nodejs.yml

# This workflow will do a clean install of node dependencies, build the source code and run tests across different versions of node
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions
name: Node.js CI
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  SonatypeUrl: "https://finos.sonatype.app/platform/"
  SonatypeAppId: "morphir-elm"
  SonatypeScanTarget: "."
  ExcludeDirectory: "**/docs/ **/.*'"
      
jobs:
  # building project
  build:
    name: Build
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        node-version: [20.x]
        os: [ubuntu-latest]
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}

      - name: Cache NPM
        uses: actions/cache@v4
        with:
          path: ~/.npm
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-

      - name: Cache Elm
        uses: actions/cache@v4
        with:
          path: ~/.elm
          key: ${{ runner.os }}-elm-${{ hashFiles('**/elm.json') }}
          restore-keys: |
            ${{ runner.os }}-elm-

      - name: Download dependencies
        run: npm ci

      - name: Build
        run: npm run build --if-present

      - name: Running Test
        run: npm test

      ###########################
      ## Sonatype SCA Scanning ##
      ###########################
      - name: Sonatype Lifecycle SCA Scan
        if: github.repository_owner == 'finos'
        id: evaluate
        uses: sonatype/actions/evaluate@v1
        with:
          iq-server-url: ${{ env.SonatypeUrl }}
          username: ${{ secrets.SONATYPE_SCANNER_USERNAME }}
          password: ${{ secrets.SONATYPE_SCANNER_PASSWORD }}
          application-id: ${{ env.SonatypeAppId }}
          stage: "build"
          scan-targets: ${{ env.SonatypeScanTarget }}
          module-exclude: ${{ env.ExcludeDirectory }}

      - name: Save Sonatype SBOM
        uses: sonatype/actions/fetch-sbom@v1
        if: always() && steps.evaluate.outputs.scan-id
        with:
          iq-server-url: ${{ env.SonatypeUrl }}
          username: ${{ secrets.SONATYPE_SCANNER_USERNAME }}
          password: ${{ secrets.SONATYPE_SCANNER_PASSWORD }}
          application-id: ${{ env.SonatypeAppId }}
          scan-id: ${{ steps.evaluate.outputs.scan-id }}
          sbom-standard: spdx
          sbom-version: 2.3
          artifact-name: ${{ env.SonatypeAppId }}-bom

  # CVE scanning
  # cvescan:
  #   name: CVE Scanning
  #   runs-on: ubuntu-latest
  #   needs: [build]
  #   strategy:
  #     matrix:
  #       node-version: [18.x]
  #   steps:
  #     - uses: actions/checkout@v4
  #     - name: Use Node.js ${{ matrix.node-version }}
  #       uses: actions/setup-node@v4
  #       with:
  #         node-version: ${{ matrix.node-version }}
  #     - run: npm ci
  #     - run: npx --yes auditjs ossi --whitelist allow-list.json

  # Semgrep static code analysis
  semgrep:
    name: Semgrep
    runs-on: ubuntu-latest
    # needs: [cvescan]
    needs: [build]
    container:
      # A Docker image with Semgrep installed. Don't change this.
      image: returntocorp/semgrep
    # Skip any PR created by dependabot to avoid permission issues
    if: (github.actor != 'dependabot[bot]')
    steps:
      - uses: actions/checkout@v4
      - run: semgrep scan --config auto --severity ERROR
        env:
          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}