Skip to content

Workflow file for this run

name: 'Main branch CI'
on:
push:
branches: [main]
pull_request:
branches: [main]
jobs:
sast:
name: Static Security Tests
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
strategy:
fail-fast: false
matrix:
language: ['javascript']
steps:
- name: Checkout repository
uses: actions/checkout@v3
- name: Initialise CodeQL
uses: github/codeql-action/init@v2
with:
languages: ${{ matrix.language }}
- name: Run CodeQL
uses: github/codeql-action/analyze@v2
sca:
name: Dependency Scan
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v3
# Report all vulnerabilities GitHub security tab
- name: Report on all vulnerabilities
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
ignore-unfixed: true
hide-progress: true
format: 'sarif'
output: 'trivy-results.sarif'
# Fail the job on critical vulnerabiliies with fix available
- name: Fail on critical vulnerabilities
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
ignore-unfixed: true
hide-progress: true
format: 'table'
severity: 'CRITICAL'
exit-code: '1'
- name: Upload scan results
uses: github/codeql-action/upload-sarif@v2
if: always()
with:
sarif_file: 'trivy-results.sarif'
test:
name: Run Tests
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v3
- name: Setup Node
uses: actions/setup-node@v3
with:
node-version: lts/*
cache: yarn
- name: Cache dependencies
uses: actions/cache@v3
with:
path: '**/node_modules'
key: ${{ runner.os }}-modules-${{ hashFiles('**/yarn.lock') }}
- name: Install dependencies
run: yarn install --frozen-lockfile
- name: Run tests
run: yarn test-all
pass:
name: All tests pass
needs: ['sast', 'sca', 'test']
runs-on: ubuntu-latest
steps:
- run: echo ok