    if: (! github.event.pull_request.draft)
     continue-on-error: true
     permissions:
       security-events: write
@@ -112,8 +109,7 @@ jobs:
 
   results:
     name: Analysis Results
-    needs: [backend-tests, frontend-tests]
-    if: (! github.event.pull_request.draft)
+    needs: [backend-tests, frontend-tests, trivy]
     runs-on: ubuntu-24.04
     steps:
       - if: contains(needs.*.result, 'failure')||contains(needs.*.result, 'canceled')

.github/workflows/demo.yml

@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
     inputs:
       target:
-        description: "PR number to receive DEMO URL routing"
+        description: 'PR number to receive DEMO URL routing'
         required: true
         type: number
 

.github/workflows/merge.yml

@@ -4,16 +4,16 @@ on:
   push:
     branches: [main]
     paths-ignore:
-      - "*.md"
-      - ".github/**"
-      - ".github/graphics/**"
-      - "!.github/workflows/**"
+      - '*.md'
+      - '.github/**'
+      - '.github/graphics/**'
+      - '!.github/workflows/**'
   workflow_dispatch:
     inputs:
       tag:
-        description: "Image tag set to deploy; e.g. PR number or prod"
+        description: 'Image tag set to deploy; e.g. PR number or prod'
         type: string
-        default: "prod"
+        default: 'prod'
 
 concurrency:
   # Do not interrupt previous workflows

.github/workflows/pr-open.yml

@@ -2,6 +2,7 @@ name: PR
 
 on:
   pull_request:
+    types: [labeled, opened, reopened, synchronize]
 
 concurrency:
   # Cancel in progress for PR open and close
@@ -53,9 +54,33 @@ jobs:
     needs: [deploys]
     uses: ./.github/workflows/.tests.yml
 
+  zap:
+    name: ZAP Security Scan
+    needs: [deploys]
+    if: |
+      contains(github.event.pull_request.labels.*.name, 'zap') &&
+      needs.deploys.outputs.triggered == 'true'
+    runs-on: ubuntu-24.04
+    strategy:
+      matrix:
+        name: [backend, frontend]
+        include:
+          - name: backend
+            path: api
+          - name: frontend
+            path: ''
+    steps:
+      - name: ZAP Scan
+        uses: zaproxy/action-full-scan@3c58388149901b9a03b7718852c5ba889646c27c
+        with:
+          allow_issue_writing: false
+          artifact_name: zap-${{ matrix.name }}-pr${{ github.event.number }}
+          target: https://cstar-pr-${{ github.event.number }}.apps.silver.devops.gov.bc.ca/${{ matrix.path }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
   results:
     name: PR Results
-    needs: [builds, deploys, tests]
+    needs: [builds, deploys, tests, zap]
     if: always()
     runs-on: ubuntu-24.04
     steps:

.github/workflows/pr-validate.yml

@@ -13,7 +13,6 @@ permissions: {}
 jobs:
   validate:
     name: Validate PR
-    if: (! github.event.pull_request.draft)
     permissions:
       pull-requests: write
     uses: bcgov/quickstart-openshift-helpers/.github/workflows/.pr-validate.yml@6d695dd755fa9255ea4bde335890516beb6f95e4 # v1.0.1

.github/workflows/scheduled.yml

@@ -1,7 +1,7 @@
 name: Scheduled
 
 on:
-  schedule: [cron: "0 11 * * 6"] # 3 AM PST = 12 PM UDT, Saturdays
+  schedule: [cron: '0 11 * * 6'] # 3 AM PST = 12 PM UDT, Saturdays
   workflow_dispatch:
   workflow_call:
 
@@ -16,7 +16,7 @@ jobs:
     name: PR Deployment Purge
     env:
       # https://tecadmin.net/getting-yesterdays-date-in-bash/
-      CUTOFF: "1 week ago"
+      CUTOFF: '1 week ago'
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
@@ -82,6 +82,6 @@ jobs:
         with:
           allow_issue_writing: true
           artifact_name: ${{ matrix.name }}
-          issue_title: "ZAP Security Report: ${{ matrix.name }}"
+          issue_title: 'ZAP Security Report: ${{ matrix.name }}'
           token: ${{ secrets.GITHUB_TOKEN }}
           target: https://cstar-dev.apps.silver.devops.gov.bc.ca/${{ matrix.path }}