code-review.yml

name: Code Review

on: [pull_request]

jobs:

  # -- ESLINT -----------------------------------------------------------------
  eslint:
    name: ESLint
    runs-on: ubuntu-latest

    steps:
      - name: Harden the GitHub Actions Runner
        uses: step-security/harden-runner@951b48540b429070694bc8abd82fd6901eb123ca
        with:
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            github.com:443
            objects.githubusercontent.com:443
            raw.githubusercontent.com:443
            registry.npmjs.org:443
            snyk.io:443

      - name: Checkout
        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

      - name: Run ESLint
        uses: reviewdog/action-eslint@1d4b2566223411c02be19b14ca258fa44a46dc31 # v1.30.0
        env:
          REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # -- DOCKER -----------------------------------------------------------------
  hadolint:
    name: Hadolint
    runs-on: ubuntu-latest

    steps:
      - name: Harden the GitHub Actions Runner
        uses: step-security/harden-runner@951b48540b429070694bc8abd82fd6901eb123ca
        with:
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            github.com:443
            objects.githubusercontent.com:443
            raw.githubusercontent.com:443

      - name: Checkout
        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

      - name: Run hadolint
        uses: reviewdog/action-hadolint@2d90b15b2b969e507fc2a31af6e29ca19a0f9516 # v1.45.0
        env:
          REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}