pipeline.yml

name: Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  # Allow to run this workflow manually
  workflow_dispatch:

env:
  IMAGE_NAME: ${{ github.repository }}

# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
concurrency:
  group: "pages" # FIXME
  cancel-in-progress: false

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version-file: .node-version
          cache: npm

      - name: Cache npm dependencies
        id: cache-npm-deps
        uses: actions/cache@v4
        with:
          path: |
            **/node_modules
          key: "${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}"
          restore-keys: |
            ${{ runner.os }}-node-

      - name: Install dependencies
        if: steps.cache-npm-deps.outputs.cache-hit != 'true'
        run: npm ci

      - name: Build for tests
        run: npm run build

      - name: Check format
        run: npm run format:check

      - name: Lint
        run: npm run lint:check

      - name: Check types
        run: npm run typecheck

      - name: Run unit tests
        run: npm test

      - name: Install E2E & A11y test dependencies
        run: |
          npx --yes playwright install --with-deps

      - name: Run E2E tests
        id: e2e
        run: npm run test:e2e

      - uses: actions/upload-artifact@v4
        if: ${{ failure() && steps.e2e.outcome == 'failure' }}
        with:
          name: playwright-e2e-test-results
          path: packages/*/test/e2e/playwright-report

      - name: Run A11y tests
        id: a11y
        run: npm run test:a11y
        env:
          # Use a different port (from the one used with E2E tests) to workaround problem in CI/GitHub Actions,
          # starting to occur with playwright/test 1.28.0:
          # Error: http://localhost:4173 is already used ...
          # See https://github.com/digitalservicebund/typescript-vite-application-template/actions/runs/3486985178/jobs/5834089375
          VITE_PORT: 4183

      - uses: actions/upload-artifact@v4
        if: ${{ failure() && steps.a11y.outcome == 'failure' }}

        with:
          name: playwright-a11y-test-results
          path: packages/*/test/a11y/playwright-report

      - name: Send failure to Slack
        uses: digitalservicebund/notify-on-failure-gha@814d0c4b2ad6a3443e89c991f8657b10126510bf # v1.5.0
        if: ${{ failure() }}
        with:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  audit-licenses:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version-file: .node-version
          cache: npm

      - name: Cache npm dependencies
        id: cache-npm-deps
        uses: actions/cache@v4
        with:
          path: |
            **/node_modules
          key: "${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}"
          restore-keys: |
            ${{ runner.os }}-node-

      - name: Install dependencies
        if: steps.cache-npm-deps.outputs.cache-hit != 'true'
        run: npm ci

      - name: Audit used licences
        run: npm run audit:licences

      - name: Send status to Slack
        uses: digitalservicebund/notify-on-failure-gha@814d0c4b2ad6a3443e89c991f8657b10126510bf # v1.5.0
        if: ${{ failure() }}
        with:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  vulnerability-scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      actions: read
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - name: validate github workflow files to have pinned versions
        uses: digitalservicebund/github-actions-linter@dccac3ada437947aada4bc901daff08ceb87c3f1 # v0.1.11

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@d710430a6722f083d3b36b8339ff66b32f22ee55 # v0.19.0
        env:
          TRIVY_USERNAME: ${{ github.actor }}
          TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
        with:
          scan-type: "fs"
          skip-dirs: "node_modules" # See https://github.com/aquasecurity/trivy/issues/1283
          format: "sarif"
          output: "trivy-results.sarif"
          severity: "CRITICAL,HIGH"
          exit-code: "1" # Fail the build!

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@4355270be187e1b672a7a1c7c7bae5afdc1ab94a # v3.24.10
        if: always() # Bypass non-zero exit code..
        with:
          sarif_file: "trivy-results.sarif"

      - name: Send status to Slack
        uses: digitalservicebund/notify-on-failure-gha@814d0c4b2ad6a3443e89c991f8657b10126510bf # v1.5.0
        if: ${{ failure() }}
        with:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  build-and-deploy:
    needs:
      - test
      - audit-licenses
      - vulnerability-scan
    if: ${{ github.ref == 'refs/heads/main' }}
    uses: ./.github/workflows/build-and-deploy.yml
    strategy:
      fail-fast: false
      matrix:
        packages:
          - name: digitalcheck-dito
            directory: packages/dito
            handle: dito
          - name: digitalcheck-tool-finder
            directory: packages/tool-finder
            handle: tool-finder
    with:
      name: ${{ matrix.packages.name }}
      directory: ${{ matrix.packages.directory }}
      handle: ${{ matrix.packages.handle }}
      environment: production
    secrets: inherit