pipeline.yml

name: Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  # Allow to run this workflow manually
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup Node
        uses: actions/setup-node@v3
        with:
          node-version-file: .node-version
          cache: npm
      - run: npm ci
      - name: Check build
        run: npm run build
      - name: Check format
        run: npm run format:check
      - name: Lint
        run: npm run lint:check
      - name: Run tests
        run: npm test
      - name: Install E2E test dependencies
        run: |
          npx --yes playwright install-deps
          npx --yes playwright install
          npx --yes playwright install msedge
      - name: Run E2E tests
        run: npm run test:e2e
      - uses: actions/upload-artifact@v3
        if: ${{ failure() }}
        with:
          name: playwright-test-results
          path: test-results
      - name: Run a11y tests
        run: npm run test:a11y
        env:
          # Use a different port (from the one used with E2E tests) to workaround problem in CI/GitHub Actions,
          # starting to occur with playwright/test 1.28.0:
          # Error: http://localhost:4173 is already used ...
          # See https://github.com/digitalservicebund/typescript-vite-application-template/actions/runs/3486985178/jobs/5834089375
          VITE_PORT: 4183
      - name: Send status to Slack
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: lazy-actions/slatify@c4847b8c84e3e8076fd3c42cc00517a10426ed65 # == v3.0.0
        if: ${{ failure() && env.SLACK_WEBHOOK_URL }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
        with:
          type: ${{ job.status }}
          job_name: "Build :point_right:"
          mention: "here"
          mention_if: "failure"
          commit: true
          url: ${{ secrets.SLACK_WEBHOOK_URL }}
          token: ${{ secrets.GITHUB_TOKEN }}

  audit-licenses:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup Node
        uses: actions/setup-node@v3
        with:
          node-version-file: .node-version
          cache: npm
      - run: npm ci
      - name: Audit used licences
        run: npm run audit:licences
      - name: Send status to Slack
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: lazy-actions/slatify@c4847b8c84e3e8076fd3c42cc00517a10426ed65 # == v3.0.0
        if: ${{ failure() && env.SLACK_WEBHOOK_URL }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
        with:
          type: ${{ job.status }}
          job_name: "License audit :point_right:"
          mention: "here"
          mention_if: "failure"
          commit: true
          url: ${{ secrets.SLACK_WEBHOOK_URL }}
          token: ${{ secrets.GITHUB_TOKEN }}

  vulnerability-scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Run Trivy vulnerability scanner
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: aquasecurity/trivy-action@fbd16365eb88e12433951383f5e99bd901fc618f
        env:
          TRIVY_USERNAME: ${{ github.actor }}
          TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
        with:
          scan-type: "fs"
          skip-dirs: "node_modules" # See https://github.com/aquasecurity/trivy/issues/1283
          format: "sarif"
          output: "trivy-results.sarif"
          severity: "CRITICAL,HIGH"
          exit-code: "1" # Fail the build!
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        if: always() # Bypass non-zero exit code..
        with:
          sarif_file: "trivy-results.sarif"
      - name: Send status to Slack
        # Third-party action, pin to commit SHA!
        # See https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
        uses: lazy-actions/slatify@c4847b8c84e3e8076fd3c42cc00517a10426ed65 # == v3.0.0
        if: ${{ failure() && env.SLACK_WEBHOOK_URL }}
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
        with:
          type: ${{ job.status }}
          job_name: "Vulnerability scan :point_right:"
          mention: "here"
          mention_if: "failure"
          commit: true
          url: ${{ secrets.SLACK_WEBHOOK_URL }}
          token: ${{ secrets.GITHUB_TOKEN }}