ci-checks.yml

name: CI checks


on:
  - push
  - pull_request

jobs:
  Hadolint:
    runs-on: ubuntu-latest
    strategy:
        matrix:
          dockerfile: ["docker-builds/base/Dockerfile"]
    steps:
      - uses: actions/checkout@v2
      - uses: hadolint/hadolint-action@v1.5.0
        with:
          dockerfile: ${{ matrix.dockerfile }}

  Prettier:
    runs-on: ubuntu-latest
    steps:
      - name: Prettier Action
        uses: creyD/prettier_action@v3.3

  Code_security:
    name: Code security
    runs-on: ubuntu-latest

    steps:
    - name: Checkout repository
      uses: actions/checkout@v2

    - name: Scan project
      uses: ShiftLeftSecurity/scan-action@master

  nodejs-build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: ["14"]
    steps:
      - uses: actions/checkout@v2
      - name: Lint code using Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v1
        with:
          node-version: ${{ matrix.node-version }}
      - run: mkdir -p ~/.config/truffle/
      - run: npm i -g yarn
      - run: yarn deps
      - run: yarn lint

  docker_checks:
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        image: [ 'base' ]
    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Build an image from Dockerfile
        run: |
          docker build -t ${{ matrix.image }}:${{ github.sha }} -f docker-builds/${{ matrix.image }}/Dockerfile .

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: '${{ matrix.image }}:${{ github.sha }}'
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL'