build-test-javascript.yml

# AUTOGENERATED FROM build-test-javascript.jsonnet DO NOT MODIFY
jobs:
  build:
    container: returntocorp/ocaml:alpine-2024-01-18
    env:
      HOME: /root
    runs-on: ubuntu-latest-16-core
    steps:
      - name: Make checkout speedy
        run: git config --global fetch.parallel 50
      - uses: actions/checkout@v3
        with:
          submodules: true
      - name: Configure git safedir properly
        run: git config --global --add safe.directory $(pwd)
      - name: Set up tree-sitter
        run: (cd libs/ocaml-tree-sitter-core && ./configure && ./scripts/install-tree-sitter-lib)
      - id: cache-git
        name: Cache git checkout
        uses: actions/cache/save@v3
        with:
          key: semgrep-with-submodules-and-tree-sitter-${{ github.sha }}
          path: .
      - name: Build semgrep
        run: |
          eval $(opam env)
          make install-deps-ALPINE-for-semgrep-core
          make install-deps-for-semgrep-core
          make build-semgrep-jsoo
      - uses: actions/upload-artifact@v3
        with:
          name: semgrep-js-ocaml-build-${{ github.sha }}
          path: |
            _build/default/js/**/*.bc.js
          retention-days: 1
  test:
    container: emscripten/emsdk:3.1.51
    env:
      HOME: /root
    needs:
      - build
    runs-on: ubuntu-latest-16-core
    steps:
      - id: restore-git
        name: Restore git checkout cache
        uses: actions/cache/restore@v3
        with:
          key: semgrep-with-submodules-and-tree-sitter-${{ github.sha }}
          path: .
      - if: ${{ steps.restore-git.outputs.cache-hit != 'true' }}
        name: Make checkout speedy
        run: git config --global fetch.parallel 50
      - name: Configure git safedir properly
        run: git config --global --add safe.directory $(pwd)
      - if: ${{ steps.restore-git.outputs.cache-hit != 'true' }}
        uses: actions/checkout@v3
        with:
          submodules: true
      - if: ${{ steps.restore-git.outputs.cache-hit != 'true' }}
        name: Set up tree-sitter
        run: (cd libs/ocaml-tree-sitter-core && ./configure && ./scripts/install-tree-sitter-lib)
      - uses: actions/download-artifact@v3
        with:
          name: semgrep-js-ocaml-build-${{ github.sha }}
          path: _build/default/js
      - uses: actions/setup-node@v3
        with:
          node-version: "18"
      - name: Build JS artifacts
        run: make -C js -j $(nproc) build
      - name: Test JS artifacts
        run: |
          # Allow 'git rev-parse --show-toplevel' even though the owner of the
          # semgrep folder is different than the owner of its contents.
          # Needed by OCaml test code to determine the project root.
          git config --global --add safe.directory /__w/semgrep/semgrep
          make -C js -j $(nproc) test
      - name: Setup APT for xvfb
        run: |
          sudo apt-get update
          sudo apt-get install -y libatk-bridge2.0-0 libgtk-3-0 libgbm1
      - name: Test LSP.js
        uses: coactions/setup-xvfb@v1
        with:
          run: make -C js/language_server test
      - name: Package JS artifacts
        run: |
          tar cvzf semgrep-js-artifacts.tar.gz \
            js/engine/dist/index.cjs \
            js/engine/dist/index.mjs \
            js/languages/*/dist/index.cjs \
            js/languages/*/dist/index.mjs \
            js/languages/*/dist/semgrep-parser.wasm \
            js/language_server/dist/*
      - name: Upload JS artifacts
        uses: actions/upload-artifact@v3
        with:
          name: semgrep-js-artifacts-${{ github.sha }}
          path: semgrep-js-artifacts.tar.gz
          retention-days: 2
  upload:
    if: ${{ inputs.upload-artifacts }}
    needs:
      - test
    permissions:
      contents: write
      id-token: write
    runs-on: ubuntu-latest
    steps:
      - name: Configure AWS credentials for semgrep-oss-js-artifacts-deploy-role
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-west-2
          role-duration-seconds: 900
          role-session-name: semgrep-s3-access
          role-to-assume: arn:aws:iam::338683922796:role/semgrep-oss-js-artifacts-deploy-role
      - uses: actions/download-artifact@v3
        with:
          name: semgrep-js-artifacts-${{ github.sha }}
          path: /tmp/semgrep
      - name: Upload to S3
        run: |
          cd /tmp/semgrep
          tar xvzf semgrep-js-artifacts.tar.gz
          branch_name=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}
          urlencoded_branch_name=$(printf %s $branch_name | jq -sRr @uri)

          cache_control=""
          if [[ "${branch_name}" =~ "^release-[0-9.]+$" ]]; then
            # If this is a release:
            # - public: The response can be stored in a shared cache
            # - max-age=31536000: Cache for up to 1 year
            # - immutable: The response will not be updated while fresh
            cache_control="public,max-age=31536000,immutable"
          else
            # Otherwise:
            # - public: This response can be stored in a shared cache
            # - max-age=300: Cache for up to 5 mins
            cache_control="public,max-age=300"
          fi

          aws s3 cp --recursive --cache-control "${cache_control}" /tmp/semgrep/js/ "s3://semgrep-app-static-assets/static/turbo/${urlencoded_branch_name}/"
name: build-test-javascript
on:
  workflow_call:
    inputs:
      upload-artifacts:
        default: false
        description: Whether or not to upload JS artifacts to S3
        type: boolean
  workflow_dispatch:
    inputs:
      upload-artifacts:
        default: false
        description: Whether or not to upload JS artifacts to S3
        type: boolean