ci.yml

name: Continuous Integration

on:
  pull_request:
    branches:
      - main
  push:
    branches: [main, development, staging]
    paths-ignore:
      - '.github/**' # We don't want to trigger when we update the workflows.
      - 'docs/**' # We don't want to trigger when we update the docs.
      - '*.md'
      - 'terraform/**'

jobs:

  secret-scanning:
    name: Trufflehog Secret Scanning
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          fetch-depth: 0
      - name: TruffleHog OSS
        id: trufflehog
        uses: trufflesecurity/trufflehog@main
        env:
          GITHUB_HEAD_REF_SAFE: ${{ github.head_ref }}
        continue-on-error: true
        with:
          path: ./
          base: "${{ github.event.repository.default_branch }}"
          head: "$GITHUB_HEAD_REF_SAFE"
          extra_args: --debug --only-verified
      # - name: Setup Trufflehog [Docker]
      #   env:
      #     GITHUB_HEAD_REF_SAFE: ${{ github.head_ref }}
      #   run: docker run --rm -v "$PWD:/pwd" trufflesecurity/trufflehog:3.67.1 git file://. --since-commit main --branch "$GITHUB_HEAD_REF_SAFE" --only-verified --fail

  unit-tests:
    name: Unit Tests
    secrets: inherit # https://docs.github.com/en/actions/using-workflows/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow
    uses: ./.github/workflows/unit_test_reusable.yml

  e2e-tests:
    name: End-to-End Tests
    secrets: inherit # https://docs.github.com/en/actions/using-workflows/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow
    uses: ./.github/workflows/e2e_test_reusable.yml

  codeql-analysis:
    permissions:
      actions: read
      contents: read
      security-events: write
    name: CodeQL Scan
    uses: ./.github/workflows/security_codeql.yml

  semgrep-analysis:
    permissions:
      security-events: write
    name: Semgrep Scan
    uses: ./.github/workflows/security_semgrep.yml

  lint:
    name: Linting
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - uses: ./.github/actions/setup-python

      - name: Lint backend
        working-directory: ./backend/ops_api
        run: pipenv run nox -s lint

      - uses: ./.github/actions/setup-javascript

      - name: Lint frontend
        working-directory: ./frontend
        run: bun lint