feat: moved to general actions repo for sysdig monitor action (#2806) #4647
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Analysis | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| types: [opened, reopened, synchronize, ready_for_review, converted_to_draft] | |
| schedule: | |
| - cron: "0 11 * * 0" # 3 AM PST = 12 PM UDT, runs sundays | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| jobs: | |
| backend-tests: | |
| name: Backend Tests | |
| if: (! github.event.pull_request.draft) | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 5 | |
| services: | |
| postgres: | |
| image: postgres | |
| env: | |
| POSTGRES_PASSWORD: default | |
| options: >- | |
| --health-cmd pg_isready | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| ports: | |
| - 5432:5432 | |
| steps: | |
| - uses: bcgov/action-test-and-analyse@8f699e3fd3fadd9a6adf6f4b1f2638ef7ecfefb9 # v2.0.0 | |
| env: | |
| sonar_token: ${{ secrets.sonar_token_backend }} | |
| with: | |
| commands: | | |
| npm ci | |
| npm run lint | |
| npm run format:check | |
| npm run test:cov | |
| dir: backend | |
| node_version: "22" | |
| sonar_args: > | |
| -Dsonar.exclusions=**/coverage/**,**/node_modules/**,**/*spec.ts | |
| -Dsonar.organization=bcgov-sonarcloud | |
| -Dsonar.projectKey=quickstart-openshift_backend | |
| -Dsonar.sources=src | |
| -Dsonar.test.inclusions=**/*spec.ts | |
| -Dsonar.javascript.lcov.reportPaths=./coverage/lcov.info | |
| sonar_token: ${{ env.sonar_token }} | |
| dep_scan: warn | |
| supply_scan: true | |
| triggers: ('backend/') | |
| frontend-tests: | |
| name: Frontend Tests | |
| if: (! github.event.pull_request.draft) | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: bcgov/action-test-and-analyse@8f699e3fd3fadd9a6adf6f4b1f2638ef7ecfefb9 # v2.0.0 | |
| env: | |
| sonar_token: ${{ secrets.sonar_token_frontend }} | |
| with: | |
| commands: | | |
| npm ci | |
| npm run lint | |
| npm run format:check | |
| npm run test:cov | |
| dir: frontend | |
| node_version: "22" | |
| sonar_args: > | |
| -Dsonar.exclusions=**/coverage/**,**/node_modules/**,**/*spec.ts,**/*test.tsx,**/routeTree.gen.ts | |
| -Dsonar.organization=bcgov-sonarcloud | |
| -Dsonar.projectKey=quickstart-openshift_frontend | |
| -Dsonar.sources=src | |
| -Dsonar.test.inclusions=**/*spec.ts,**/*test.tsx | |
| -Dsonar.javascript.lcov.reportPaths=./coverage/lcov.info | |
| sonar_token: ${{ env.sonar_token }} | |
| dep_scan: warn | |
| supply_scan: true | |
| triggers: ('frontend/') | |
| # https://github.com/marketplace/actions/aqua-security-trivy | |
| trivy: | |
| name: Trivy Security Scan | |
| if: (! github.event.pull_request.draft) | |
| permissions: | |
| contents: read | |
| security-events: write | |
| runs-on: ubuntu-slim | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Cache Trivy DB | |
| uses: actions/cache@v6 | |
| with: | |
| path: .trivycache | |
| key: ${{ runner.os }}-trivy-v0.36.0-cache-v1 | |
| restore-keys: | | |
| ${{ runner.os }}-trivy- | |
| # Reports every severity to the Security tab for triage. Findings are not a merge | |
| # gate: advisories are published on their own schedule, not the contributor's, and | |
| # committed secrets are already blocked at push time by GitHub secret scanning. | |
| - name: Run Trivy vulnerability scanner in repo mode | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| format: "sarif" | |
| output: "trivy-results.sarif" | |
| ignore-unfixed: true | |
| scan-type: "fs" | |
| scanners: "vuln,secret,misconfig" | |
| severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL" | |
| trivyignores: ".github/.trivyignore" | |
| cache-dir: .trivycache | |
| skip-dirs: "**/node_modules,**/coverage,**/dist,.git" | |
| exit-code: "0" | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| category: "trivy" | |
| sarif_file: "trivy-results.sarif" | |
| # ========================================================================== | |
| # WARNING: This job acts as the required merge gate for this workflow. | |
| # If you add a new job to this workflow, you MUST add its ID to the 'needs' | |
| # array below, otherwise its failure or cancellation will not block the PR! | |
| # ========================================================================== | |
| results: | |
| name: Analysis Results | |
| needs: [backend-tests, frontend-tests, trivy] | |
| if: always() && (! github.event.pull_request.draft) | |
| runs-on: ubuntu-slim | |
| timeout-minutes: 1 | |
| steps: | |
| - name: Log Job Results Context | |
| run: | | |
| echo "=== Upstream Job Statuses ===" | |
| echo '${{ toJson(needs) }}' | |
| - name: Evaluate Overall Status | |
| if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') | |
| run: | | |
| echo "❌ Critical Check Failure: At least one required job has failed or was cancelled." | |
| exit 1 | |
| - name: Success Message | |
| run: echo "✅ All critical checks passed or were intentionally skipped!" |