analysis.yml

name: Analysis

on:
  push:
    branches: [main]
  pull_request:
    types: [opened, reopened, synchronize, ready_for_review, converted_to_draft]
  schedule:
    - cron: "0 11 * * 0" # 3 AM PST = 12 PM UDT, runs sundays
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  backend-tests:
    name: Backend Tests
    if: (! github.event.pull_request.draft)
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    services:
      postgres:
        image: postgres
        env:
          POSTGRES_PASSWORD: default
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432
    steps:
      - uses: bcgov/action-test-and-analyse@8f699e3fd3fadd9a6adf6f4b1f2638ef7ecfefb9 # v2.0.0
        with:
          commands: |
            npm ci
            npm run lint
            npm run test:unit:cov
          dir: backend
          node_version: "22"
          dep_scan: off
          supply_scan: true
      - name: Publish backend coverage for the SonarCloud job
        uses: actions/upload-artifact@v4
        with:
          name: coverage-backend
          path: backend/coverage/lcov.info
          if-no-files-found: error
          retention-days: 1

  frontend-tests:
    name: Frontend Tests
    if: (! github.event.pull_request.draft)
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - uses: bcgov/action-test-and-analyse@8f699e3fd3fadd9a6adf6f4b1f2638ef7ecfefb9 # v2.0.0
        with:
          commands: |
            npm ci
            npm run lint
            npm run test:cov
          dir: frontend
          node_version: "22"
          dep_scan: off
          supply_scan: true
      - name: Publish frontend coverage for the SonarCloud job
        uses: actions/upload-artifact@v4
        with:
          name: coverage-frontend
          path: frontend/coverage/lcov.info
          if-no-files-found: error
          retention-days: 1

  # ---------------------------------------------------------------------------
  # One scan, because SonarCloud provisioned ONE project for this repo
  # (bcgov_common-notify). We asked for a monorepo with backend and frontend
  # components; bcgov_common-notify_backend does not exist. Two scanners
  # pushing to a single project key do not merge - whichever finishes last
  # replaces the other's results - so the scan is done once here over both
  # apps, which is also the pattern bcgov documents
  # (sonar.sources=ppr-api/src,ppr-ui/src in bcgov/sonarqube).
  #
  # Coverage comes from the test jobs as artifacts rather than being
  # regenerated, so the suites still run exactly once.
  # ---------------------------------------------------------------------------
  sonar:
    name: SonarCloud Scan
    needs: [backend-tests, frontend-tests]
    if: (! github.event.pull_request.draft)
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    env:
      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
    steps:
      # The scan is guarded on the token below. Without this the job would pass
      # silently while analysing nothing, which is how this went unnoticed in
      # the first place. A warning, not a failure, so PRs stay green until the
      # token is added.
      - name: Warn when SonarQube analysis is skipped
        if: env.SONAR_TOKEN == ''
        run: |
          echo "::warning title=SonarQube analysis skipped::SONAR_TOKEN is not set, so the scan did not run. Lint, tests and coverage did run. Add the token from https://sonarcloud.io/project/overview?id=bcgov_common-notify to enable it."

      # Sonar needs full history to attribute issues to new code.
      - uses: actions/checkout@v6
        if: env.SONAR_TOKEN != ''
        with:
          fetch-depth: 0

      - name: Collect coverage from the test jobs
        if: env.SONAR_TOKEN != ''
        uses: actions/download-artifact@v4
        with:
          name: coverage-backend
          path: backend/coverage

      - name: Collect frontend coverage
        if: env.SONAR_TOKEN != ''
        uses: actions/download-artifact@v4
        with:
          name: coverage-frontend
          path: frontend/coverage

      - uses: SonarSource/sonarqube-scan-action@a31c9398be7ace6bbfaf30c0bd5d415f843d45e9 # v6.0.0
        if: env.SONAR_TOKEN != ''
        env:
          SONAR_TOKEN: ${{ env.SONAR_TOKEN }}
        with:
          args: >
            -Dsonar.organization=bcgov-sonarcloud
            -Dsonar.projectKey=bcgov_common-notify
            -Dsonar.sources=backend/src,frontend/src
            -Dsonar.tests=backend/src,frontend/src
            -Dsonar.test.inclusions=**/*.spec.ts,**/*.spec.tsx,**/*.test.ts,**/*.test.tsx
            -Dsonar.exclusions=**/coverage/**,**/node_modules/**,**/dist/**,**/*.gen.ts
            -Dsonar.javascript.lcov.reportPaths=backend/coverage/lcov.info,frontend/coverage/lcov.info

  # https://github.com/marketplace/actions/aqua-security-trivy
  trivy:
    name: Trivy Security Scan
    if: (! github.event.pull_request.draft)
    continue-on-error: true
    permissions:
      security-events: write
    runs-on: ubuntu-slim
    timeout-minutes: 3
    steps:
      - uses: actions/checkout@v7
      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          format: "sarif"
          output: "trivy-results.sarif"
          ignore-unfixed: true
          scan-type: "fs"
          scanners: "vuln,secret,misconfig"
          severity: "CRITICAL,HIGH"
          trivy-config: ".github/trivy.yaml"
          trivyignores: ".trivyignore"

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: "trivy-results.sarif"

  results:
    name: Analysis Results
    needs: [backend-tests, frontend-tests, sonar]
    if: (! github.event.pull_request.draft)
    runs-on: ubuntu-slim
    steps:
      - if: contains(needs.*.result, 'failure')||contains(needs.*.result, 'canceled')
        run: echo "At least one job has failed." && exit 1
      - run: echo "Success!"