Skip to content

Merge pull request #1205 from AttilaMihaly/report-invalid-exposed-module #2861

Merge pull request #1205 from AttilaMihaly/report-invalid-exposed-module

Merge pull request #1205 from AttilaMihaly/report-invalid-exposed-module #2861

Workflow file for this run

# This workflow will do a clean install of node dependencies, build the source code and run tests across different versions of node
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions
name: Node.js CI
on:
push:
branches: [main]
pull_request_target:
branches: [main]
env:
SonatypeUrl: "https://finos.sonatype.app/platform/"
SonatypeAppId: "morphir-elm"
SonatypeScanTarget: "."
ExcludeDirectory: "**/docs/ **/.*'"
jobs:
# building project
build:
name: Build
runs-on: ${{ matrix.os }}
strategy:
matrix:
node-version: [20.x]
os: [ubuntu-latest]
steps:
- uses: actions/checkout@v4
- name: Setup Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v4
with:
node-version: ${{ matrix.node-version }}
- name: Cache NPM
uses: actions/cache@v4
with:
path: ~/.npm
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
restore-keys: |
${{ runner.os }}-node-
- name: Cache Elm
uses: actions/cache@v4
with:
path: ~/.elm
key: ${{ runner.os }}-elm-${{ hashFiles('**/elm.json') }}
restore-keys: |
${{ runner.os }}-elm-
- name: Download dependencies
run: npm ci
- name: Build
run: npm run build --if-present
- name: Running Test
run: npm test
###########################
## Sonatype SCA Scanning ##
###########################
- name: Sonatype Lifecycle SCA Scan
if: github.repository_owner == 'finos'
id: evaluate
uses: sonatype/actions/evaluate@v1
with:
iq-server-url: ${{ env.SonatypeUrl }}
username: ${{ secrets.SONATYPE_SCANNER_USERNAME }}
password: ${{ secrets.SONATYPE_SCANNER_PASSWORD }}
application-id: ${{ env.SonatypeAppId }}
stage: "build"
scan-targets: ${{ env.SonatypeScanTarget }}
module-exclude: ${{ env.ExcludeDirectory }}
- name: Save Sonatype SBOM
uses: sonatype/actions/fetch-sbom@v1
if: always() && steps.evaluate.outputs.scan-id
with:
iq-server-url: ${{ env.SonatypeUrl }}
username: ${{ secrets.SONATYPE_SCANNER_USERNAME }}
password: ${{ secrets.SONATYPE_SCANNER_PASSWORD }}
application-id: ${{ env.SonatypeAppId }}
scan-id: ${{ steps.evaluate.outputs.scan-id }}
sbom-standard: spdx
sbom-version: 2.3
artifact-name: ${{ env.SonatypeAppId }}-bom
# CVE scanning
# cvescan:
# name: CVE Scanning
# runs-on: ubuntu-latest
# needs: [build]
# strategy:
# matrix:
# node-version: [18.x]
# steps:
# - uses: actions/checkout@v4
# - name: Use Node.js ${{ matrix.node-version }}
# uses: actions/setup-node@v4
# with:
# node-version: ${{ matrix.node-version }}
# - run: npm ci
# - run: npx --yes auditjs ossi --whitelist allow-list.json
# Semgrep static code analysis
semgrep:
name: Semgrep
runs-on: ubuntu-latest
# needs: [cvescan]
needs: [build]
container:
# A Docker image with Semgrep installed. Don't change this.
image: returntocorp/semgrep
# Skip any PR created by dependabot to avoid permission issues
if: (github.actor != 'dependabot[bot]')
steps:
- uses: actions/checkout@v4
- run: semgrep scan --config auto --severity ERROR
env:
SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}